《互联网产品的 AI 架构·多能力编排与任务闭环》9.3 注入在多能力间的传播

// file: src/orch/injection-flow.ts
// tier: L1
// verify: node --test test/orch/permission.test.ts

import { AiError } from "../core/errors.ts";

/** 数据层四种信任，加上平台自己的 system 层。数字越小越不可信。 */
export type TrustLevel = "system" | "trusted" | "retrieved" | "tool" | "untrusted";

const TRUST_RANK: Record<TrustLevel, number> = {
  system: 4,
  trusted: 3,
  retrieved: 2,
  tool: 2,
  untrusted: 1,
};

/** 节点输出携带的信任标记；taint 一旦打上，除非显式净化否则一直随行。 */
export interface TrustEnvelope {
  id: string;
  origin: string;
  trust: TrustLevel;
  taint: readonly string[];
  injectionScore: number;
}

export interface NodeGuard {
  nodeId: string;
  capability: string;
  accepts: readonly TrustLevel[];
  outputCeiling: TrustLevel;
  canCallTools: boolean;
  sideEffect: boolean;
  quarantineScore: number;
  /** 只有人工复核或策略节点可以显式声明净化能力。 */
  declassify: boolean;
  clearsTaint?: readonly string[];
}

export type BoundaryAction = "pass" | "wrap-as-data" | "quarantine" | "reject";

export interface BoundaryDecision {
  nodeId: string;
  action: BoundaryAction;
  allowed: boolean;
  trustIn: TrustLevel;
  trustOut: TrustLevel;
  taint: string[];
  score: number;
  reasons: string[];
}

export interface TraceStep {
  nodeId: string;
  action: BoundaryAction;
  trustIn: TrustLevel;
  trustOut: TrustLevel;
  taint: string[];
  score: number;
}

export interface ChainTrace {
  steps: TraceStep[];
  delivered: boolean;
  finalTrust: TrustLevel | null;
  blockedAt: string | null;
}

export function trustRank(level: TrustLevel): number {
  return TRUST_RANK[level];
}

/** 信任只能降级或持平：目标等级高于来源时一律视为提权。 */
export function canPromote(from: TrustLevel, to: TrustLevel): boolean {
  return TRUST_RANK[to] <= TRUST_RANK[from];
}

export function lowestTrust(levels: readonly TrustLevel[]): TrustLevel {
  if (levels.length === 0) throw new AiError("invalid-request", "injection-flow: 至少需要一个信任级别");
  const order: TrustLevel[] = ["untrusted", "retrieved", "tool", "trusted", "system"];
  let lowest = levels[0];
  for (const level of levels) {
    const left = order.indexOf(level);
    const right = order.indexOf(lowest);
    if (left < right) lowest = level;
  }
  return lowest;
}

function fail(message: string): never {
  throw new AiError("invalid-request", `injection-flow: ${message}`);
}

function score(value: number, field: string): number {
  if (!Number.isFinite(value) || value < 0 || value > 100) fail(`${field} 必须落在 [0, 100]`);
  return value;
}

/**
 * 一个节点接收多个上游输出时的边界判定。
 * 输入信任取最低、污点取并集、注入分取最大值；输出信任不得超过节点 ceiling。
 */
export function evaluateBoundary(
  inputs: readonly TrustEnvelope[],
  guard: NodeGuard,
): BoundaryDecision {
  if (inputs.length === 0) fail("至少需要一个输入信封");
  if (!Number.isInteger(guard.quarantineScore) || guard.quarantineScore < 1 || guard.quarantineScore > 100) {
    fail("quarantineScore 必须是 1..100 的整数");
  }
  for (const input of inputs) score(input.injectionScore, `${input.id}.injectionScore`);

  const trustIn = lowestTrust(inputs.map((input) => input.trust));
  const taint = [...new Set(inputs.flatMap((input) => input.taint))].sort();
  const topScore = Math.max(...inputs.map((input) => input.injectionScore));
  const reasons: string[] = [];
  let action: BoundaryAction = "pass";

  if (!guard.accepts.includes(trustIn)) {
    action = "reject";
    reasons.push("trust-not-accepted");
  } else if (topScore >= guard.quarantineScore) {
    action = "quarantine";
    reasons.push("injection-score");
  } else if (guard.sideEffect && trustIn !== "system" && trustIn !== "trusted") {
    action = "quarantine";
    reasons.push("side-effect-needs-trusted");
  } else if (
    guard.canCallTools &&
    (trustIn === "untrusted" || trustIn === "retrieved" || trustIn === "tool")
  ) {
    action = "wrap-as-data";
    reasons.push("tool-args-revalidate");
  } else {
    reasons.push("clean");
  }

  const allowed = action === "pass" || action === "wrap-as-data";
  const ceiling = canPromote(trustIn, guard.outputCeiling) ? guard.outputCeiling : trustIn;
  const cleared = new Set(guard.declassify ? guard.clearsTaint ?? [] : []);
  const taintOut = taint.filter((label) => !cleared.has(label));
  const declassified =
    guard.declassify && action === "pass" && taintOut.length === 0 && topScore < guard.quarantineScore;
  const trustOut = declassified ? guard.outputCeiling : ceiling;

  if (declassified) reasons.push("declassified");

  return {
    nodeId: guard.nodeId,
    action,
    allowed,
    trustIn,
    trustOut,
    taint: taintOut,
    score: topScore,
    reasons,
  };
}

/** 把一个信封依次推过节点链；遇到第一个不放行的节点就停。 */
export function traceChain(seed: TrustEnvelope, guards: readonly NodeGuard[]): ChainTrace {
  let current = seed;
  const steps: TraceStep[] = [];
  for (const guard of guards) {
    const result = evaluateBoundary([current], guard);
    steps.push({
      nodeId: guard.nodeId,
      action: result.action,
      trustIn: result.trustIn,
      trustOut: result.trustOut,
      taint: result.taint,
      score: result.score,
    });
    if (!result.allowed) {
      return { steps, delivered: false, finalTrust: null, blockedAt: guard.nodeId };
    }
    current = {
      id: seed.id,
      origin: guard.nodeId,
      trust: result.trustOut,
      taint: result.taint,
      injectionScore: result.score,
    };
  }
  return { steps, delivered: true, finalTrust: current.trust, blockedAt: null };
}