xsl
f46ecc5eb0
Two defects that only surface against the real DeepSeek API, both of which break the cost model rather than the code: deepseek-v4-flash enables thinking mode by default. The same single-turn question took 13.5s with it on and 1.8s with it off, and the thinking tokens are billed at the output rate. That misses NFR-PERF-02b (15s per turn) and inflates every conversational call. SceneConfig now carries an explicit `thinking` flag, all four V1 scenes set it to false, and the provider always sends the parameter rather than relying on the upstream default. Reasoning tokens are recorded separately in Usage.tokens_reasoning so the cost of ever turning it back on is visible. DeepSeek moves to peak/off-peak pricing on 2026-08-17, with peak (Beijing 09:00-12:00 and 14:00-18:00) at twice the off-peak rate. Reports are generated mostly during peak hours, so a single blended rate would leave ob_ai_call -- the only input to V2 pricing -- off by nearly a factor of two. PeakAwareRateTable resolves the rate at call time; cost is computed and stored then, never recomputed later at whatever the current rate happens to be. Also here: - Replace the live API key in the redaction test with a synthetic one. The test that proves we redact secrets was itself a secret leak waiting for its first commit. - Correct LLM_COST_RATES_JSON, which held placeholder rates. - Make ids.SnowflakeGenerator take an injectable clock so rollover and clock-rollback are testable without patching a slots class. - Rename exceptions to the -Error suffix (N818) and clear the remaining ruff, mypy and import-linter findings, including two dead lines: a duplicate pytestmark assignment and a no-op assert on a None return. Gates: ruff, mypy (96 files incl. tests), 4/4 import contracts, detect-secrets, 166 unit + 3 integration tests, migration up/down round-trip.
packages/ — 业务域与能力包
架构 §3.2：单体不等于混乱。这里的每个子目录都是一个边界，越界会被 CI 拦下。
目录含义
| 包 | 类型 | 内容 |
|---|---|---|
domain/ |
纯逻辑层 | 领域模型与业务规则。无 IO、无框架、可纯单测 |
shared/ |
基础设施 | 配置、日志、错误码、统一响应、DB、Redis、可观测 |
llm/ |
AI 能力 | LLM 网关（已实现） |
retrieval/ rules/ memory/ |
AI 能力 | 混合检索 / 规则引擎 / 记忆系统（占位） |
compliance/ |
业务域 | 统一合规出口（占位，CR-05/CR-06） |
identity/ billing/ task/ agent/ |
业务域 | 已有实现 |
profile/ report/ tryon/ kb/ notify/ wardrobe/ |
业务域 | 占位 |
每个业务域包的标准结构：
packages/<域>/
├─ __init__.py
├─ README.md 这个域负责什么、不负责什么
├─ service.py 对外唯一入口。其他域只能调这里
└─ repo.py SQL。只有本域可以 import
硬性规则（由 make importlint 机器校验）
- 禁止跨域直接查表。要用别的域的数据，调它的
service，不要 import 它的repo，更不要在自己的 SQL 里 JOIN 别人的表。表名的域前缀（id_/bl_/tk_/ …）就是为将来拆库预留的边界。 packages/domain/必须保持纯净。不许 importfastapi、sqlalchemy、httpx、redis、celery，也不许 importpackages/shared。放不进去说明 它不是领域逻辑，是应用逻辑，应该待在service.py。compliance不得依赖任何业务域。它必须能被任何模块安全调用。identity不得依赖任何其他业务域。登录链路不能被业务拖累。- AI 能力包（
llm/retrieval/rules）不得依赖业务域，也不得 importapps。它们要能在 V2 原样拆成独立服务。
加一个新业务域时
- 建目录，写
README.md说明职责与不负责的事。 - 在
pyproject.toml的[tool.importlinter]契约里把它加进相应的layers/forbidden_modules列表 —— 新域默认没有约束，忘了加就等于没有边界。 - 领域规则先写进
packages/domain/<域>/并配单测，再写service.py。 - 表加域前缀，走 Alembic，迁移必须向后兼容（NFR-MAINT-06）。