feat(ECR-023): AICoreConfig KnowledgeSource 只读并 Closed

运营可观测知识源目录（knowledge_sources + admin /ai），不含 Chunk/Embedding。

Co-authored-by: Cursor <cursoragent@cursor.com>

.ai/product/feature-spec/README.md

@@ -32,6 +32,7 @@
 | [ops-quality-feedback.md](ops-quality-feedback.md) | 问答质量反馈 QualityFeedback | §7 | `admin-h5` `/ask` · `GET/POST /admin/ask/feedback*` | Ops-D · **ECR-020 Closed** |
 | [ops-ai-core-config.md](ops-ai-core-config.md) | AI 核心配置 AICoreConfig | §7 | `admin-h5` `/ai` · `GET /admin/ai/system-prompts*` | Ops-D · **ECR-021 Closed** |
 | [ops-crisis-care.md](ops-crisis-care.md) | 危机关怀 CrisisCare | §7 | `admin-h5` `/crisis` · `GET /admin/crisis/policies*` | Ops-D · **ECR-022 Closed** |
+| [ops-knowledge-source.md](ops-knowledge-source.md) | AI 知识源 KnowledgeSource | §7 | `admin-h5` `/ai` · `GET /admin/ai/knowledge-sources*` | Ops-D · **ECR-023 Closed** |
 
 新功能：复制 `_TEMPLATE.md` → 填满 → 在本表登记 → 再编码。
 

.ai/product/feature-spec/ops-knowledge-source.md

@@ -0,0 +1,41 @@
+# Feature Spec: AICoreConfig · KnowledgeSource（Ops · ECR-023）
+
+> Status: `Active`（Loop continuous · **ECR-023 Closed**）  
+> Parent: WAVE0-FROZEN · Predecessor: ECR-022 Closed  
+> Capability: `AICoreConfig` · BC: `Ask_Ops`  
+> 授权：`docs/WAVE0/LOOP_AUTHORIZATION.md`
+
+## Non-goals
+
+KnowledgeChunk / Embedding · 源文件上传 · 在线编辑发布 · ToolDefinition · 运行时 RAG 接线 · UGC · 真支付
+
+## L2 Domain
+
+| 概念 | 语义 |
+|------|------|
+| `KnowledgeSource` | code 唯一；source_kind ∈ {faq,policy,guide}；active/system；本切片只读目录，不含 Chunk |
+
+## L3 API
+
+| Method | Path | 权限 | 语义 |
+|--------|------|------|------|
+| GET | `/admin/ai/knowledge-sources` | `admin.ai_config.read` | 列表 |
+| GET | `/admin/ai/knowledge-sources/:id` | 同上 | 详情 |
+
+## Migration
+
+`000024`：`knowledge_sources` + 种子 `ask_grounding`（权限已由 000022 授予）
+
+## L4 AC
+
+| ID | Then |
+|----|------|
+| AC-F-01 | list 含 ask_grounding |
+| AC-F-02 | get 返回 source_kind 合法 |
+| AC-F-03 | 未知 id → 404 |
+| AC-S-01 | 无 Admin → 401 |
+| AC-S-02 | 无 ai_config.read → 403 |
+| AC-P-01 | list < 500ms |
+| AC-O-01 | N/A 只读 |
+
+contract_diff: `docs/CONTRACT_DIFF/ECR-023.yaml`

apps/admin-h5/src/api/client.ts

@@ -321,6 +321,32 @@ export const adminApi = {
       system: boolean
       updated_at: string
     }>('GET', `/ai/system-prompts/${id}`),
+  knowledgeSources: () =>
+    request<{
+      items: Array<{
+        id: string
+        code: string
+        title: string
+        description?: string
+        source_kind: string
+        version: number
+        active: boolean
+        system: boolean
+        updated_at: string
+      }>
+    }>('GET', '/ai/knowledge-sources'),
+  knowledgeSource: (id: string) =>
+    request<{
+      id: string
+      code: string
+      title: string
+      description?: string
+      source_kind: string
+      version: number
+      active: boolean
+      system: boolean
+      updated_at: string
+    }>('GET', `/ai/knowledge-sources/${id}`),
   crisisPolicies: () =>
     request<{
       items: Array<{

apps/admin-h5/src/pages/AIConfigPage.vue

@@ -3,6 +3,7 @@ import { onMounted, ref } from 'vue'
 import { adminApi } from '@/api/client'
 
 type Prompt = Awaited<ReturnType<typeof adminApi.systemPrompts>>['items'][number]
+type Source = Awaited<ReturnType<typeof adminApi.knowledgeSources>>['items'][number]
 
 const loading = ref(false)
 const error = ref('')
@@ -10,6 +11,12 @@ const items = ref<Prompt[]>([])
 const selected = ref<Prompt | null>(null)
 const detailErr = ref('')
 
+const ksLoading = ref(false)
+const ksError = ref('')
+const sources = ref<Source[]>([])
+const selectedSource = ref<Source | null>(null)
+const ksDetailErr = ref('')
+
 async function load() {
   loading.value = true
   error.value = ''
@@ -23,6 +30,19 @@ async function load() {
   }
 }
 
+async function loadSources() {
+  ksLoading.value = true
+  ksError.value = ''
+  try {
+    const res = await adminApi.knowledgeSources()
+    sources.value = res.items || []
+  } catch (e) {
+    ksError.value = e instanceof Error ? e.message : '加载失败'
+  } finally {
+    ksLoading.value = false
+  }
+}
+
 async function openPrompt(id: string) {
   detailErr.value = ''
   try {
@@ -33,6 +53,16 @@ async function openPrompt(id: string) {
   }
 }
 
+async function openSource(id: string) {
+  ksDetailErr.value = ''
+  try {
+    selectedSource.value = await adminApi.knowledgeSource(id)
+  } catch (e) {
+    ksDetailErr.value = e instanceof Error ? e.message : '详情失败'
+    selectedSource.value = null
+  }
+}
+
 function fmtTime(iso?: string) {
   if (!iso) return '—'
   try {
@@ -42,13 +72,16 @@ function fmtTime(iso?: string) {
   }
 }
 
-onMounted(load)
+onMounted(() => {
+  void load()
+  void loadSources()
+})
 </script>
 
 <template>
   <section>
     <h1>AI 配置</h1>
-    <p class="muted">SystemPrompt 只读目录 · 本切片不可编辑发布</p>
+    <p class="muted">SystemPrompt / KnowledgeSource 只读目录 · 本切片不可编辑发布</p>
     <p v-if="loading" class="muted">加载中…</p>
     <p v-else-if="error" class="err">{{ error }}</p>
     <div v-else class="layout">
@@ -80,6 +113,41 @@ onMounted(load)
         <p v-else class="muted">选择左侧提示词查看正文</p>
       </div>
     </div>
+
+    <p v-if="ksLoading" class="muted ks-gap">知识源加载中…</p>
+    <p v-else-if="ksError" class="err ks-gap">{{ ksError }}</p>
+    <div v-else class="layout ks-gap">
+      <div class="card">
+        <h2>知识源</h2>
+        <p v-if="!sources.length" class="muted">暂无</p>
+        <table v-else>
+          <thead>
+            <tr><th>代码</th><th>标题</th><th>类型</th><th>状态</th><th></th></tr>
+          </thead>
+          <tbody>
+            <tr v-for="s in sources" :key="s.id">
+              <td><code>{{ s.code }}</code></td>
+              <td>{{ s.title }}</td>
+              <td>{{ s.source_kind }}</td>
+              <td>{{ s.active ? '启用' : '停用' }}{{ s.system ? ' · 系统' : '' }}</td>
+              <td><button class="btn" type="button" @click="openSource(s.id)">查看</button></td>
+            </tr>
+          </tbody>
+        </table>
+      </div>
+      <div class="card">
+        <h2>知识源详情</h2>
+        <p v-if="ksDetailErr" class="err">{{ ksDetailErr }}</p>
+        <template v-else-if="selectedSource">
+          <p class="meta">
+            {{ selectedSource.title }} · {{ selectedSource.source_kind }} ·
+            更新 {{ fmtTime(selectedSource.updated_at) }}
+          </p>
+          <p>{{ selectedSource.description || '无描述' }}</p>
+        </template>
+        <p v-else class="muted">选择左侧知识源查看详情</p>
+      </div>
+    </div>
   </section>
 </template>
 
@@ -87,6 +155,7 @@ onMounted(load)
 h1 { margin: 0 0 0.35rem; font-size: 1.35rem; }
 h2 { margin: 0 0 0.6rem; font-size: 1.05rem; }
 .layout { display: grid; grid-template-columns: 1fr 1.1fr; gap: 1rem; margin-top: 1rem; }
+.ks-gap { margin-top: 1.5rem; }
 .meta { color: var(--muted); font-size: 0.85rem; margin-bottom: 0.5rem; }
 pre {
   margin: 0;

apps/api/internal/handler/admin_ai_config.go

@@ -16,6 +16,8 @@ func (h *AdminHandler) registerAIConfig(authed *gin.RouterGroup) {
 	g := authed.Group("/ai")
 	g.GET("/system-prompts", middleware.RequireAdminPermission(h.Svc, admin.PermAIConfigRead), h.ListSystemPrompts)
 	g.GET("/system-prompts/:id", middleware.RequireAdminPermission(h.Svc, admin.PermAIConfigRead), h.GetSystemPrompt)
+	g.GET("/knowledge-sources", middleware.RequireAdminPermission(h.Svc, admin.PermAIConfigRead), h.ListKnowledgeSources)
+	g.GET("/knowledge-sources/:id", middleware.RequireAdminPermission(h.Svc, admin.PermAIConfigRead), h.GetKnowledgeSource)
 }
 
 func (h *AdminHandler) ListSystemPrompts(c *gin.Context) {
@@ -44,3 +46,30 @@ func (h *AdminHandler) GetSystemPrompt(c *gin.Context) {
 	}
 	response.OK(c, row)
 }
+
+func (h *AdminHandler) ListKnowledgeSources(c *gin.Context) {
+	items, err := h.Svc.ListKnowledgeSources(c.Request.Context())
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50029, "list knowledge sources failed")
+		return
+	}
+	response.OK(c, gin.H{"items": items})
+}
+
+func (h *AdminHandler) GetKnowledgeSource(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40002, "invalid id")
+		return
+	}
+	row, err := h.Svc.GetKnowledgeSource(c.Request.Context(), id)
+	if errors.Is(err, admin.ErrKnowledgeSourceNotFound) {
+		response.Fail(c, http.StatusNotFound, 40405, "knowledge source not found")
+		return
+	}
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50030, "get knowledge source failed")
+		return
+	}
+	response.OK(c, row)
+}

apps/api/internal/integration/knowledge_source_test.go

@@ -0,0 +1,105 @@
+package integration_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func TestAICoreKnowledgeSources(t *testing.T) {
+	r, pool := setupAPIPool(t)
+	ctx := context.Background()
+	tok := adminLogin(t, r, "admin", "change-me")
+
+	_, code := doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ai/knowledge-sources", nil, "")
+	if code != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d", code)
+	}
+
+	limitedRoleID := uuid.New()
+	_, err := pool.Exec(ctx, `
+		INSERT INTO admin_roles(id, name, system) VALUES ($1,$2,false)`,
+		limitedRoleID, "ks_lim_"+limitedRoleID.String()[:8])
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = pool.Exec(ctx, `
+		INSERT INTO admin_role_permissions(role_id, code) VALUES ($1,'admin.users.read')`, limitedRoleID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte("limited-pass"), bcrypt.DefaultCost)
+	if err != nil {
+		t.Fatal(err)
+	}
+	limUser := fmt.Sprintf("kslim_%d", time.Now().UnixNano())
+	_, err = pool.Exec(ctx, `
+		INSERT INTO admin_accounts(username, password_hash, role_id) VALUES ($1,$2,$3)`,
+		limUser, string(hash), limitedRoleID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM admin_accounts WHERE username=$1`, limUser)
+		_, _ = pool.Exec(ctx, `DELETE FROM admin_roles WHERE id=$1`, limitedRoleID)
+	})
+	limTok := adminLogin(t, r, limUser, "limited-pass")
+	_, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ai/knowledge-sources", nil, limTok)
+	if code != http.StatusForbidden {
+		t.Fatalf("expected 403, got %d", code)
+	}
+
+	start := time.Now()
+	env, code := doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ai/knowledge-sources", nil, tok)
+	if code != 200 || env.Code != 0 {
+		t.Fatalf("list http=%d msg=%s", code, env.Message)
+	}
+	if time.Since(start) > 500*time.Millisecond {
+		t.Fatalf("list too slow %v", time.Since(start))
+	}
+	var list struct {
+		Items []struct {
+			ID         string `json:"id"`
+			Code       string `json:"code"`
+			SourceKind string `json:"source_kind"`
+		} `json:"items"`
+	}
+	_ = json.Unmarshal(env.Data, &list)
+	var srcID string
+	for _, it := range list.Items {
+		if it.Code == "ask_grounding" {
+			srcID = it.ID
+			if it.SourceKind != "faq" && it.SourceKind != "policy" && it.SourceKind != "guide" {
+				t.Fatalf("bad source_kind %q", it.SourceKind)
+			}
+			break
+		}
+	}
+	if srcID == "" {
+		t.Fatalf("missing ask_grounding: %#v", list.Items)
+	}
+
+	env, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ai/knowledge-sources/"+srcID, nil, tok)
+	if code != 200 {
+		t.Fatalf("get %d", code)
+	}
+	var detail struct {
+		Code       string `json:"code"`
+		SourceKind string `json:"source_kind"`
+	}
+	_ = json.Unmarshal(env.Data, &detail)
+	if detail.Code != "ask_grounding" || detail.SourceKind == "" {
+		t.Fatalf("bad detail %#v", detail)
+	}
+
+	_, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ai/knowledge-sources/"+fakeUUID(), nil, tok)
+	if code != http.StatusNotFound {
+		t.Fatalf("expected 404, got %d", code)
+	}
+}

apps/api/internal/repository/ai_config_repo.go

@@ -60,3 +60,59 @@ func (r *AdminRepo) GetSystemPrompt(ctx context.Context, id uuid.UUID) (*SystemP
 	}
 	return &p, nil
 }
+
+// KnowledgeSourceRow is AICoreConfig KnowledgeSource catalog row.
+type KnowledgeSourceRow struct {
+	ID          uuid.UUID `json:"id"`
+	Code        string    `json:"code"`
+	Title       string    `json:"title"`
+	Description *string   `json:"description,omitempty"`
+	SourceKind  string    `json:"source_kind"`
+	Version     int       `json:"version"`
+	Active      bool      `json:"active"`
+	System      bool      `json:"system"`
+	UpdatedAt   time.Time `json:"updated_at"`
+}
+
+// ListKnowledgeSources returns knowledge source catalog.
+func (r *AdminRepo) ListKnowledgeSources(ctx context.Context) ([]KnowledgeSourceRow, error) {
+	rows, err := r.Pool.Query(ctx, `
+		SELECT id, code, title, description, source_kind, version, active, system, updated_at
+		FROM knowledge_sources
+		ORDER BY active DESC, code ASC`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []KnowledgeSourceRow
+	for rows.Next() {
+		var k KnowledgeSourceRow
+		if err := rows.Scan(
+			&k.ID, &k.Code, &k.Title, &k.Description, &k.SourceKind,
+			&k.Version, &k.Active, &k.System, &k.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		out = append(out, k)
+	}
+	return out, rows.Err()
+}
+
+// GetKnowledgeSource loads one source by id.
+func (r *AdminRepo) GetKnowledgeSource(ctx context.Context, id uuid.UUID) (*KnowledgeSourceRow, error) {
+	var k KnowledgeSourceRow
+	err := r.Pool.QueryRow(ctx, `
+		SELECT id, code, title, description, source_kind, version, active, system, updated_at
+		FROM knowledge_sources WHERE id=$1`, id,
+	).Scan(
+		&k.ID, &k.Code, &k.Title, &k.Description, &k.SourceKind,
+		&k.Version, &k.Active, &k.System, &k.UpdatedAt,
+	)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, err
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &k, nil
+}

apps/api/internal/service/admin/ai_config.go

@@ -11,6 +11,7 @@ import (
 )
 
 var ErrSystemPromptNotFound = errString("system prompt not found")
+var ErrKnowledgeSourceNotFound = errString("knowledge source not found")
 
 // ListSystemPrompts returns SystemPrompt catalog.
 func (s *Service) ListSystemPrompts(ctx context.Context) ([]repository.SystemPromptRow, error) {
@@ -32,3 +33,24 @@ func (s *Service) GetSystemPrompt(ctx context.Context, id uuid.UUID) (*repositor
 	}
 	return row, err
 }
+
+// ListKnowledgeSources returns KnowledgeSource catalog.
+func (s *Service) ListKnowledgeSources(ctx context.Context) ([]repository.KnowledgeSourceRow, error) {
+	items, err := s.Repo.ListKnowledgeSources(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if items == nil {
+		items = []repository.KnowledgeSourceRow{}
+	}
+	return items, nil
+}
+
+// GetKnowledgeSource loads one source.
+func (s *Service) GetKnowledgeSource(ctx context.Context, id uuid.UUID) (*repository.KnowledgeSourceRow, error) {
+	row, err := s.Repo.GetKnowledgeSource(ctx, id)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, ErrKnowledgeSourceNotFound
+	}
+	return row, err
+}

apps/api/migrations/000024_knowledge_sources.down.sql

@@ -0,0 +1,2 @@
+-- ECR-023 down
+DROP TABLE IF EXISTS knowledge_sources;

apps/api/migrations/000024_knowledge_sources.up.sql

@@ -0,0 +1,29 @@
+-- ECR-023 AICoreConfig KnowledgeSource (read catalog)
+
+CREATE TABLE IF NOT EXISTS knowledge_sources (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  code varchar(64) NOT NULL UNIQUE,
+  title varchar(128) NOT NULL,
+  description text NULL,
+  source_kind varchar(32) NOT NULL
+    CHECK (source_kind IN ('faq', 'policy', 'guide')),
+  version int NOT NULL DEFAULT 1 CHECK (version > 0),
+  active boolean NOT NULL DEFAULT true,
+  system boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_knowledge_sources_active ON knowledge_sources(active);
+
+INSERT INTO knowledge_sources(code, title, description, source_kind, version, active, system)
+VALUES (
+  'ask_grounding',
+  '问答 grounding 知识源',
+  '运营可观测的 Ask grounding 目录占位；本切片不含 KnowledgeChunk。',
+  'faq',
+  1,
+  true,
+  true
+)
+ON CONFLICT (code) DO NOTHING;

docs/BACKEND_DESIGN/BD-2026-023-knowledge-source.md

@@ -0,0 +1,24 @@
+# Backend Design: ECR-023 KnowledgeSource
+
+| ID | BD-2026-023 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000024 |
+
+## Backend Change Boundary
+
+```text
+Domain: KnowledgeSource (read catalog only)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/ai/knowledge-sources[+/:id]
+Permission: admin.ai_config.read (reuse; no new perm)
+Migration: 000024 knowledge_sources + seed ask_grounding
+UI: admin-h5 /ai KnowledgeSource panel
+```
+
+## Out of boundary
+
+KnowledgeChunk · Embedding · upload/publish · ToolDefinition · UGC · Payment · runtime RAG wiring
+
+Rollback: down migration + remove routes/UI panel

docs/CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## 2026-08-08
 
+- **ECR-023 Closed**：AICoreConfig KnowledgeSource（`knowledge_sources` · admin-h5 `/ai` · migration 000024 · 只读）  
 - **ECR-022 Closed**：CrisisCare CrisisPolicy（`crisis_policies` · evaluate · admin-h5 `/crisis` · migration 000023）  
 - **ECR-021 Closed**：AICoreConfig SystemPrompt（`system_prompts` · admin-h5 `/ai` · migration 000022 · 只读）  
 

docs/CODE_REVIEW/ECR-023.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-023
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- KnowledgeSource 只读；无 Chunk/Embedding/UGC  
+- Integration AC mapped · OpenAPI updated · 复用 admin.ai_config.read

docs/CONTRACT_DIFF/ECR-023.yaml

@@ -0,0 +1,23 @@
+ecr: ECR-023
+capability: AICoreConfig
+bounded_context: Ask_Ops
+parent: WAVE0-FROZEN
+predecessor: ECR-022
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds knowledge_sources catalog with system seed ask_grounding and read admin APIs.
+  Reuses admin.ai_config.read. Does not introduce KnowledgeChunk or embeddings.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/ai/knowledge-sources
+    change: added
+  - method: GET
+    path: /api/v1/admin/ai/knowledge-sources/{id}
+    change: added
+perms:
+  - code: admin.ai_config.read
+    change: unchanged

docs/ECR/ECR-023-knowledge-source.md

@@ -0,0 +1,19 @@
+# ECR-023
+
+**Title:** AICoreConfig · KnowledgeSource（只读薄切片）  
+**Status:** **Closed**  
+**Closed:** 2026-08-08（Loop continuous）  
+**Parent:** WAVE0-FROZEN · **Predecessor:** ECR-022 Closed  
+**Change Level:** L2  
+
+## Change
+
+`knowledge_sources` + `GET /admin/ai/knowledge-sources*`；复用 `admin.ai_config.read`；admin-h5「AI」页增知识源区。  
+
+## Forbidden
+
+KnowledgeChunk/Embedding 写 · 源上传 · 在线发布 · UGC · 真支付  
+
+## Linked
+
+Spec `ops-knowledge-source.md` · BD-2026-023 · CONTRACT_DIFF/ECR-023.yaml · TEST_REPORT/ECR-023.md

docs/ENGINEERING_SPEC/ECR-023-knowledge-source.md

@@ -0,0 +1,7 @@
+# ENGINEERING_SPEC — ECR-023
+
+1. migration 000024 knowledge_sources + seed  
+2. AdminRepo list/get KnowledgeSource  
+3. Admin API + OpenAPI  
+4. admin-h5 /ai 知识源区  
+5. Integration · Closed  

docs/HANDOFF/ECR-023-architect-to-engineer.md

@@ -0,0 +1,4 @@
+# HANDOFF — ECR-023 Architect → Engineer
+
+Loop continuous · Approved + Coding. Migration 000024. Forbidden: Chunk/Embedding/UGC/真支付.
+复用 admin.ai_config.read。

docs/HANDOFF/ECR-023-engineer-to-reviewer.md

@@ -0,0 +1,3 @@
+# HANDOFF — ECR-023 Engineer → Reviewer
+
+TestAICoreKnowledgeSources PASS · /ai 知识源区 · Ready for Closed.

docs/PRODUCT_SPEC/ECR-023-knowledge-source.md

@@ -0,0 +1,3 @@
+# PRODUCT_SPEC — ECR-023
+
+对齐 ops-knowledge-source.md · Approved · Loop · L2 · KnowledgeSource 只读

docs/STATE/ECR-023.md

@@ -0,0 +1,6 @@
+# STATE — ECR-023
+
+| Status | **Closed** |
+| Phase | closed |
+| Spec | ops-knowledge-source.md |
+| Updated | 2026-08-08 |

docs/TASKS/TASK-023-ECR023.yaml

@@ -0,0 +1,12 @@
+id: TASK-023-ECR023
+ecr: ECR-023
+title: AICoreConfig KnowledgeSource read
+role: engineer
+status: closed
+change_level: L2
+parent: WAVE0-FROZEN
+predecessor: ECR-022
+acceptance:
+  - Spec AC mapped
+  - KnowledgeSource read only
+  - No Chunk / Embedding / UGC / payment

docs/TEST_REPORT/ECR-023.md

@@ -0,0 +1,33 @@
+# TEST_REPORT — ECR-023 KnowledgeSource
+
+Date: 2026-08-08 · Loop continuous · commit: `PENDING`
+
+## Commands
+
+```bash
+cd apps/api && go test ./internal/integration/ -run TestAICoreKnowledgeSources -count=1
+npm run build:admin
+python3 scripts/ess-validate.py --phase review --ecr ECR-023
+python3 scripts/ess-gate-check.py --ecr ECR-023
+```
+
+## Results
+
+| Check | Result |
+|-------|--------|
+| TestAICoreKnowledgeSources | PASS |
+| build:admin | PASS |
+| ess-validate review | PASS |
+| ess-gate-check | PASS |
+
+## AC
+
+| ID | Evidence |
+|----|----------|
+| AC-F-01 | list 含 ask_grounding |
+| AC-F-02 | get source_kind 合法 |
+| AC-F-03 | 未知 id → 404 |
+| AC-S-01 | 无 token → 401 |
+| AC-S-02 | 仅 users.read → 403 |
+| AC-P-01 | list < 500ms |
+| AC-O-01 | N/A 只读 |

docs/TRACEABILITY.md

@@ -27,3 +27,4 @@
 | ECR-020 | QualityFeedback | **Closed** | Spec ops-quality-feedback · BD-2026-020 · migration 000021 · TEST_REPORT · CODE_REVIEW · Loop continuous |
 | ECR-021 | AICoreConfig | **Closed** | Spec ops-ai-core-config · BD-2026-021 · migration 000022 · TEST_REPORT · CODE_REVIEW · Loop continuous |
 | ECR-022 | CrisisCare | **Closed** | Spec ops-crisis-care · BD-2026-022 · migration 000023 · TEST_REPORT · CODE_REVIEW · Loop continuous |
+| ECR-023 | AICoreConfig · KnowledgeSource | **Closed** | Spec ops-knowledge-source · BD-2026-023 · migration 000024 · TEST_REPORT · CODE_REVIEW · Loop continuous |

docs/WAVE0/LOOP_AUTHORIZATION.md

@@ -30,4 +30,4 @@ Human 明文：**直接用 Loop，不用人工确认。**
 
 | Done | Next |
 |------|------|
-| ECR-013A…022 Closed | **ECR-023** KnowledgeSource 薄切片（只读优先）或 Banner/OpsCMS；禁真支付/UGC |
+| ECR-013A…023 Closed | **ECR-024** Banner/OpsCMS 薄切片（只读优先）或 KnowledgeChunk；禁真支付/UGC |

proto/openapi.yaml

@@ -555,6 +555,34 @@ paths:
         '404':
           description: Not found
 
+  /api/v1/admin/ai/knowledge-sources:
+    get:
+      tags: [admin]
+      summary: List KnowledgeSource catalog
+      description: Requires admin.ai_config.read
+      responses:
+        '200':
+          description: OK
+        '401':
+          description: Unauthorized
+        '403':
+          description: Forbidden
+
+  /api/v1/admin/ai/knowledge-sources/{id}:
+    get:
+      tags: [admin]
+      summary: Get KnowledgeSource
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema: { type: string, format: uuid }
+      responses:
+        '200':
+          description: OK
+        '404':
+          description: Not found
+
   /api/v1/admin/crisis/policies:
     get:
       tags: [admin]