M1: 底座 —— @contracts 首版 + event / ledger / org / llm

@contracts 首版(§8.1 九个文件):
- id 品牌 ID / terminal 终态五名与归侧四标签 / envelope 信封六字段与四类事件
- card 工单两模式 + 对话卡族(形状对齐 2026-07-26 原型定稿)
- contract7 契约七件 / ledger 三级寻址与写三分 / process-package 流程包 DSL 与触发器三类
- manifest 活动包清单六区(含 CMMN·DMN·步序声明的资产形状)/ org / api 路由契约

模块(L1):
- event   信封存储、归属解析三级短路、投递五诺、监听注册表、三级消费裁定
- ledger  schema 自生长(最大化合并/最宽类型/只增不破坏)、任务视图叠加、写三分、冲突检查
- org     岗位授权(客体三类×动作三种)、停用前置检查、会话、种子播种
- llm     四元绑定、ModelGateway 三模式(live/record/replay)—— 两缝之一

app 装配:Hono 服务 + 鉴权中间件 + 治理台/工作台路由;drizzle 迁移;AES-256-GCM 凭证密封

ADR-007 工具链与门禁 · ADR-008 投递队列 · ADR-009 凭证加密
(ADR 编号自 007 续:编码规范 §14 已用到 006,README 写「从 005 续」是笔误)

门禁五道全绿;96 个测试通过,含对真实 PG 的 ledger 集成测试

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KeDBx2PHLavbURXB8LJJ7m

apps/api/src/modules/ledger/contract.ts

@@ -0,0 +1,96 @@
+/**
+ * module: ledger —— 对外类型(编码规范 §10.1)。只有类型和常量,没有实现。
+ */
+import type {
+  LedgerAddress,
+  LedgerKey,
+  LedgerPage,
+  LedgerQuery,
+  LedgerRow,
+  ObjectDeclaration,
+  TaskId,
+  WriteKind,
+} from '@contracts';
+import type { MaterializedObject, MergeConflict, MergeNotice, MergedObject } from './internal/domain/schema-merge.ts';
+import type { ConflictFinding } from './internal/domain/task-view.ts';
+
+export type { LedgerAddress, LedgerKey, LedgerPage, LedgerQuery, LedgerRow, ObjectDeclaration, WriteKind };
+export type { MaterializedObject, MergeConflict, MergeNotice, MergedObject, ConflictFinding };
+
+export class DraftConflictError extends Error {
+  constructor(readonly findings: readonly ConflictFinding[]) {
+    super(`草稿与正式版并发冲突:${findings.length} 处字段已被他单改动`);
+    this.name = 'DraftConflictError';
+  }
+}
+
+export class SchemaConflictError extends Error {
+  constructor(readonly conflicts: readonly MergeConflict[]) {
+    super(`台账声明语义互斥,交数据管理裁决:${conflicts.map((c) => `${c.field}(${c.message})`).join('; ')}`);
+    this.name = 'SchemaConflictError';
+  }
+}
+
+export class ObjectNotMaterializedError extends Error {
+  constructor(readonly address: string) {
+    super(`台账对象未物化:${address}`);
+    this.name = 'ObjectNotMaterializedError';
+  }
+}
+
+/** 声明合并与物化的结果 —— 安装静态审读它:conflicts 非空即不上架 */
+export type SchemaApplyResult = {
+  readonly merged: MergedObject | undefined;
+  readonly notices: readonly MergeNotice[];
+  readonly conflicts: readonly MergeConflict[];
+  readonly applied: boolean;
+};
+
+export type ObjectAddress = { readonly domain: string; readonly object: string };
+
+export type SystemWrite = {
+  readonly address: ObjectAddress;
+  readonly key: LedgerKey;
+  readonly values: LedgerRow;
+  /** 归因:哪条入站 / 哪次流转产生了这次系统写 */
+  readonly cause: { readonly kind: 'inbound' | 'engine' | 'governance'; readonly ref: string };
+  /** 系统写也可挂到任务上(入站归一到某任务),数据事件的目标即它 */
+  readonly taskId?: TaskId;
+};
+
+export type DraftWrite = {
+  readonly taskId: TaskId;
+  readonly address: ObjectAddress;
+  readonly key: LedgerKey;
+  readonly patch: LedgerRow;
+  readonly tombstone?: boolean;
+};
+
+export type ReleaseWriteResult = {
+  readonly mergedRows: number;
+  readonly emittedEvents: number;
+};
+
+/**
+ * 写三分是**三个不同方法**,不是一个带 flag 的方法 —— 调用方拿不到「绕门」的形态(§7.2)。
+ *   systemWrite  —— 登记世界已发生的事实,不过放行门,写正式版并**即时**抛数据事件
+ *   draftWrite   —— 任务级草稿层,读己之写,**不抛**事件
+ *   releaseWrite —— 放行通过,草稿合并入正式版,**此刻**抛数据事件;原子且过冲突检查
+ */
+export type LedgerService = {
+  applyDeclarations(declarations: readonly ObjectDeclaration[]): Promise<SchemaApplyResult[]>;
+  describe(address: ObjectAddress): Promise<MaterializedObject | undefined>;
+  listObjects(): Promise<ObjectAddress[]>;
+
+  systemWrite(write: SystemWrite): Promise<void>;
+  draftWrite(write: DraftWrite): Promise<void>;
+  releaseWrite(taskId: TaskId): Promise<ReleaseWriteResult>;
+
+  /** 正式版查询 —— 跨任务只见过门的事实 */
+  query(query: LedgerQuery): Promise<LedgerPage>;
+  /** 任务视图 = 正式版 + 本任务草稿层 */
+  taskView(taskId: TaskId, query: LedgerQuery): Promise<LedgerPage>;
+  /** 落地预检第五项:数据冲突检查 */
+  checkConflicts(taskId: TaskId): Promise<ConflictFinding[]>;
+  discardDrafts(taskId: TaskId): Promise<void>;
+};