Checklists forget.
Gates don’t.

清单会遗漏，门禁不放行。

FDE Scope turns the complete Forward-Deployed-Engineer SOP (4 zones, 18 phases, 10 executable gates) into a state machine that refuses to advance until the proof is in. Software desks and factory floors run the same engine. 把完整 FDE 作业流程（4 区、18 阶段、10 个可执行门禁）固化为状态机：证据不齐，拒绝推进。软件与车间共用一台引擎。

SCENARIO PROFILE · 场景

Star on GitHub Read the full 18-phase SOP · 完整 SOP → NO LLM KEY · NO DOCKER · PYTHON ≥ 3.11

APre-engagement进场前

Qualification项目立项与问题框定

Site survey · Gemba现场勘察site_survey

Stakeholder map干系人地图与对齐

Success criteria成功标准契约化success_criteria

BBuild构建

Connect数据接入air_gap

Corpus forge语料锻造

Prototype · real data真实未策展数据上原型

Validate干系人验证

Deploy · FAT/SAT部署上线fat_satfunctional_safetyconformityadvance → REFUSED
hazard analysis missing

Eval评估交付

COperationalization运营化

SLO / on-callSLO/SLA + 轮值sloshift_handover

RunbookRunbook 编写

Monitoring · drift监控与漂移检测

Change mgmt变更管理 + 培训works_council

Flywheel → product飞轮 → 产品化

DHandoff交接退场

Ops handoff运维移交

Knowledge transfer知识转移

Disengage · signed退场签收handoff_signoff

Entries the gates caught

门禁拦下的事故日志

Real incidents, synced from the public postmortem database kuba-database ↗. On a checklist they slip through; mapped onto the board, each one is a refusal the SOP now records. 真实事故，同步自公开复盘库 kuba-database。在清单上它们会溜过去；映射到看板上，每一条都是一道会拒绝放行的门禁。

2015·05·28FDEINC-20150528-CTRIP · SEV-1

Production code deleted by hand on a busy evening; recovery ran all night on improvised steps.携程 5·28 全站瘫痪（运维误删生产服务器执行代码，12 小时全业务中断）

FDE · PHASE 12 · RUNBOOK: rollback and safe failure modes defined before launch.回滚路径与安全失败模式，先于上线存在。CASE FILE ↗ 携程

2022·12·18FDEINC-20221218-ALIYUN-HK · SEV-1

A chilled-water air lock plus group-control deadlock took a whole availability zone down for over 10 hours.阿里云香港可用区 C 大规模服务中断（冷机水路气阻+群控死锁，运营十余年最长大故障）

FDE · GATE fat_sat: cooling and control interlocks pass on-site acceptance before launch.冷却与群控联动必须通过现场验收，才能放行上线。CASE FILE ↗ 阿里云

2025·09·18FDEINC-20250918-CLERK-DATABASE · SEV-1

A vendor auto-upgrade stormed connection pools for 4 days; monitoring sampling hid the diagnosis.Clerk 数据库事件（供应商自动升级触发连接池同步回收，惊群效应致间歇性故障 4 天，诊断被监控采样率掩盖）

FDE · GATE slo: error budget + alert route; evidence that sampling cannot mask.错误预算 + 告警路由；采样不能掩盖证据。CASE FILE ↗ Clerk

2025·06·26SAINC-20250626-CLERK-CLOUDRUN · SEV-1

Single-region auth trusted the vendor's redundancy promise; one regional failure logged out every customer for 45 minutes.Clerk 全服务中断 45 分钟（单区域架构 + 过度信任 Cloud Run 冗余承诺，认证基础设施整体不可用）

SA · PHASE 07 · REAL DATA: vendor promises are not verified facts; prove it on production-shaped reality.供应商承诺不等于已验证事实，用生产形态的真实环境验证。CASE FILE ↗ Clerk

2023·09·12SAINC-20230912-UNITY-RUNTIME · SEV-2

An install-fee decision shipped without stakeholder alignment; the ecosystem revolted, the CEO left, the policy died.Unity Runtime Fee 收费政策引爆开发者生态危机（按安装收费决策 + 傲慢沟通，CEO 下台、政策最终取消）

SA · GATE success_criteria: written criteria + ≥ 2 sponsors + aligned success metrics.书面标准 + ≥2 发起人 + 干系人对齐的成功指标。CASE FILE ↗ Unity

2021·10·04SAINC-20211004-FACEBOOK · SEV-1

A maintenance command withdrew every BGP route; engineers were locked out of the very building holding the recovery tools.Facebook 全球中断（骨干网维护命令撤销全部 BGP 路由）

SA · PHASE 12 · RUNBOOK: an out-of-band recovery path that was rehearsed, not assumed.带外恢复路径要演练过，不能假设它在。CASE FILE ↗ Meta (Facebook)

Ten gates, executable

十个门禁，全部是可执行代码

Not checklist rows. Gate.check(ctx) returns passed, blockers, warnings, and advance refuses until clean. Seven exist only on the factory profile. 不是清单条目。Gate.check(ctx) 返回通过/阻断/警告，advance 不干净就拒绝。其中七个只存在于工厂场景。

INTERLOCK PANEL · 互锁面板KEYS 1–0 JUMP TO GATE · 数字键直达

1site_surveySite location required; empty assets or multi-shift without network → warning.现场位置必填；资产为空或多班次无网络 → 警告。

2success_criteriaWritten criteria + ≥ 2 sponsors; sponsor without metric → warning.书面标准 + ≥2 发起人；发起人无指标 → 警告。

3functional_safetyAchieved PL/SIL ≥ required; ISO 10218 assessed; hazard analysis mandatory.PL/SIL 达标；ISO 10218 评估；危害分析强制（阻断项）。

4fat_satFAT and SAT both passed, each signed off.FAT 与 SAT 均通过且分别签核。

5conformityEU-AI-Act high-risk ⇒ CE marking + technical construction file.高风险 ⇒ CE 标志 + 技术构造文件 + 危害分析。

6works_councilCo-determination signed off where representatives exist (BetrVG §87).有员工代表时须劳资共决签核。

7air_gapOffline deployment posture settled at connect time; never phone-home.离线部署形态在接入时定论，杜绝事后外联。

8shift_handoverMulti-shift sites need a digital handover log + per-shift runbook.多班次现场须有数字交接日志 + 分班次 runbook。

9sloSLO/SLA + error budget + alert route; missing route → warning.SLO/SLA + 错误预算 + 告警路由；缺路由 → 警告。

0handoff_signoffRunbook + eval report + SLO + training material, customer accepted.交接包齐备（runbook/评估/SLO/培训）且客户签收。

CHECKLIST · 清单

A record. Freshest the day it is filled in, then it rots as reality drifts: the box never learns the world changed.一份记录。填完那天最准，此后随现实漂移单向腐化，勾选框不会知道世界变了。

GATE · 门禁

A predicate. Re-run on every advance; a stale pass never counts. Even force evaluates and records, so the override itself stays on the audit log.一个谓词。每次推进重新执行，过期通过一律不作数；强推也照常评估留痕，例外本身进审计。

One engine, two work orders

一台引擎，两张工单

The same state machine runs a customer-service desk and an embodied-robotics line; the profile swaps connectors, KPIs and which gates apply. 同一台状态机既跑客服台也跑机器人产线；场景配置切换连接器、KPI 与适用门禁。

Ticket

PROFILE · 客服

Phases: 15 of 18; the 3 industrial-only phases stand down.18 阶段中的 15 个；3 个工业专属阶段自动不适用。
Connectors: CSV · Zammad · Salesforce · MySQL
Gates: success_criteria · slo · handoff_signoff
Proof: resolution rate · CSAT · deflection · bad-case miner解决率 / 满意度 / 分流率 / 坏例挖掘

Manufacturing

PROFILE · 工厂

Phases: 18 of 18: site survey, FAT/SAT deploy, works-council change management.全 18 阶段，含现场勘察、FAT/SAT 部署与共决变更。
Connectors: OPC UA · MQTT-Sparkplug · ROS2 · MES · Historian
Gates: all 10 · 全部十个门禁
Proof: OEE · MTBF/MTTR · FPY/DPMO · grasp success · collision rateOEE / 平均故障间隔 / 良率 / 抓取成功率 / 碰撞率

One deploy, a whole crew

一次部署，拉起一支 Agent 班组

Every name on the roster is a real AgentScope 2.0 Agent — wired model, role toolkit, permission rules injected via AgentState. The FDE names the crew; unknown roles degrade to corpus-only, and tools without a data source are reported unbound — never faked. 点到的每个名字都是真实的 AgentScope 2.0 Agent——接线模型、角色工具包、经 AgentState 注入的权限规则。FDE 自己点名开 Agent；未知角色退化为语料工具，缺数据源的工具在清单里如实标注 unbound，绝不假装可用。

Name the crew · 点名名字:角色[:模型]，可重复

fde-scope deploy --tenant acme --agent 数据员:数据分析 --agent 日志员:日志分析:qwen3-14b --connector-source csv=sample.csv

Pre-flight · 预检发车前先看 plan：Web 控制台 /console#deploy「🤖 Agent 部署」（macOS App 同款标签页），同走 build_deploy_planfde-scope web

ROSTERreal Agent per spec每个名字一个真实 Agent SUBAGENT TEMPLATEblueprint → create_app蓝图注册进真实 app AGENTCREATE · TEAM SAYleader routes, members reportleader 派活，成员回报 SERVE--serve = real runtime--serve 起真服务（Redis + 模型）

The board, already worked

一块已经跑起来的看板

Seed the console with six realistic engagements; every gate record below is produced by the engine itself, so the panels never lie. 一条命令种入六个真实感项目；以下每条门禁记录都由引擎自身生成，面板不会说谎。

Customer · 客户ProfilePhaseStory · 状态故事State

古茗 · tea chainticket15/15Full handoff package, customer accepted.完整交接包，客户签收。SIGNED

一汽-大众 · automakermfg11/189/9 industrial gates passed: 3 shifts, works council, PL d / SIL 2, HAZOP.9/9 工业门禁通过：三班制、共决、PL d/SIL 2、HAZOP。RUNBOOK

广汽 · automakermfg9/18FAT/SAT + functional safety + conformity genuinely blocked → advance refused.FAT/SAT、功能安全与合规真实阻断 → 拒绝推进。BLOCKED

一汽 · automakerticket13/15Productization flywheel running.产品化飞轮运转中。FLYWHEEL

曹操出行 · ride-hailingticket8/15Real-data prototyping, SLO defined.真实数据原型，SLO 已定义。PROTOTYPE

易点天下 · outbound SaaSticket3/15Single-sponsor blocker: the Sponsor Collapse anti-pattern, caught.单一发起人阻断，即 Sponsor Collapse 反模式，被门禁拦下。BLOCKED

DEMO DATA · 演示数据 · seeded by examples/seed_mock_engagements.py; every record engine-generated.

Shipped, not mocked

真机界面 · macOS App 实拍

Live capture of the double-click macOS app — universal2, codesigned DMG, single-instance guard, SIGTERM-safe exit. The same engine the CLI drives, behind a desktop icon that needs no Python. 双击即用的 macOS App 实机截图：universal2 双架构、codesign 签名 DMG、单实例守护、优雅退出。CLI 背后那台引擎，装进了一个免 Python 的桌面图标。

FDE Scope macOS app — engagement console with cross-project matrix — **ENGAGEMENT CONSOLE · 工作台**cross-project matrix · gates · recent skills

FDE Scope macOS app — 18-phase SOP functional overview — **FUNCTIONAL OVERVIEW · 功能总览**18 phases · 4 zones · 10 gates · 10 connectors

LIVE CAPTURE · 实机截图 · FDE-Scope-0.1.0-universal2.app · 1440×900 @2x · $ ./appbuild/build_release.sh

Zero-config crib

零配置工具架

Core plus engagement layers carry no AgentScope dependency: no LLM key, no Docker. Green in five minutes. 核心与 engagement 层零 AgentScope 依赖：无 LLM key、无 Docker，五分钟全绿。

Install · 安装核心 + 开发 + Webpip install -e ".[dev]"

Seed demo · 种入演示六个真实感 engagementpython examples/seed_mock_engagements.py

Open console · 控制台http://127.0.0.1:8080fde-scope web

SKILL CAPTUREdraft现场沉淀草稿 REVIEWreview审阅队列 PUBLISHpublished可检索复用 EXPORTAgentScope · QwenPaw双格式导出

The ship list

交付清单 · 功能 / 架构 / 最佳实践

Three ledgers, all verifiable today — not roadmap. What the product does, how it is layered, and the six engineering invariants pinned by contract tests. 三本台账，今天即可验证——不是路线图：功能做什么、架构怎么分层、六条被契约测试钉住的工程不变式。

01Product

功能清单

18-phase SOP · 4 zones · 10 executable gates门禁是代码 Gate.check()，不是检查清单
2 profiles — ticket & manufacturing工业门禁：FAT/SAT · ISO 13849 · CE/EU-AI-Act · BetrVG §87 · 气隙 · 换班
10 data connectorsCSV/MySQL/OPC UA 真实 · MQTT-Sparkplug/MES JSONL · Documents 解析延迟导入
Corpus forge — synthesize to fill gaps, not to pad脱敏→质量门→覆盖度→缺口检测→补盲区合成
Eval + industrial KPIOEE / MTBF / 抓取成功率 / 碰撞率
Skills library — draft→review→publish→exportAgentScope 与 QwenPaw 双格式导出
Deploy three-pillar on real AgentScope 2.0Agent 装配 · 权限上下文 · 沙箱 workspace
Handoff + flywheel, optional MiMo LLM无 key 全走规则路径，失败自动回退

02Architecture

架构清单

Core layers — data / SOP / profiles / web零顶层 agentscope 依赖：无 key、无 Docker 五分钟全绿
deploy/ — 5 modules lazy-import agentscope三支柱运行时组装，optional extra
connectors/documents.pyPDF/Word/Excel/PPT 解析延迟用 agentscope.rag
Cross-cutting — llm · config · templates · paths唯一 LLM 出口 llm.py；data_root() 四级解析
4 surfacesCLI · Web 控制台 27 路由 · PawApp 18 路由 · macOS DMG 双击即用
Evidence model — docs/architecture-model/Structurizr DSL + DOT 为事实源，Mermaid 沉淀可读图

03Best practices

最佳实践 · 六条不变式

Live gate re-evaluation每次 advance 重评门禁，过期 passed 不放行
Server-generated IDs外部输入永远不能指定记录 ID
Credentials env-only密钥只走环境变量，绝不落 manifest/报告/日志
Atomic writes所有落盘记录经 fsutil.atomic_write_text
Rule grants only唯一权限通道；未匹配工具 DEFAULT→ASK · DONT_ASK→DENY
Measured AgentScope window>=2.0.4.post1,<3 逐版本实测，契约测试钉住引用

VERIFIED BY: CI-green suite · contract pins tests/test_architecture_guard.py · evidence model docs/architecture-model/architecture-map.md

Show up with
the whole SOP.

带着完整 SOP 进场。

Star · 安装 · 进场 → Factory walkthrough · 工厂 walkthrough

Checklists forget.Gates don’t.