feat(ECR-027): AICoreConfig KnowledgeChunk 只读并 Closed

KnowledgeChunk catalog (000028) · Loop continuous.

.ai/product/feature-spec/README.md

@@ -36,6 +36,7 @@
 | [ops-banner.md](ops-banner.md) | OpsCMS Banner | §7 | `admin-h5` `/cms` · `GET /admin/cms/banners*` | Ops-D · **ECR-024 Closed** |
 | [ops-feed-slot.md](ops-feed-slot.md) | OpsCMS FeedSlot | §7 | `admin-h5` `/cms` · `GET /admin/cms/feed-slots*` | Ops-D · **ECR-025 Closed** |
 | [ops-scheduled-publication.md](ops-scheduled-publication.md) | OpsCMS ScheduledPublication | §7 | `GET /admin/cms/publications*` | Ops-D · **ECR-026 Closed** |
+| [ops-knowledge-chunk.md](ops-knowledge-chunk.md) | AICoreConfig KnowledgeChunk | §7 | `GET /admin/ai/knowledge-chunks*` | Ops-D · **ECR-027 Closed** |
 
 新功能：复制 `_TEMPLATE.md` → 填满 → 在本表登记 → 再编码。
 

.ai/product/feature-spec/ops-knowledge-chunk.md

@@ -0,0 +1,41 @@
+# Feature Spec: AICoreConfig · KnowledgeChunk（Ops · ECR-027）
+
+> Status: `Active`（Loop continuous · **ECR-027 Closed**）  
+> Parent: WAVE0-FROZEN · Predecessor: ECR-026 Closed  
+> Capability: `AICoreConfig` · BC: `Ask_Ops`  
+> 授权：`docs/WAVE0/LOOP_AUTHORIZATION.md`
+
+## Non-goals
+
+Embedding · 上传切块 · 运行时 RAG 接线 · UGC · 真支付
+
+## L2 Domain
+
+| 概念 | 语义 |
+|------|------|
+| `KnowledgeChunk` | 本切片只读目录；code 唯一（若适用） |
+
+## L3 API
+
+| Method | Path | 权限 | 语义 |
+|--------|------|------|------|
+| GET | `/admin/ai/knowledge-chunks` | `admin.ai_config.read` | 只读 |
+| GET | `/admin/ai/knowledge-chunks/{id}` | `admin.ai_config.read` | 只读 |
+
+## Migration
+
+`000028`：表 + 种子（若有）（权限复用）
+
+## L4 AC
+
+| ID | Then |
+|----|------|
+| AC-F-01 | list 含种子或空列表合法 |
+| AC-F-02 | 已知 id get 200 |
+| AC-F-03 | 未知 id → 404 |
+| AC-S-01 | 无 Admin → 401 |
+| AC-S-02 | 无权限 → 403 |
+| AC-P-01 | list < 500ms |
+| AC-O-01 | N/A 只读 |
+
+contract_diff: `docs/CONTRACT_DIFF/ECR-027.yaml`

apps/admin-h5/src/api/client.ts

@@ -441,6 +441,10 @@ export const adminApi = {
     request<{ items: Array<Record<string, unknown>> }>('GET', '/cms/publications'),
   publication: (id: string) =>
     request<Record<string, unknown>>('GET', `/cms/publications/${id}`),
+  knowledgeChunks: () =>
+    request<{ items: Array<Record<string, unknown>> }>('GET', '/ai/knowledge-chunks'),
+  knowledgeChunk: (id: string) =>
+    request<Record<string, unknown>>('GET', `/ai/knowledge-chunks/${id}`),
   orders: () =>
     request<{
       items: Array<{

apps/api/internal/handler/admin.go

@@ -55,6 +55,7 @@ func (h *AdminHandler) Register(api *gin.RouterGroup) {
 	h.registerCrisis(authed)
 	h.registerCMS(authed)
 	h.registerCMSPublications(authed)
+	h.registerKnowledgeChunks(authed)
 }
 
 func (h *AdminHandler) Login(c *gin.Context) {

apps/api/internal/handler/admin_knowledge_chunk.go

@@ -0,0 +1,46 @@
+package handler
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+
+	"github.com/yuxingu/digital-psychology/apps/api/internal/middleware"
+	"github.com/yuxingu/digital-psychology/apps/api/internal/service/admin"
+	"github.com/yuxingu/digital-psychology/apps/api/pkg/response"
+)
+
+func (h *AdminHandler) registerKnowledgeChunks(authed *gin.RouterGroup) {
+	g := authed.Group("/ai")
+	g.GET("/knowledge-chunks", middleware.RequireAdminPermission(h.Svc, admin.PermAIConfigRead), h.ListKnowledgeChunks)
+	g.GET("/knowledge-chunks/:id", middleware.RequireAdminPermission(h.Svc, admin.PermAIConfigRead), h.GetKnowledgeChunk)
+}
+
+func (h *AdminHandler) ListKnowledgeChunks(c *gin.Context) {
+	items, err := h.Svc.ListKnowledgeChunks(c.Request.Context())
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50050, "list knowledge-chunk failed")
+		return
+	}
+	response.OK(c, gin.H{"items": items})
+}
+
+func (h *AdminHandler) GetKnowledgeChunk(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40002, "invalid id")
+		return
+	}
+	row, err := h.Svc.GetKnowledgeChunk(c.Request.Context(), id)
+	if errors.Is(err, admin.ErrKnowledgeChunkNotFound) {
+		response.Fail(c, http.StatusNotFound, 40420, "knowledge-chunk not found")
+		return
+	}
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50051, "get knowledge-chunk failed")
+		return
+	}
+	response.OK(c, row)
+}

apps/api/internal/integration/knowledge_chunk_test.go

@@ -0,0 +1,88 @@
+package integration_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func TestAICoreKnowledgeChunks(t *testing.T) {
+	r, pool := setupAPIPool(t)
+	ctx := context.Background()
+	tok := adminLogin(t, r, "admin", "change-me")
+
+	_, code := doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ai/knowledge-chunks", nil, "")
+	if code != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d", code)
+	}
+
+	limitedRoleID := uuid.New()
+	_, err := pool.Exec(ctx, `INSERT INTO admin_roles(id, name, system) VALUES ($1,$2,false)`,
+		limitedRoleID, "lim_"+limitedRoleID.String()[:8])
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = pool.Exec(ctx, `INSERT INTO admin_role_permissions(role_id, code) VALUES ($1,'admin.users.read')`, limitedRoleID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte("limited-pass"), bcrypt.DefaultCost)
+	if err != nil {
+		t.Fatal(err)
+	}
+	limUser := fmt.Sprintf("lim_%d", time.Now().UnixNano())
+	_, err = pool.Exec(ctx, `INSERT INTO admin_accounts(username, password_hash, role_id) VALUES ($1,$2,$3)`,
+	limUser, string(hash), limitedRoleID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM admin_accounts WHERE username=$1`, limUser)
+		_, _ = pool.Exec(ctx, `DELETE FROM admin_roles WHERE id=$1`, limitedRoleID)
+	})
+	limTok := adminLogin(t, r, limUser, "limited-pass")
+	_, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ai/knowledge-chunks", nil, limTok)
+	if code != http.StatusForbidden {
+		t.Fatalf("expected 403, got %d", code)
+	}
+
+	start := time.Now()
+	env, code := doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ai/knowledge-chunks", nil, tok)
+	if code != 200 || env.Code != 0 {
+		t.Fatalf("list http=%d msg=%s", code, env.Message)
+	}
+	if time.Since(start) > 500*time.Millisecond {
+		t.Fatalf("list too slow %v", time.Since(start))
+	}
+	var list struct {
+		Items []struct {
+			ID   string `json:"id"`
+			Code string `json:"code"`
+		} `json:"items"`
+	}
+	_ = json.Unmarshal(env.Data, &list)
+	var id string
+	for _, it := range list.Items {
+		if it.Code == "ask_grounding_intro" {
+			id = it.ID
+			break
+		}
+	}
+	if id == "" {
+		t.Fatalf("missing ask_grounding_intro: %#v", list.Items)
+	}
+	env, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ai/knowledge-chunks/"+id, nil, tok)
+	if code != 200 {
+		t.Fatalf("get %d", code)
+	}
+	_, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ai/knowledge-chunks/"+fakeUUID(), nil, tok)
+	if code != http.StatusNotFound {
+		t.Fatalf("expected 404, got %d", code)
+	}
+}

apps/api/internal/repository/knowledge_chunk_repo.go

@@ -0,0 +1,59 @@
+package repository
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+)
+
+// KnowledgeChunkRow is KnowledgeChunk catalog row.
+type KnowledgeChunkRow struct {
+	ID uuid.UUID `json:"id"`
+	Code string `json:"code"`
+	SourceCode string `json:"source_code"`
+	Title string `json:"title"`
+	Body string `json:"body"`
+	Active bool `json:"active"`
+	System bool `json:"system"`
+	UpdatedAt time.Time `json:"updated_at"`
+}
+
+// ListKnowledgeChunks returns KnowledgeChunk catalog.
+func (r *AdminRepo) ListKnowledgeChunks(ctx context.Context) ([]KnowledgeChunkRow, error) {
+	rows, err := r.Pool.Query(ctx, `
+		SELECT id, code, source_code, title, body, active, system, updated_at
+		FROM knowledge_chunks
+		ORDER BY active DESC, code ASC`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []KnowledgeChunkRow
+	for rows.Next() {
+		var row KnowledgeChunkRow
+		if err := rows.Scan(&row.ID, &row.Code, &row.SourceCode, &row.Title, &row.Body, &row.Active, &row.System, &row.UpdatedAt); err != nil {
+			return nil, err
+		}
+		out = append(out, row)
+	}
+	return out, rows.Err()
+}
+
+// GetKnowledgeChunk loads one by id.
+func (r *AdminRepo) GetKnowledgeChunk(ctx context.Context, id uuid.UUID) (*KnowledgeChunkRow, error) {
+	var row KnowledgeChunkRow
+	err := r.Pool.QueryRow(ctx, `
+		SELECT id, code, source_code, title, body, active, system, updated_at
+		FROM knowledge_chunks WHERE id=$1`, id,
+	).Scan(&row.ID, &row.Code, &row.SourceCode, &row.Title, &row.Body, &row.Active, &row.System, &row.UpdatedAt)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, err
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &row, nil
+}

apps/api/internal/service/admin/knowledge_chunk.go

@@ -0,0 +1,34 @@
+package admin
+
+import (
+	"context"
+	"errors"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+
+	"github.com/yuxingu/digital-psychology/apps/api/internal/repository"
+)
+
+var ErrKnowledgeChunkNotFound = errString("knowledge chunk not found")
+
+// ListKnowledgeChunks returns catalog.
+func (s *Service) ListKnowledgeChunks(ctx context.Context) ([]repository.KnowledgeChunkRow, error) {
+	items, err := s.Repo.ListKnowledgeChunks(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if items == nil {
+		items = []repository.KnowledgeChunkRow{}
+	}
+	return items, nil
+}
+
+// GetKnowledgeChunk loads one.
+func (s *Service) GetKnowledgeChunk(ctx context.Context, id uuid.UUID) (*repository.KnowledgeChunkRow, error) {
+	row, err := s.Repo.GetKnowledgeChunk(ctx, id)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, ErrKnowledgeChunkNotFound
+	}
+	return row, err
+}

apps/api/migrations/000028_knowledge_chunks.down.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS knowledge_chunks;

apps/api/migrations/000028_knowledge_chunks.up.sql

@@ -0,0 +1,19 @@
+-- ECR-027 KnowledgeChunk (read catalog)
+
+CREATE TABLE IF NOT EXISTS knowledge_chunks (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  code varchar(64) NOT NULL UNIQUE,
+  source_code varchar(64) NOT NULL,
+  title varchar(128) NOT NULL,
+  body text NOT NULL,
+  active boolean NOT NULL DEFAULT true,
+  system boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_knowledge_chunks_active ON knowledge_chunks(active);
+
+INSERT INTO knowledge_chunks(code, source_code, title, body, active, system)
+VALUES ('ask_grounding_intro', 'ask_grounding', '问答 grounding 引言块', '愈心谷提供陪伴式成长对话，非医疗诊断。', true, true)
+ON CONFLICT (code) DO NOTHING;

docs/BACKEND_DESIGN/BD-2026-027-knowledge-chunk.md

@@ -0,0 +1,23 @@
+# Backend Design: ECR-027 KnowledgeChunk
+
+| ID | BD-2026-027 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000028 |
+
+## Backend Change Boundary
+
+```text
+Domain: KnowledgeChunk (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/ai/knowledge-chunks; GET /admin/ai/knowledge-chunks/{id}
+Permission: admin.ai_config.read
+Migration: 000028
+```
+
+## Out of boundary
+
+Embedding · 上传切块 · 运行时 RAG 接线 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI

docs/CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## 2026-08-08
 
+- **ECR-027 Closed**：AICoreConfig KnowledgeChunk（migration 000028 · admin client · /ai/knowledge-chunks · 只读）  
 - **ECR-026 Closed**：OpsCMS ScheduledPublication（migration 000027 · admin-h5 client + /cms · 只读）  
 - **ECR-025 Closed**：OpsCMS FeedSlot（migration 000026 · admin-h5 /cms · 只读）  
 - **ECR-024 Closed**：OpsCMS Banner（`ops_banners` · admin-h5 `/cms` · migration 000025 · 只读）  

docs/CODE_REVIEW/ECR-027.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-027
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- KnowledgeChunk 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated

docs/CONTRACT_DIFF/ECR-027.yaml

@@ -0,0 +1,22 @@
+ecr: ECR-027
+capability: AICoreConfig
+bounded_context: Ask_Ops
+parent: WAVE0-FROZEN
+predecessor: ECR-026
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  Adds KnowledgeChunk read catalog. Forbidden: UGC / real payment.
+
+apis:
+  - method: GET
+    path: /api/v1/admin/ai/knowledge-chunks
+    change: added
+  - method: GET
+    path: /api/v1/admin/ai/knowledge-chunks/{id}
+    change: added
+perms:
+  - code: admin.ai_config.read
+    change: unchanged

docs/ECR/ECR-027-knowledge-chunk.md

@@ -0,0 +1,15 @@
+# ECR-027
+
+**Title:** AICoreConfig · KnowledgeChunk（只读薄切片）  
+**Status:** **Closed**  
+**Closed:** 2026-08-08（Loop continuous）  
+**Parent:** WAVE0-FROZEN · **Predecessor:** ECR-026 Closed  
+**Change Level:** L2  
+
+## Change
+
+KnowledgeChunk 只读 · migration 000028 · admin client · /ai/knowledge-chunks
+
+## Linked
+
+Spec `ops-knowledge-chunk.md` · BD-2026-027 · CONTRACT_DIFF/ECR-027.yaml · TEST_REPORT/ECR-027.md

docs/ENGINEERING_SPEC/ECR-027-knowledge-chunk.md

@@ -0,0 +1,6 @@
+# ENGINEERING_SPEC — ECR-027
+
+1. migration 000028
+2. AdminRepo/Service/Handler
+3. OpenAPI + admin-h5
+4. Integration · Closed

docs/HANDOFF/ECR-027-architect-to-engineer.md

@@ -0,0 +1,3 @@
+# HANDOFF — ECR-027 Architect → Engineer
+
+Loop continuous · Approved + Coding. Migration 000028. Forbidden: UGC/真支付.

docs/HANDOFF/ECR-027-engineer-to-reviewer.md

@@ -0,0 +1,3 @@
+# HANDOFF — ECR-027 Engineer → Reviewer
+
+TestAICoreKnowledgeChunks PASS · Ready for Closed.

docs/PRODUCT_SPEC/ECR-027-knowledge-chunk.md

@@ -0,0 +1,3 @@
+# PRODUCT_SPEC — ECR-027
+
+对齐 ops-knowledge-chunk.md · Approved · Loop · L2 · KnowledgeChunk 只读

docs/STATE/ECR-027.md

@@ -0,0 +1,6 @@
+# STATE — ECR-027
+
+| Status | **Closed** |
+| Phase | closed |
+| Spec | ops-knowledge-chunk.md |
+| Updated | 2026-08-08 |

docs/TASKS/TASK-027-ECR027.yaml

@@ -0,0 +1,12 @@
+id: TASK-027-ECR027
+ecr: ECR-027
+title: AICoreConfig · KnowledgeChunk（只读薄切片）
+role: engineer
+status: closed
+change_level: L2
+parent: WAVE0-FROZEN
+predecessor: ECR-026
+acceptance:
+  - Spec AC mapped
+  - KnowledgeChunk read only
+  - No UGC / payment

docs/TEST_REPORT/ECR-027.md

@@ -0,0 +1,33 @@
+# TEST_REPORT — ECR-027 KnowledgeChunk
+
+Date: 2026-08-08 · Loop continuous · commit: `PENDING`
+
+## Commands
+
+```bash
+cd apps/api && go test ./internal/integration/ -run TestAICoreKnowledgeChunks -count=1
+npm run build:admin
+python3 scripts/ess-validate.py --phase review --ecr ECR-027
+python3 scripts/ess-gate-check.py --ecr ECR-027
+```
+
+## Results
+
+| Check | Result |
+|-------|--------|
+| TestAICoreKnowledgeChunks | PASS |
+| build:admin | PASS |
+| ess-validate review | PASS |
+| ess-gate-check | PASS |
+
+## AC
+
+| ID | Evidence |
+|----|----------|
+| AC-F-01 | list seed/empty ok |
+| AC-F-02 | get 200 |
+| AC-F-03 | 未知 id → 404 |
+| AC-S-01 | 401 |
+| AC-S-02 | 403 |
+| AC-P-01 | list < 500ms |
+| AC-O-01 | N/A 只读 |

docs/TRACEABILITY.md

@@ -31,3 +31,4 @@
 | ECR-024 | OpsCMS · Banner | **Closed** | Spec ops-banner · BD-2026-024 · migration 000025 · TEST_REPORT · CODE_REVIEW · Loop continuous |
 | ECR-025 | OpsCMS · FeedSlot | **Closed** | Spec ops-feed-slot.md · BD-2026-025 · migration 000026 · TEST_REPORT · CODE_REVIEW · Loop continuous |
 | ECR-026 | OpsCMS · ScheduledPublication | **Closed** | Spec ops-scheduled-publication.md · BD-2026-026 · migration 000027 · TEST_REPORT · CODE_REVIEW · Loop continuous |
+| ECR-027 | AICoreConfig · KnowledgeChunk | **Closed** | Spec ops-knowledge-chunk.md · BD-2026-027 · migration 000028 · TEST_REPORT · CODE_REVIEW · Loop continuous |

docs/WAVE0/LOOP_AUTHORIZATION.md

@@ -55,4 +55,4 @@ Human 明文：**直接用 Loop，不用人工确认。**
 
 | Done | Next |
 |------|------|
-| ECR-013A…026 Closed | **ECR-027** KnowledgeChunk |
+| ECR-013A…027 Closed | **ECR-028** KnowledgeChunk→ToolDefinition |

proto/openapi.yaml

@@ -667,6 +667,34 @@ paths:
         '404':
           description: Not found
 
+  /api/v1/admin/ai/knowledge-chunks:
+    get:
+      tags: [admin]
+      summary: List KnowledgeChunk catalog
+      description: Requires admin.ai_config.read
+      responses:
+        '200':
+          description: OK
+        '401':
+          description: Unauthorized
+        '403':
+          description: Forbidden
+
+  /api/v1/admin/ai/knowledge-chunks/{id}:
+    get:
+      tags: [admin]
+      summary: Get KnowledgeChunk
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema: { type: string, format: uuid }
+      responses:
+        '200':
+          description: OK
+        '404':
+          description: Not found
+
   /api/v1/admin/crisis/policies:
     get:
       tags: [admin]

scripts/ops-batch-027-039.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+# Batch generate/test/close/commit Ops catalog ECRs 027-039
+set -euo pipefail
+export PATH=/home/jack/.local/go/bin:$PATH
+ROOT=/www/Project/digital-psychology
+cd "$ROOT"
+
+declare -A NEXT_MAP
+NEXT_MAP=(
+  [027]="ECR-028 KnowledgeChunk→ToolDefinition"
+  [028]="ECR-029 BlockPolicy"
+  [029]="ECR-030 ModerationCase"
+  [030]="ECR-031 CrisisEvent"
+  [031]="ECR-032 InterventionOutcome"
+  [032]="ECR-033 HandoffCase"
+  [033]="ECR-034 PrivacyRequest"
+  [034]="ECR-035 StarConfig"
+  [035]="ECR-036 RhythmConfig"
+  [036]="ECR-037 ImageCardDeck"
+  [037]="ECR-038 ReportTemplate"
+  [038]="ECR-039 FunnelDefinition"
+  [039]="ECR-040 ScaleDefinition 只读投影"
+)
+
+declare -A PRED_MAP
+PRED_MAP=(
+  [027]=ECR-026
+  [028]=ECR-027
+  [029]=ECR-028
+  [030]=ECR-029
+  [031]=ECR-030
+  [032]=ECR-031
+  [033]=ECR-032
+  [034]=ECR-033
+  [035]=ECR-034
+  [036]=ECR-035
+  [037]=ECR-036
+  [038]=ECR-037
+  [039]=ECR-038
+)
+
+for ECR in 027 028 029 030 031 032 033 034 035 036 037 038 039; do
+  echo "======== ECR-$ECR ========"
+  SPEC="docs/WAVE0/slice-specs/ecr-$ECR.json"
+  python3 scripts/ops-read-catalog-gen.py --spec "$SPEC"
+
+  # extract fields
+  TEST=$(python3 -c "import json;print(json.load(open('$SPEC'))['test_name'])")
+  SLUG=$(python3 -c "import json;print(json.load(open('$SPEC'))['slug'])")
+  CONCEPT=$(python3 -c "import json;print(json.load(open('$SPEC'))['concept'])")
+  CAP=$(python3 -c "import json;print(json.load(open('$SPEC'))['capability'])")
+  MIG=$(python3 -c "import json;print(json.load(open('$SPEC'))['migration'])")
+  TITLE=$(python3 -c "import json;print(json.load(open('$SPEC'))['title'])")
+  ROUTE=$(python3 -c "import json;d=json.load(open('$SPEC'));print(d['route_group']+'/'+d['route_resource'])")
+
+  (cd apps/api && go test ./internal/integration/ -run "^${TEST}$" -count=1)
+
+  NEXT="${NEXT_MAP[$ECR]}"
+  NEXT_ECR=$(echo "$NEXT" | awk '{print $1}')
+  NEXT_LABEL=$(echo "$NEXT" | cut -d' ' -f2-)
+  PRED="${PRED_MAP[$ECR]}"
+
+  python3 scripts/ess-slice-close.py \
+    --ecr "$ECR" --slug "$SLUG" --title "$TITLE" \
+    --concept "$CONCEPT" --capability "$CAP" --migration "$MIG" \
+    --test "$TEST" --ui "admin client · $ROUTE" --predecessor "$PRED" \
+    --next-ecr "$NEXT_ECR" --next-label "$NEXT_LABEL" \
+    --readme-line "| [ops-${SLUG}.md](ops-${SLUG}.md) | ${CAP} ${CONCEPT} | §7 | \`GET /admin${ROUTE}*\` | Ops-D · **ECR-${ECR} Closed** |"
+
+  # keep README table tidy: move appended line next to ops-scheduled if at EOF
+  python3 - << PY
+from pathlib import Path
+p = Path('.ai/product/feature-spec/README.md')
+t = p.read_text()
+line = '| [ops-${SLUG}.md](ops-${SLUG}.md) | ${CAP} ${CONCEPT} | §7 | \`GET /admin${ROUTE}*\` | Ops-D · **ECR-${ECR} Closed** |'
+# if line at end after markdown prose, relocate before "新功能"
+if line in t:
+    t2 = t.replace('\n'+line, '').replace(line+'\n', '')
+    anchor = '| [ops-scheduled-publication.md](ops-scheduled-publication.md)'
+    # find last ops- closed line in table
+    import re
+    m = list(re.finditer(r'\| \[ops-[^\n]+\| Ops-D · \*\*ECR-\d+ Closed\*\* \|\n', t2))
+    if m:
+        last = m[-1]
+        t2 = t2[:last.end()] + line + '\n' + t2[last.end():]
+        p.write_text(t2)
+PY
+
+  python3 scripts/ess-validate.py --phase review --ecr "ECR-$ECR"
+  python3 scripts/ess-gate-check.py --ecr "ECR-$ECR"
+
+  git add -A
+  git reset HEAD .gates 2>/dev/null || true
+  git add .ai apps docs proto scripts 2>/dev/null || true
+  git commit -m "feat(ECR-${ECR}): ${CAP} ${CONCEPT} 只读并 Closed
+
+${CONCEPT} catalog (${MIG}) · Loop continuous."
+
+  SHA=$(git rev-parse --short HEAD)
+  sed -i "s/commit: \`PENDING\`/commit: \`$SHA\`/" "docs/TEST_REPORT/ECR-$ECR.md"
+  git add "docs/TEST_REPORT/ECR-$ECR.md"
+  git commit -m "docs(ECR-${ECR}): TEST_REPORT 补 commit sha"
+  echo "CLOSED ECR-$ECR @ $SHA"
+done
+
+echo ALL_DONE_027_039