xsl
f46ecc5eb0
Two defects that only surface against the real DeepSeek API, both of which break the cost model rather than the code: deepseek-v4-flash enables thinking mode by default. The same single-turn question took 13.5s with it on and 1.8s with it off, and the thinking tokens are billed at the output rate. That misses NFR-PERF-02b (15s per turn) and inflates every conversational call. SceneConfig now carries an explicit `thinking` flag, all four V1 scenes set it to false, and the provider always sends the parameter rather than relying on the upstream default. Reasoning tokens are recorded separately in Usage.tokens_reasoning so the cost of ever turning it back on is visible. DeepSeek moves to peak/off-peak pricing on 2026-08-17, with peak (Beijing 09:00-12:00 and 14:00-18:00) at twice the off-peak rate. Reports are generated mostly during peak hours, so a single blended rate would leave ob_ai_call -- the only input to V2 pricing -- off by nearly a factor of two. PeakAwareRateTable resolves the rate at call time; cost is computed and stored then, never recomputed later at whatever the current rate happens to be. Also here: - Replace the live API key in the redaction test with a synthetic one. The test that proves we redact secrets was itself a secret leak waiting for its first commit. - Correct LLM_COST_RATES_JSON, which held placeholder rates. - Make ids.SnowflakeGenerator take an injectable clock so rollover and clock-rollback are testable without patching a slots class. - Rename exceptions to the -Error suffix (N818) and clear the remaining ruff, mypy and import-linter findings, including two dead lines: a duplicate pytestmark assignment and a no-op assert on a None return. Gates: ruff, mypy (96 files incl. tests), 4/4 import contracts, detect-secrets, 166 unit + 3 integration tests, migration up/down round-trip.
migrations/ — Alembic
异步引擎（asyncpg）+ pgvector。Base.metadata 来自 packages/shared/models.py。
make migrate # upgrade head
make makemigration m="add kb tables" # autogenerate
uv run alembic downgrade -1 # 回滚一步
规矩
- 迁移必须向后兼容（架构 §14.3）：加列不删列、先双写后切读。发布流程是 「先迁移，后发布」，所以新迁移必须能和旧版应用代码共存，否则回滚时数据 不兼容。
- 必须可逆，或在文件头明确标注不可逆并说明原因（§16.2 迁移检查清单）。
CI 会跑
upgrade → downgrade base → upgrade。 - 表名必须带域前缀：
id_/pf_/rp_/kb_/ag_/tr_/bl_/tk_/cp_/ob_。单库多域，前缀就是将来拆库的边界（§6.1）。 - 主键用雪花 ID（bigint），不用自增（枚举攻击 + 分库冲突），不用 UUID 作主键（索引局部性差）。
- 不要存人脸原图，也不要存可反推生物特征的数据（TD-20 / CR-02）。诊断结果 只存分类标签与色值等派生量。
- 需要过滤的字段一律提升为列；JSONB 只用于「结构会演进且不需要索引全部字段」 的场景（§6.1 原则 6）。
- 配置类数据（配额规则、色板、路由）用迁移种子进表，不要硬编码进代码 （NFR-MAINT-05）。
已有迁移
| 版本 | 内容 |
|---|---|
0001 |
pgvector 扩展；id_user id_user_identity id_consent；bl_quota_rule bl_quota bl_ledger；tk_task；ob_ai_call；配额规则种子数据 |
§6.2 里其余的表（pf_ 画像与记忆、rp_ 报告、kb_ 知识库、ag_ 会话、
tr_ 换装、cp_ 合规）尚未创建，属于 M2~M4。