docs: record explore snapshot sources (#58)

.gitattributes

@@ -1,12 +0,0 @@
-# 仓库内文本统一以 LF 存储，避免 Windows/WSL 混用产生全量行尾差异。
-# 行尾差异会淹没真实改动，也会让 gitea.env 之类的配置在 bash 中带上 \r。
-* text=auto eol=lf
-
-*.py   text eol=lf
-*.md   text eol=lf
-*.json text eol=lf
-*.ps1  text eol=crlf
-
-*.png binary
-*.jpg binary
-*.zip binary

.gitea/issue_template/task.md

@@ -1,6 +1,9 @@
 ## 基本信息
 
 - 类型：需求 / 缺陷 / 重构
+- 任务类型：单项目 / 协同
+- 主项目：Sense / Brain / Bell / contracts / 根级
+- 主 agent：
 - 所属 Epic：#
 - 所属 MVP / 版本：#
 - 阶段：
@@ -18,8 +21,20 @@
 - 仅影响的子项目 / 交付单元：
 - 是否跨子项目：是 / 否
 - 是否修改共享接口或契约：是 / 否；唯一事实来源：
+- write_paths：
 - 各子项目需要执行的验证：
 
+## 协同接口
+
+<!-- 单项目工单填写“不适用”；协同工单必须完整填写。 -->
+
+- 生产者：
+- 消费者：
+- 契约/共享事实源：
+- 兼容策略：不适用 / 向后兼容 / 发布新版本
+- 被阻塞或需要适配的工单：
+- 集成顺序：
+
 ## 原始需求
 
 - 来源：用户对话 / Gitea / 其他
@@ -53,22 +68,6 @@
 |---|---|---|---|
 | | | | 是 / 否 |
 
-## 设计与原型门禁
-
-<!-- 先判断是否属于纯显示文案豁免，再选择最低成本、足以确认的设计证据。 -->
-
-- 修改类型：纯显示文案 / 小范围 UI / 新组件 / 新页面或独立用户功能 / 重大交互或导航 / 非 UI / 恢复既有行为的 Bug
-- 所需设计证据：无 / 标注截图 / 低保真图 / 已确认原型 / 架构、API、数据、状态或流程设计 / 原设计或复现证据
-- 可编辑设计源、线上原型链接和访问检查：
-- 审核版本、revision、复制版本或确认日期及识别方式：
-- 本地 HTML 导出：未要求 / 用户明确要求 / 项目规则要求
-- 本地 HTML 路径、版本和资源检查（仅显式导出时填写）：
-- 状态：无 / 草稿 / 已确认 / 已废弃
-- 确认人、确认时间和覆盖范围：
-- 无需 UI 原型或无需任何原型的原因：
-
-<!-- 新页面、独立用户功能、重大交互或导航变化默认通过可访问且版本明确的线上原型审核；只有用户或项目规则明确要求时才导出 prototypes/<工单号>/<版本>/index.html。原型和文字需求未确认前不得编写生产代码。 -->
-
 ## 文档影响
 
 <!-- 至少选择一项；不影响长期文档时必须写明原因。 -->
@@ -89,15 +88,6 @@
 - [ ] 新增交付文档，受众与页面：
 - [ ] 需要目标岗位或客户代表验证：是 / 否；验证方式：
 
-## 任务记录与可选快照
-
-- 单次任务事实来源：当前 Gitea 工单正文与评论
-- [ ] 默认不创建任务快照
-- [ ] 用户明确要求专项快照；用途和范围：
-- [ ] 项目专用规则要求任务快照；规则入口：
-
-<!-- 工单正文保存确认基线；重要变化、最终证据和验收结论通过评论追加。只有长期事实变化时才更新 Wiki 和同步镜像。 -->
-
 ## 验收标准
 
 - [ ] <!-- 填写 -->

.gitignore

@@ -1,5 +1,4 @@
 .codex/gitea.env
-gitea.env
 .codex/*.log
 .codex/config.toml
 __pycache__/

AGENTS.md

@@ -1,25 +1,8 @@
 # Agent 开发规则
 
-本仓库采用 DevHarness 工作流：Gitea 工单是单次任务需求、变化、实现、测试、提交和验收的事实来源，Gitea Wiki 是长期开发文档的事实来源，Git 是代码与版本绑定资料的变更记录。`docs/` 默认保存核心 Wiki 的只读镜像，`docs/task/` 只保存人工明确要求的专项或历史兼容快照。人负责确认方案与验收，Agent 负责检查、实现、测试和留下证据。
+本仓库采用 DevHarness 工作流：Gitea 工单是任务过程的事实来源，Gitea Wiki 是长期开发文档和任务归档的事实来源，Git 是代码与版本绑定资料的变更记录，`docs/` 只保存 Wiki 的只读镜像。人负责确认方案与验收，Agent 负责检查、实现、测试和留下证据。
 
-开始工作前先阅读任务涉及目录中的 `AGENTS.md`。目录越深的规则越具体，但不得削弱上级安全规则。
-
-[项目档案](docs/00-project-profile.md) 按需阅读，不作为每次任务的固定前置。出现下列情况之一时必须读：需要环境、配置或凭据来源；需要确认目录边界；需要判断子项目与交付单元划分；需要 DevHarness 来源与基线；需要项目专用验收要求。只为查命令不必打开项目档案。
-
-## 常用命令
-
-所有命令默认从仓库根目录执行，与项目档案保持一致。
-
-| 用途 | 命令 |
-|---|---|
-| 查看工作区 | `git status --short --branch` |
-| 检查模板结构 | `python dev_scripts/harness.py check --strict` |
-| 运行单元测试 | `python -m unittest discover -s tests -v` |
-| 导出核心 Wiki 镜像 | `python dev_scripts/harness.py sync` |
-| 检查核心 Wiki 镜像 | `python dev_scripts/harness.py sync --check` |
-| 创建可选任务快照 | `python dev_scripts/harness.py archive 123 "修复登录超时"` |
-| 增量导出已有快照 | `python dev_scripts/harness.py export` |
-| 全量导出已有快照 | `python dev_scripts/harness.py export --all` |
+开始工作前先阅读 [项目档案](docs/00-project-profile.md) 和任务涉及目录中的 `AGENTS.md`。目录越深的规则越具体，但不得削弱上级安全规则。
 
 ## 1. 永久规则
 
@@ -35,15 +18,14 @@
 
 新功能、缺陷修复、重构以及任何用户可感知或改变程序行为的修改，必须先建立单元任务工单。
 
-以下小改动可以直接提交，不要求工单：
+以下小改动可以直接提交，不要求工单和任务归档：
 
 - 只改错别字、注释或文档措辞；
 - 只做格式化、导入排序或不跨文件的内部变量改名；
 - 补充类型标注或文档字符串且不改变行为；
 - 删除已经确认无人使用的死代码。
-- 只修改用户看到的界面显示文案，并且满足本文件“工单与设计证据双门禁”的全部豁免条件。
 
-除严格符合界面显示文案豁免的修改外，只要涉及接口、数据库、状态、权限、安全、并发、用户界面，或者无法确定是否改变行为，就必须建工单。代码组件名、类名、变量、国际化键、API 字段和数据库字段不是显示文案，不适用豁免。
+只要涉及接口、数据库、状态、权限、安全、并发、用户界面，或者无法确定是否改变行为，就必须建工单。
 
 ## 3. 需求到实施
 
@@ -55,61 +37,24 @@
 6. 开始实施前检查分支和工作区，明确哪些现有改动不属于本任务。
 7. 严格按工单范围实现；新发现的问题先记录，不顺手混入当前任务。
 8. 执行与风险相称的测试，把关键结果和未验证部分更新到工单。实施过程中出现计划外、当前无法解除的问题时才标记“阻塞”。
-9. 只有长期事实变化时才修改 Wiki、读取确认，再运行 `python dev_scripts/harness.py sync` 导出本地镜像；没有长期文档影响时在工单说明原因并跳过 Wiki 同步。不得直接编辑镜像后反向覆盖 Wiki。
-
-工单正文保存用户确认的任务基线；根因、范围、方案、风险或阻塞发生重要变化时追加评论。完成实现后用一条评论集中记录最终差异、测试、未验证内容、提交哈希和文档影响；用户验收后再追加验收时间与结论，不重复覆盖或抄写已有证据。
+9. 长期文档必须先修改 Wiki、读取确认，再运行 `python dev_scripts/sync_wiki_docs.py` 导出本地镜像；不得直接编辑 `docs/` 后反向覆盖 Wiki。
 
 Gitea 不可用时，输出完整工单草稿并说明阻塞。未经用户明确授权，不得默认绕过建单。
 
-### Gitea 交互与工单最小读取
-
-- 所有 Gitea 工单和 Wiki 的查询、创建、更新、评论、状态变更及关闭操作，优先使用项目已配置的 Gitea MCP。
-- MCP 不可用或不支持所需操作时才回退 Gitea API，并在当前工单记录回退原因；初始化阶段尚无工单时记录到初始化工单草稿，建单后补回。凭据只从环境或 MCP 安全配置读取。
-- 首次接手任务时读取工单确认基线和完成当前判断所需的评论，不因节省 Token 跳过范围、依赖、安全、验收或重要变更。
-- 同一任务、同一会话且关键前提未变化时，复用仍有效的工单事实，优先关注当前状态、最新评论和首个未完成步骤，不重复分析已经确认且仍有效的内容。
-- 会话、代码、配置、依赖、凭据、远端状态或关键前提变化，任务基线不清楚，或最新评论声明历史需求、方案、范围、风险或验收发生变化时，重新读取必要历史；无法判断影响范围时读取完整工单。
-- 连接器不支持评论分页或增量读取时允许读取完整工单，但不得把“已读取全文”误当成需要重新分析全部历史，也不得为规避完整读取而新增本地工单、缓存或第二事实来源。
-- 正确性、安全规则和已确认范围优先于 Token 优化；读取边界存在不确定时补读必要证据。
-
-### 新项目 Wiki 初始化门禁
-
-- 从本模板创建新项目时，先创建 Gitea 远端仓库并启用工单和 Wiki，再配置 `wiki-docs.json`；不得把模板自带的本地 `docs/` 当作新项目 Wiki 已初始化的证据。
-- 优先使用项目已配置的 Gitea MCP 查询和写入 Wiki；MCP 不可用或不支持所需写操作时，才使用 Gitea API，并在初始化工单记录回退原因。凭据只从环境或 MCP 安全配置读取。
-- 先查询线上页面列表；`Home` 不存在时必须先创建 `Home`，在线回读正文并记录 revision，然后再逐页创建或更新其他核心映射页面。
-- 每个核心页面写入后必须在线回读并取得 revision。页面缺失、回读失败或没有 revision 时停止初始化，不得开始产品代码。
-- 产品编码前必须运行 `python dev_scripts/harness.py sync --verify`；全部成功才表示线上 Wiki 和核心镜像初始化完成。
-
-### 工单与设计证据双门禁
-
-- 纯界面显示文案只有在不改变业务含义、流程、权限、状态、接口、数据、法律/安全/支付/单位等高风险含义、国际化键、程序标识符、布局和可访问性，且没有任何不确定时，才免工单和原型；修改后执行最小界面检查。
-- 新页面、独立用户功能、重大交互或导航变化，必须先用 Quant-UX 或其他合适工具制作可审阅原型；用户确认原型、文字需求和覆盖范围后，才能建立或放行实现工单并编写生产代码。
-- 上述完整原型形成待审核版本后，默认直接通过 Quant-UX 或其他设计工具的线上链接审核，不要求每次导出本地 HTML。工单必须记录可访问链接、版本/revision 或确认日期、审核版本识别方式、确认人、确认时间和覆盖范围；线上链接无法访问或无法区分版本时停止审核，等待用户确认等效方案。
-- 只有用户明确要求 `导出原型 #N`、`导出全部原型`，或项目专用规则明确要求离线交付时，才导出到 `prototypes/<工单号>/<版本>/index.html`。已确认的本地快照不得原位覆盖；版本目录内资源使用相对路径，导出后检查入口、主要交互和资源完整性，但不自动提交。
-- 现有界面的小范围样式或布局调整使用标注截图、低保真图或明确复用的现有规范；新组件记录状态、错误和边界。两者只要不符合纯文案豁免就必须建单。
-- 后端、接口、数据处理和定时任务不强制 UI 原型，但必须先确认架构、API、数据、状态或流程设计；恢复既有确认行为的 Bug 可以复用原设计、截图、复现步骤或已有验收证据。
-- 需要设计证据的工单记录链接或路径、版本/revision 或日期、状态、确认人、确认时间和覆盖范围；没有 UI 原型时记录替代技术设计或原因。
-- 页面结构、主要流程、状态、权限、异常处理或验收结果变化时，必须更新原型或文字需求并重新确认后再继续正式编码。
-- 草稿原型可以用于讨论；写入 Git/Wiki、多人协作或单独实施时建立设计任务。草稿和经明确授权的隔离技术验证都不得直接作为生产实现。
-- 设计工具无法生成用户明确要求的可用 HTML 时，在工单记录限制并停止该导出或离线交付，等待用户确认等效方案；线上原型可访问且版本明确时不因此阻塞线上审核。纯显示文案、小范围 UI、非 UI 需求和恢复既有行为的 Bug 不强制建立完整线上原型或导出 HTML。
-
 ### 自然语言快捷指令
 
 快捷指令只是本工作流的自然语言别名，不得绕过方案确认、前置依赖、安全规则、工单范围、Wiki 主源、必要验证或人工验收：
 
 - `只分析`：只读检查并给出方案；不建单、不修改，停在等待确认。
 - `建工单`：根据已确认方案创建单元任务工单；建单后停止，不修改代码。
-- `执行工单 #N`：检查工单和依赖，实施、测试、提交、推送并回写证据；仅在明确要求时创建任务快照；停在“待验收”。
+- `执行工单 #N`：检查工单和依赖，实施、测试、提交、归档、推送并回写证据；停在“待验收”。
 - `建工单并做`：依次建单和执行，`建工单，做`、`建工单,做` 含义相同；停在“待验收”。
-- `继续工单 #N`：优先核对当前状态、最新评论、Git 和必要 Wiki 证据，从首个未完成步骤继续；关键前提未变化时不重复读取和分析仍有效的内容。
+- `继续工单 #N`：核对工单、Git 和 Wiki 证据，从首个未完成步骤继续，不重复仍然有效的检查。
 - `检查工单 #N`：只读核对范围、验收、测试和证据并输出报告；不自动修复。
-- `同步文档`：读取 Wiki、导出核心 `docs/` 并检查一致性，不处理任务归档；不修改 Wiki、不自动提交。
-- `导出原型 #N`：人工触发导出指定工单已确认的原型版本，按工单和版本写入 `prototypes/`；不扩展范围、不自动提交。
-- `导出全部原型`：人工触发导出当前项目已明确范围内的全部已确认原型；不自动提交。
-- `导出任务归档`：人工触发 `python dev_scripts/harness.py export`，只导出新增或 revision 已变化的任务归档；不删除本地文件、不自动提交。
-- `导出全部任务归档`：人工触发 `python dev_scripts/harness.py export --all`，读取并导出全部线上任务归档；不删除本地文件、不自动提交。
-- `#N 验收通过`：仅在用户明确验收后，在工单追加验收结论；按需更新真实变化的长期 Wiki，推送、同步父工单并关闭任务；不创建或导出任务归档。
+- `同步文档`：读取 Wiki、导出 `docs/` 并检查一致性；不修改 Wiki、不自动提交。
+- `#N 验收通过`：仅在用户明确验收后，更新归档、同步并提交镜像、推送、同步父工单并关闭任务。
 
-方案未确认或前置依赖未满足时，实施类指令必须停在对应门禁；除 `#N 验收通过` 外，快捷指令不得关闭待验收工单。原型和任务快照的导出必须由用户明确提出或项目专用规则明确要求，其他指令不得隐式执行。Gitea 工单不导出全文，`docs/task/` 只是可能不完整的专项或历史兼容快照。详细语义见 [开发工作流](docs/01-workflow.md)。
+方案未确认或前置依赖未满足时，实施类指令必须停在对应门禁；除 `#N 验收通过` 外，快捷指令不得关闭待验收工单。Gitea 工单不导出全文，本地只保存 Wiki 任务归档镜像。详细语义见 [开发工作流](docs/01-workflow.md)。
 
 ### 需求记录与流转
 
@@ -117,13 +62,13 @@ Gitea 不可用时，输出完整工单草稿并说明阻塞。未经用户明
 - 工单中的目标、非目标、已确认方案、验收标准和文档影响构成确认后的正式任务需求。
 - 影响范围、接口、数据、风险或验收的需求变化必须记录日期、内容、原因和用户确认；会改变已确认结果时先更新工单并等待再次确认。
 - 不复制完整聊天，不保存 Agent 内部推理，不写入密码、令牌、个人数据或生产数据；包含敏感信息的原话必须删除敏感部分或改写为脱敏摘要。
-- 长期有效的产品需求、业务规则和系统边界进入对应 Wiki 主题页并导出核心 `docs/`；单次任务的完成结果和验收保留在工单正文与评论。只有用户明确要求专项快照或项目专用规则要求时才创建 Wiki 任务快照并按需导出 `docs/task/`。Gitea 工单全文不导出到仓库。
+- 长期有效的产品需求、业务规则和系统边界进入对应 Wiki 主题页并导出 `docs/`；完成结果进入 Wiki 任务归档并导出 `docs/task/`。Gitea 工单全文不导出到仓库。
 
 详细记录边界见 [开发工作流](docs/01-workflow.md) 与 [业务规则和术语](docs/03-business-rules-and-glossary.md)。
 
 ### 效率与范围控制
 
-本节只用于减少无关工作和重复检查，不得削弱安全规则、已确认方案、工单范围、必要测试、必要的长期文档同步、Git 提交和人工验收要求。
+本节只用于减少无关工作和重复检查，不得削弱安全规则、已确认方案、工单范围、必要测试、Wiki 同步、Git 提交和验收归档要求。
 
 #### 严格控制范围
 
@@ -175,22 +120,19 @@ Gitea 不可用时，输出完整工单草稿并说明阻塞。未经用户明
 - 实现提交信息引用工单号，例如：`fix: 修复登录超时 (#123)`。
 - 不为流程制造空提交。
 - 优先运行项目档案中记录的格式检查、静态检查、单元测试和必要的集成测试。
-- 不能验证的真机、生产、迁移或并发行为必须写入工单；存在明确要求的任务快照时再同步记录。
-- Windows 环境优先使用当前已配置的 PowerShell；可选择时优先 PowerShell 7 `pwsh.exe`，不得仅为设置编码重复启动一层 PowerShell。
-- 文本文件读写在命令支持时显式指定 UTF-8；文件解码和控制台输出分别处理，只有出现真实乱码或已知宿主非 UTF-8 时才设置当前进程的输出编码或 Python UTF-8 环境变量。
-- 不得默认使用 `-ExecutionPolicy Bypass`；只有可信 `.ps1`确实被执行策略阻止且没有更小替代方案时，才对该次进程使用并在工单记录原因。
+- 不能验证的真机、生产、迁移或并发行为必须写入工单和归档。
 
-## 7. 完成和验收
+## 7. 完成、验收和归档
 
-1. 逐项完成验收、测试和实现提交，在工单追加最终证据评论，记录最终方案、差异、结果、提交、遗留问题和文档影响。
+1. 逐项完成验收、测试和实现提交，并把最终方案、差异、结果、提交及遗留问题写回工单。
 2. 工单保持“待验收”，用户没有明确验收通过前不得关闭。
-3. 有长期文档影响时，读取确认 Wiki，运行 `python dev_scripts/harness.py sync --check` 检查核心镜像，并把页面 revision 和镜像提交哈希写回工单；没有长期文档影响时不运行 Wiki 同步。
-4. 用户验收通过后，在工单追加验收时间和结论，关闭单元工单，并同步更新 MVP 和 Epic；没有真实变化的 Wiki 不重复更新或检查。
-5. 默认不创建任务归档。只有用户明确要求专项快照或项目专用规则明确要求时，才运行 `python dev_scripts/harness.py archive <编号> "<短标题>"`；`export` 和 `export --all` 同样必须显式触发。
+3. 运行 `python dev_scripts/new_task_archive.py <编号> "<短标题>"`，先创建 Wiki 归档，再登记并导出本地镜像。
+4. 读取确认 Wiki，运行 `python dev_scripts/sync_wiki_docs.py --check`；归档镜像单独提交，并把页面、revision、路径和提交哈希写回工单。
+5. 用户验收通过后关闭单元工单，并同步更新 MVP 和 Epic。
 
 MVP 内所有单元任务通过后才能做 MVP 集成验收；MVP 通过后才能关闭 MVP。Epic 的全部范围完成后才能关闭 Epic。
 
-详细证据回写、可选快照和文档同步边界见 [开发工作流](docs/01-workflow.md)。
+详细归档顺序和字段见 [开发工作流](docs/01-workflow.md)。
 
 ## 8. 可维护性
 
@@ -211,9 +153,8 @@ MVP 内所有单元任务通过后才能做 MVP 集成验收；MVP 通过后才
 
 - 每个单元任务必须在工单中选择“无长期文档影响并说明原因”或列出需要更新的 Wiki 页面。
 - 启动、测试、部署、排错命令，模块入口、目录职责、主要调用路径，配置、API、数据结构、状态、业务规则、安全边界、日志位置发生变化时，必须更新对应 Wiki。
-- 部署命令变化时，有常驻服务的项目更新自己的 `Deployment-and-Operations` 页面（由 [部署文档模板](docs/templates/deployment.md) 复制建立）；没有常驻服务的项目记录为无部署文档影响，不创建空的部署页。
 - 普通内部重构只有在入口、行为、配置和验证方式均未改变时，才可以记录为不影响长期文档。
-- 必需核心页面及结构以 `python dev_scripts/harness.py check --strict` 和 [新项目文档初始化](docs/07-new-project-documentation-setup.md) 为准；稳定文档与可选历史快照的分工见 [开发工作流](docs/01-workflow.md)。
+- 必需核心页面及结构以 `python dev_scripts/check_harness.py --strict` 和 [新项目文档初始化](docs/07-new-project-documentation-setup.md) 为准；稳定文档与任务归档的分工见 [开发工作流](docs/01-workflow.md)。
 
 ## 9. 引导提交例外
 
@@ -223,20 +164,11 @@ MVP 内所有单元任务通过后才能做 MVP 集成验收；MVP 通过后才
 
 ## 10. 项目专用规则
 
-### YoVision 分支治理
-
-- `explore` 是旧实现的只读聚合快照，不接受新功能、修复或文档演进；需要恢复旧行为时从其来源提交读取证据，不在该分支续写产品。
-- `main` 是用户审核基线，禁止直接开发、直接提交或未经用户明确审核的合并。
-- 新任务分支必须从当前 `dev` 创建，完成后通过 PR 合回 `dev`；不得把功能分支直接合入 `main`。
-- `dev` 完成集成测试后仍不能自动进入 `main`；只有用户明确表示审核/验收通过，Agent 才能执行 `dev → main`。
-- 紧急修复也必须建单并取得用户对分支与合并路径的明确授权，不默认绕过 `dev`。
-
 <!-- 在项目初始化时填写不可违反的技术、安全和业务约束。复杂子项目请在其目录中增加 AGENTS.md。 -->
 
-- 长期开发文档以 Gitea Wiki 为事实来源，单次任务证据以 Gitea 工单为事实来源；`docs/` 默认保存显式映射生成的核心只读镜像，`docs/task/` 是人工明确要求的专项或历史兼容快照，可能不完整或不是最新状态。
-- 核心 Wiki 与镜像的固定顺序是：修改 Wiki → 读取确认 → 导出核心 `docs` → 校验差异 → 提交镜像。
-- 默认不创建任务归档；`archive`、`导出任务归档` 或 `导出全部任务归档` 必须由用户明确提出或项目专用规则明确要求，且不得自动传播删除或重命名。
-- 同步配置只允许写入 `docs/` 下的 Markdown；发现核心镜像有未提交修改时必须停止。
+- 长期开发文档以 Gitea Wiki 为事实来源，`docs/` 是显式映射生成的只读镜像。
+- Wiki 与镜像的固定顺序是：修改 Wiki → 读取确认 → 导出 `docs` → 校验差异 → 提交镜像。
+- 同步配置只允许写入 `docs/` 下的 Markdown；发现镜像有未提交修改时必须停止。
 - Gitea 凭据只通过进程环境或 MCP 安全配置提供，不得写入仓库。
 - `dev_scripts/` 只存放 DevHarness 自身工具；业务项目的通用脚本必须使用独立目录，不得混放。
 - 本仓库包含 `Sense/`、`Brain/`、`Bell/` 三个独立开发与交付单元；Sense 与 Bell 是认证、数据、部署和发布完全独立的销售产品，Brain 是无界面推理交付单元。
@@ -262,10 +194,6 @@ MVP 内所有单元任务通过后才能做 MVP 集成验收；MVP 通过后才
 
 - `goadmin-baseline.json` 是 Sense、Bell 共用的 GoAdmin 上游与工具链版本事实来源；上游 URL 加完整 commit 是可复现标识，tag、`package.json` version、本机目录内容或本机已安装版本都不能替代 commit。
 - `D:\github\goadmin\go-admin`、`go-admin-ui`、`go-admin-doc` 是当前机器的只读参考副本。Agent 可以读取和验证，不得在这些目录开发、修改或提交 yovision 产品代码。
-- “基于 go-admin / go-admin-ui 二次开发”必须表现为从 `goadmin-baseline.json` 指定的两个完整上游 commit 导入或派生产品源码，并保留可核对的目录结构、框架启动链、通用认证/RBAC、菜单路由、请求封装及许可证来源；仅采用 Go、Vue、Element Plus、相似目录、页面外观或交互不算满足基线。
-- 禁止用自建 `net/http`、自建认证/RBAC/会话框架或自制管理端外壳替代 go-admin/go-admin-ui 后仍声称是 GoAdmin 二次开发。确有上游能力无法满足时，必须在独立工单中说明缺口、保留上游扩展边界并等待用户确认。
-- 每个 Sense/Bell 骨架、基础能力或框架相关工单开始实施前，必须读取任务相关的冻结 `go-admin-doc` 内容，并在工单中记录参考的文档主题或文件、继承的上游路径以及计划隐藏/禁用的默认模块。
-- 初始化验收必须包含来源证据：上游 URL/commit、实际导入路径、保留的 MIT 文件、相对上游的裁剪/修改清单和构建测试；缺少任一项不得标记为 GoAdmin 骨架完成。
 - Sense、Bell 必须从同一冻结基线分别初始化，保留独立代码、配置、构建、测试、版本和发布；不得通过共同修改参考仓库形成隐藏的共享实现。
 - 复制或派生上游代码时必须保留对应 MIT 许可证和版权声明，并记录实际复制来源的 commit。
 - `go-admin-doc` 只用于理解上游框架用法；yovision 的 Gitea Wiki、`AGENTS.md` 和 `goadmin-baseline.json` 仍是本项目事实来源。

Bell/.env.example

@@ -0,0 +1,6 @@
+# Copy values into the process environment. Do not commit real credentials.
+BELL_ENV=development
+BELL_HTTP_ADDRESS=127.0.0.1:8082
+BELL_DATABASE_URL=postgres://bell_app:replace-at-deploy@127.0.0.1:5432/bell?sslmode=disable
+BELL_SESSION_SECRET=generate-an-independent-random-value-at-deploy
+BELL_SHUTDOWN_SECONDS=10

Bell/AGENTS.md

@@ -26,9 +26,6 @@
 ## GoAdmin 技术基线
 
 - 初始化或升级 Bell 前必须读取根 `goadmin-baseline.json`，按其中的 go-admin、go-admin-ui commit 和 Go/Node/pnpm 精确版本实施。
-- Bell 必须由冻结 go-admin 后端与 go-admin-ui 前端源码直接派生；旧 `explore` 实现只能用于业务语义对照，禁止把其中自研认证、RBAC、会话、HTTP 平台或前端外壳复制为新基础。
-- 开始每个骨架、认证权限、菜单路由、代码生成、ORM 或通用 UI 工单前，必须读取任务相关的冻结 go-admin-doc，并把参考主题/文件及采用方式写回工单。
-- 骨架验收必须证明上游来源、继承路径、许可证、裁剪清单和相对上游差异；只有相似技术栈或视觉不能通过验收。
 - `D:\github\goadmin` 下的仓库仅可只读参考；Bell 产品代码只能写入 `Bell/` 或工单授权路径，不得在参考仓库原地开发。
 - 派生上游代码必须保留 MIT 许可证和版权声明；上游 `go-admin-doc` 只作框架用法参考，不覆盖 yovision Wiki 和本目录规则。
 - 变更冻结基线必须升级为 Sense/Bell 协同工单；Bell 可以独立发布，但不得单独漂移上游或工具链版本。

Bell/LICENSES/SOURCES.md

@@ -0,0 +1,11 @@
+# Upstream sources
+
+Bell is independently derived from the frozen YoVision GoAdmin baseline.
+
+| Source | Commit | License | Use |
+|---|---|---|---|
+| https://github.com/go-admin-team/go-admin.git | `f06540883b41d03782bb6b2c4150f298f328c6b6` | MIT | Backend architecture reference |
+| https://github.com/go-admin-team/go-admin-ui.git | `67d393d713877572fab0b897296a4c1d525fc81d` | MIT | Vue 3 application shell and component patterns |
+
+The local copies under `D:\github\goadmin` are read-only references and are not Bell source directories.
+

Bell/LICENSES/go-admin-LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 go-admin-team
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Bell/LICENSES/go-admin-ui-LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 PanJiaChen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Bell/README.md

@@ -0,0 +1,81 @@
+# Bell
+
+Bell is YoVision's independently deployable alert intake and response product. It owns its users, roles, sessions, database, audit facts and release artifacts. Sense and Brain are not required for Bell to build or run.
+
+## Frozen baseline
+
+- Go `1.26.5`
+- Node.js `22.22.1`
+- pnpm `9.15.1`
+- go-admin commit `f06540883b41d03782bb6b2c4150f298f328c6b6`
+- go-admin-ui commit `67d393d713877572fab0b897296a4c1d525fc81d`
+
+Exact upstream sources and retained MIT notices are in `LICENSES/`.
+
+## Configuration
+
+Copy variable names from `.env.example` into the process environment. Replace every placeholder at deployment time. Bell intentionally has no built-in database password, session secret or administrator password.
+
+`BELL_SESSION_SECRET` is mandatory, must be at least 32 characters, and must be generated independently from Sense. In production Bell marks its `bell_session` cookie as Secure, HttpOnly and SameSite=Strict.
+
+The PostgreSQL role used by `BELL_DATABASE_URL` must be dedicated to Bell. Do not reuse a Sense role or database.
+
+## Backend
+
+```powershell
+Set-Location Bell/server
+go test ./...
+go run . migrate
+go run . serve
+```
+
+Create the first administrator only through a one-time process environment value; do not place the password in shell history, source files or command arguments:
+
+```powershell
+$env:BELL_BOOTSTRAP_PASSWORD = Read-Host -AsSecureString | ConvertFrom-SecureString -AsPlainText
+go run . create-admin --username bell-admin --display-name "Bell 管理员"
+Remove-Item Env:BELL_BOOTSTRAP_PASSWORD
+```
+
+Passwords require at least 12 characters with upper-case, lower-case and numeric characters. Bell ships no user or default password. Administrator, operator and viewer roles are seeded with least-privilege permissions; only an administrator can read user and authentication-audit pages.
+
+Health endpoints:
+
+```powershell
+Invoke-RestMethod http://127.0.0.1:8082/healthz
+Invoke-RestMethod http://127.0.0.1:8082/readyz
+```
+
+Migrations are embedded and applied transactionally. The `migrate` command is idempotent. To roll back this initial skeleton, stop Bell and drop only the dedicated Bell test database; migrations are forward-only and never touch another product database.
+
+## Web
+
+```powershell
+Set-Location Bell/web
+pnpm install --frozen-lockfile
+pnpm lint
+pnpm build:prod
+pnpm dev
+```
+
+The web client listens on port 8083 in development and proxies `/api` to Bell only. The visible shell contains only Bell's product navigation; go-admin demonstration routes are neither registered nor served by the backend.
+
+### Development-only synthetic events
+
+When `BELL_ENV=development` or `test`, administrators can open “合成事件测试” or call the `/api/v1/synthetic/*` endpoints. Fixtures live under `server/testdata/events/`, contain only invented anonymous data, and call the same Event/Receipt service as every future producer adapter. Reusing a source event ID verifies idempotency; using the same ID with a different fixture verifies conflict handling.
+
+In `BELL_ENV=production` those routes are not registered and return `404`; hiding the menu is not the security boundary.
+
+### Rules and alerts
+
+Administrators configure and enable rules from “规则配置”. Each accepted Event is evaluated in the same database transaction that creates its Event/Receipt. A matching Event creates or joins an open Alert correlated by rule and location; one Event may match several rules and one Alert may collect several related Events. Every evaluation records its rule version and explanation, while every match also stores the actual rule snapshot. Unmatched Events remain visible as Events and are never labelled as notified or handled.
+
+Alert handling is two-step: the first authorized operator to acknowledge becomes the handler, then that handler (or an administrator) records a required site outcome before closing. PostgreSQL conditional updates select one concurrent acknowledgement winner. Later operators receive the actual handler instead of overwriting it. Successful lifecycle facts are append-only; failed, duplicate and denied attempts are also written to the security audit without tokens or passwords.
+
+## Independent smoke check
+
+Run PostgreSQL with an empty Bell-only database, set `BELL_DATABASE_URL`, start the backend and then the web client. Keep Sense and Brain stopped. Verify `/healthz`, `/readyz`, the workbench shell, and a direct request to an unregistered framework demo route returns `404`.
+
+## Logs and secrets
+
+Application logs go to standard output. Never log database URLs, passwords, session tokens, event evidence credentials, customer data or production payloads.

Bell/scripts/bootstrap/check-toolchain.ps1

@@ -0,0 +1,11 @@
+$ErrorActionPreference = 'Stop'
+
+$expectedGo = 'go version go1.26.5 windows/amd64'
+$expectedNode = 'v22.22.1'
+$expectedPnpm = '9.15.1'
+
+if ((go version) -ne $expectedGo) { throw "Expected $expectedGo" }
+if ((node --version) -ne $expectedNode) { throw "Expected Node $expectedNode" }
+if ((pnpm --version) -ne $expectedPnpm) { throw "Expected pnpm $expectedPnpm" }
+
+Write-Output 'Bell toolchain matches goadmin-baseline.json.'

Bell/server/app/alert/lifecycle/http.go

@@ -0,0 +1,58 @@
+package lifecycle
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/app/auth"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/rbac"
+)
+
+type HTTP struct {
+	Service Service
+	Auth    auth.HTTP
+}
+
+func (h HTTP) Register(mux *http.ServeMux) {
+	mux.Handle("POST /api/v1/alerts/{id}/ack", h.Auth.Require(rbac.AlertsHandle, http.HandlerFunc(h.ack)))
+	mux.Handle("POST /api/v1/alerts/{id}/close", h.Auth.Require(rbac.AlertsHandle, http.HandlerFunc(h.close)))
+}
+func (h HTTP) ack(w http.ResponseWriter, r *http.Request) {
+	result, err := h.Service.Ack(r.Context(), r.PathValue("id"), auth.Principal(r.Context()))
+	if err != nil {
+		status := 500
+		if errors.Is(err, ErrAlreadyHandled) {
+			status = 409
+		}
+		writeJSON(w, status, map[string]any{"error": err.Error(), "current": result.Detail})
+		return
+	}
+	writeJSON(w, 200, result)
+}
+func (h HTTP) close(w http.ResponseWriter, r *http.Request) {
+	var input CloseInput
+	decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&input); err != nil {
+		writeJSON(w, 400, map[string]string{"error": "请求格式无效"})
+		return
+	}
+	result, err := h.Service.Close(r.Context(), r.PathValue("id"), input, auth.Principal(r.Context()))
+	if err != nil {
+		status := 500
+		if errors.Is(err, ErrOutcomeRequired) {
+			status = 400
+		} else if errors.Is(err, ErrInvalidTransition) {
+			status = 409
+		}
+		writeJSON(w, status, map[string]any{"error": err.Error(), "current": result.Detail})
+		return
+	}
+	writeJSON(w, 200, result)
+}
+func writeJSON(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}

Bell/server/app/alert/lifecycle/service.go

@@ -0,0 +1,128 @@
+package lifecycle
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/app/alert/model"
+	alertQuery "git.ilapage.cn/ila/yovision/Bell/server/app/alert/query"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/audit"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/auth"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+var ErrAlreadyHandled = errors.New("预警已由其他人员开始处理")
+var ErrInvalidTransition = errors.New("当前状态不能执行此操作")
+var ErrOutcomeRequired = errors.New("请选择现场处理结果")
+
+type CloseInput struct {
+	Outcome string `json:"outcome"`
+	Note    string `json:"note"`
+}
+type Result struct {
+	Detail     model.Detail `json:"detail"`
+	Idempotent bool         `json:"idempotent"`
+}
+type Service struct {
+	DB    *pgxpool.Pool
+	Audit audit.Store
+	Query alertQuery.Service
+}
+
+func hasRole(user auth.User, role string) bool {
+	for _, value := range user.Roles {
+		if value == role {
+			return true
+		}
+	}
+	return false
+}
+func validOutcome(value string) bool {
+	return value == "danger_confirmed" || value == "false_positive" || value == "site_normal" || value == "unable_to_confirm"
+}
+
+func (s Service) Ack(ctx context.Context, alertID string, actor auth.User) (Result, error) {
+	tx, err := s.DB.Begin(ctx)
+	if err != nil {
+		return Result{}, err
+	}
+	var updated string
+	err = tx.QueryRow(ctx, `UPDATE bell_alerts SET status='acknowledged',acknowledged_by=$2,acknowledged_at=now(),updated_at=now() WHERE id=$1 AND status='open' RETURNING id::text`, alertID, actor.ID).Scan(&updated)
+	if err == nil {
+		if _, err = tx.Exec(ctx, `INSERT INTO bell_alert_lifecycle_facts(alert_id,transition,actor_user_id) VALUES($1,'acknowledged',$2)`, alertID, actor.ID); err == nil {
+			_, err = tx.Exec(ctx, `INSERT INTO bell_audit_log(actor_user_id,action,target_type,target_id,outcome,details) VALUES($1,'alert.ack','alert',$2,'success','{}')`, actor.ID, alertID)
+		}
+		if err == nil {
+			err = tx.Commit(ctx)
+		}
+		if err != nil {
+			_ = tx.Rollback(ctx)
+			return Result{}, err
+		}
+		detail, err := s.Query.Get(ctx, alertID)
+		return Result{Detail: detail}, err
+	}
+	_ = tx.Rollback(ctx)
+	if !errors.Is(err, pgx.ErrNoRows) {
+		return Result{}, err
+	}
+	detail, getErr := s.Query.Get(ctx, alertID)
+	if getErr != nil {
+		return Result{}, getErr
+	}
+	if detail.Alert.AcknowledgedBy != nil && *detail.Alert.AcknowledgedBy == actor.ID {
+		_ = s.Audit.Record(ctx, &actor.ID, "alert.ack", "alert", &alertID, "failure", map[string]any{"reason": "duplicate"})
+		return Result{Detail: detail, Idempotent: true}, nil
+	}
+	_ = s.Audit.Record(ctx, &actor.ID, "alert.ack", "alert", &alertID, "failure", map[string]any{"reason": "already_handled"})
+	return Result{Detail: detail}, ErrAlreadyHandled
+}
+
+func (s Service) Close(ctx context.Context, alertID string, input CloseInput, actor auth.User) (Result, error) {
+	if !validOutcome(input.Outcome) {
+		_ = s.Audit.Record(ctx, &actor.ID, "alert.close", "alert", &alertID, "failure", map[string]any{"reason": "outcome_required"})
+		return Result{}, ErrOutcomeRequired
+	}
+	current, err := s.Query.Get(ctx, alertID)
+	if err != nil {
+		return Result{}, err
+	}
+	if current.Alert.Status == "closed" {
+		if current.Alert.ClosedBy != nil && *current.Alert.ClosedBy == actor.ID && current.Alert.CloseOutcome != nil && *current.Alert.CloseOutcome == input.Outcome {
+			return Result{Detail: current, Idempotent: true}, nil
+		}
+		_ = s.Audit.Record(ctx, &actor.ID, "alert.close", "alert", &alertID, "failure", map[string]any{"reason": "already_closed"})
+		return Result{Detail: current}, ErrInvalidTransition
+	}
+	admin := hasRole(actor, "administrator")
+	if current.Alert.Status != "acknowledged" || (!admin && (current.Alert.AcknowledgedBy == nil || *current.Alert.AcknowledgedBy != actor.ID)) {
+		_ = s.Audit.Record(ctx, &actor.ID, "alert.close", "alert", &alertID, "failure", map[string]any{"reason": "invalid_owner_or_state"})
+		return Result{Detail: current}, ErrInvalidTransition
+	}
+	details, _ := json.Marshal(map[string]any{"outcome": input.Outcome, "note": input.Note})
+	tx, err := s.DB.Begin(ctx)
+	if err != nil {
+		return Result{}, err
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	result, err := tx.Exec(ctx, `UPDATE bell_alerts SET status='closed',closed_by=$2,closed_at=now(),close_outcome=$3,close_note=nullif($4,''),updated_at=now() WHERE id=$1 AND status='acknowledged'`, alertID, actor.ID, input.Outcome, input.Note)
+	if err != nil {
+		return Result{}, err
+	}
+	if result.RowsAffected() != 1 {
+		return Result{}, ErrInvalidTransition
+	}
+	if _, err = tx.Exec(ctx, `INSERT INTO bell_alert_lifecycle_facts(alert_id,transition,actor_user_id,details) VALUES($1,'closed',$2,$3::jsonb)`, alertID, actor.ID, string(details)); err != nil {
+		return Result{}, err
+	}
+	if _, err = tx.Exec(ctx, `INSERT INTO bell_audit_log(actor_user_id,action,target_type,target_id,outcome,details) VALUES($1,'alert.close','alert',$2,'success',$3::jsonb)`, actor.ID, alertID, string(details)); err != nil {
+		return Result{}, err
+	}
+	if err = tx.Commit(ctx); err != nil {
+		return Result{}, err
+	}
+	detail, err := s.Query.Get(ctx, alertID)
+	return Result{Detail: detail}, err
+}

Bell/server/app/alert/lifecycle/service_test.go

@@ -0,0 +1,135 @@
+package lifecycle
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"sync"
+	"testing"
+	"time"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/app/alert/query"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/audit"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/auth"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/event"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/rule"
+	"git.ilapage.cn/ila/yovision/Bell/server/internal/platform"
+	"git.ilapage.cn/ila/yovision/Bell/server/migrations"
+)
+
+func TestConcurrentAckCloseAndRestart(t *testing.T) {
+	url := os.Getenv("BELL_TEST_DATABASE_URL")
+	if url == "" {
+		t.Skip("BELL_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	db, err := platform.OpenDatabase(ctx, url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := migrations.Apply(ctx, db); err != nil {
+		t.Fatal(err)
+	}
+	prefix := fmt.Sprintf("lifecycle-%d", time.Now().UnixNano())
+	actors := make([]auth.User, 2)
+	for i := range actors {
+		var id string
+		username := fmt.Sprintf("%s-%d", prefix, i)
+		if err := db.QueryRow(ctx, `INSERT INTO bell_users(username,display_name,password_hash) VALUES($1,$2,'test-only-not-a-login-hash') RETURNING id::text`, username, username).Scan(&id); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := db.Exec(ctx, `INSERT INTO bell_user_roles(user_id,role_id) SELECT $1,id FROM bell_roles WHERE code='operator'`, id); err != nil {
+			t.Fatal(err)
+		}
+		actors[i] = auth.User{ID: id, Username: username, DisplayName: username, Roles: []string{"operator"}}
+	}
+	eventType := prefix + "-event"
+	ruleService := rule.Service{DB: db}
+	createdRule, err := ruleService.Create(ctx, rule.CreateInput{Code: prefix, Name: "生命周期测试规则", EventType: &eventType, MinimumSeverity: "low"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	eventService := event.Service{DB: db, AfterPersist: ruleService.Match}
+	accepted, err := eventService.Ingest(ctx, event.Command{ProducerID: prefix, SourceEventID: "1", EventType: eventType, OccurredAt: time.Now().UTC(), Location: "test place", Severity: "high", Attributes: map[string]any{}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	queryService := query.Service{DB: db}
+	alerts, err := queryService.ForEvent(ctx, accepted.Event.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	alertID := ""
+	for _, item := range alerts {
+		if item.PrimaryRuleID == createdRule.ID {
+			alertID = item.ID
+		}
+	}
+	if alertID == "" {
+		t.Fatal("alert not created")
+	}
+	service := Service{DB: db, Audit: audit.Store{DB: db}, Query: queryService}
+	const attempts = 20
+	var wg sync.WaitGroup
+	for i := 0; i < attempts; i++ {
+		wg.Add(1)
+		actor := actors[i%2]
+		go func() { defer wg.Done(); _, _ = service.Ack(ctx, alertID, actor) }()
+	}
+	wg.Wait()
+	detail, err := queryService.Get(ctx, alertID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if detail.Alert.Status != "acknowledged" || detail.Alert.AcknowledgedBy == nil {
+		t.Fatalf("unexpected ack projection: %#v", detail.Alert)
+	}
+	var facts int
+	if err := db.QueryRow(ctx, `SELECT count(*) FROM bell_alert_lifecycle_facts WHERE alert_id=$1 AND transition='acknowledged'`, alertID).Scan(&facts); err != nil {
+		t.Fatal(err)
+	}
+	if facts != 1 {
+		t.Fatalf("ack facts=%d", facts)
+	}
+	winner := actors[0]
+	loser := actors[1]
+	if winner.ID != *detail.Alert.AcknowledgedBy {
+		winner, loser = loser, winner
+	}
+	if _, err := service.Close(ctx, alertID, CloseInput{Outcome: "site_normal"}, loser); err == nil {
+		t.Fatal("non-owner closed alert")
+	}
+	closed, err := service.Close(ctx, alertID, CloseInput{Outcome: "site_normal", Note: "现场检查正常"}, winner)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if closed.Detail.Alert.Status != "closed" {
+		t.Fatal("alert not closed")
+	}
+	repeat, err := service.Close(ctx, alertID, CloseInput{Outcome: "site_normal", Note: "现场检查正常"}, winner)
+	if err != nil || !repeat.Idempotent {
+		t.Fatalf("repeat close: %#v %v", repeat, err)
+	}
+	if err := db.QueryRow(ctx, `SELECT count(*) FROM bell_alert_lifecycle_facts WHERE alert_id=$1`, alertID).Scan(&facts); err != nil {
+		t.Fatal(err)
+	}
+	if facts != 2 {
+		t.Fatalf("lifecycle facts=%d", facts)
+	}
+	if _, err := db.Exec(ctx, `DELETE FROM bell_alert_lifecycle_facts WHERE alert_id=$1`, alertID); err == nil {
+		t.Fatal("lifecycle deletion succeeded")
+	}
+	db.Close()
+	reopened, err := platform.OpenDatabase(ctx, url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer reopened.Close()
+	afterRestart, err := (query.Service{DB: reopened}).Get(ctx, alertID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if afterRestart.Alert.Status != "closed" || len(afterRestart.Timeline) != 2 {
+		t.Fatalf("restart projection: %#v", afterRestart)
+	}
+}

Bell/server/app/alert/model/types.go

@@ -0,0 +1,53 @@
+package model
+
+import "encoding/json"
+
+type Alert struct {
+	ID                 string  `json:"id"`
+	Status             string  `json:"status"`
+	Severity           string  `json:"severity"`
+	Summary            string  `json:"summary"`
+	Location           string  `json:"location"`
+	PrimaryRuleID      string  `json:"primary_rule_id"`
+	RuleName           string  `json:"rule_name"`
+	EventCount         int     `json:"event_count"`
+	AcknowledgedBy     *string `json:"acknowledged_by,omitempty"`
+	AcknowledgedByName *string `json:"acknowledged_by_name,omitempty"`
+	AcknowledgedAt     *string `json:"acknowledged_at,omitempty"`
+	ClosedBy           *string `json:"closed_by,omitempty"`
+	ClosedByName       *string `json:"closed_by_name,omitempty"`
+	ClosedAt           *string `json:"closed_at,omitempty"`
+	CloseOutcome       *string `json:"close_outcome,omitempty"`
+	CloseNote          *string `json:"close_note,omitempty"`
+	CreatedAt          string  `json:"created_at"`
+	UpdatedAt          string  `json:"updated_at"`
+}
+type LinkedEvent struct {
+	ID         string `json:"id"`
+	EventType  string `json:"event_type"`
+	OccurredAt string `json:"occurred_at"`
+	Location   string `json:"location"`
+	Severity   string `json:"severity"`
+}
+type Match struct {
+	EventID      string          `json:"event_id"`
+	RuleID       string          `json:"rule_id"`
+	RuleVersion  int             `json:"rule_version"`
+	RuleSnapshot json.RawMessage `json:"rule_snapshot"`
+	Explanation  string          `json:"explanation"`
+	MatchedAt    string          `json:"matched_at"`
+}
+type Detail struct {
+	Alert    Alert           `json:"alert"`
+	Events   []LinkedEvent   `json:"events"`
+	Matches  []Match         `json:"matches"`
+	Timeline []TimelineEntry `json:"timeline"`
+}
+type TimelineEntry struct {
+	ID          int64           `json:"id"`
+	Transition  string          `json:"transition"`
+	ActorUserID string          `json:"actor_user_id"`
+	ActorName   string          `json:"actor_name"`
+	OccurredAt  string          `json:"occurred_at"`
+	Details     json.RawMessage `json:"details"`
+}

Bell/server/app/alert/query/http.go

@@ -0,0 +1,61 @@
+package query
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"strconv"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/app/auth"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/rbac"
+	"github.com/jackc/pgx/v5"
+)
+
+type HTTP struct {
+	Service Service
+	Auth    auth.HTTP
+}
+
+func (h HTTP) Register(mux *http.ServeMux) {
+	mux.Handle("GET /api/v1/alerts", h.Auth.Require(rbac.AlertsRead, http.HandlerFunc(h.list)))
+	mux.Handle("GET /api/v1/alerts/{id}", h.Auth.Require(rbac.AlertsRead, http.HandlerFunc(h.get)))
+	mux.Handle("GET /api/v1/events/{id}/alerts", h.Auth.Require(rbac.EventsRead, http.HandlerFunc(h.forEvent)))
+}
+func (h HTTP) list(w http.ResponseWriter, r *http.Request) {
+	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
+	items, err := h.Service.List(r.Context(), limit, r.URL.Query().Get("before"))
+	if err != nil {
+		writeJSON(w, 500, map[string]string{"error": "读取预警失败"})
+		return
+	}
+	next := ""
+	if len(items) > 0 {
+		next = items[len(items)-1].ID
+	}
+	writeJSON(w, 200, map[string]any{"items": items, "next": next})
+}
+func (h HTTP) get(w http.ResponseWriter, r *http.Request) {
+	item, err := h.Service.Get(r.Context(), r.PathValue("id"))
+	if err != nil {
+		status := 500
+		if errors.Is(err, pgx.ErrNoRows) {
+			status = 404
+		}
+		writeJSON(w, status, map[string]string{"error": "预警不存在"})
+		return
+	}
+	writeJSON(w, 200, item)
+}
+func (h HTTP) forEvent(w http.ResponseWriter, r *http.Request) {
+	items, err := h.Service.ForEvent(r.Context(), r.PathValue("id"))
+	if err != nil {
+		writeJSON(w, 500, map[string]string{"error": "读取关联预警失败"})
+		return
+	}
+	writeJSON(w, 200, map[string]any{"items": items})
+}
+func writeJSON(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}

Bell/server/app/alert/query/service.go

@@ -0,0 +1,102 @@
+package query
+
+import (
+	"context"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/app/alert/model"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+type Service struct{ DB *pgxpool.Pool }
+
+const base = `SELECT a.id::text,a.status,a.severity,a.summary,a.location,a.primary_rule_id::text,r.name,(SELECT count(*) FROM bell_alert_events ae WHERE ae.alert_id=a.id),a.acknowledged_by::text,ack_user.display_name,a.acknowledged_at::text,a.closed_by::text,close_user.display_name,a.closed_at::text,a.close_outcome,a.close_note,a.created_at::text,a.updated_at::text FROM bell_alerts a JOIN bell_rules r ON r.id=a.primary_rule_id LEFT JOIN bell_users ack_user ON ack_user.id=a.acknowledged_by LEFT JOIN bell_users close_user ON close_user.id=a.closed_by`
+
+func scanAlert(row interface{ Scan(...any) error }) (model.Alert, error) {
+	var item model.Alert
+	err := row.Scan(&item.ID, &item.Status, &item.Severity, &item.Summary, &item.Location, &item.PrimaryRuleID, &item.RuleName, &item.EventCount, &item.AcknowledgedBy, &item.AcknowledgedByName, &item.AcknowledgedAt, &item.ClosedBy, &item.ClosedByName, &item.ClosedAt, &item.CloseOutcome, &item.CloseNote, &item.CreatedAt, &item.UpdatedAt)
+	return item, err
+}
+func (s Service) List(ctx context.Context, limit int, before string) ([]model.Alert, error) {
+	if limit < 1 || limit > 100 {
+		limit = 25
+	}
+	rows, err := s.DB.Query(ctx, base+` WHERE ($2='' OR (a.created_at,a.id)<((SELECT created_at FROM bell_alerts WHERE id=nullif($2,'')::uuid),nullif($2,'')::uuid)) ORDER BY a.created_at DESC,a.id DESC LIMIT $1`, limit, before)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []model.Alert{}
+	for rows.Next() {
+		item, err := scanAlert(rows)
+		if err != nil {
+			return nil, err
+		}
+		items = append(items, item)
+	}
+	return items, rows.Err()
+}
+func (s Service) Get(ctx context.Context, id string) (model.Detail, error) {
+	item, err := scanAlert(s.DB.QueryRow(ctx, base+` WHERE a.id=$1`, id))
+	if err != nil {
+		return model.Detail{}, err
+	}
+	detail := model.Detail{Alert: item, Events: []model.LinkedEvent{}, Matches: []model.Match{}, Timeline: []model.TimelineEntry{}}
+	rows, err := s.DB.Query(ctx, `SELECT e.id::text,e.event_type,e.occurred_at::text,e.location,e.severity FROM bell_alert_events ae JOIN bell_events e ON e.id=ae.event_id WHERE ae.alert_id=$1 ORDER BY e.occurred_at,e.id`, id)
+	if err != nil {
+		return model.Detail{}, err
+	}
+	for rows.Next() {
+		var linked model.LinkedEvent
+		if err := rows.Scan(&linked.ID, &linked.EventType, &linked.OccurredAt, &linked.Location, &linked.Severity); err != nil {
+			rows.Close()
+			return model.Detail{}, err
+		}
+		detail.Events = append(detail.Events, linked)
+	}
+	rows.Close()
+	rows, err = s.DB.Query(ctx, `SELECT event_id::text,rule_id::text,rule_version,rule_snapshot,explanation,matched_at::text FROM bell_rule_matches WHERE alert_id=$1 ORDER BY matched_at,event_id`, id)
+	if err != nil {
+		return model.Detail{}, err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var match model.Match
+		if err := rows.Scan(&match.EventID, &match.RuleID, &match.RuleVersion, &match.RuleSnapshot, &match.Explanation, &match.MatchedAt); err != nil {
+			return model.Detail{}, err
+		}
+		detail.Matches = append(detail.Matches, match)
+	}
+	if err := rows.Err(); err != nil {
+		return model.Detail{}, err
+	}
+	rows.Close()
+	rows, err = s.DB.Query(ctx, `SELECT f.id,f.transition,f.actor_user_id::text,u.display_name,f.occurred_at::text,f.details FROM bell_alert_lifecycle_facts f JOIN bell_users u ON u.id=f.actor_user_id WHERE f.alert_id=$1 ORDER BY f.id`, id)
+	if err != nil {
+		return model.Detail{}, err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var entry model.TimelineEntry
+		if err := rows.Scan(&entry.ID, &entry.Transition, &entry.ActorUserID, &entry.ActorName, &entry.OccurredAt, &entry.Details); err != nil {
+			return model.Detail{}, err
+		}
+		detail.Timeline = append(detail.Timeline, entry)
+	}
+	return detail, rows.Err()
+}
+func (s Service) ForEvent(ctx context.Context, eventID string) ([]model.Alert, error) {
+	rows, err := s.DB.Query(ctx, base+` JOIN bell_alert_events link ON link.alert_id=a.id WHERE link.event_id=$1 ORDER BY a.created_at,a.id`, eventID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []model.Alert{}
+	for rows.Next() {
+		item, err := scanAlert(rows)
+		if err != nil {
+			return nil, err
+		}
+		items = append(items, item)
+	}
+	return items, rows.Err()
+}

Bell/server/app/audit/store.go

@@ -0,0 +1,56 @@
+package audit
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+type Entry struct {
+	ID          int64          `json:"id"`
+	OccurredAt  string         `json:"occurred_at"`
+	ActorUserID *string        `json:"actor_user_id,omitempty"`
+	Action      string         `json:"action"`
+	TargetType  string         `json:"target_type"`
+	TargetID    *string        `json:"target_id,omitempty"`
+	Outcome     string         `json:"outcome"`
+	Details     map[string]any `json:"details"`
+}
+
+type Store struct{ DB *pgxpool.Pool }
+
+func (s Store) Record(ctx context.Context, actorUserID *string, action, targetType string, targetID *string, outcome string, details map[string]any) error {
+	data, err := json.Marshal(details)
+	if err != nil {
+		return fmt.Errorf("encode audit details: %w", err)
+	}
+	_, err = s.DB.Exec(ctx, `INSERT INTO bell_audit_log(actor_user_id,action,target_type,target_id,outcome,details) VALUES($1,$2,$3,$4,$5,$6)`, actorUserID, action, targetType, targetID, outcome, data)
+	if err != nil {
+		return fmt.Errorf("append audit entry: %w", err)
+	}
+	return nil
+}
+
+func (s Store) List(ctx context.Context, limit int) ([]Entry, error) {
+	if limit < 1 || limit > 200 {
+		limit = 50
+	}
+	rows, err := s.DB.Query(ctx, `SELECT id,occurred_at::text,actor_user_id::text,action,target_type,target_id,outcome,details FROM bell_audit_log ORDER BY id DESC LIMIT $1`, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	entries := make([]Entry, 0, limit)
+	for rows.Next() {
+		var e Entry
+		var data []byte
+		if err := rows.Scan(&e.ID, &e.OccurredAt, &e.ActorUserID, &e.Action, &e.TargetType, &e.TargetID, &e.Outcome, &data); err != nil {
+			return nil, err
+		}
+		_ = json.Unmarshal(data, &e.Details)
+		entries = append(entries, e)
+	}
+	return entries, rows.Err()
+}

Bell/server/app/auth/http.go

@@ -0,0 +1,179 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/app/audit"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/rbac"
+)
+
+const CookieName = "bell_session"
+
+type HTTP struct {
+	Service      Service
+	Store        Store
+	Audit        audit.Store
+	SecureCookie bool
+}
+
+func (h HTTP) Register(mux *http.ServeMux) {
+	mux.HandleFunc("POST /api/v1/auth/login", h.login)
+	mux.Handle("GET /api/v1/auth/me", h.authenticated(http.HandlerFunc(h.me)))
+	mux.Handle("POST /api/v1/auth/logout", h.authenticated(http.HandlerFunc(h.logout)))
+	mux.Handle("GET /api/v1/users", h.Require(rbac.UsersRead, http.HandlerFunc(h.users)))
+	mux.Handle("POST /api/v1/users", h.Require(rbac.UsersWrite, http.HandlerFunc(h.createUser)))
+	mux.Handle("PUT /api/v1/users/{id}/roles", h.Require(rbac.UsersWrite, http.HandlerFunc(h.replaceRoles)))
+	mux.Handle("GET /api/v1/audit", h.Require(rbac.AuditRead, http.HandlerFunc(h.auditEntries)))
+}
+
+func (h HTTP) login(w http.ResponseWriter, r *http.Request) {
+	var input LoginInput
+	if err := decodeJSON(w, r, &input); err != nil {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
+		return
+	}
+	result, err := h.Service.Login(r.Context(), input)
+	if err != nil {
+		status := http.StatusInternalServerError
+		if errors.Is(err, ErrInvalidCredentials) {
+			status = http.StatusUnauthorized
+		}
+		writeJSON(w, status, map[string]string{"error": err.Error()})
+		return
+	}
+	h.setCookie(w, result.Token, time.Now().Add(8*time.Hour))
+	result.User.PasswordHash = ""
+	writeJSON(w, http.StatusOK, map[string]any{"user": result.User, "expires_at": result.ExpiresAt})
+}
+
+func (h HTTP) me(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, http.StatusOK, principal(r.Context()))
+}
+func (h HTTP) logout(w http.ResponseWriter, r *http.Request) {
+	cookie, _ := r.Cookie(CookieName)
+	token := ""
+	if cookie != nil {
+		token = cookie.Value
+	}
+	user := principal(r.Context())
+	if err := h.Service.Logout(r.Context(), token, user); err != nil {
+		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "退出失败"})
+		return
+	}
+	h.setCookie(w, "", time.Unix(0, 0))
+	w.WriteHeader(http.StatusNoContent)
+}
+func (h HTTP) users(w http.ResponseWriter, r *http.Request) {
+	users, err := h.Store.ListUsers(r.Context())
+	if err != nil {
+		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "读取用户失败"})
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"items": users})
+}
+func (h HTTP) createUser(w http.ResponseWriter, r *http.Request) {
+	var input struct {
+		Username    string `json:"username"`
+		DisplayName string `json:"display_name"`
+		Password    string `json:"password"`
+		Role        string `json:"role"`
+	}
+	if err := decodeJSON(w, r, &input); err != nil {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
+		return
+	}
+	input.Username = strings.ToLower(strings.TrimSpace(input.Username))
+	if input.Username == "" || input.DisplayName == "" {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "用户名和显示名称必填"})
+		return
+	}
+	hash, err := hashPassword(input.Password)
+	if err != nil {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
+		return
+	}
+	id, err := h.Store.CreateUser(r.Context(), input.Username, input.DisplayName, hash, input.Role)
+	if err != nil {
+		writeJSON(w, http.StatusConflict, map[string]string{"error": "用户或角色无效"})
+		return
+	}
+	actor := principal(r.Context())
+	_ = h.Audit.Record(r.Context(), &actor.ID, "rbac.user_created", "user", &id, "success", map[string]any{"role": input.Role})
+	writeJSON(w, http.StatusCreated, map[string]string{"id": id})
+}
+func (h HTTP) replaceRoles(w http.ResponseWriter, r *http.Request) {
+	var input struct {
+		Roles []string `json:"roles"`
+	}
+	if err := decodeJSON(w, r, &input); err != nil || len(input.Roles) == 0 {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "至少选择一个角色"})
+		return
+	}
+	id := r.PathValue("id")
+	if err := h.Store.ReplaceRoles(r.Context(), id, input.Roles); err != nil {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "角色更新失败"})
+		return
+	}
+	actor := principal(r.Context())
+	_ = h.Audit.Record(r.Context(), &actor.ID, "rbac.roles_replaced", "user", &id, "success", map[string]any{"roles": input.Roles})
+	w.WriteHeader(http.StatusNoContent)
+}
+func (h HTTP) auditEntries(w http.ResponseWriter, r *http.Request) {
+	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
+	entries, err := h.Audit.List(r.Context(), limit)
+	if err != nil {
+		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "读取审计失败"})
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"items": entries})
+}
+
+func (h HTTP) authenticated(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		cookie, err := r.Cookie(CookieName)
+		if err != nil {
+			writeJSON(w, http.StatusUnauthorized, map[string]string{"error": ErrUnauthorized.Error()})
+			return
+		}
+		user, err := h.Service.Authenticate(r.Context(), cookie.Value)
+		if err != nil {
+			writeJSON(w, http.StatusUnauthorized, map[string]string{"error": ErrUnauthorized.Error()})
+			return
+		}
+		next.ServeHTTP(w, r.WithContext(context.WithValue(r.Context(), principalKey{}, user)))
+	})
+}
+func (h HTTP) Require(permission string, next http.Handler) http.Handler {
+	return h.authenticated(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		user := principal(r.Context())
+		if !user.Permissions.Has(permission) {
+			_ = h.Audit.Record(r.Context(), &user.ID, "rbac.denied", "permission", &permission, "denied", map[string]any{})
+			writeJSON(w, http.StatusForbidden, map[string]string{"error": "没有执行此操作的权限"})
+			return
+		}
+		next.ServeHTTP(w, r)
+	}))
+}
+
+func (h HTTP) setCookie(w http.ResponseWriter, value string, expires time.Time) {
+	http.SetCookie(w, &http.Cookie{Name: CookieName, Value: value, Path: "/", HttpOnly: true, Secure: h.SecureCookie, SameSite: http.SameSiteStrictMode, Expires: expires, MaxAge: int(time.Until(expires).Seconds())})
+}
+func principal(ctx context.Context) User { user, _ := ctx.Value(principalKey{}).(User); return user }
+func Principal(ctx context.Context) User { return principal(ctx) }
+func decodeJSON(w http.ResponseWriter, r *http.Request, value any) error {
+	r.Body = http.MaxBytesReader(w, r.Body, 1<<20)
+	decoder := json.NewDecoder(r.Body)
+	decoder.DisallowUnknownFields()
+	return decoder.Decode(value)
+}
+func writeJSON(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}

Bell/server/app/auth/password.go

@@ -0,0 +1,41 @@
+package auth
+
+import (
+	"errors"
+	"fmt"
+	"unicode"
+	"unicode/utf8"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+func validatePassword(value string) error {
+	if utf8.RuneCountInString(value) < 12 {
+		return errors.New("密码至少需要 12 个字符")
+	}
+	var lower, upper, digit bool
+	for _, r := range value {
+		lower = lower || unicode.IsLower(r)
+		upper = upper || unicode.IsUpper(r)
+		digit = digit || unicode.IsDigit(r)
+	}
+	if !lower || !upper || !digit {
+		return errors.New("密码必须同时包含大写字母、小写字母和数字")
+	}
+	return nil
+}
+
+func hashPassword(value string) (string, error) {
+	if err := validatePassword(value); err != nil {
+		return "", err
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(value), bcrypt.DefaultCost)
+	if err != nil {
+		return "", fmt.Errorf("hash password: %w", err)
+	}
+	return string(hash), nil
+}
+
+func passwordMatches(hash, value string) bool {
+	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(value)) == nil
+}

Bell/server/app/auth/password_test.go

@@ -0,0 +1,27 @@
+package auth
+
+import "testing"
+
+func TestPasswordPolicy(t *testing.T) {
+	for _, value := range []string{"short", "alllowercase123", "ALLUPPERCASE123"} {
+		if validatePassword(value) == nil {
+			t.Fatalf("expected %q to fail policy", value)
+		}
+	}
+	if err := validatePassword("Bell-Safe-2026"); err != nil {
+		t.Fatalf("valid password rejected: %v", err)
+	}
+}
+
+func TestPasswordHashRoundTrip(t *testing.T) {
+	hash, err := hashPassword("Bell-Safe-2026")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !passwordMatches(hash, "Bell-Safe-2026") {
+		t.Fatal("password did not match")
+	}
+	if passwordMatches(hash, "Wrong-Safe-2026") {
+		t.Fatal("wrong password matched")
+	}
+}

Bell/server/app/auth/service.go

@@ -0,0 +1,94 @@
+package auth
+
+import (
+	"context"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"errors"
+	"strings"
+	"time"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/app/audit"
+	"github.com/jackc/pgx/v5"
+)
+
+var ErrInvalidCredentials = errors.New("用户名或密码错误")
+var ErrUnauthorized = errors.New("会话无效或已过期")
+
+type Service struct {
+	Store      Store
+	Audit      audit.Store
+	Secret     []byte
+	SessionTTL time.Duration
+}
+
+func (s Service) digest(token string) []byte {
+	mac := hmac.New(sha256.New, s.Secret)
+	_, _ = mac.Write([]byte(token))
+	return mac.Sum(nil)
+}
+
+func (s Service) Login(ctx context.Context, input LoginInput) (LoginResult, error) {
+	username := strings.ToLower(strings.TrimSpace(input.Username))
+	user, err := s.Store.UserByUsername(ctx, username)
+	if err != nil || !user.Enabled || !passwordMatches(user.PasswordHash, input.Password) {
+		_ = s.Audit.Record(ctx, nil, "auth.login", "user", nil, "failure", map[string]any{"reason": "invalid_credentials"})
+		return LoginResult{}, ErrInvalidCredentials
+	}
+	bytes := make([]byte, 32)
+	if _, err := rand.Read(bytes); err != nil {
+		return LoginResult{}, err
+	}
+	token := base64.RawURLEncoding.EncodeToString(bytes)
+	expires := time.Now().UTC().Add(s.SessionTTL)
+	if s.SessionTTL == 0 {
+		expires = time.Now().UTC().Add(8 * time.Hour)
+	}
+	if err := s.Store.CreateSession(ctx, user.ID, s.digest(token), expires); err != nil {
+		return LoginResult{}, err
+	}
+	_ = s.Audit.Record(ctx, &user.ID, "auth.login", "user", &user.ID, "success", map[string]any{})
+	return LoginResult{Token: token, User: user, ExpiresAt: expires.Format(time.RFC3339)}, nil
+}
+
+func (s Service) Authenticate(ctx context.Context, token string) (User, error) {
+	if token == "" {
+		return User{}, ErrUnauthorized
+	}
+	user, err := s.Store.UserBySessionDigest(ctx, s.digest(token))
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return User{}, ErrUnauthorized
+		}
+		return User{}, err
+	}
+	if !user.Enabled {
+		return User{}, ErrUnauthorized
+	}
+	return user, nil
+}
+func (s Service) Logout(ctx context.Context, token string, user User) error {
+	if token != "" {
+		if err := s.Store.RevokeSession(ctx, s.digest(token)); err != nil {
+			return err
+		}
+	}
+	return s.Audit.Record(ctx, &user.ID, "auth.logout", "user", &user.ID, "success", map[string]any{})
+}
+func (s Service) BootstrapAdministrator(ctx context.Context, username, displayName, password string) error {
+	username = strings.ToLower(strings.TrimSpace(username))
+	if username == "" {
+		return errors.New("username is required")
+	}
+	hash, err := hashPassword(password)
+	if err != nil {
+		return err
+	}
+	id, err := s.Store.BootstrapAdministrator(ctx, username, displayName, hash)
+	if err != nil {
+		return err
+	}
+	return s.Audit.Record(ctx, &id, "rbac.bootstrap_administrator", "user", &id, "success", map[string]any{})
+}

Bell/server/app/auth/store.go

@@ -0,0 +1,164 @@
+package auth
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/app/rbac"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+type Store struct{ DB *pgxpool.Pool }
+
+func (s Store) UserByUsername(ctx context.Context, username string) (User, error) {
+	var user User
+	err := s.DB.QueryRow(ctx, `SELECT id::text,username,display_name,password_hash,enabled FROM bell_users WHERE username=$1`, username).Scan(&user.ID, &user.Username, &user.DisplayName, &user.PasswordHash, &user.Enabled)
+	if err != nil {
+		return User{}, err
+	}
+	if err = s.loadAccess(ctx, &user); err != nil {
+		return User{}, err
+	}
+	return user, nil
+}
+
+func (s Store) UserBySessionDigest(ctx context.Context, digest []byte) (User, error) {
+	var user User
+	err := s.DB.QueryRow(ctx, `SELECT u.id::text,u.username,u.display_name,u.password_hash,u.enabled FROM bell_sessions s JOIN bell_users u ON u.id=s.user_id WHERE s.token_digest=$1 AND s.revoked_at IS NULL AND s.expires_at>now()`, digest).Scan(&user.ID, &user.Username, &user.DisplayName, &user.PasswordHash, &user.Enabled)
+	if err != nil {
+		return User{}, err
+	}
+	if err = s.loadAccess(ctx, &user); err != nil {
+		return User{}, err
+	}
+	return user, nil
+}
+
+func (s Store) loadAccess(ctx context.Context, user *User) error {
+	rows, err := s.DB.Query(ctx, `SELECT DISTINCT r.code,p.permission_code FROM bell_user_roles ur JOIN bell_roles r ON r.id=ur.role_id LEFT JOIN bell_role_permissions p ON p.role_id=r.id WHERE ur.user_id=$1 ORDER BY r.code,p.permission_code`, user.ID)
+	if err != nil {
+		return err
+	}
+	defer rows.Close()
+	user.Permissions = rbac.Set{}
+	roleSeen := map[string]bool{}
+	for rows.Next() {
+		var role string
+		var permission *string
+		if err := rows.Scan(&role, &permission); err != nil {
+			return err
+		}
+		if !roleSeen[role] {
+			user.Roles = append(user.Roles, role)
+			roleSeen[role] = true
+		}
+		if permission != nil {
+			user.Permissions[*permission] = struct{}{}
+		}
+	}
+	return rows.Err()
+}
+
+func (s Store) CreateSession(ctx context.Context, userID string, digest []byte, expires time.Time) error {
+	_, err := s.DB.Exec(ctx, `INSERT INTO bell_sessions(user_id,token_digest,expires_at) VALUES($1,$2,$3)`, userID, digest, expires)
+	return err
+}
+
+func (s Store) RevokeSession(ctx context.Context, digest []byte) error {
+	_, err := s.DB.Exec(ctx, `UPDATE bell_sessions SET revoked_at=COALESCE(revoked_at,now()) WHERE token_digest=$1`, digest)
+	return err
+}
+
+func (s Store) BootstrapAdministrator(ctx context.Context, username, displayName, passwordHash string) (string, error) {
+	tx, err := s.DB.Begin(ctx)
+	if err != nil {
+		return "", err
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	var id string
+	err = tx.QueryRow(ctx, `INSERT INTO bell_users(username,display_name,password_hash) VALUES($1,$2,$3) ON CONFLICT(username) DO NOTHING RETURNING id::text`, username, displayName, passwordHash).Scan(&id)
+	if err != nil {
+		if err == pgx.ErrNoRows {
+			return "", fmt.Errorf("administrator %q already exists", username)
+		}
+		return "", err
+	}
+	if _, err = tx.Exec(ctx, `INSERT INTO bell_user_roles(user_id,role_id) SELECT $1,id FROM bell_roles WHERE code='administrator'`, id); err != nil {
+		return "", err
+	}
+	if err = tx.Commit(ctx); err != nil {
+		return "", err
+	}
+	return id, nil
+}
+
+func (s Store) ListUsers(ctx context.Context) ([]User, error) {
+	rows, err := s.DB.Query(ctx, `SELECT id::text,username,display_name,enabled FROM bell_users ORDER BY username LIMIT 200`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	users := []User{}
+	for rows.Next() {
+		var u User
+		if err := rows.Scan(&u.ID, &u.Username, &u.DisplayName, &u.Enabled); err != nil {
+			return nil, err
+		}
+		users = append(users, u)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	for i := range users {
+		if err := s.loadAccess(ctx, &users[i]); err != nil {
+			return nil, err
+		}
+	}
+	return users, nil
+}
+
+func (s Store) CreateUser(ctx context.Context, username, displayName, passwordHash, role string) (string, error) {
+	tx, err := s.DB.Begin(ctx)
+	if err != nil {
+		return "", err
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	var id string
+	if err = tx.QueryRow(ctx, `INSERT INTO bell_users(username,display_name,password_hash) VALUES($1,$2,$3) RETURNING id::text`, username, displayName, passwordHash).Scan(&id); err != nil {
+		return "", err
+	}
+	result, err := tx.Exec(ctx, `INSERT INTO bell_user_roles(user_id,role_id) SELECT $1,id FROM bell_roles WHERE code=$2`, id, role)
+	if err != nil {
+		return "", err
+	}
+	if result.RowsAffected() != 1 {
+		return "", fmt.Errorf("unknown role %q", role)
+	}
+	if err = tx.Commit(ctx); err != nil {
+		return "", err
+	}
+	return id, nil
+}
+
+func (s Store) ReplaceRoles(ctx context.Context, userID string, roles []string) error {
+	tx, err := s.DB.Begin(ctx)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	if _, err = tx.Exec(ctx, `DELETE FROM bell_user_roles WHERE user_id=$1`, userID); err != nil {
+		return err
+	}
+	for _, role := range roles {
+		result, err := tx.Exec(ctx, `INSERT INTO bell_user_roles(user_id,role_id) SELECT $1,id FROM bell_roles WHERE code=$2`, userID, role)
+		if err != nil {
+			return err
+		}
+		if result.RowsAffected() != 1 {
+			return fmt.Errorf("unknown role %q", role)
+		}
+	}
+	return tx.Commit(ctx)
+}

Bell/server/app/auth/types.go

@@ -0,0 +1,25 @@
+package auth
+
+import "git.ilapage.cn/ila/yovision/Bell/server/app/rbac"
+
+type User struct {
+	ID           string   `json:"id"`
+	Username     string   `json:"username"`
+	DisplayName  string   `json:"display_name"`
+	Enabled      bool     `json:"enabled"`
+	Roles        []string `json:"roles"`
+	Permissions  rbac.Set `json:"permissions"`
+	PasswordHash string   `json:"-"`
+}
+
+type LoginInput struct {
+	Username string `json:"username"`
+	Password string `json:"password"`
+}
+type LoginResult struct {
+	Token     string
+	User      User
+	ExpiresAt string
+}
+
+type principalKey struct{}

Bell/server/app/event/http.go

@@ -0,0 +1,52 @@
+package event
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"strconv"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/app/auth"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/rbac"
+	"github.com/jackc/pgx/v5"
+)
+
+type HTTP struct {
+	Service Service
+	Auth    auth.HTTP
+}
+
+func (h HTTP) Register(mux *http.ServeMux) {
+	mux.Handle("GET /api/v1/events", h.Auth.Require(rbac.EventsRead, http.HandlerFunc(h.list)))
+	mux.Handle("GET /api/v1/events/{id}", h.Auth.Require(rbac.EventsRead, http.HandlerFunc(h.get)))
+}
+func (h HTTP) list(w http.ResponseWriter, r *http.Request) {
+	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
+	items, err := h.Service.List(r.Context(), limit, r.URL.Query().Get("before"))
+	if err != nil {
+		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "读取事件失败"})
+		return
+	}
+	next := ""
+	if len(items) > 0 {
+		next = items[len(items)-1].ID
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"items": items, "next": next})
+}
+func (h HTTP) get(w http.ResponseWriter, r *http.Request) {
+	item, err := h.Service.Get(r.Context(), r.PathValue("id"))
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			writeJSON(w, http.StatusNotFound, map[string]string{"error": "事件不存在"})
+			return
+		}
+		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "读取事件失败"})
+		return
+	}
+	writeJSON(w, http.StatusOK, item)
+}
+func writeJSON(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}

Bell/server/app/event/service.go

@@ -0,0 +1,143 @@
+package event
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+var ErrConflict = errors.New("幂等键已用于不同事件载荷")
+var ErrInvalid = errors.New("事件字段无效")
+
+type PersistHook func(context.Context, pgx.Tx, Event) error
+type Service struct {
+	DB           *pgxpool.Pool
+	AfterPersist PersistHook
+}
+
+func normalize(command Command) ([]byte, [32]byte, error) {
+	command.ProducerID = strings.TrimSpace(command.ProducerID)
+	command.SourceEventID = strings.TrimSpace(command.SourceEventID)
+	command.EventType = strings.TrimSpace(command.EventType)
+	command.Location = strings.TrimSpace(command.Location)
+	command.Severity = strings.ToLower(strings.TrimSpace(command.Severity))
+	command.OccurredAt = command.OccurredAt.UTC()
+	if command.ProducerID == "" || command.SourceEventID == "" || command.EventType == "" || command.Location == "" || command.OccurredAt.IsZero() {
+		return nil, [32]byte{}, ErrInvalid
+	}
+	if command.Severity != "low" && command.Severity != "medium" && command.Severity != "high" && command.Severity != "critical" {
+		return nil, [32]byte{}, ErrInvalid
+	}
+	if command.EvidenceRef != nil {
+		value := strings.TrimSpace(*command.EvidenceRef)
+		if value == "" || strings.Contains(value, "@") || strings.Contains(value, "\\") || strings.HasPrefix(strings.ToLower(value), "file:") {
+			return nil, [32]byte{}, fmt.Errorf("%w: evidence_ref must be a safe logical reference", ErrInvalid)
+		}
+		command.EvidenceRef = &value
+	}
+	if command.Attributes == nil {
+		command.Attributes = map[string]any{}
+	}
+	data, err := json.Marshal(command)
+	if err != nil {
+		return nil, [32]byte{}, fmt.Errorf("normalize event: %w", err)
+	}
+	return data, sha256.Sum256(data), nil
+}
+
+func (s Service) Ingest(ctx context.Context, command Command) (Result, error) {
+	payload, digest, err := normalize(command)
+	if err != nil {
+		return Result{}, err
+	}
+	var normalized Command
+	if err := json.Unmarshal(payload, &normalized); err != nil {
+		return Result{}, err
+	}
+	tx, err := s.DB.Begin(ctx)
+	if err != nil {
+		return Result{}, err
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	var eventID string
+	err = tx.QueryRow(ctx, `INSERT INTO bell_events(producer_id,source_event_id,event_type,occurred_at,location,severity,evidence_ref,normalized_payload,payload_sha256) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9) ON CONFLICT(producer_id,source_event_id) DO NOTHING RETURNING id::text`, normalized.ProducerID, normalized.SourceEventID, normalized.EventType, normalized.OccurredAt, normalized.Location, normalized.Severity, normalized.EvidenceRef, payload, digest[:]).Scan(&eventID)
+	created := err == nil
+	if err != nil && !errors.Is(err, pgx.ErrNoRows) {
+		return Result{}, err
+	}
+	if created {
+		if _, err = tx.Exec(ctx, `INSERT INTO bell_event_receipts(event_id,producer_id,source_event_id,payload_sha256) VALUES($1,$2,$3,$4)`, eventID, normalized.ProducerID, normalized.SourceEventID, digest[:]); err != nil {
+			return Result{}, err
+		}
+	}
+	result, storedDigest, err := loadResult(ctx, tx, normalized.ProducerID, normalized.SourceEventID)
+	if err != nil {
+		return Result{}, err
+	}
+	if !created && !equalDigest(storedDigest, digest[:]) {
+		return Result{}, ErrConflict
+	}
+	result.Duplicate = !created
+	if created && s.AfterPersist != nil {
+		if err := s.AfterPersist(ctx, tx, result.Event); err != nil {
+			return Result{}, fmt.Errorf("process accepted Event: %w", err)
+		}
+	}
+	if err = tx.Commit(ctx); err != nil {
+		return Result{}, err
+	}
+	return result, nil
+}
+
+func loadResult(ctx context.Context, q interface {
+	QueryRow(context.Context, string, ...any) pgx.Row
+}, producerID, sourceEventID string) (Result, []byte, error) {
+	var result Result
+	var digest []byte
+	err := q.QueryRow(ctx, `SELECT e.id::text,e.producer_id,e.source_event_id,e.event_type,e.occurred_at::text,e.location,e.severity,e.evidence_ref,e.normalized_payload,e.created_at::text,e.payload_sha256,r.id::text,r.accepted_at::text FROM bell_events e JOIN bell_event_receipts r ON r.event_id=e.id WHERE e.producer_id=$1 AND e.source_event_id=$2`, producerID, sourceEventID).Scan(&result.Event.ID, &result.Event.ProducerID, &result.Event.SourceEventID, &result.Event.EventType, &result.Event.OccurredAt, &result.Event.Location, &result.Event.Severity, &result.Event.EvidenceRef, &result.Event.NormalizedPayload, &result.Event.CreatedAt, &digest, &result.Receipt.ID, &result.Receipt.AcceptedAt)
+	result.Receipt.EventID = result.Event.ID
+	result.Receipt.ProducerID = producerID
+	result.Receipt.SourceEventID = sourceEventID
+	return result, digest, err
+}
+func equalDigest(a, b []byte) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	var different byte
+	for i := range a {
+		different |= a[i] ^ b[i]
+	}
+	return different == 0
+}
+
+func (s Service) List(ctx context.Context, limit int, before string) ([]Event, error) {
+	if limit < 1 || limit > 100 {
+		limit = 25
+	}
+	rows, err := s.DB.Query(ctx, `SELECT id::text,producer_id,source_event_id,event_type,occurred_at::text,location,severity,evidence_ref,normalized_payload,created_at::text FROM bell_events WHERE ($2='' OR (created_at,id)<((SELECT created_at FROM bell_events WHERE id=nullif($2,'')::uuid),nullif($2,'')::uuid)) ORDER BY created_at DESC,id DESC LIMIT $1`, limit, before)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []Event{}
+	for rows.Next() {
+		var item Event
+		if err := rows.Scan(&item.ID, &item.ProducerID, &item.SourceEventID, &item.EventType, &item.OccurredAt, &item.Location, &item.Severity, &item.EvidenceRef, &item.NormalizedPayload, &item.CreatedAt); err != nil {
+			return nil, err
+		}
+		items = append(items, item)
+	}
+	return items, rows.Err()
+}
+func (s Service) Get(ctx context.Context, id string) (Event, error) {
+	var item Event
+	err := s.DB.QueryRow(ctx, `SELECT id::text,producer_id,source_event_id,event_type,occurred_at::text,location,severity,evidence_ref,normalized_payload,created_at::text FROM bell_events WHERE id=$1`, id).Scan(&item.ID, &item.ProducerID, &item.SourceEventID, &item.EventType, &item.OccurredAt, &item.Location, &item.Severity, &item.EvidenceRef, &item.NormalizedPayload, &item.CreatedAt)
+	return item, err
+}

Bell/server/app/event/service_test.go

@@ -0,0 +1,113 @@
+package event
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"sync"
+	"testing"
+	"time"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/internal/platform"
+	"git.ilapage.cn/ila/yovision/Bell/server/migrations"
+	"github.com/jackc/pgx/v5"
+)
+
+func TestNormalizeRejectsUnsafeEvidence(t *testing.T) {
+	value := `file:C:\camera\secret.mp4`
+	_, _, err := normalize(Command{ProducerID: "test", SourceEventID: "1", EventType: "intrusion", OccurredAt: time.Now(), Location: "gate", Severity: "high", EvidenceRef: &value})
+	if !errors.Is(err, ErrInvalid) {
+		t.Fatalf("expected invalid evidence reference, got %v", err)
+	}
+}
+
+func TestPostgresIdempotencyAndImmutability(t *testing.T) {
+	url := os.Getenv("BELL_TEST_DATABASE_URL")
+	if url == "" {
+		t.Skip("BELL_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	db, err := platform.OpenDatabase(ctx, url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	if err := migrations.Apply(ctx, db); err != nil {
+		t.Fatal(err)
+	}
+	service := Service{DB: db}
+	key := fmt.Sprintf("event-test-%d", time.Now().UnixNano())
+	command := Command{ProducerID: "integration-test", SourceEventID: key, EventType: "danger-zone", OccurredAt: time.Now().UTC().Truncate(time.Millisecond), Location: "test-zone", Severity: "high", Attributes: map[string]any{"track_id": "anonymous-1"}}
+	const count = 16
+	results := make(chan Result, count)
+	errorsFound := make(chan error, count)
+	var wg sync.WaitGroup
+	for range count {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			result, err := service.Ingest(ctx, command)
+			if err != nil {
+				errorsFound <- err
+				return
+			}
+			results <- result
+		}()
+	}
+	wg.Wait()
+	close(results)
+	close(errorsFound)
+	for err := range errorsFound {
+		t.Errorf("concurrent ingest: %v", err)
+	}
+	var eventID, receiptID string
+	seen := 0
+	for result := range results {
+		seen++
+		if eventID == "" {
+			eventID = result.Event.ID
+			receiptID = result.Receipt.ID
+		}
+		if result.Event.ID != eventID || result.Receipt.ID != receiptID {
+			t.Errorf("unstable identities: %#v", result)
+		}
+	}
+	if seen != count {
+		t.Fatalf("received %d results, want %d", seen, count)
+	}
+	conflict := command
+	conflict.Location = "different"
+	if _, err := service.Ingest(ctx, conflict); !errors.Is(err, ErrConflict) {
+		t.Fatalf("expected conflict, got %v", err)
+	}
+	if _, err := db.Exec(ctx, `UPDATE bell_events SET location='tampered' WHERE id=$1`, eventID); err == nil {
+		t.Fatal("immutable Event accepted update")
+	}
+	db.Close()
+	reopened, err := platform.OpenDatabase(ctx, url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer reopened.Close()
+	afterRestart, err := (Service{DB: reopened}).Ingest(ctx, command)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if afterRestart.Event.ID != eventID || afterRestart.Receipt.ID != receiptID || !afterRestart.Duplicate {
+		t.Fatalf("receipt changed after restart: %#v", afterRestart)
+	}
+	failing := command
+	failing.SourceEventID = key + "-rollback"
+	failedService := Service{DB: reopened, AfterPersist: func(context.Context, pgx.Tx, Event) error { return errors.New("forced matching failure") }}
+	if _, err := failedService.Ingest(ctx, failing); err == nil {
+		t.Fatal("expected hook failure")
+	}
+	var persisted int
+	if err := reopened.QueryRow(ctx, `SELECT count(*) FROM bell_events WHERE producer_id=$1 AND source_event_id=$2`, failing.ProducerID, failing.SourceEventID).Scan(&persisted); err != nil {
+		t.Fatal(err)
+	}
+	if persisted != 0 {
+		t.Fatal("Event committed without atomic match")
+	}
+}

Bell/server/app/event/types.go

@@ -0,0 +1,38 @@
+package event
+
+import (
+	"encoding/json"
+	"time"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/app/receipt"
+)
+
+type Command struct {
+	ProducerID    string         `json:"producer_id"`
+	SourceEventID string         `json:"source_event_id"`
+	EventType     string         `json:"event_type"`
+	OccurredAt    time.Time      `json:"occurred_at"`
+	Location      string         `json:"location"`
+	Severity      string         `json:"severity"`
+	EvidenceRef   *string        `json:"evidence_ref,omitempty"`
+	Attributes    map[string]any `json:"attributes"`
+}
+
+type Event struct {
+	ID                string          `json:"id"`
+	ProducerID        string          `json:"producer_id"`
+	SourceEventID     string          `json:"source_event_id"`
+	EventType         string          `json:"event_type"`
+	OccurredAt        string          `json:"occurred_at"`
+	Location          string          `json:"location"`
+	Severity          string          `json:"severity"`
+	EvidenceRef       *string         `json:"evidence_ref,omitempty"`
+	NormalizedPayload json.RawMessage `json:"normalized_payload"`
+	CreatedAt         string          `json:"created_at"`
+}
+
+type Result struct {
+	Event     Event           `json:"event"`
+	Receipt   receipt.Receipt `json:"receipt"`
+	Duplicate bool            `json:"duplicate"`
+}

Bell/server/app/rbac/permissions.go

@@ -0,0 +1,32 @@
+package rbac
+
+import (
+	"encoding/json"
+	"sort"
+)
+
+const (
+	DashboardRead  = "dashboard:read"
+	AlertsRead     = "alerts:read"
+	AlertsHandle   = "alerts:handle"
+	EventsRead     = "events:read"
+	RulesRead      = "rules:read"
+	RulesWrite     = "rules:write"
+	UsersRead      = "users:read"
+	UsersWrite     = "users:write"
+	AuditRead      = "audit:read"
+	SyntheticWrite = "synthetic:write"
+)
+
+type Set map[string]struct{}
+
+func (s Set) Has(permission string) bool { _, ok := s[permission]; return ok }
+
+func (s Set) MarshalJSON() ([]byte, error) {
+	values := make([]string, 0, len(s))
+	for value := range s {
+		values = append(values, value)
+	}
+	sort.Strings(values)
+	return json.Marshal(values)
+}

Bell/server/app/receipt/types.go

@@ -0,0 +1,9 @@
+package receipt
+
+type Receipt struct {
+	ID            string `json:"id"`
+	EventID       string `json:"event_id"`
+	ProducerID    string `json:"producer_id"`
+	SourceEventID string `json:"source_event_id"`
+	AcceptedAt    string `json:"accepted_at"`
+}

Bell/server/app/rule/http.go

@@ -0,0 +1,72 @@
+package rule
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/app/audit"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/auth"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/rbac"
+)
+
+type HTTP struct {
+	Service Service
+	Auth    auth.HTTP
+	Audit   audit.Store
+}
+
+func (h HTTP) Register(mux *http.ServeMux) {
+	mux.Handle("GET /api/v1/rules", h.Auth.Require(rbac.RulesRead, http.HandlerFunc(h.list)))
+	mux.Handle("POST /api/v1/rules", h.Auth.Require(rbac.RulesWrite, http.HandlerFunc(h.create)))
+	mux.Handle("PUT /api/v1/rules/{id}/enabled", h.Auth.Require(rbac.RulesWrite, http.HandlerFunc(h.setEnabled)))
+}
+func (h HTTP) list(w http.ResponseWriter, r *http.Request) {
+	items, err := h.Service.List(r.Context())
+	if err != nil {
+		writeJSON(w, 500, map[string]string{"error": "读取规则失败"})
+		return
+	}
+	writeJSON(w, 200, map[string]any{"items": items})
+}
+func (h HTTP) create(w http.ResponseWriter, r *http.Request) {
+	var input CreateInput
+	if err := decode(w, r, &input); err != nil {
+		writeJSON(w, 400, map[string]string{"error": "请求格式无效"})
+		return
+	}
+	item, err := h.Service.Create(r.Context(), input)
+	if err != nil {
+		writeJSON(w, 400, map[string]string{"error": err.Error()})
+		return
+	}
+	actor := auth.Principal(r.Context())
+	_ = h.Audit.Record(r.Context(), &actor.ID, "rule.created", "rule", &item.ID, "success", map[string]any{"version": item.Version})
+	writeJSON(w, 201, item)
+}
+func (h HTTP) setEnabled(w http.ResponseWriter, r *http.Request) {
+	var input struct {
+		Enabled bool `json:"enabled"`
+	}
+	if err := decode(w, r, &input); err != nil {
+		writeJSON(w, 400, map[string]string{"error": "请求格式无效"})
+		return
+	}
+	item, err := h.Service.SetEnabled(r.Context(), r.PathValue("id"), input.Enabled)
+	if err != nil {
+		writeJSON(w, 404, map[string]string{"error": "规则不存在"})
+		return
+	}
+	actor := auth.Principal(r.Context())
+	_ = h.Audit.Record(r.Context(), &actor.ID, "rule.enabled_changed", "rule", &item.ID, "success", map[string]any{"enabled": item.Enabled, "version": item.Version})
+	writeJSON(w, 200, item)
+}
+func decode(w http.ResponseWriter, r *http.Request, value any) error {
+	decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20))
+	decoder.DisallowUnknownFields()
+	return decoder.Decode(value)
+}
+func writeJSON(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}

Bell/server/app/rule/service.go

@@ -0,0 +1,132 @@
+package rule
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/app/event"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+var ErrInvalid = errors.New("规则字段无效")
+
+type Service struct{ DB *pgxpool.Pool }
+
+func validSeverity(value string) bool {
+	return value == "low" || value == "medium" || value == "high" || value == "critical"
+}
+func severityRank(value string) int {
+	return map[string]int{"low": 1, "medium": 2, "high": 3, "critical": 4}[value]
+}
+func (s Service) Create(ctx context.Context, input CreateInput) (Rule, error) {
+	input.Code = strings.ToLower(strings.TrimSpace(input.Code))
+	input.Name = strings.TrimSpace(input.Name)
+	input.MinimumSeverity = strings.ToLower(strings.TrimSpace(input.MinimumSeverity))
+	if input.Code == "" || input.Name == "" || !validSeverity(input.MinimumSeverity) {
+		return Rule{}, ErrInvalid
+	}
+	if input.EventType != nil {
+		v := strings.TrimSpace(*input.EventType)
+		if v == "" {
+			input.EventType = nil
+		} else {
+			input.EventType = &v
+		}
+	}
+	if input.LocationContains != nil {
+		v := strings.TrimSpace(*input.LocationContains)
+		if v == "" {
+			input.LocationContains = nil
+		} else {
+			input.LocationContains = &v
+		}
+	}
+	var result Rule
+	err := s.DB.QueryRow(ctx, `INSERT INTO bell_rules(code,name,event_type,minimum_severity,location_contains) VALUES($1,$2,$3,$4,$5) RETURNING id::text,code,name,enabled,event_type,minimum_severity,location_contains,version,created_at::text,updated_at::text`, input.Code, input.Name, input.EventType, input.MinimumSeverity, input.LocationContains).Scan(&result.ID, &result.Code, &result.Name, &result.Enabled, &result.EventType, &result.MinimumSeverity, &result.LocationContains, &result.Version, &result.CreatedAt, &result.UpdatedAt)
+	return result, err
+}
+func (s Service) SetEnabled(ctx context.Context, id string, enabled bool) (Rule, error) {
+	var result Rule
+	err := s.DB.QueryRow(ctx, `UPDATE bell_rules SET enabled=$2,version=version+1,updated_at=now() WHERE id=$1 RETURNING id::text,code,name,enabled,event_type,minimum_severity,location_contains,version,created_at::text,updated_at::text`, id, enabled).Scan(&result.ID, &result.Code, &result.Name, &result.Enabled, &result.EventType, &result.MinimumSeverity, &result.LocationContains, &result.Version, &result.CreatedAt, &result.UpdatedAt)
+	return result, err
+}
+func (s Service) List(ctx context.Context) ([]Rule, error) {
+	rows, err := s.DB.Query(ctx, `SELECT id::text,code,name,enabled,event_type,minimum_severity,location_contains,version,created_at::text,updated_at::text FROM bell_rules ORDER BY created_at,id LIMIT 200`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []Rule{}
+	for rows.Next() {
+		var item Rule
+		if err := rows.Scan(&item.ID, &item.Code, &item.Name, &item.Enabled, &item.EventType, &item.MinimumSeverity, &item.LocationContains, &item.Version, &item.CreatedAt, &item.UpdatedAt); err != nil {
+			return nil, err
+		}
+		items = append(items, item)
+	}
+	return items, rows.Err()
+}
+
+func (s Service) Match(ctx context.Context, tx pgx.Tx, evt event.Event) error {
+	rows, err := tx.Query(ctx, `SELECT id::text,code,name,enabled,event_type,minimum_severity,location_contains,version,created_at::text,updated_at::text FROM bell_rules WHERE enabled=true ORDER BY id`)
+	if err != nil {
+		return err
+	}
+	rules := []Rule{}
+	for rows.Next() {
+		var item Rule
+		if err := rows.Scan(&item.ID, &item.Code, &item.Name, &item.Enabled, &item.EventType, &item.MinimumSeverity, &item.LocationContains, &item.Version, &item.CreatedAt, &item.UpdatedAt); err != nil {
+			rows.Close()
+			return err
+		}
+		rules = append(rules, item)
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		return err
+	}
+	for _, current := range rules {
+		matched := true
+		reasons := []string{}
+		if current.EventType != nil && *current.EventType != evt.EventType {
+			matched = false
+			reasons = append(reasons, "事件类型不匹配")
+		}
+		if severityRank(evt.Severity) < severityRank(current.MinimumSeverity) {
+			matched = false
+			reasons = append(reasons, "风险等级低于阈值")
+		}
+		if current.LocationContains != nil && !strings.Contains(strings.ToLower(evt.Location), strings.ToLower(*current.LocationContains)) {
+			matched = false
+			reasons = append(reasons, "地点条件不匹配")
+		}
+		explanation := "全部条件命中"
+		if !matched {
+			explanation = strings.Join(reasons, "；")
+		}
+		if _, err := tx.Exec(ctx, `INSERT INTO bell_rule_evaluations(event_id,rule_id,rule_version,matched,explanation) VALUES($1,$2,$3,$4,$5) ON CONFLICT DO NOTHING`, evt.ID, current.ID, current.Version, matched, explanation); err != nil {
+			return err
+		}
+		if !matched {
+			continue
+		}
+		snapshot, _ := json.Marshal(current)
+		summary := fmt.Sprintf("%s：%s", current.Name, evt.EventType)
+		var alertID string
+		err := tx.QueryRow(ctx, `INSERT INTO bell_alerts(primary_rule_id,correlation_key,severity,summary,location) VALUES($1,$2,$3,$4,$5) ON CONFLICT(primary_rule_id,correlation_key) WHERE status='open' DO UPDATE SET updated_at=now(),severity=CASE WHEN array_position(ARRAY['low','medium','high','critical'],EXCLUDED.severity)>array_position(ARRAY['low','medium','high','critical'],bell_alerts.severity) THEN EXCLUDED.severity ELSE bell_alerts.severity END RETURNING id::text`, current.ID, strings.ToLower(evt.Location), evt.Severity, summary, evt.Location).Scan(&alertID)
+		if err != nil {
+			return err
+		}
+		if _, err := tx.Exec(ctx, `INSERT INTO bell_alert_events(alert_id,event_id) VALUES($1,$2) ON CONFLICT DO NOTHING`, alertID, evt.ID); err != nil {
+			return err
+		}
+		if _, err := tx.Exec(ctx, `INSERT INTO bell_rule_matches(alert_id,event_id,rule_id,rule_version,rule_snapshot,explanation) VALUES($1,$2,$3,$4,$5,$6) ON CONFLICT DO NOTHING`, alertID, evt.ID, current.ID, current.Version, snapshot, explanation); err != nil {
+			return err
+		}
+	}
+	return nil
+}

Bell/server/app/rule/service_test.go

@@ -0,0 +1,87 @@
+package rule
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/app/event"
+	"git.ilapage.cn/ila/yovision/Bell/server/internal/platform"
+	"git.ilapage.cn/ila/yovision/Bell/server/migrations"
+)
+
+func TestPostgresMatchingAndNavigationShape(t *testing.T) {
+	url := os.Getenv("BELL_TEST_DATABASE_URL")
+	if url == "" {
+		t.Skip("BELL_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	db, err := platform.OpenDatabase(ctx, url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	if err := migrations.Apply(ctx, db); err != nil {
+		t.Fatal(err)
+	}
+	service := Service{DB: db}
+	prefix := fmt.Sprintf("rule-test-%d", time.Now().UnixNano())
+	eventType := "rule-test-danger"
+	location := "north"
+	first, err := service.Create(ctx, CreateInput{Code: prefix + "-one", Name: "规则一", EventType: &eventType, MinimumSeverity: "medium", LocationContains: &location})
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := service.Create(ctx, CreateInput{Code: prefix + "-two", Name: "规则二", EventType: &eventType, MinimumSeverity: "low"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	eventService := event.Service{DB: db, AfterPersist: service.Match}
+	base := event.Command{ProducerID: prefix, SourceEventID: "1", EventType: eventType, OccurredAt: time.Now().UTC(), Location: "north gate", Severity: "high", Attributes: map[string]any{}}
+	one, err := eventService.Ingest(ctx, base)
+	if err != nil {
+		t.Fatal(err)
+	}
+	base.SourceEventID = "2"
+	two, err := eventService.Ingest(ctx, base)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var alertCount, linkCount int
+	if err := db.QueryRow(ctx, `SELECT count(DISTINCT m.alert_id),count(*) FROM bell_rule_matches m WHERE m.rule_id=ANY($1::uuid[])`, []string{first.ID, second.ID}).Scan(&alertCount, &linkCount); err != nil {
+		t.Fatal(err)
+	}
+	if alertCount != 2 || linkCount != 4 {
+		t.Fatalf("alerts=%d links=%d", alertCount, linkCount)
+	}
+	var shared int
+	if err := db.QueryRow(ctx, `SELECT count(*) FROM bell_alert_events a JOIN bell_alert_events b ON b.alert_id=a.alert_id JOIN bell_alerts current ON current.id=a.alert_id WHERE a.event_id=$1 AND b.event_id=$2 AND current.primary_rule_id=ANY($3::uuid[])`, one.Event.ID, two.Event.ID, []string{first.ID, second.ID}).Scan(&shared); err != nil {
+		t.Fatal(err)
+	}
+	if shared != 2 {
+		t.Fatalf("expected two correlated alerts, got %d", shared)
+	}
+	base.SourceEventID = "3"
+	base.EventType = "unmatched"
+	unmatched, err := eventService.Ingest(ctx, base)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var evaluations, matches int
+	if err := db.QueryRow(ctx, `SELECT count(*),count(*) FILTER(WHERE matched) FROM bell_rule_evaluations WHERE event_id=$1`, unmatched.Event.ID).Scan(&evaluations, &matches); err != nil {
+		t.Fatal(err)
+	}
+	if evaluations < 2 || matches != 0 {
+		t.Fatalf("evaluations=%d matches=%d", evaluations, matches)
+	}
+	disabled, err := service.SetEnabled(ctx, first.ID, false)
+	if err != nil || disabled.Enabled || disabled.Version != 2 {
+		t.Fatalf("disable: %#v %v", disabled, err)
+	}
+	enabled, err := service.SetEnabled(ctx, first.ID, true)
+	if err != nil || !enabled.Enabled || enabled.Version != 3 {
+		t.Fatalf("enable: %#v %v", enabled, err)
+	}
+}

Bell/server/app/rule/types.go

@@ -0,0 +1,21 @@
+package rule
+
+type Rule struct {
+	ID               string  `json:"id"`
+	Code             string  `json:"code"`
+	Name             string  `json:"name"`
+	Enabled          bool    `json:"enabled"`
+	EventType        *string `json:"event_type,omitempty"`
+	MinimumSeverity  string  `json:"minimum_severity"`
+	LocationContains *string `json:"location_contains,omitempty"`
+	Version          int     `json:"version"`
+	CreatedAt        string  `json:"created_at"`
+	UpdatedAt        string  `json:"updated_at"`
+}
+type CreateInput struct {
+	Code             string  `json:"code"`
+	Name             string  `json:"name"`
+	EventType        *string `json:"event_type,omitempty"`
+	MinimumSeverity  string  `json:"minimum_severity"`
+	LocationContains *string `json:"location_contains,omitempty"`
+}

Bell/server/app/synthetic/http.go

@@ -0,0 +1,66 @@
+package synthetic
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/app/auth"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/event"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/rbac"
+)
+
+type HTTP struct {
+	Service Service
+	Auth    auth.HTTP
+}
+
+func (h HTTP) Register(mux *http.ServeMux) {
+	mux.Handle("GET /api/v1/synthetic/fixtures", h.Auth.Require(rbac.SyntheticWrite, http.HandlerFunc(h.fixtures)))
+	mux.Handle("POST /api/v1/synthetic/events", h.Auth.Require(rbac.SyntheticWrite, http.HandlerFunc(h.inject)))
+}
+func (h HTTP) fixtures(w http.ResponseWriter, r *http.Request) {
+	items, err := h.Service.Fixtures()
+	if err != nil {
+		writeJSON(w, 500, map[string]string{"error": "读取夹具失败"})
+		return
+	}
+	type summary struct {
+		Name            string `json:"name"`
+		Label           string `json:"label"`
+		ExpectedFailure bool   `json:"expected_failure"`
+	}
+	result := make([]summary, 0, len(items))
+	for _, item := range items {
+		result = append(result, summary{Name: item.Name, Label: item.Label, ExpectedFailure: item.ValidationError != ""})
+	}
+	writeJSON(w, 200, map[string]any{"items": result})
+}
+func (h HTTP) inject(w http.ResponseWriter, r *http.Request) {
+	var input Input
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&input); err != nil {
+		writeJSON(w, 400, map[string]string{"error": "请求格式无效"})
+		return
+	}
+	result, err := h.Service.Inject(r.Context(), input)
+	if err != nil {
+		status := 500
+		if errors.Is(err, ErrFixture) || errors.Is(err, event.ErrInvalid) {
+			status = 400
+		} else if errors.Is(err, event.ErrConflict) {
+			status = 409
+		}
+		writeJSON(w, status, map[string]string{"error": err.Error()})
+		return
+	}
+	status := 201
+	if result.Duplicate {
+		status = 200
+	}
+	writeJSON(w, status, result)
+}
+func writeJSON(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}

Bell/server/app/synthetic/service.go

@@ -0,0 +1,33 @@
+package synthetic
+
+import (
+	"context"
+	"errors"
+	"strings"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/app/event"
+	testevents "git.ilapage.cn/ila/yovision/Bell/server/testdata/events"
+)
+
+var ErrFixture = errors.New("合成夹具验证失败")
+
+type Service struct{ Events event.Service }
+type Input struct {
+	Fixture       string `json:"fixture"`
+	SourceEventID string `json:"source_event_id,omitempty"`
+}
+
+func (s Service) Fixtures() ([]testevents.Fixture, error) { return testevents.All() }
+func (s Service) Inject(ctx context.Context, input Input) (event.Result, error) {
+	fixture, err := testevents.Find(input.Fixture)
+	if err != nil {
+		return event.Result{}, err
+	}
+	if fixture.ValidationError != "" {
+		return event.Result{}, errors.Join(ErrFixture, errors.New(fixture.ValidationError))
+	}
+	if value := strings.TrimSpace(input.SourceEventID); value != "" {
+		fixture.Command.SourceEventID = value
+	}
+	return s.Events.Ingest(ctx, fixture.Command)
+}

Bell/server/app/synthetic/service_test.go

@@ -0,0 +1,51 @@
+package synthetic
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/app/event"
+	"git.ilapage.cn/ila/yovision/Bell/server/internal/platform"
+	"git.ilapage.cn/ila/yovision/Bell/server/migrations"
+)
+
+func TestInvalidFixturesAreStable(t *testing.T) {
+	service := Service{}
+	for _, name := range []string{"invalid-fields", "missing-evidence"} {
+		if _, err := service.Inject(context.Background(), Input{Fixture: name}); !errors.Is(err, ErrFixture) {
+			t.Fatalf("fixture %s: got %v", name, err)
+		}
+	}
+}
+func TestFixtureUsesEventService(t *testing.T) {
+	url := os.Getenv("BELL_TEST_DATABASE_URL")
+	if url == "" {
+		t.Skip("BELL_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	db, err := platform.OpenDatabase(ctx, url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	if err := migrations.Apply(ctx, db); err != nil {
+		t.Fatal(err)
+	}
+	service := Service{Events: event.Service{DB: db}}
+	source := fmt.Sprintf("synthetic-%d", time.Now().UnixNano())
+	first, err := service.Inject(ctx, Input{Fixture: "danger-zone", SourceEventID: source})
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := service.Inject(ctx, Input{Fixture: "danger-zone", SourceEventID: source})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first.Event.ID != second.Event.ID || !second.Duplicate {
+		t.Fatalf("fixture bypassed idempotency: %#v %#v", first, second)
+	}
+}

Bell/server/cmd/bell/root.go

@@ -0,0 +1,106 @@
+package bell
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+	"time"
+
+	alertLifecycle "git.ilapage.cn/ila/yovision/Bell/server/app/alert/lifecycle"
+	alertQuery "git.ilapage.cn/ila/yovision/Bell/server/app/alert/query"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/audit"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/auth"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/event"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/rule"
+	"git.ilapage.cn/ila/yovision/Bell/server/app/synthetic"
+	"git.ilapage.cn/ila/yovision/Bell/server/config"
+	"git.ilapage.cn/ila/yovision/Bell/server/internal/platform"
+	"git.ilapage.cn/ila/yovision/Bell/server/migrations"
+)
+
+const Version = "0.1.0"
+
+func Run(ctx context.Context, args []string) error {
+	command := "serve"
+	if len(args) > 0 {
+		command = args[0]
+	}
+	if command == "version" {
+		fmt.Println(Version)
+		return nil
+	}
+	if command != "serve" && command != "migrate" && command != "create-admin" {
+		return fmt.Errorf("unknown command %q (use serve, migrate, create-admin, or version)", command)
+	}
+	cfg, err := config.Load()
+	if err != nil {
+		return err
+	}
+	db, err := platform.OpenDatabase(ctx, cfg.DatabaseURL)
+	if err != nil {
+		return err
+	}
+	defer db.Close()
+	if err := migrations.Apply(ctx, db); err != nil {
+		return err
+	}
+	if command == "migrate" {
+		return nil
+	}
+	auditStore := audit.Store{DB: db}
+	authStore := auth.Store{DB: db}
+	authService := auth.Service{Store: authStore, Audit: auditStore, Secret: []byte(cfg.SessionSecret), SessionTTL: 8 * time.Hour}
+	if command == "create-admin" {
+		username, displayName := argument(args, "--username"), argument(args, "--display-name")
+		password := os.Getenv("BELL_BOOTSTRAP_PASSWORD")
+		if displayName == "" {
+			displayName = username
+		}
+		if password == "" {
+			return fmt.Errorf("BELL_BOOTSTRAP_PASSWORD is required for create-admin")
+		}
+		return authService.BootstrapAdministrator(ctx, username, displayName, password)
+	}
+	app := platform.NewHTTPApp(db)
+	authHTTP := auth.HTTP{Service: authService, Store: authStore, Audit: auditStore, SecureCookie: cfg.CookieSecure}
+	authHTTP.Register(app.Router())
+	ruleService := rule.Service{DB: db}
+	eventService := event.Service{DB: db, AfterPersist: ruleService.Match}
+	event.HTTP{Service: eventService, Auth: authHTTP}.Register(app.Router())
+	rule.HTTP{Service: ruleService, Auth: authHTTP, Audit: auditStore}.Register(app.Router())
+	alertQueryService := alertQuery.Service{DB: db}
+	alertQuery.HTTP{Service: alertQueryService, Auth: authHTTP}.Register(app.Router())
+	alertLifecycle.HTTP{Service: alertLifecycle.Service{DB: db, Audit: auditStore, Query: alertQueryService}, Auth: authHTTP}.Register(app.Router())
+	if cfg.Environment == "development" || cfg.Environment == "test" {
+		synthetic.HTTP{Service: synthetic.Service{Events: eventService}, Auth: authHTTP}.Register(app.Router())
+	}
+	server := &http.Server{Addr: cfg.HTTPAddress, Handler: app.Handler()}
+	serverCtx, stop := signal.NotifyContext(ctx, os.Interrupt, syscall.SIGTERM)
+	defer stop()
+	go func() {
+		<-serverCtx.Done()
+		shutdownCtx, cancel := context.WithTimeout(context.Background(), cfg.ShutdownTimeout)
+		defer cancel()
+		_ = server.Shutdown(shutdownCtx)
+	}()
+	slog.Info("Bell listening", "address", cfg.HTTPAddress, "environment", cfg.Environment)
+	if err := server.ListenAndServe(); !errors.Is(err, http.ErrServerClosed) {
+		return err
+	}
+	return nil
+}
+
+func argument(args []string, name string) string {
+	for i := 1; i < len(args)-1; i++ {
+		if strings.EqualFold(args[i], name) {
+			return args[i+1]
+		}
+	}
+	return ""
+}

Bell/server/config/config.go

@@ -0,0 +1,49 @@
+package config
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"time"
+)
+
+type Config struct {
+	Environment     string
+	HTTPAddress     string
+	DatabaseURL     string
+	SessionSecret   string
+	CookieSecure    bool
+	ShutdownTimeout time.Duration
+}
+
+func Load() (Config, error) {
+	cfg := Config{
+		Environment:     value("BELL_ENV", "development"),
+		HTTPAddress:     value("BELL_HTTP_ADDRESS", "127.0.0.1:8082"),
+		DatabaseURL:     os.Getenv("BELL_DATABASE_URL"),
+		SessionSecret:   os.Getenv("BELL_SESSION_SECRET"),
+		ShutdownTimeout: 10 * time.Second,
+	}
+	if raw := os.Getenv("BELL_SHUTDOWN_SECONDS"); raw != "" {
+		seconds, err := strconv.Atoi(raw)
+		if err != nil || seconds < 1 || seconds > 300 {
+			return Config{}, fmt.Errorf("BELL_SHUTDOWN_SECONDS must be between 1 and 300")
+		}
+		cfg.ShutdownTimeout = time.Duration(seconds) * time.Second
+	}
+	if cfg.DatabaseURL == "" {
+		return Config{}, fmt.Errorf("BELL_DATABASE_URL is required")
+	}
+	if len(cfg.SessionSecret) < 32 {
+		return Config{}, fmt.Errorf("BELL_SESSION_SECRET must contain at least 32 characters")
+	}
+	cfg.CookieSecure = cfg.Environment == "production"
+	return cfg, nil
+}
+
+func value(name, fallback string) string {
+	if value := os.Getenv(name); value != "" {
+		return value
+	}
+	return fallback
+}

Bell/server/go.mod

@@ -0,0 +1,16 @@
+module git.ilapage.cn/ila/yovision/Bell/server
+
+go 1.26.5
+
+require (
+	github.com/jackc/pgx/v5 v5.7.6
+	golang.org/x/crypto v0.37.0
+)
+
+require (
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	golang.org/x/sync v0.13.0 // indirect
+	golang.org/x/text v0.24.0 // indirect
+)

Bell/server/go.sum

@@ -0,0 +1,28 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.7.6 h1:rWQc5FwZSPX58r1OQmkuaNicxdmExaEz5A2DO2hUuTk=
+github.com/jackc/pgx/v5 v5.7.6/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
+golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
+golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
+golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
+golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

Bell/server/internal/platform/database.go

@@ -0,0 +1,30 @@
+package platform
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+func OpenDatabase(ctx context.Context, databaseURL string) (*pgxpool.Pool, error) {
+	poolConfig, err := pgxpool.ParseConfig(databaseURL)
+	if err != nil {
+		return nil, fmt.Errorf("parse Bell database URL: %w", err)
+	}
+	poolConfig.MaxConns = 8
+	poolConfig.MinConns = 1
+	poolConfig.MaxConnLifetime = 30 * time.Minute
+	pool, err := pgxpool.NewWithConfig(ctx, poolConfig)
+	if err != nil {
+		return nil, fmt.Errorf("open Bell database: %w", err)
+	}
+	pingCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	if err := pool.Ping(pingCtx); err != nil {
+		pool.Close()
+		return nil, fmt.Errorf("ping Bell database: %w", err)
+	}
+	return pool, nil
+}

Bell/server/internal/platform/http.go

@@ -0,0 +1,50 @@
+package platform
+
+import (
+	"encoding/json"
+	"net/http"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+type HTTPApp struct {
+	DB  *pgxpool.Pool
+	Mux *http.ServeMux
+}
+
+func NewHTTPApp(db *pgxpool.Pool) *HTTPApp {
+	app := &HTTPApp{DB: db, Mux: http.NewServeMux()}
+	app.Mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, _ *http.Request) {
+		writeJSON(w, http.StatusOK, map[string]any{"status": "ok", "service": "bell", "time": time.Now().UTC()})
+	})
+	app.Mux.HandleFunc("GET /readyz", func(w http.ResponseWriter, r *http.Request) {
+		if err := db.Ping(r.Context()); err != nil {
+			writeJSON(w, http.StatusServiceUnavailable, map[string]string{"status": "not_ready"})
+			return
+		}
+		writeJSON(w, http.StatusOK, map[string]string{"status": "ready"})
+	})
+	return app
+}
+
+func (a *HTTPApp) Router() *http.ServeMux { return a.Mux }
+
+func (a *HTTPApp) Handler() http.Handler {
+	return securityHeaders(a.Mux)
+}
+
+func securityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("Referrer-Policy", "no-referrer")
+		next.ServeHTTP(w, r)
+	})
+}
+
+func writeJSON(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}

Bell/server/internal/platform/http_test.go

@@ -0,0 +1,16 @@
+package platform
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestSecurityHeaders(t *testing.T) {
+	h := securityHeaders(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusNoContent) }))
+	recorder := httptest.NewRecorder()
+	h.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+	if recorder.Header().Get("X-Frame-Options") != "DENY" {
+		t.Fatal("missing frame protection")
+	}
+}

Bell/server/main.go

@@ -0,0 +1,19 @@
+// Bell is derived from the frozen go-admin baseline. See Bell/LICENSES/SOURCES.md.
+package main
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"os"
+
+	"git.ilapage.cn/ila/yovision/Bell/server/cmd/bell"
+)
+
+func main() {
+	if err := bell.Run(context.Background(), os.Args[1:]); err != nil {
+		slog.Error("bell stopped", "error", err)
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}

Bell/server/migrations/2026081200_platform.sql

@@ -0,0 +1,4 @@
+CREATE TABLE IF NOT EXISTS bell_runtime_probe (
+    singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
+    started_at timestamptz NOT NULL DEFAULT now()
+);

Bell/server/migrations/2026081201_auth.sql

@@ -0,0 +1,62 @@
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+CREATE TABLE bell_roles (
+    id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    code text NOT NULL UNIQUE CHECK (code IN ('administrator','operator','viewer')),
+    name text NOT NULL
+);
+CREATE TABLE bell_permissions (code text PRIMARY KEY, description text NOT NULL);
+CREATE TABLE bell_role_permissions (
+    role_id uuid NOT NULL REFERENCES bell_roles(id),
+    permission_code text NOT NULL REFERENCES bell_permissions(code),
+    PRIMARY KEY (role_id, permission_code)
+);
+CREATE TABLE bell_users (
+    id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    username text NOT NULL UNIQUE CHECK (username = lower(username)),
+    display_name text NOT NULL,
+    password_hash text NOT NULL,
+    enabled boolean NOT NULL DEFAULT true,
+    created_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE TABLE bell_user_roles (
+    user_id uuid NOT NULL REFERENCES bell_users(id),
+    role_id uuid NOT NULL REFERENCES bell_roles(id),
+    PRIMARY KEY (user_id, role_id)
+);
+CREATE TABLE bell_sessions (
+    id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id uuid NOT NULL REFERENCES bell_users(id),
+    token_digest bytea NOT NULL UNIQUE,
+    created_at timestamptz NOT NULL DEFAULT now(),
+    expires_at timestamptz NOT NULL,
+    revoked_at timestamptz,
+    CHECK (expires_at > created_at)
+);
+CREATE INDEX bell_sessions_user_active_idx ON bell_sessions(user_id, expires_at) WHERE revoked_at IS NULL;
+CREATE TABLE bell_audit_log (
+    id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    occurred_at timestamptz NOT NULL DEFAULT now(),
+    actor_user_id uuid REFERENCES bell_users(id),
+    action text NOT NULL,
+    target_type text NOT NULL,
+    target_id text,
+    outcome text NOT NULL CHECK (outcome IN ('success','failure','denied')),
+    details jsonb NOT NULL DEFAULT '{}'::jsonb
+);
+
+CREATE OR REPLACE FUNCTION bell_reject_audit_mutation() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN RAISE EXCEPTION 'bell audit facts are append-only'; END $$;
+CREATE TRIGGER bell_audit_no_update BEFORE UPDATE OR DELETE ON bell_audit_log FOR EACH ROW EXECUTE FUNCTION bell_reject_audit_mutation();
+
+INSERT INTO bell_roles(code,name) VALUES ('administrator','管理员'),('operator','处置员'),('viewer','只读用户');
+INSERT INTO bell_permissions(code,description) VALUES
+ ('dashboard:read','查看工作台'),('alerts:read','查看预警'),('alerts:handle','处置预警'),
+ ('events:read','查看事件'),('rules:read','查看规则'),('rules:write','管理规则'),
+ ('users:read','查看用户'),('users:write','管理用户与角色'),('audit:read','查看审计');
+INSERT INTO bell_role_permissions(role_id,permission_code)
+SELECT r.id,p.code FROM bell_roles r CROSS JOIN bell_permissions p WHERE r.code='administrator';
+INSERT INTO bell_role_permissions(role_id,permission_code)
+SELECT r.id,p.code FROM bell_roles r JOIN bell_permissions p ON p.code IN ('dashboard:read','alerts:read','alerts:handle','events:read','rules:read') WHERE r.code='operator';
+INSERT INTO bell_role_permissions(role_id,permission_code)
+SELECT r.id,p.code FROM bell_roles r JOIN bell_permissions p ON p.code IN ('dashboard:read','alerts:read','events:read','rules:read') WHERE r.code='viewer';

Bell/server/migrations/2026081202_event_receipt.sql

@@ -0,0 +1,29 @@
+CREATE TABLE bell_events (
+    id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    producer_id text NOT NULL,
+    source_event_id text NOT NULL,
+    event_type text NOT NULL,
+    occurred_at timestamptz NOT NULL,
+    location text NOT NULL,
+    severity text NOT NULL CHECK (severity IN ('low','medium','high','critical')),
+    evidence_ref text,
+    normalized_payload jsonb NOT NULL,
+    payload_sha256 bytea NOT NULL,
+    created_at timestamptz NOT NULL DEFAULT now(),
+    UNIQUE (producer_id, source_event_id)
+);
+CREATE INDEX bell_events_created_page_idx ON bell_events(created_at DESC,id DESC);
+CREATE TABLE bell_event_receipts (
+    id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    event_id uuid NOT NULL UNIQUE REFERENCES bell_events(id),
+    producer_id text NOT NULL,
+    source_event_id text NOT NULL,
+    payload_sha256 bytea NOT NULL,
+    accepted_at timestamptz NOT NULL DEFAULT now(),
+    UNIQUE (producer_id, source_event_id)
+);
+
+CREATE OR REPLACE FUNCTION bell_reject_event_mutation() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN RAISE EXCEPTION 'Bell Event and Receipt facts are immutable'; END $$;
+CREATE TRIGGER bell_event_no_update BEFORE UPDATE OR DELETE ON bell_events FOR EACH ROW EXECUTE FUNCTION bell_reject_event_mutation();
+CREATE TRIGGER bell_receipt_no_update BEFORE UPDATE OR DELETE ON bell_event_receipts FOR EACH ROW EXECUTE FUNCTION bell_reject_event_mutation();

Bell/server/migrations/2026081203_synthetic_permission.sql

@@ -0,0 +1,3 @@
+INSERT INTO bell_permissions(code,description) VALUES ('synthetic:write','注入开发测试合成事件');
+INSERT INTO bell_role_permissions(role_id,permission_code)
+SELECT id,'synthetic:write' FROM bell_roles WHERE code='administrator';

Bell/server/migrations/2026081204_rule_alert_base.sql

@@ -0,0 +1,51 @@
+CREATE TABLE bell_rules (
+    id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    code text NOT NULL UNIQUE,
+    name text NOT NULL,
+    enabled boolean NOT NULL DEFAULT true,
+    event_type text,
+    minimum_severity text NOT NULL CHECK (minimum_severity IN ('low','medium','high','critical')),
+    location_contains text,
+    version integer NOT NULL DEFAULT 1 CHECK (version > 0),
+    created_at timestamptz NOT NULL DEFAULT now(),
+    updated_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE TABLE bell_alerts (
+    id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    primary_rule_id uuid NOT NULL REFERENCES bell_rules(id),
+    correlation_key text NOT NULL,
+    status text NOT NULL DEFAULT 'open' CHECK (status IN ('open','acknowledged','closed')),
+    severity text NOT NULL CHECK (severity IN ('low','medium','high','critical')),
+    summary text NOT NULL,
+    location text NOT NULL,
+    created_at timestamptz NOT NULL DEFAULT now(),
+    updated_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX bell_alert_open_correlation_idx ON bell_alerts(primary_rule_id,correlation_key) WHERE status='open';
+CREATE INDEX bell_alerts_page_idx ON bell_alerts(created_at DESC,id DESC);
+CREATE TABLE bell_alert_events (
+    alert_id uuid NOT NULL REFERENCES bell_alerts(id),
+    event_id uuid NOT NULL REFERENCES bell_events(id),
+    linked_at timestamptz NOT NULL DEFAULT now(),
+    PRIMARY KEY(alert_id,event_id)
+);
+CREATE INDEX bell_alert_events_event_idx ON bell_alert_events(event_id,alert_id);
+CREATE TABLE bell_rule_matches (
+    alert_id uuid NOT NULL REFERENCES bell_alerts(id),
+    event_id uuid NOT NULL REFERENCES bell_events(id),
+    rule_id uuid NOT NULL REFERENCES bell_rules(id),
+    rule_version integer NOT NULL,
+    rule_snapshot jsonb NOT NULL,
+    explanation text NOT NULL,
+    matched_at timestamptz NOT NULL DEFAULT now(),
+    PRIMARY KEY(event_id,rule_id)
+);
+CREATE TABLE bell_rule_evaluations (
+    event_id uuid NOT NULL REFERENCES bell_events(id),
+    rule_id uuid NOT NULL REFERENCES bell_rules(id),
+    rule_version integer NOT NULL,
+    matched boolean NOT NULL,
+    explanation text NOT NULL,
+    evaluated_at timestamptz NOT NULL DEFAULT now(),
+    PRIMARY KEY(event_id,rule_id)
+);

Bell/server/migrations/2026081205_alert_lifecycle.sql

@@ -0,0 +1,18 @@
+ALTER TABLE bell_alerts
+    ADD COLUMN acknowledged_by uuid REFERENCES bell_users(id),
+    ADD COLUMN acknowledged_at timestamptz,
+    ADD COLUMN closed_by uuid REFERENCES bell_users(id),
+    ADD COLUMN closed_at timestamptz,
+    ADD COLUMN close_outcome text CHECK (close_outcome IN ('danger_confirmed','false_positive','site_normal','unable_to_confirm')),
+    ADD COLUMN close_note text;
+CREATE TABLE bell_alert_lifecycle_facts (
+    id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    alert_id uuid NOT NULL REFERENCES bell_alerts(id),
+    transition text NOT NULL CHECK (transition IN ('acknowledged','closed')),
+    actor_user_id uuid NOT NULL REFERENCES bell_users(id),
+    occurred_at timestamptz NOT NULL DEFAULT now(),
+    details jsonb NOT NULL DEFAULT '{}'::jsonb,
+    UNIQUE(alert_id,transition)
+);
+CREATE INDEX bell_alert_lifecycle_timeline_idx ON bell_alert_lifecycle_facts(alert_id,id);
+CREATE TRIGGER bell_alert_lifecycle_no_update BEFORE UPDATE OR DELETE ON bell_alert_lifecycle_facts FOR EACH ROW EXECUTE FUNCTION bell_reject_audit_mutation();

Bell/server/migrations/runner.go

@@ -0,0 +1,67 @@
+package migrations
+
+import (
+	"context"
+	"embed"
+	"fmt"
+	"io/fs"
+	"sort"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+//go:embed *.sql
+var files embed.FS
+
+func Apply(ctx context.Context, pool *pgxpool.Pool) error {
+	conn, err := pool.Acquire(ctx)
+	if err != nil {
+		return fmt.Errorf("acquire migration connection: %w", err)
+	}
+	defer conn.Release()
+	if _, err = conn.Exec(ctx, `SELECT pg_advisory_lock(hashtext('yovision-bell-migrations'))`); err != nil {
+		return fmt.Errorf("lock migrations: %w", err)
+	}
+	defer func() {
+		_, _ = conn.Exec(context.Background(), `SELECT pg_advisory_unlock(hashtext('yovision-bell-migrations'))`)
+	}()
+	if _, err := conn.Exec(ctx, `CREATE TABLE IF NOT EXISTS bell_schema_migrations (name text PRIMARY KEY, applied_at timestamptz NOT NULL DEFAULT now())`); err != nil {
+		return fmt.Errorf("create migration ledger: %w", err)
+	}
+	entries, err := fs.ReadDir(files, ".")
+	if err != nil {
+		return fmt.Errorf("read embedded migrations: %w", err)
+	}
+	sort.Slice(entries, func(i, j int) bool { return entries[i].Name() < entries[j].Name() })
+	for _, entry := range entries {
+		if entry.IsDir() || len(entry.Name()) < 4 || entry.Name()[len(entry.Name())-4:] != ".sql" {
+			continue
+		}
+		var applied bool
+		if err := conn.QueryRow(ctx, `SELECT EXISTS(SELECT 1 FROM bell_schema_migrations WHERE name=$1)`, entry.Name()).Scan(&applied); err != nil {
+			return err
+		}
+		if applied {
+			continue
+		}
+		sqlBytes, err := files.ReadFile(entry.Name())
+		if err != nil {
+			return err
+		}
+		tx, err := conn.Begin(ctx)
+		if err != nil {
+			return err
+		}
+		if _, err = tx.Exec(ctx, string(sqlBytes)); err == nil {
+			_, err = tx.Exec(ctx, `INSERT INTO bell_schema_migrations(name) VALUES($1)`, entry.Name())
+		}
+		if err != nil {
+			_ = tx.Rollback(ctx)
+			return fmt.Errorf("apply migration %s: %w", entry.Name(), err)
+		}
+		if err := tx.Commit(ctx); err != nil {
+			return fmt.Errorf("commit migration %s: %w", entry.Name(), err)
+		}
+	}
+	return nil
+}

Bell/server/testdata/events/danger-zone.json

@@ -0,0 +1 @@
+{"name":"danger-zone","label":"危险区域进入","command":{"producer_id":"bell-synthetic","source_event_id":"fixture-danger-zone","event_type":"danger-zone-entry","occurred_at":"2026-08-12T09:00:00Z","location":"北侧围墙","severity":"high","evidence_ref":"evidence://synthetic/danger-zone","attributes":{"object":"anonymous-person","zone":"north-wall"}}}

Bell/server/testdata/events/fixtures.go

@@ -0,0 +1,57 @@
+package events
+
+import (
+	"embed"
+	"encoding/json"
+	"fmt"
+	"io/fs"
+	"sort"
+
+	bellEvent "git.ilapage.cn/ila/yovision/Bell/server/app/event"
+)
+
+//go:embed *.json
+var files embed.FS
+
+type Fixture struct {
+	Name            string            `json:"name"`
+	Label           string            `json:"label"`
+	ValidationError string            `json:"validation_error,omitempty"`
+	Command         bellEvent.Command `json:"command"`
+}
+
+func All() ([]Fixture, error) {
+	entries, err := fs.ReadDir(files, ".")
+	if err != nil {
+		return nil, err
+	}
+	items := []Fixture{}
+	for _, entry := range entries {
+		if entry.IsDir() {
+			continue
+		}
+		data, err := files.ReadFile(entry.Name())
+		if err != nil {
+			return nil, err
+		}
+		var item Fixture
+		if err := json.Unmarshal(data, &item); err != nil {
+			return nil, fmt.Errorf("decode fixture %s: %w", entry.Name(), err)
+		}
+		items = append(items, item)
+	}
+	sort.Slice(items, func(i, j int) bool { return items[i].Name < items[j].Name })
+	return items, nil
+}
+func Find(name string) (Fixture, error) {
+	items, err := All()
+	if err != nil {
+		return Fixture{}, err
+	}
+	for _, item := range items {
+		if item.Name == name {
+			return item, nil
+		}
+	}
+	return Fixture{}, fmt.Errorf("unknown synthetic fixture %q", name)
+}

Bell/server/testdata/events/invalid-fields.json

@@ -0,0 +1 @@
+{"name":"invalid-fields","label":"字段无效（预期失败）","validation_error":"夹具用于验证字段拒绝","command":{"producer_id":"bell-synthetic","source_event_id":"fixture-invalid","event_type":"","occurred_at":"2026-08-12T09:02:00Z","location":"测试区域","severity":"unknown","attributes":{}}}

Bell/server/testdata/events/line-crossing.json

@@ -0,0 +1 @@
+{"name":"line-crossing","label":"方向越线","command":{"producer_id":"bell-synthetic","source_event_id":"fixture-line-crossing","event_type":"line-crossing","occurred_at":"2026-08-12T09:01:00Z","location":"宿舍楼东门","severity":"critical","evidence_ref":"evidence://synthetic/line-crossing","attributes":{"direction":"outside-to-inside","object":"anonymous-person"}}}

Bell/server/testdata/events/missing-evidence.json

@@ -0,0 +1 @@
+{"name":"missing-evidence","label":"证据缺失（预期失败）","validation_error":"此测试场景要求证据引用","command":{"producer_id":"bell-synthetic","source_event_id":"fixture-missing-evidence","event_type":"danger-zone-entry","occurred_at":"2026-08-12T09:03:00Z","location":"测试区域","severity":"high","attributes":{"requires_evidence":true}}}

Bell/web/.eslintrc.js

@@ -0,0 +1,7 @@
+module.exports = {
+  root: true,
+  env: { node: true },
+  extends: ['plugin:vue/vue3-essential', 'eslint:recommended'],
+  parserOptions: { parser: '@babel/eslint-parser', requireConfigFile: false },
+  rules: { 'vue/multi-word-component-names': 'off' }
+}

Bell/web/.gitignore

@@ -0,0 +1,3 @@
+node_modules/
+dist/
+*.log

Bell/web/babel.config.js

@@ -0,0 +1 @@
+module.exports = { presets: ['@vue/cli-plugin-babel/preset'] }

Bell/web/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "yovision-bell-ui",
+  "version": "0.1.0",
+  "private": true,
+  "license": "MIT",
+  "scripts": {
+    "dev": "vue-cli-service serve",
+    "lint": "eslint --ext .js,.vue src",
+    "build:prod": "vue-cli-service build"
+  },
+  "dependencies": {
+    "@element-plus/icons-vue": "2.3.2",
+    "axios": "1.19.0",
+    "core-js": "3.50.0",
+    "element-plus": "2.14.4",
+    "vue": "3.5.41",
+    "vue-router": "4.6.4",
+    "vuex": "4.1.0"
+  },
+  "devDependencies": {
+    "@babel/eslint-parser": "7.29.7",
+    "@vue/cli-plugin-babel": "5.0.9",
+    "@vue/cli-plugin-eslint": "5.0.9",
+    "@vue/cli-service": "5.0.9",
+    "@vue/compiler-sfc": "3.5.41",
+    "eslint": "7.32.0",
+    "eslint-plugin-vue": "9.33.0"
+  },
+  "packageManager": "pnpm@9.15.1",
+  "engines": { "node": "22.22.1", "pnpm": "9.15.1" }
+}

Bell/web/public/index.html

@@ -0,0 +1,5 @@
+<!doctype html>
+<html lang="zh-CN">
+  <head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Bell 预警中心</title></head>
+  <body><noscript>Bell 需要启用 JavaScript。</noscript><div id="app"></div></body>
+</html>

Bell/web/src/api/alert/index.js

@@ -0,0 +1,6 @@
+import request from '../../bootstrap/request'
+export const listAlerts = params => request.get('/api/v1/alerts', { params })
+export const getAlert = id => request.get(`/api/v1/alerts/${id}`)
+export const alertsForEvent = id => request.get(`/api/v1/events/${id}/alerts`)
+export const acknowledgeAlert = id => request.post(`/api/v1/alerts/${id}/ack`)
+export const closeAlert = (id, data) => request.post(`/api/v1/alerts/${id}/close`, data)

Bell/web/src/api/auth/index.js

@@ -0,0 +1,9 @@
+import request from '../../bootstrap/request'
+
+export const login = data => request.post('/api/v1/auth/login', data)
+export const logout = () => request.post('/api/v1/auth/logout')
+export const currentUser = () => request.get('/api/v1/auth/me')
+export const listUsers = () => request.get('/api/v1/users')
+export const createUser = data => request.post('/api/v1/users', data)
+export const replaceRoles = (id, roles) => request.put(`/api/v1/users/${id}/roles`, { roles })
+export const listAudit = () => request.get('/api/v1/audit?limit=100')

Bell/web/src/api/event/index.js

@@ -0,0 +1,3 @@
+import request from '../../bootstrap/request'
+export const listEvents = params => request.get('/api/v1/events', { params })
+export const getEvent = id => request.get(`/api/v1/events/${id}`)

Bell/web/src/api/rule/index.js

@@ -0,0 +1,4 @@
+import request from '../../bootstrap/request'
+export const listRules = () => request.get('/api/v1/rules')
+export const createRule = data => request.post('/api/v1/rules', data)
+export const setRuleEnabled = (id, enabled) => request.put(`/api/v1/rules/${id}/enabled`, { enabled })

Bell/web/src/api/synthetic/index.js

@@ -0,0 +1,3 @@
+import request from '../../bootstrap/request'
+export const listFixtures = () => request.get('/api/v1/synthetic/fixtures')
+export const injectSynthetic = data => request.post('/api/v1/synthetic/events', data)

Bell/web/src/bootstrap/App.vue

@@ -0,0 +1,6 @@
+<template><router-view v-if="route.meta.public" /><AppLayout v-else><router-view /></AppLayout></template>
+<script setup>
+import { useRoute } from 'vue-router'
+import AppLayout from '../layout/AppLayout.vue'
+const route = useRoute()
+</script>

Bell/web/src/bootstrap/Dashboard.vue

@@ -0,0 +1,10 @@
+<template>
+  <main class="page" tabindex="-1">
+    <header class="page__header"><div><p class="eyebrow">BELL</p><h1>预警工作台</h1><p>Bell 已独立运行，业务模块将按工单顺序启用。</p></div><el-tag type="success">服务就绪</el-tag></header>
+    <el-row :gutter="16">
+      <el-col :xs="24" :sm="12" :lg="8"><el-card><template #header>待处理预警</template><strong class="metric">0</strong><p>规则模块启用后显示。</p></el-card></el-col>
+      <el-col :xs="24" :sm="12" :lg="8"><el-card><template #header>今日事件</template><strong class="metric">0</strong><p>事件入站启用后显示。</p></el-card></el-col>
+      <el-col :xs="24" :sm="12" :lg="8"><el-card><template #header>运行状态</template><strong class="metric metric--small">独立</strong><p>无需 Sense 或 Brain 在线。</p></el-card></el-col>
+    </el-row>
+  </main>
+</template>

Bell/web/src/bootstrap/main.js

@@ -0,0 +1,9 @@
+import { createApp } from 'vue'
+import ElementPlus from 'element-plus'
+import 'element-plus/dist/index.css'
+import App from './App.vue'
+import router from './router'
+import store from './store'
+import './theme.css'
+
+createApp(App).use(store).use(router).use(ElementPlus).mount('#app')

Bell/web/src/bootstrap/request.js

@@ -0,0 +1,5 @@
+import axios from 'axios'
+
+const request = axios.create({ timeout: 10000, withCredentials: true, headers: { 'Content-Type': 'application/json' } })
+request.interceptors.response.use(response => response.data, error => Promise.reject(error.response?.data || { error: '无法连接 Bell 服务' }))
+export default request

Bell/web/src/bootstrap/router.js

@@ -0,0 +1,37 @@
+import { createRouter, createWebHistory } from 'vue-router'
+import Dashboard from './Dashboard.vue'
+import Login from '../views/login/Login.vue'
+import Users from '../views/system/Users.vue'
+import Audit from '../views/system/Audit.vue'
+import Events from '../views/event/Events.vue'
+import SyntheticEvent from '../views/synthetic-event/SyntheticEvent.vue'
+import Rules from '../views/rule/Rules.vue'
+import Alerts from '../views/alert/list/Alerts.vue'
+import { listFixtures } from '../api/synthetic'
+import store from './store'
+
+const router = createRouter({
+  history: createWebHistory(),
+  routes: [
+    { path: '/login', name: 'login', component: Login, meta: { title: '登录', public: true } },
+    { path: '/', name: 'dashboard', component: Dashboard, meta: { title: '工作台', permission: 'dashboard:read' } },
+    { path: '/events', name: 'events', component: Events, meta: { title: '事件查询', permission: 'events:read' } },
+    { path: '/alerts', name: 'alerts', component: Alerts, meta: { title: '预警管理', permission: 'alerts:read' } },
+    { path: '/rules', name: 'rules', component: Rules, meta: { title: '规则配置', permission: 'rules:read' } },
+    { path: '/development/synthetic-events', name: 'synthetic-events', component: SyntheticEvent, meta: { title: '合成事件测试', permission: 'synthetic:write', developmentOnly: true } },
+    { path: '/system/users', name: 'users', component: Users, meta: { title: '用户与角色', permission: 'users:read' } },
+    { path: '/system/audit', name: 'audit', component: Audit, meta: { title: '认证审计', permission: 'audit:read' } }
+  ]
+})
+
+router.beforeEach(async to => {
+  if (!store.state.identity.checked) await store.dispatch('identity/restore')
+  const user = store.state.identity.user
+  if (to.meta.public) return user && to.name === 'login' ? { name: 'dashboard' } : true
+  if (!user) return { name: 'login', query: { redirect: to.fullPath } }
+  if (to.meta.permission && !user.permissions?.includes(to.meta.permission)) return { name: 'dashboard' }
+  if (to.meta.developmentOnly) { try { await listFixtures() } catch (_) { return { name: 'dashboard' } } }
+  return true
+})
+
+export default router

Bell/web/src/bootstrap/store.js

@@ -0,0 +1,4 @@
+import { createStore } from 'vuex'
+import identity from '../store/modules/identity'
+
+export default createStore({ state: () => ({ product: 'Bell' }), modules: { identity } })

Bell/web/src/bootstrap/theme.css

@@ -0,0 +1,26 @@
+:root { --bell-accent:#409eff; --bell-bg:#f3f4f7; --bell-surface:#fff; --bell-text:#1f2329; --bell-muted:#6b7280; --bell-stroke:#e5e7eb; }
+* { box-sizing:border-box; }
+html, body, #app { min-height:100%; margin:0; }
+body { font-family:"Segoe UI Variable","Microsoft YaHei",sans-serif; color:var(--bell-text); background:var(--bell-bg); }
+.shell { min-height:100vh; display:grid; grid-template-columns:220px minmax(0,1fr); }
+.sidebar { background:#263445; color:#fff; padding:16px 12px; }
+.brand { display:flex; gap:12px; align-items:center; min-height:48px; padding:0 8px 16px; }
+.brand__mark { display:grid; place-items:center; width:36px; height:36px; border-radius:8px; background:var(--bell-accent); font-weight:700; }
+.brand small { display:block; color:#cbd5e1; margin-top:2px; }
+.nav-item { display:flex; min-height:44px; align-items:center; padding:0 12px; color:#cbd5e1; text-decoration:none; border-radius:6px; }
+.nav-item.router-link-active { color:#fff; background:#1f2d3d; }
+.workspace { min-width:0; }
+.navbar { height:50px; display:flex; align-items:center; justify-content:space-between; padding:0 20px; background:var(--bell-surface); border-bottom:1px solid var(--bell-stroke); }
+.navbar__identity { color:var(--bell-muted); display:flex; align-items:center; gap:12px; }
+.tags-view { height:34px; display:flex; align-items:end; padding:0 16px; background:#fff; border-bottom:1px solid var(--bell-stroke); }
+.tag-current { padding:6px 12px; border:1px solid var(--bell-stroke); border-bottom:2px solid var(--bell-accent); }
+.app-main { padding:20px; }
+.page { max-width:1440px; margin:0 auto; outline:none; }
+.page__header { display:flex; justify-content:space-between; gap:16px; align-items:flex-start; margin-bottom:20px; }
+.page__header h1 { margin:0 0 6px; font-size:24px; }
+.page__header p { margin:0; color:var(--bell-muted); }
+.eyebrow { color:var(--bell-accent)!important; font-size:12px; font-weight:700; letter-spacing:.12em; }
+.metric { font-size:36px; font-variant-numeric:tabular-nums; }
+.metric--small { font-size:24px; }
+@media (max-width:640px) { .shell { grid-template-columns:1fr; } .sidebar { position:static; padding:8px 12px; } .brand { padding-bottom:8px; } .sidebar nav { display:flex; } .workspace { min-width:0; } .app-main { padding:12px; } .page__header { flex-direction:column; } }
+@media (prefers-reduced-motion:reduce) { *,*::before,*::after { scroll-behavior:auto!important; transition-duration:.01ms!important; animation-duration:.01ms!important; } }

Bell/web/src/layout/AppLayout.vue

@@ -0,0 +1,28 @@
+<template>
+  <div class="shell">
+    <aside class="sidebar" aria-label="主导航">
+      <div class="brand"><span class="brand__mark">B</span><div><strong>Bell</strong><small>预警中心</small></div></div>
+      <nav>
+        <router-link to="/" class="nav-item">工作台</router-link>
+        <router-link v-if="has('alerts:read')" to="/alerts" class="nav-item">预警管理</router-link>
+        <router-link v-if="has('events:read')" to="/events" class="nav-item">事件查询</router-link>
+        <router-link v-if="has('rules:read')" to="/rules" class="nav-item">规则配置</router-link>
+        <router-link v-if="has('users:read')" to="/system/users" class="nav-item">用户与角色</router-link>
+        <router-link v-if="has('audit:read')" to="/system/audit" class="nav-item">认证审计</router-link>
+        <router-link v-if="syntheticAvailable" to="/development/synthetic-events" class="nav-item">合成事件测试</router-link>
+      </nav>
+    </aside>
+    <section class="workspace">
+      <header class="navbar"><span>学校安全预警</span><div class="navbar__identity"><span>{{ user?.display_name }}</span><el-button link @click="signOut">退出</el-button></div></header>
+      <div class="tags-view"><span class="tag-current">{{ route.meta.title }}</span></div>
+      <div class="app-main"><slot /></div>
+    </section>
+  </div>
+</template>
+<script setup>
+import { computed,onMounted,ref } from 'vue'
+import { useRoute,useRouter } from 'vue-router'
+import { useStore } from 'vuex'
+import { listFixtures } from '../api/synthetic'
+const store=useStore();const route=useRoute();const router=useRouter();const user=computed(()=>store.state.identity.user);const syntheticAvailable=ref(false);const has=permission=>store.getters['identity/has'](permission);onMounted(async()=>{if(has('synthetic:write')){try{await listFixtures();syntheticAvailable.value=true}catch(_){syntheticAvailable.value=false}}});async function signOut(){await store.dispatch('identity/logout');await router.replace('/login')}
+</script>

Bell/web/src/main.js

@@ -0,0 +1 @@
+import './bootstrap/main'

Bell/web/src/store/modules/identity.js

@@ -0,0 +1,13 @@
+import { currentUser, login, logout } from '../../api/auth'
+
+export default {
+  namespaced: true,
+  state: () => ({ user: null, checked: false }),
+  getters: { has: state => permission => Boolean(state.user?.permissions?.includes(permission)) },
+  mutations: { setUser (state, user) { state.user = user; state.checked = true } },
+  actions: {
+    async restore ({ commit }) { try { commit('setUser', await currentUser()) } catch (_) { commit('setUser', null) } },
+    async login ({ commit }, form) { const result = await login(form); commit('setUser', result.user); return result.user },
+    async logout ({ commit }) { try { await logout() } finally { commit('setUser', null) } }
+  }
+}

Bell/web/src/views/alert/list/Alerts.vue

@@ -0,0 +1,26 @@
+<template>
+  <main class="page" tabindex="-1">
+    <header class="page__header"><div><h1>预警管理</h1><p>先确认已看到并开始处理，再记录现场结果完成预警。</p></div></header>
+    <el-table :data="items" v-loading="loading" row-key="id" @row-dblclick="open">
+      <el-table-column prop="created_at" label="创建时间" min-width="180"/><el-table-column prop="summary" label="预警事项" min-width="190"/><el-table-column prop="location" label="地点" min-width="130"/>
+      <el-table-column label="状态"><template #default="scope"><el-tag :type="statusType(scope.row.status)">{{statusName(scope.row.status)}}</el-tag></template></el-table-column>
+      <el-table-column label="处理人" min-width="120"><template #default="scope">{{scope.row.acknowledged_by_name||'待确认'}}</template></el-table-column><el-table-column prop="event_count" label="关联事件" width="100"/>
+      <el-table-column label="操作" width="100"><template #default="scope"><el-button link type="primary" @click.stop="open(scope.row)">详情</el-button></template></el-table-column>
+    </el-table>
+    <el-empty v-if="!loading&&!items.length" description="尚无预警"/><div class="pagination-actions"><el-button :disabled="!next" @click="load(next)">下一页</el-button></div>
+    <el-drawer v-model="drawer" title="预警详情" size="min(640px, 100%)">
+      <template v-if="detail">
+        <el-alert v-if="actionError" :title="actionError" type="warning" show-icon :closable="false"/>
+        <el-descriptions :column="1" border><el-descriptions-item label="事项">{{detail.alert.summary}}</el-descriptions-item><el-descriptions-item label="地点">{{detail.alert.location}}</el-descriptions-item><el-descriptions-item label="规则">{{detail.alert.rule_name}}</el-descriptions-item><el-descriptions-item label="状态">{{statusName(detail.alert.status)}}</el-descriptions-item><el-descriptions-item label="处理人">{{detail.alert.acknowledged_by_name||'尚未开始处理'}}</el-descriptions-item><el-descriptions-item v-if="detail.alert.close_outcome" label="现场结果">{{outcomeName(detail.alert.close_outcome)}}</el-descriptions-item><el-descriptions-item v-if="detail.alert.close_note" label="处理说明">{{detail.alert.close_note}}</el-descriptions-item></el-descriptions>
+        <div class="action-bar" v-if="canHandle"><el-button v-if="detail.alert.status==='open'" type="primary" :loading="acting" @click="ack">我已看到并开始处理</el-button><el-button v-if="canClose" type="primary" :loading="acting" @click="closeDialog=true">记录现场结果并完成</el-button></div>
+        <h2>关联事件</h2><el-table :data="detail.events" row-key="id"><el-table-column prop="occurred_at" label="发生时间"/><el-table-column prop="event_type" label="类型"/><el-table-column label="操作" width="80"><template #default="scope"><el-button link @click="router.push({name:'events',query:{event:scope.row.id}})">查看</el-button></template></el-table-column></el-table>
+        <h2>处理时间线</h2><el-timeline><el-timeline-item v-for="entry in detail.timeline" :key="entry.id" :timestamp="entry.occurred_at">{{entry.transition==='acknowledged'?'开始处理':'处理完成'}} · {{entry.actor_name}}</el-timeline-item><el-timeline-item v-for="match in detail.matches" :key="`${match.event_id}-${match.rule_id}`" :timestamp="match.matched_at" type="primary">规则 v{{match.rule_version}}：{{match.explanation}}</el-timeline-item></el-timeline>
+      </template>
+    </el-drawer>
+    <el-dialog v-model="closeDialog" title="记录现场结果" width="min(520px, calc(100vw - 32px))" @closed="resetClose"><el-alert title="完成后预警进入已完成状态，原始事件不会被修改。" type="info" :closable="false"/><el-form ref="closeFormRef" :model="closeForm" :rules="closeRules" label-position="top"><el-form-item label="现场结果" prop="outcome"><el-radio-group v-model="closeForm.outcome" class="outcome-group"><el-radio value="danger_confirmed">确认有危险</el-radio><el-radio value="false_positive">误报</el-radio><el-radio value="site_normal">现场正常</el-radio><el-radio value="unable_to_confirm">无法确认</el-radio></el-radio-group></el-form-item><el-form-item label="补充说明（可选）"><el-input v-model="closeForm.note" type="textarea" :rows="3" maxlength="500" show-word-limit/></el-form-item></el-form><template #footer><el-button @click="closeDialog=false">取消</el-button><el-button type="primary" :loading="acting" @click="finish">确认结果并完成</el-button></template></el-dialog>
+  </main>
+</template>
+<script setup>
+import { computed,onMounted,reactive,ref } from 'vue';import { useRouter } from 'vue-router';import { useStore } from 'vuex';import { ElMessage } from 'element-plus';import { acknowledgeAlert,closeAlert,getAlert,listAlerts } from '../../../api/alert';const router=useRouter();const store=useStore();const items=ref([]);const loading=ref(false);const acting=ref(false);const next=ref('');const drawer=ref(false);const detail=ref(null);const actionError=ref('');const closeDialog=ref(false);const closeFormRef=ref();const closeForm=reactive({outcome:'',note:''});const closeRules={outcome:[{required:true,message:'请选择现场结果',trigger:'change'}]};const canHandle=computed(()=>store.getters['identity/has']('alerts:handle'));const currentUser=computed(()=>store.state.identity.user);const canClose=computed(()=>detail.value?.alert.status==='acknowledged'&&(detail.value.alert.acknowledged_by===currentUser.value?.id||currentUser.value?.roles?.includes('administrator')));const statusName=value=>({open:'待处理',acknowledged:'处理中',closed:'已完成'}[value]||value);const statusType=value=>({open:'danger',acknowledged:'warning',closed:'success'}[value]||'info');const outcomeName=value=>({danger_confirmed:'确认有危险',false_positive:'误报',site_normal:'现场正常',unable_to_confirm:'无法确认'}[value]||value);async function load(before=''){loading.value=true;try{const result=await listAlerts({limit:25,before});items.value=result.items;next.value=result.items.length===25?result.next:''}catch(e){ElMessage.error(e.error||'读取预警失败')}finally{loading.value=false}}async function open(row){try{detail.value=await getAlert(row.id);actionError.value='';drawer.value=true}catch(e){ElMessage.error(e.error||'读取预警失败')}}async function ack(){acting.value=true;actionError.value='';try{const result=await acknowledgeAlert(detail.value.alert.id);detail.value=result.detail;ElMessage.success(result.idempotent?'您已在处理此预警':'已记录由您开始处理');await load()}catch(e){if(e.current)detail.value=e.current;actionError.value=e.error||'确认失败'}finally{acting.value=false}}async function finish(){try{await closeFormRef.value.validate();acting.value=true;actionError.value='';const result=await closeAlert(detail.value.alert.id,closeForm);detail.value=result.detail;closeDialog.value=false;ElMessage.success(result.idempotent?'该结果已记录':'预警已完成');await load()}catch(e){if(e?.current)detail.value=e.current;if(e?.error)actionError.value=e.error}finally{acting.value=false}}function resetClose(){closeForm.outcome='';closeForm.note='';closeFormRef.value?.clearValidate()}onMounted(()=>load())
+</script>
+<style scoped>.pagination-actions{display:flex;justify-content:flex-end;margin-top:16px}.action-bar{display:flex;gap:12px;margin-top:16px}h2{font-size:16px;margin-top:20px}.outcome-group{display:grid;gap:10px}</style>

Bell/web/src/views/event/Events.vue

@@ -0,0 +1,5 @@
+<template><main class="page" tabindex="-1"><header class="page__header"><div><h1>事件查询</h1><p>原始事件只读保存；处理结果不会改写事件。</p></div></header><el-table :data="items" v-loading="loading" row-key="id" @row-dblclick="open"><el-table-column prop="occurred_at" label="发生时间" min-width="180"/><el-table-column prop="event_type" label="事件类型" min-width="140"/><el-table-column prop="location" label="地点" min-width="150"/><el-table-column label="风险"><template #default="scope"><el-tag :type="severityType(scope.row.severity)">{{severityName(scope.row.severity)}}</el-tag></template></el-table-column><el-table-column label="操作" width="100"><template #default="scope"><el-button link type="primary" @click.stop="open(scope.row)">详情</el-button></template></el-table-column></el-table><el-empty v-if="!loading&&!items.length" description="尚无事件"/><div class="pagination-actions"><el-button :disabled="!next" @click="load(next)">下一页</el-button></div><el-drawer v-model="drawer" title="事件技术详情" size="min(560px, 100%)"><template v-if="selected"><el-descriptions :column="1" border><el-descriptions-item label="事件编号">{{selected.id}}</el-descriptions-item><el-descriptions-item label="来源">{{selected.producer_id}}</el-descriptions-item><el-descriptions-item label="来源事件编号">{{selected.source_event_id}}</el-descriptions-item><el-descriptions-item label="发生时间">{{selected.occurred_at}}</el-descriptions-item><el-descriptions-item label="证据引用">{{selected.evidence_ref||'无'}}</el-descriptions-item><el-descriptions-item label="规范化载荷"><pre>{{JSON.stringify(selected.normalized_payload,null,2)}}</pre></el-descriptions-item></el-descriptions><h2>关联预警</h2><el-table :data="selectedAlerts" row-key="id"><el-table-column prop="summary" label="事项"/><el-table-column label="操作" width="80"><template #default><el-button link @click="router.push('/alerts')">查看</el-button></template></el-table-column></el-table><el-empty v-if="!selectedAlerts.length" description="该事件未命中规则"/></template></el-drawer></main></template>
+<script setup>
+import { onMounted,ref } from 'vue';import { useRouter } from 'vue-router';import { ElMessage } from 'element-plus';import { alertsForEvent } from '../../api/alert';import { getEvent,listEvents } from '../../api/event';const router=useRouter();const items=ref([]);const loading=ref(false);const next=ref('');const drawer=ref(false);const selected=ref(null);const selectedAlerts=ref([]);const severityType=value=>({critical:'danger',high:'warning',medium:'primary',low:'info'}[value]||'info');const severityName=value=>({critical:'紧急',high:'高',medium:'中',low:'低'}[value]||value);async function load(before=''){loading.value=true;try{const result=await listEvents({limit:25,before});items.value=result.items;next.value=result.items.length===25?result.next:''}catch(e){ElMessage.error(e.error||'读取事件失败')}finally{loading.value=false}}async function open(row){try{selected.value=await getEvent(row.id);selectedAlerts.value=(await alertsForEvent(row.id)).items;drawer.value=true}catch(e){ElMessage.error(e.error||'读取事件失败')}}onMounted(()=>load())
+</script>
+<style scoped>.pagination-actions{display:flex;justify-content:flex-end;margin-top:16px}pre{white-space:pre-wrap;word-break:break-word;margin:0}h2{font-size:16px;margin-top:20px}</style>

Bell/web/src/views/login/Login.vue

@@ -0,0 +1,21 @@
+<template>
+  <main class="login-page">
+    <el-card class="login-card">
+      <template #header><div><p class="eyebrow">BELL</p><h1>登录预警中心</h1><p>使用 Bell 独立账户。Sense 账户不能登录此系统。</p></div></template>
+      <el-alert v-if="error" :title="error" type="error" show-icon :closable="false" />
+      <el-form ref="formRef" :model="form" :rules="rules" label-position="top" @submit.prevent="submit">
+        <el-form-item label="用户名" prop="username"><el-input v-model.trim="form.username" autocomplete="username" autofocus /></el-form-item>
+        <el-form-item label="密码" prop="password"><el-input v-model="form.password" type="password" show-password autocomplete="current-password" @keyup.enter="submit" /></el-form-item>
+        <el-button type="primary" native-type="submit" :loading="loading" class="full-button">登录 Bell</el-button>
+      </el-form>
+    </el-card>
+  </main>
+</template>
+<script setup>
+import { reactive, ref } from 'vue'
+import { useRoute, useRouter } from 'vue-router'
+import { useStore } from 'vuex'
+const store=useStore();const route=useRoute();const router=useRouter();const formRef=ref();const loading=ref(false);const error=ref('');const form=reactive({username:'',password:''});const rules={username:[{required:true,message:'请输入用户名',trigger:'blur'}],password:[{required:true,message:'请输入密码',trigger:'blur'}]}
+async function submit(){if(loading.value)return;try{await formRef.value.validate();loading.value=true;error.value='';await store.dispatch('identity/login',form);await router.replace(String(route.query.redirect||'/'))}catch(e){if(e?.error)error.value=e.error}finally{loading.value=false}}
+</script>
+<style scoped>.login-page{min-height:100vh;display:grid;place-items:center;padding:20px;background:#f3f4f7}.login-card{width:min(420px,100%)}h1{margin:0 0 8px}.full-button{width:100%;min-height:44px}</style>

Bell/web/src/views/rule/Rules.vue

@@ -0,0 +1,4 @@
+<template><main class="page" tabindex="-1"><header class="page__header"><div><h1>规则配置</h1><p>启用规则会评估新 Event；版本与实际匹配快照永久保留。</p></div><el-button v-if="canWrite" type="primary" @click="dialog=true">新建规则</el-button></header><el-table :data="items" v-loading="loading" row-key="id"><el-table-column prop="name" label="规则名称" min-width="160"/><el-table-column prop="event_type" label="事件类型"><template #default="scope">{{scope.row.event_type||'全部'}}</template></el-table-column><el-table-column prop="minimum_severity" label="最低风险"/><el-table-column prop="location_contains" label="地点包含"><template #default="scope">{{scope.row.location_contains||'不限'}}</template></el-table-column><el-table-column prop="version" label="版本" width="80"/><el-table-column label="启用" width="100"><template #default="scope"><el-switch :model-value="scope.row.enabled" :disabled="!canWrite" :aria-label="`${scope.row.name}启用状态`" @change="value=>toggle(scope.row,value)"/></template></el-table-column></el-table><el-empty v-if="!loading&&!items.length" description="尚无规则"/><el-dialog v-model="dialog" title="新建预警规则" width="min(520px, calc(100vw - 32px))" @closed="reset"><el-form ref="formRef" :model="form" :rules="rules" label-position="top"><el-form-item label="规则编码" prop="code"><el-input v-model.trim="form.code" placeholder="如 north-wall-danger"/></el-form-item><el-form-item label="规则名称" prop="name"><el-input v-model.trim="form.name"/></el-form-item><el-form-item label="事件类型（留空表示全部）"><el-input v-model.trim="form.event_type"/></el-form-item><el-form-item label="最低风险" prop="minimum_severity"><el-select v-model="form.minimum_severity" style="width:100%"><el-option label="低" value="low"/><el-option label="中" value="medium"/><el-option label="高" value="high"/><el-option label="紧急" value="critical"/></el-select></el-form-item><el-form-item label="地点包含（可选）"><el-input v-model.trim="form.location_contains"/></el-form-item></el-form><template #footer><el-button @click="dialog=false">取消</el-button><el-button type="primary" :loading="saving" @click="save">创建规则</el-button></template></el-dialog></main></template>
+<script setup>
+import { computed,onMounted,reactive,ref } from 'vue';import { ElMessage } from 'element-plus';import { useStore } from 'vuex';import { createRule,listRules,setRuleEnabled } from '../../api/rule';const store=useStore();const canWrite=computed(()=>store.getters['identity/has']('rules:write'));const items=ref([]);const loading=ref(false);const saving=ref(false);const dialog=ref(false);const formRef=ref();const form=reactive({code:'',name:'',event_type:'',minimum_severity:'high',location_contains:''});const rules={code:[{required:true,message:'请输入规则编码',trigger:'blur'}],name:[{required:true,message:'请输入规则名称',trigger:'blur'}],minimum_severity:[{required:true,message:'请选择最低风险',trigger:'change'}]};async function load(){loading.value=true;try{items.value=(await listRules()).items}catch(e){ElMessage.error(e.error||'读取规则失败')}finally{loading.value=false}}async function save(){try{await formRef.value.validate();saving.value=true;const payload={...form,event_type:form.event_type||null,location_contains:form.location_contains||null};await createRule(payload);dialog.value=false;ElMessage.success('规则已创建');await load()}catch(e){if(e?.error)ElMessage.error(e.error)}finally{saving.value=false}}async function toggle(item,value){try{await setRuleEnabled(item.id,value);ElMessage.success(value?'规则已启用':'规则已停用');await load()}catch(e){ElMessage.error(e.error||'更新失败')}}function reset(){Object.assign(form,{code:'',name:'',event_type:'',minimum_severity:'high',location_contains:''});formRef.value?.clearValidate()}onMounted(load)
+</script>

Bell/web/src/views/synthetic-event/SyntheticEvent.vue

@@ -0,0 +1,4 @@
+<template><main class="page" tabindex="-1"><header class="page__header"><div><h1>合成事件测试</h1><p>仅开发测试环境可用；所有成功数据仍经过正式 Event/Receipt 服务。</p></div><el-tag type="warning">开发测试</el-tag></header><el-card><el-alert v-if="error" :title="error" type="error" show-icon :closable="false"/><el-form ref="formRef" :model="form" :rules="rules" label-position="top" @submit.prevent="submit"><el-form-item label="测试场景" prop="fixture"><el-select v-model="form.fixture" style="width:100%"><el-option v-for="item in fixtures" :key="item.name" :label="item.label" :value="item.name"><span>{{item.label}}</span><el-tag v-if="item.expected_failure" type="info" size="small" style="margin-left:8px">预期失败</el-tag></el-option></el-select></el-form-item><el-form-item label="来源事件编号" prop="source_event_id"><el-input v-model.trim="form.source_event_id"/><small>保持编号不变可验证重复；换用另一夹具可验证冲突。</small></el-form-item><el-button type="primary" native-type="submit" :loading="loading">注入合成事件</el-button></el-form></el-card><el-card v-if="result" style="margin-top:16px"><template #header>接收结果</template><el-descriptions :column="1" border><el-descriptions-item label="结果">{{result.duplicate?'重复请求，返回原收据':'首次接收'}}</el-descriptions-item><el-descriptions-item label="Event ID">{{result.event.id}}</el-descriptions-item><el-descriptions-item label="Receipt ID">{{result.receipt.id}}</el-descriptions-item></el-descriptions></el-card></main></template>
+<script setup>
+import { onMounted,reactive,ref } from 'vue';import { ElMessage } from 'element-plus';import { injectSynthetic,listFixtures } from '../../api/synthetic';const fixtures=ref([]);const formRef=ref();const loading=ref(false);const error=ref('');const result=ref(null);const form=reactive({fixture:'danger-zone',source_event_id:`ui-${Date.now()}`});const rules={fixture:[{required:true,message:'请选择场景',trigger:'change'}],source_event_id:[{required:true,message:'请输入来源事件编号',trigger:'blur'}]};onMounted(async()=>{try{fixtures.value=(await listFixtures()).items}catch(e){error.value=e.error||'测试入口不可用'}});async function submit(){if(loading.value)return;try{await formRef.value.validate();loading.value=true;error.value='';result.value=await injectSynthetic(form);ElMessage.success(result.value.duplicate?'已返回原收据':'合成事件已接收')}catch(e){if(e?.error)error.value=e.error}finally{loading.value=false}}
+</script>

Bell/web/src/views/system/Audit.vue

@@ -0,0 +1,4 @@
+<template><main class="page" tabindex="-1"><header class="page__header"><div><h1>认证审计</h1><p>登录、退出和权限拒绝事实仅追加保存。</p></div></header><el-table :data="items" v-loading="loading" row-key="id"><el-table-column prop="occurred_at" label="时间" min-width="180"/><el-table-column prop="action" label="动作" min-width="150"/><el-table-column prop="outcome" label="结果"><template #default="scope"><el-tag :type="scope.row.outcome==='success'?'success':'danger'">{{scope.row.outcome}}</el-tag></template></el-table-column><el-table-column prop="target_type" label="对象"/></el-table></main></template>
+<script setup>
+import { onMounted,ref } from 'vue';import { ElMessage } from 'element-plus';import { listAudit } from '../../api/auth';const items=ref([]);const loading=ref(false);onMounted(async()=>{loading.value=true;try{items.value=(await listAudit()).items}catch(e){ElMessage.error(e.error||'读取审计失败')}finally{loading.value=false}})
+</script>

Bell/web/src/views/system/Users.vue

@@ -0,0 +1,4 @@
+<template><main class="page" tabindex="-1"><header class="page__header"><div><h1>用户与角色</h1><p>Bell 账户与 Sense 完全独立；按最小权限分配角色。</p></div><el-button v-if="canWrite" type="primary" @click="dialog=true">创建用户</el-button></header><el-table :data="items" v-loading="loading" row-key="id"><el-table-column prop="username" label="用户名"/><el-table-column prop="display_name" label="显示名称"/><el-table-column label="角色"><template #default="scope"><el-select v-if="canWrite" :model-value="scope.row.roles[0]" aria-label="角色" @change="role=>changeRole(scope.row,role)"><el-option v-for="option in roleOptions" :key="option.value" v-bind="option"/></el-select><span v-else>{{roleName(scope.row.roles[0])}}</span></template></el-table-column><el-table-column label="状态"><template #default="scope"><el-tag :type="scope.row.enabled?'success':'info'">{{scope.row.enabled?'启用':'停用'}}</el-tag></template></el-table-column></el-table><el-empty v-if="!loading&&!items.length" description="尚未创建用户"/><el-dialog v-model="dialog" title="创建 Bell 用户" width="min(480px, calc(100vw - 32px))" @closed="reset"><el-alert title="不会生成默认密码；密码必须由管理员安全传递。" type="info" :closable="false"/><el-form ref="formRef" :model="form" :rules="rules" label-position="top"><el-form-item label="用户名" prop="username"><el-input v-model.trim="form.username"/></el-form-item><el-form-item label="显示名称" prop="display_name"><el-input v-model.trim="form.display_name"/></el-form-item><el-form-item label="初始密码" prop="password"><el-input v-model="form.password" type="password" show-password autocomplete="new-password"/></el-form-item><el-form-item label="角色" prop="role"><el-select v-model="form.role" style="width:100%"><el-option v-for="option in roleOptions" :key="option.value" v-bind="option"/></el-select></el-form-item></el-form><template #footer><el-button @click="dialog=false">取消</el-button><el-button type="primary" :loading="saving" @click="save">创建用户</el-button></template></el-dialog></main></template>
+<script setup>
+import { computed,onMounted,reactive,ref } from 'vue';import { ElMessage } from 'element-plus';import { useStore } from 'vuex';import { createUser,listUsers,replaceRoles } from '../../api/auth';const store=useStore();const items=ref([]);const loading=ref(false);const dialog=ref(false);const saving=ref(false);const formRef=ref();const form=reactive({username:'',display_name:'',password:'',role:'operator'});const canWrite=computed(()=>store.getters['identity/has']('users:write'));const roleOptions=[{value:'administrator',label:'管理员'},{value:'operator',label:'处置员'},{value:'viewer',label:'只读用户'}];const rules={username:[{required:true,message:'请输入用户名',trigger:'blur'}],display_name:[{required:true,message:'请输入显示名称',trigger:'blur'}],password:[{required:true,message:'请输入初始密码',trigger:'blur'},{min:12,message:'至少 12 个字符',trigger:'blur'}],role:[{required:true,message:'请选择角色',trigger:'change'}]};const roleName=value=>roleOptions.find(x=>x.value===value)?.label||value;async function load(){loading.value=true;try{items.value=(await listUsers()).items}catch(e){ElMessage.error(e.error||'读取用户失败')}finally{loading.value=false}}async function save(){try{await formRef.value.validate();saving.value=true;await createUser(form);ElMessage.success('用户已创建');dialog.value=false;await load()}catch(e){if(e?.error)ElMessage.error(e.error)}finally{saving.value=false}}async function changeRole(user,role){try{await replaceRoles(user.id,[role]);ElMessage.success('角色已更新');await load()}catch(e){ElMessage.error(e.error||'角色更新失败')}}function reset(){form.username='';form.display_name='';form.password='';form.role='operator';formRef.value?.clearValidate()}onMounted(load)
+</script>

Bell/web/vue.config.js

@@ -0,0 +1,10 @@
+const { defineConfig } = require('@vue/cli-service')
+
+module.exports = defineConfig({
+  transpileDependencies: true,
+  outputDir: 'dist',
+  devServer: {
+    port: 8083,
+    proxy: { '/api': { target: process.env.BELL_API_ORIGIN || 'http://127.0.0.1:8082' } }
+  }
+})

Brain/.env.example

@@ -1,3 +0,0 @@
-# Safe local defaults. Do not add credentials, customer data, or production paths.
-BRAIN_DEVICE=auto
-BRAIN_LOG_LEVEL=INFO

Brain/.python-version

@@ -1 +0,0 @@
-3.11.15

Brain/README.md

@@ -1,90 +0,0 @@
-# YoVision Brain
-
-Brain 是无界面的独立推理交付单元。本骨架只提供可安装 Python 包、命令入口和运行时探测；尚不包含视频、模型、规则、事件或部署能力，也不依赖 Sense、Bell 在线。
-
-## 冻结基线
-
-| 项目 | 版本 / 选择 |
-|---|---|
-| Python | CPython `3.11.15`（`.python-version`；本机由 uv 隔离管理） |
-| 环境与包管理 | Python `venv` + pip `26.2.1`；可用 uv `0.11.6` 取得固定 Python |
-| 构建后端 | setuptools `80.9.0` |
-| 测试 | pytest `8.4.2` |
-| 数组运行时 | NumPy `2.3.3` |
-| 推理运行时 | PyTorch `2.12.1` |
-| CPU wheel | PyTorch 官方 `https://download.pytorch.org/whl/cpu` |
-| NVIDIA wheel | PyTorch 官方 CUDA 12.6 `https://download.pytorch.org/whl/cu126` |
-
-选择 Python 3.11 是因为 PyTorch 的 Windows 支持范围包含 Python 3.9–3.12，并且本机已有隔离的 CPython 3.11.15。选择 `torch 2.12.1 + cu126` 是因为 PyTorch 官方为 Linux/Windows 同时发布该固定组合；NVIDIA 的 CUDA 12.x 兼容表要求 Windows 驱动至少为 528.33，本机驱动 566.24 满足运行 CUDA 12.6 wheel 的驱动前提。
-
-本机安装的 CUDA Toolkit 11.2 不参与 PyTorch wheel 构建，也不因本项目而修改。驱动满足最低版本只是兼容前提，不等于 GPU 已验证；必须以 `--smoke cuda` 的真实结果为准。
-
-官方依据：
-
-- [PyTorch - Start Locally](https://docs.pytorch.org/get-started/locally/)
-- [PyTorch - Previous Versions](https://pytorch.org/get-started/previous-versions/)
-- [NVIDIA CUDA 12.6 Release Notes](https://docs.nvidia.com/cuda/archive/12.6.0/cuda-toolkit-release-notes/index.html)
-- [Python 3.11.15](https://www.python.org/downloads/release/python-31115/)
-
-## 创建隔离环境
-
-从仓库根目录执行。无需激活虚拟环境，也不需要更改 PowerShell 执行策略：
-
-```powershell
-uv python install 3.11.15
-uv venv --python 3.11.15 Brain/.venv
-Brain\.venv\Scripts\python.exe -m pip install pip==26.2.1 --index-url https://pypi.org/simple
-Brain\.venv\Scripts\python.exe -m pip install -e "Brain[dev]" --index-url https://pypi.org/simple
-```
-
-若不使用 uv，也可以让已安装的 Python 3.11.15 创建环境：
-
-```powershell
-py -V:3.11 -m venv Brain/.venv
-Brain\.venv\Scripts\python.exe -m pip install pip==26.2.1 --index-url https://pypi.org/simple
-Brain\.venv\Scripts\python.exe -m pip install -e "Brain[dev]" --index-url https://pypi.org/simple
-```
-
-## 安装运行时
-
-CPU 环境使用 PyTorch 官方 CPU 索引：
-
-```powershell
-Brain\.venv\Scripts\python.exe -m pip install numpy==2.3.3 --index-url https://pypi.org/simple
-Brain\.venv\Scripts\python.exe -m pip install torch==2.12.1 --index-url https://download.pytorch.org/whl/cpu
-```
-
-目标 NVIDIA 环境使用官方 CUDA 12.6 wheel。该 wheel 自带所需 CUDA 用户态运行库，不要求把系统 Toolkit 改成 12.6：
-
-```powershell
-Brain\.venv\Scripts\python.exe -m pip install numpy==2.3.3 --index-url https://pypi.org/simple
-Brain\.venv\Scripts\python.exe -m pip install torch==2.12.1 --index-url https://download.pytorch.org/whl/cu126
-```
-
-不要在同一环境混装 CPU 与 CUDA wheel；切换后端时重建 `.venv`。
-
-## 运行和验证
-
-入口的帮助与版本查询不导入 PyTorch，因此未安装运行时时也可用：
-
-```powershell
-Brain\.venv\Scripts\python.exe -m yovision_brain --help
-Brain\.venv\Scripts\python.exe -m yovision_brain --version
-```
-
-安装相应运行时后执行：
-
-```powershell
-Brain\.venv\Scripts\python.exe -m pytest Brain/tests/test_package.py -q
-Brain\.venv\Scripts\python.exe -m yovision_brain --runtime-info
-Brain\.venv\Scripts\python.exe -m yovision_brain --smoke cpu
-Brain\.venv\Scripts\python.exe -m yovision_brain --smoke cuda
-```
-
-`--runtime-info` 只输出 Python、PyTorch 和设备能力，不读取或显示环境变量值。`--smoke cuda` 在 CUDA wheel、驱动或设备不可用时以非零状态退出，不会回退 CPU 后伪称成功。
-
-## 配置与安全边界
-
-`.env.example` 只有无秘密默认值。Brain 不接收用户会话，不持有账户、RBAC、Alert 或通知状态。不得把 token、摄像头凭据、客户数据、内部文件路径或未经授权的人脸信息写入配置、日志或事件。
-
-第三方许可证与来源见 [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md)。

Brain/THIRD_PARTY_NOTICES.md

@@ -1,17 +0,0 @@
-# Third-party notices
-
-本文件记录 Brain 骨架直接固定或明确依赖的第三方软件。具体安装包内许可证文本仍是最终依据。
-
-| 组件 | 固定版本 | 许可证 | 来源 |
-|---|---:|---|---|
-| CPython | 3.11.15 | Python Software Foundation License | https://www.python.org/downloads/release/python-31115/ |
-| pip | 26.2.1 | MIT | https://github.com/pypa/pip/tree/26.2.1 |
-| uv（可选 Python 获取工具，不随 Brain 分发） | 0.11.6 | Apache-2.0 OR MIT | https://github.com/astral-sh/uv/tree/0.11.6 |
-| python-build-standalone（uv 管理的 Python 分发来源，不随 Brain 分发） | 2026 系列 | MPL-2.0；分发包内另含 CPython 与组件许可证 | https://github.com/astral-sh/python-build-standalone |
-| setuptools | 80.9.0 | MIT | https://github.com/pypa/setuptools/tree/v80.9.0 |
-| pytest | 8.4.2 | MIT | https://github.com/pytest-dev/pytest/tree/8.4.2 |
-| NumPy | 2.3.3 | BSD-3-Clause | https://github.com/numpy/numpy/tree/v2.3.3 |
-| PyTorch | 2.12.1 | BSD-3-Clause | https://github.com/pytorch/pytorch/tree/v2.12.1 |
-| NVIDIA CUDA runtime（随官方 PyTorch CUDA wheel 分发） | 12.6 系列 | NVIDIA CUDA Toolkit End User License Agreement | https://docs.nvidia.com/cuda/eula/index.html |
-
-PyTorch 及后续模型可能带来额外第三方依赖与模型许可。本骨架未选择或分发任何模型；引入模型前必须另行核对商用、再分发、数据和输出限制，不能把框架许可证视为模型许可证。

Brain/pyproject.toml

@@ -1,27 +0,0 @@
-[build-system]
-requires = ["setuptools==80.9.0"]
-build-backend = "setuptools.build_meta"
-
-[project]
-name = "yovision-brain"
-version = "0.1.0"
-description = "Headless inference delivery unit for YoVision"
-readme = "README.md"
-requires-python = "==3.11.*"
-dependencies = []
-
-[project.optional-dependencies]
-# The wheel backend is selected by the official PyTorch index documented in
-# README.md. Keeping one pinned requirement here prevents CPU/CUDA drift.
-runtime = ["numpy==2.3.3", "torch==2.12.1"]
-dev = ["pytest==8.4.2"]
-
-[project.scripts]
-yovision-brain = "yovision_brain.__main__:main"
-
-[tool.setuptools.packages.find]
-where = ["src"]
-
-[tool.pytest.ini_options]
-testpaths = ["tests"]
-addopts = "--strict-markers"

Brain/src/yovision_brain/__init__.py

@@ -1,5 +0,0 @@
-"""YoVision Brain package."""
-
-__version__ = "0.1.0"
-
-__all__ = ["__version__"]

Brain/src/yovision_brain/__main__.py

@@ -1,112 +0,0 @@
-"""Command-line entry point for safe Brain runtime diagnostics."""
-
-from __future__ import annotations
-
-import argparse
-import json
-import platform
-from collections.abc import Sequence
-from typing import Any
-
-from yovision_brain import __version__
-
-
-def _load_torch() -> Any:
-    try:
-        import torch
-    except ImportError as exc:
-        raise RuntimeError(
-            "PyTorch runtime is not installed; install the pinned CPU or CUDA wheel "
-            "from Brain/README.md"
-        ) from exc
-    return torch
-
-
-def runtime_info() -> dict[str, object]:
-    """Return non-sensitive interpreter and compute-runtime facts."""
-    info: dict[str, object] = {
-        "python": platform.python_version(),
-        "torch_installed": False,
-        "torch_version": None,
-        "cuda_build": None,
-        "cuda_available": False,
-        "cuda_device_count": 0,
-    }
-    try:
-        torch = _load_torch()
-    except RuntimeError:
-        return info
-
-    cuda_available = bool(torch.cuda.is_available())
-    info.update(
-        {
-            "torch_installed": True,
-            "torch_version": torch.__version__,
-            "cuda_build": torch.version.cuda,
-            "cuda_available": cuda_available,
-            "cuda_device_count": torch.cuda.device_count() if cuda_available else 0,
-        }
-    )
-    return info
-
-
-def smoke(device: str) -> dict[str, object]:
-    """Run a deterministic tensor operation on exactly the requested device."""
-    torch = _load_torch()
-    if device == "cuda" and not torch.cuda.is_available():
-        raise RuntimeError("CUDA was requested but PyTorch reports no available CUDA device")
-
-    tensor = torch.tensor([[1.0, 2.0], [3.0, 4.0]], device=device)
-    result = tensor @ tensor
-    expected = torch.tensor([[7.0, 10.0], [15.0, 22.0]], device=device)
-    if not torch.equal(result, expected):
-        raise RuntimeError("tensor smoke result did not match the expected value")
-
-    return {
-        "status": "ok",
-        "device": device,
-        "torch_version": torch.__version__,
-        "cuda_build": torch.version.cuda,
-    }
-
-
-def build_parser() -> argparse.ArgumentParser:
-    parser = argparse.ArgumentParser(
-        prog="yovision-brain",
-        description="YoVision Brain runtime diagnostics",
-    )
-    parser.add_argument("--version", action="version", version=f"%(prog)s {__version__}")
-    action = parser.add_mutually_exclusive_group()
-    action.add_argument(
-        "--runtime-info",
-        action="store_true",
-        help="print non-sensitive Python/PyTorch/CUDA capability information",
-    )
-    action.add_argument(
-        "--smoke",
-        choices=("cpu", "cuda"),
-        help="run a tensor smoke test on exactly the selected device",
-    )
-    return parser
-
-
-def main(argv: Sequence[str] | None = None) -> int:
-    args = build_parser().parse_args(argv)
-    try:
-        if args.runtime_info:
-            payload = runtime_info()
-        elif args.smoke:
-            payload = smoke(args.smoke)
-        else:
-            build_parser().print_help()
-            return 0
-    except RuntimeError as exc:
-        print(json.dumps({"status": "error", "message": str(exc)}, ensure_ascii=False))
-        return 2
-
-    print(json.dumps(payload, ensure_ascii=False, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

Brain/tests/test_package.py

@@ -1,46 +0,0 @@
-from __future__ import annotations
-
-import json
-import subprocess
-import sys
-
-import pytest
-
-from yovision_brain import __version__
-from yovision_brain.__main__ import main, runtime_info, smoke
-
-
-def test_package_version() -> None:
-    assert __version__ == "0.1.0"
-
-
-def test_module_help_runs_without_other_products() -> None:
-    result = subprocess.run(
-        [sys.executable, "-m", "yovision_brain", "--help"],
-        check=False,
-        capture_output=True,
-        text=True,
-    )
-    assert result.returncode == 0
-    assert "YoVision Brain runtime diagnostics" in result.stdout
-
-
-def test_runtime_info_is_non_sensitive(capsys: pytest.CaptureFixture[str]) -> None:
-    assert main(["--runtime-info"]) == 0
-    payload = json.loads(capsys.readouterr().out)
-    assert set(payload) == {
-        "cuda_available",
-        "cuda_build",
-        "cuda_device_count",
-        "python",
-        "torch_installed",
-        "torch_version",
-    }
-    assert payload == runtime_info()
-
-
-def test_cpu_tensor_smoke() -> None:
-    pytest.importorskip("torch")
-    result = smoke("cpu")
-    assert result["status"] == "ok"
-    assert result["device"] == "cpu"

EXPLORE-SNAPSHOT.md

@@ -0,0 +1,19 @@
+# Explore 历史快照
+
+`explore` 保存 2026-08-14 重建 GoAdmin 基线前的可运行实现和任务证据，仅用于对照、迁移与回退，不再作为新功能集成分支。
+
+## 纳入的来源
+
+- Sense 最新链：`agent/codex/56-sense-device-edit-payload`，`a9f8a55`
+- Bell MVP：`agent/codex/9-bell-mvp`，`9ee06e3`
+- Bell 文档归档：`agent/codex/36-bell-docs`，`3c245e1`
+- 已确认原型：`agent/codex/28-current-prototypes`，`8d1875c`
+- 重建前 main：`be2c1e3c81131b51ee9fba67394ae9928e41104c`
+
+所有原来源分支均保留。共享 Wiki 镜像发生冲突时，快照树保留 Sense 最新镜像；Bell 归档页作为独立 `docs/task/` 文件保留，Bell 共享文档的完整版本仍可由上述 Bell 文档提交读取。
+
+## 使用边界
+
+- 不从本分支继续开发新功能。
+- 迁移业务行为时允许只读对照，但不得把自研基础框架整树复制回新 `dev`。
+- Sense、Bell 的新实现必须从 `goadmin-baseline.json` 冻结的 go-admin 和 go-admin-ui 完整提交派生，并在实施时核对 go-admin-doc。

README.md

@@ -8,66 +8,4 @@ YoVision 是一个单仓多项目的智能视频事件平台，包含三个可
 
 Sense 与 Bell 是账户、数据、部署和发布边界完全独立的两个销售产品；Brain 是无界面的独立推理交付单元，默认随 Sense 部署。跨项目协作只通过 `contracts/` 中的版本化契约。
 
-开始工作前阅读 [AGENTS.md](AGENTS.md) 和 [文档中心](docs/README.md)。本仓库采用 DevHarness：Gitea 工单是单次任务唯一事实来源，Gitea Wiki 保存长期文档，`docs/` 默认保存核心 Wiki 的只读镜像。
-
-## 工作闭环
-
-```text
-讨论需求或缺陷
-  -> 阅读代码并提出方案
-  -> 人工确认方案
-  -> 创建 Epic / MVP / 单元任务工单
-  -> Agent 实现并测试
-  -> 提交代码并集中回写工单证据
-  -> 人工验收后记录结论并关闭工单
-  -> 长期事实变化时才同步 Wiki
-```
-
-默认不创建任务归档；`docs/task/` 只保存人工明确要求的专项或历史兼容快照。
-
-## 首次初始化顺序
-
-1. 创建 Gitea 远端仓库并推送当前引导提交，启用工单和 Wiki。
-2. 配置 `wiki-docs.json` 和安全访问方式；优先使用已配置的 Gitea MCP，MCP 不可用时才使用 Gitea API并记录原因。
-3. 查询线上 Wiki；`Home` 不存在时先创建并回读 `Home`，取得 revision 后再创建其他核心页面。
-4. 本地 `docs/` 的存在不能证明线上 Wiki 已初始化。
-5. 开始产品编码前运行：
-
-   ```powershell
-   python dev_scripts/harness.py sync --verify
-   ```
-
-YoVision 已完成远端与 Wiki 初始化，上述步骤用于维护者理解门禁和以后建立新仓库。
-
-## 常用命令
-
-```powershell
-python dev_scripts/harness.py check --strict
-python dev_scripts/harness.py sync
-python dev_scripts/harness.py sync --check
-python -m unittest discover -s tests -v
-git diff --check
-```
-
-只有明确要求时才运行 `python dev_scripts/harness.py archive <编号> "<标题>"`、`export` 或 `export --all`。
-
-## 分支模型
-
-- `explore`：2026-08-14 前实现的只读聚合快照，用于迁移对照和回退。
-- `main`：用户审核通过的基线，禁止直接开发。
-- `dev`：集成开发与测试分支；任务分支从 `dev` 创建并通过 PR 返回 `dev`。
-- 只有用户明确审核通过，才能将 `dev` 合入 `main`。
-
-Sense 与 Bell 的新实现必须从根 `goadmin-baseline.json` 冻结的 go-admin 和 go-admin-ui 完整提交派生，开发时必须核对对应 commit 的 go-admin-doc。仅参考 GoAdmin 的技术栈、布局或视觉不属于本项目认可的二次开发。
-
-## Harness 目录
-
-```text
-AGENTS.md                         Agent 通用规则与 YoVision 专用门禁
-CLAUDE.md                         Claude Code 入口和三项目角色路由
-.gitea/issue_template/            Epic、MVP、单元任务模板
-docs/                             核心 Wiki 只读镜像及可选历史快照
-wiki-docs.json                    核心 Wiki 页面显式映射
-dev_scripts/harness.py            check / sync / archive / export 单一入口
-dev_scripts/wiki_docs.py          Gitea Wiki 客户端与镜像生成库
-```
+开始工作前阅读 [AGENTS.md](AGENTS.md) 和 [文档中心](docs/README.md)。本仓库采用 DevHarness：Gitea 工单记录任务过程，Gitea Wiki 保存长期文档，`docs/` 是 Wiki 的只读镜像。

Sense/.gitignore

@@ -1,10 +0,0 @@
-server/temp/
-server/*.exe
-server/*.db
-ui/node_modules/
-ui/dist/
-dist/
-!scripts/build/
-!scripts/build/**
-.env
-*.local.yml

Sense/AGENTS.md

@@ -26,9 +26,6 @@
 ## GoAdmin 技术基线
 
 - 初始化或升级 Sense 前必须读取根 `goadmin-baseline.json`，按其中的 go-admin、go-admin-ui commit 和 Go/Node/pnpm 精确版本实施。
-- Sense 必须由冻结 go-admin 后端与 go-admin-ui 前端源码直接派生；旧 `explore` 实现只能用于需求和行为对照，禁止把其中自研 HTTP、认证、RBAC、会话或前端外壳复制为新基础。
-- 开始每个骨架、认证权限、菜单路由、代码生成、ORM 或通用 UI 工单前，必须读取任务相关的冻结 go-admin-doc，并把参考主题/文件及采用方式写回工单。
-- 骨架验收必须证明上游来源、继承路径、许可证、裁剪清单和相对上游差异；只有相似技术栈或视觉不能通过验收。
 - `D:\github\goadmin` 下的仓库仅可只读参考；Sense 产品代码只能写入 `Sense/` 或工单授权路径，不得在参考仓库原地开发。
 - 派生上游代码必须保留 MIT 许可证和版权声明；上游 `go-admin-doc` 只作框架用法参考，不覆盖 yovision Wiki 和本目录规则。
 - 变更冻结基线必须升级为 Sense/Bell 协同工单；Sense 可以独立发布，但不得单独漂移上游或工具链版本。

Sense/LICENSES/SOURCES.md

@@ -1,13 +1,15 @@
-# Sense 上游来源
+# Upstream sources
 
-Sense 的初始产品骨架从项目根目录 `goadmin-baseline.json` 冻结的上游源码派生，来源如下：
+Sense is an independent product derived from the frozen GoAdmin baseline in
+the repository root `goadmin-baseline.json`.
 
-| 用途 | 上游仓库 | 完整 commit | 本地目录 | 许可证 |
-| --- | --- | --- | --- | --- |
-| 后端基线 | https://github.com/go-admin-team/go-admin.git | `f06540883b41d03782bb6b2c4150f298f328c6b6` | `Sense/server/` | MIT，见 `Sense/server/LICENSE.md` |
-| 前端基线 | https://github.com/go-admin-team/go-admin-ui.git | `67d393d713877572fab0b897296a4c1d525fc81d` | `Sense/ui/` | MIT，见 `Sense/ui/LICENSE` |
-| 使用参考 | https://github.com/go-admin-team/go-admin-doc.git | `424855aacf6905f3fde860c3331385cb25529a0d` | 未复制产品代码 | MIT |
+- go-admin: `https://github.com/go-admin-team/go-admin`, commit
+  `f06540883b41d03782bb6b2c4150f298f328c6b6`, MIT.
+- go-admin-ui: `https://github.com/go-admin-team/go-admin-ui`, commit
+  `67d393d713877572fab0b897296a4c1d525fc81d`, MIT.
+- go-admin-doc: documentation reference only, commit
+  `424855aacf6905f3fde860c3331385cb25529a0d`, MIT.
 
-导入时保留上游受版本控制的源文件与许可证，排除 `.git/`、上游 CI 配置、后端示例数据库以及本机生成的 `node_modules/`、`dist/`。随后仅在 `Sense/` 内完成产品命名、安全默认值、无关路由关闭和 PostgreSQL 默认配置等派生修改。
+The local copies under `D:\github\goadmin` are read-only references and are
+not a distributable or reproducible source identifier.
 
-`D:\github\goadmin` 下的三个仓库仅为只读参考副本，不是 Sense 的开发目录或依赖事实来源。

Sense/LICENSES/go-admin-LICENSE

@@ -19,3 +19,4 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+