SDD 规范驱动 + Harness 驾驭工程 AI 全栈开发

┌──────────────────────────────────────────────────────────────────────────────────┐
│                         SDD × Harness × AI 工程体系                             │
├──────────────────────────────────────────────────────────────────────────────────┤
│                                                                                  │
│  ┌──────────────────────────────────────────────────────────────────────────┐   │
│  │                        规范驱动层 (SDD)                                   │   │
│  │  ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ ┌─────────────────┐  │   │
│  │  │  OpenAPI    │ │  AsyncAPI   │ │   Prisma    │ │   SLO/SLI       │  │   │
│  │  │  API规范    │ │  事件规范    │ │  数据规范   │ │  可靠性规范     │  │   │
│  │  └─────────────┘ └─────────────┘ └─────────────┘ └─────────────────┘  │   │
│  └──────────────────────────────────────────────────────────────────────────┘   │
│                                      │                                          │
│                                      ▼                                          │
│  ┌──────────────────────────────────────────────────────────────────────────┐   │
│  │                        AI 代码生成层                                      │   │
│  │  ┌──────────────────────────────────────────────────────────────────┐   │   │
│  │  │  多 Agent 协作: 前端Agent | 后端Agent | 测试Agent | DevOpsAgent │   │   │
│  │  └──────────────────────────────────────────────────────────────────┘   │   │
│  │                            │                                            │   │
│  │  ┌────────────────────────┼────────────────────────────────────────┐   │   │
│  │  │  AI 生成代码  ←─── 规范校验 ───→  质量门禁                      │   │   │
│  │  └────────────────────────────────────────────────────────────────┘   │   │
│  └──────────────────────────────────────────────────────────────────────────┘   │
│                                      │                                          │
│                                      ▼                                          │
│  ┌──────────────────────────────────────────────────────────────────────────┐   │
│  │                        Harness 工程化平台                                 │   │
│  │  ┌───────┐ ┌───────┐ ┌───────┐ ┌───────┐ ┌───────┐ ┌─────────────┐  │   │
│  │  │  CI   │ │  CD   │ │ GitOps│ │  FF   │ │  SLO  │ │  成本治理   │  │   │
│  │  └───────┘ └───────┘ └───────┘ └───────┘ └───────┘ └─────────────┘  │   │
│  └──────────────────────────────────────────────────────────────────────────┘   │
│                                                                                  │
└──────────────────────────────────────────────────────────────────────────────────┘

规范体系层次
├── 📋 业务规范层
│   ├── 需求规格 (Gherkin/BDD)
│   ├── 用户故事 (行为规范)
│   └── 业务规则 (决策表)
│
├── 🔧 技术规范层
│   ├── API规范 (OpenAPI 3.1)
│   ├── 事件规范 (AsyncAPI)
│   ├── 数据规范 (Prisma Schema)
│   ├── 组件规范 (Storybook)
│   └── 安全规范 (OWASP)
│
├── 🚀 交付规范层
│   ├── Pipeline规范 (Harness)
│   ├── 部署规范 (Helm/K8s)
│   ├── 可靠性规范 (SLO)
│   └── 成本规范 (FinOps)
│
└── 🧪 质量规范层
    ├── 测试规范 (契约测试)
    ├── 代码规范 (ESLint/Prettier)
    └── 监控规范 (可观测性)

📁 specs/
├── 📁 business/
│   ├── 📁 features/
│   │   ├── task-management.feature        # Gherkin 需求规范
│   │   ├── user-authentication.feature
│   │   └── notification.feature
│   ├── rules.yaml                         # 业务规则引擎规范
│   └── workflows.bpmn                     # 业务流程规范
│
├── 📁 api/
│   ├── openapi.yaml                       # REST API 规范
│   ├── asyncapi.yaml                      # 事件驱动规范
│   └── graphql-schema.graphql            # GraphQL 规范
│
├── 📁 database/
│   ├── schema.prisma                      # 数据模型规范
│   ├── migrations/                        # 迁移规范
│   └── seed-data.yaml                     # 种子数据规范
│
├── 📁 frontend/
│   ├── component-specs/                   # 组件规范
│   │   ├── TaskList.spec.tsx
│   │   └── TaskForm.spec.tsx
│   ├── design-tokens.json                 # 设计规范
│   └── routing.yaml                       # 路由规范
│
├── 📁 deployment/
│   ├── harness-pipeline.yaml              # Harness 流水线规范
│   ├── helm/                              # Helm Charts 规范
│   ├── k8s/                               # K8s 资源规范
│   ├── slo.yaml                           # 服务可靠性规范
│   └── cost-budget.yaml                   # 成本预算规范
│
├── 📁 quality/
│   ├── contract-tests/                    # 契约测试规范
│   ├── security-policy.yaml               # 安全策略规范
│   └── code-quality.yaml                  # 代码质量规范
│
└── 📁 observability/
    ├── metrics.yaml                       # 指标规范
    ├── logs.yaml                          # 日志规范
    └── traces.yaml                        # 追踪规范

# specs/api/openapi.yaml
openapi: 3.1.0
info:
  title: "TaskFlow AI Platform API"
  version: "2.0.0"
  description: "AI驱动的任务管理平台API"

paths:
  /api/tasks:
    get:
      operationId: listTasks
      summary: 获取任务列表（支持AI智能排序）
      parameters:
        - name: status
          in: query
          schema:
            $ref: "#/components/schemas/TaskStatus"
        - name: priority
          in: query
          schema:
            $ref: "#/components/schemas/Priority"
        - name: assigneeId
          in: query
          schema:
            type: string
        - name: search
          in: query
          description: AI语义搜索
          schema:
            type: string
        - name: sortBy
          in: query
          schema:
            type: string
            enum: [createdAt, updatedAt, priority, dueDate]
            default: createdAt
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 20
        - name: offset
          in: query
          schema:
            type: integer
            minimum: 0
            default: 0
      responses:
        "200":
          description: 成功
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/Task"
                  total:
                    type: integer
                  nextOffset:
                    type: integer

    post:
      operationId: createTask
      summary: 创建任务（支持AI辅助描述）
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateTaskRequest"
      responses:
        "201":
          description: 创建成功
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Task"

components:
  schemas:
    Task:
      type: object
      required:
        - id
        - title
        - status
        - priority
        - createdAt
      properties:
        id:
          type: string
          format: uuid
        title:
          type: string
          maxLength: 100
        description:
          type: string
          description: AI生成的描述
        status:
          $ref: "#/components/schemas/TaskStatus"
        priority:
          $ref: "#/components/schemas/Priority"
        assigneeId:
          type: string
          format: uuid
        creatorId:
          type: string
          format: uuid
        dueDate:
          type: string
          format: date-time
        tags:
          type: array
          items:
            type: string
        aiSuggestions:
          type: array
          items:
            type: string
          description: AI生成的建议
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time

    TaskStatus:
      type: string
      enum: [TODO, IN_PROGRESS, REVIEW, BLOCKED, DONE, ARCHIVED]

    Priority:
      type: string
      enum: [LOW, MEDIUM, HIGH, URGENT]

    CreateTaskRequest:
      type: object
      required:
        - title
      properties:
        title:
          type: string
          maxLength: 100
        description:
          type: string
        status:
          $ref: "#/components/schemas/TaskStatus"
          default: TODO
        priority:
          $ref: "#/components/schemas/Priority"
          default: MEDIUM
        assigneeId:
          type: string
          format: uuid
        dueDate:
          type: string
          format: date-time
        tags:
          type: array
          items:
            type: string
        aiGenerateDescription:
          type: boolean
          default: false
          description: 使用AI生成任务描述

// scripts/ai-code-generator.ts
import { OpenAI } from 'openai';
import { readFileSync, writeFileSync, mkdirSync } from 'fs';
import { parse } from 'yaml';
import { generate } from '@openapi-generator-plus/typescript-fetch';

export class AICodeGenerator {
  private openai: OpenAI;

  constructor(apiKey: string) {
    this.openai = new OpenAI({ apiKey });
  }

  // 1. 从规范生成代码
  async generateFromSpec(specPath: string, targetDir: string) {
    const spec = parse(readFileSync(specPath, 'utf-8'));
    
    // 使用 OpenAPI Generator
    await generate({
      spec,
      generator: 'typescript-fetch',
      output: targetDir,
      options: {
        useSingleRequestParameter: true,
        withSeparateModelsAndApi: true,
      },
    });

    // AI 增强：生成更智能的代码
    await this.enhanceWithAI(spec, targetDir);
  }

  // 2. AI 增强生成
  async enhanceWithAI(spec: any, targetDir: string) {
    // 为每个 API 生成智能客户端
    for (const [path, methods] of Object.entries(spec.paths)) {
      for (const [method, operation] of Object.entries(methods as any)) {
        const enhancedCode = await this.generateAIEnhancedClient(
          operation.operationId,
          path,
          method,
          operation
        );
        
        const filePath = `${targetDir}/enhanced/${operation.operationId}.ts`;
        mkdirSync(`${targetDir}/enhanced`, { recursive: true });
        writeFileSync(filePath, enhancedCode);
      }
    }
  }

  // 3. 生成 AI 增强的客户端代码
  private async generateAIEnhancedClient(
    operationId: string,
    path: string,
    method: string,
    operation: any
  ): Promise<string> {
    const prompt = `
      Generate a TypeScript function for ${operationId} that:
      1. Handles all parameters from the OpenAPI spec
      2. Adds AI-powered features:
         - Automatic retry with exponential backoff
         - Intelligent caching based on response headers
         - Request deduplication
         - Automatic error recovery
         - Performance monitoring
      3. Includes comprehensive JSDoc comments
      4. Uses fetch API with proper error handling
      
      OpenAPI Operation:
      ${JSON.stringify(operation, null, 2)}
      
      Path: ${path}
      Method: ${method}
    `;

    const response = await this.openai.chat.completions.create({
      model: 'gpt-4-turbo-preview',
      messages: [
        {
          role: 'system',
          content: 'You are an expert TypeScript developer specializing in API clients.',
        },
        {
          role: 'user',
          content: prompt,
        },
      ],
      temperature: 0.3,
    });

    return response.choices[0].message.content || '';
  }

  // 4. 生成测试代码
  async generateTests(specPath: string) {
    const spec = parse(readFileSync(specPath, 'utf-8'));
    
    for (const [path, methods] of Object.entries(spec.paths)) {
      for (const [method, operation] of Object.entries(methods as any)) {
        const testCode = await this.generateTestForOperation(
          operation.operationId,
          path,
          method,
          operation
        );
        
        const testPath = `tests/contract/${operation.operationId}.test.ts`;
        writeFileSync(testPath, testCode);
      }
    }
  }

  private async generateTestForOperation(
    operationId: string,
    path: string,
    method: string,
    operation: any
  ): Promise<string> {
    const prompt = `
      Generate comprehensive contract tests for ${operationId}:
      - Happy path tests
      - Error cases (400, 401, 403, 404, 500)
      - Edge cases (empty responses, pagination, filtering)
      - Performance tests (response time < 200ms)
      - Use Jest and SuperTest
      
      Operation: ${JSON.stringify(operation, null, 2)}
    `;

    const response = await this.openai.chat.completions.create({
      model: 'gpt-4-turbo-preview',
      messages: [
        {
          role: 'system',
          content: 'You are an expert test engineer.',
        },
        {
          role: 'user',
          content: prompt,
        },
      ],
    });

    return response.choices[0].message.content || '';
  }
}

// 使用示例
const generator = new AICodeGenerator(process.env.OPENAI_API_KEY!);
await generator.generateFromSpec('specs/api/openapi.yaml', 'src/generated');
await generator.generateTests('specs/api/openapi.yaml');

// scripts/spec-validator.ts
import { validate } from '@redocly/cli';
import { parse } from 'yaml';
import { readFileSync } from 'fs';

export class SpecValidator {
  // 1. OpenAPI 规范验证
  async validateOpenAPI(specPath: string): Promise<ValidationResult> {
    try {
      const result = await validate({
        files: [specPath],
        config: {
          rules: {
            'operation-4xx-response': 'warn',
            'operation-summary': 'warn',
            'path-exists': 'error',
            'no-ambiguous-paths': 'error',
            'no-http-verbs': 'error',
            'request-body': 'warn',
            'response-status': 'error',
          },
        },
      });

      return {
        valid: result.valid,
        errors: result.errors,
        warnings: result.warnings,
      };
    } catch (error) {
      return {
        valid: false,
        errors: [error.message],
        warnings: [],
      };
    }
  }

  // 2. 规范变更影响分析
  async analyzeChangeImpact(oldSpecPath: string, newSpecPath: string) {
    const oldSpec = parse(readFileSync(oldSpecPath, 'utf-8'));
    const newSpec = parse(readFileSync(newSpecPath, 'utf-8'));

    const changes = {
      breaking: [] as string[],
      nonBreaking: [] as string[],
      additions: [] as string[],
      removals: [] as string[],
    };

    // 检测破坏性变更
    // 1. 移除的 API
    for (const [path, methods] of Object.entries(oldSpec.paths)) {
      if (!newSpec.paths[path]) {
        changes.removals.push(`Removed path: ${path}`);
        changes.breaking.push(`Breaking: Path ${path} removed`);
      }
    }

    // 2. 参数变更
    // ... 详细实现

    return changes;
  }

  // 3. 生成规范报告
  generateReport(result: ValidationResult): string {
    return `
# 规范验证报告

## 概览
- 状态: ${result.valid ? '✅ 通过' : '❌ 失败'}
- 错误数: ${result.errors.length}
- 警告数: ${result.warnings.length}

## 错误详情
${result.errors.map(e => `- ❌ ${e}`).join('\n')}

## 警告详情
${result.warnings.map(w => `- ⚠️ ${w}`).join('\n')}

## 建议
${this.generateSuggestions(result)}
    `;
  }

  private generateSuggestions(result: ValidationResult): string {
    const suggestions = [];
    if (result.errors.some(e => e.includes('missing response'))) {
      suggestions.push('为所有 API 添加完整的响应定义');
    }
    if (result.warnings.some(w => w.includes('operation-summary'))) {
      suggestions.push('为所有操作添加 summary 描述，提升可维护性');
    }
    return suggestions.map(s => `- ${s}`).join('\n');
  }
}

# specs/deployment/harness-pipeline.yaml
pipeline:
  name: "SDD-Driven AI Fullstack Pipeline"
  identifier: "sdd_ai_fullstack"
  projectIdentifier: "ai-platform"
  orgIdentifier: "engineering"

  # 规范驱动配置
  properties:
    ci:
      codebase:
        connectorRef: "github-connector"
        repoName: "taskflow-ai"
        build: <+input>
    
    # 规范验证作为第一步
    quality:
      specValidation:
        enabled: true
        failOnError: true
        paths:
          - "specs/api/openapi.yaml"
          - "specs/database/schema.prisma"
          - "specs/deployment/slo.yaml"

  stages:
    # 阶段1: 规范验证
    - stage:
        name: "Spec Validation"
        identifier: "spec_validation"
        type: "CI"
        spec:
          execution:
            steps:
              - step:
                  type: "Run"
                  name: "Validate OpenAPI"
                  identifier: "validate_openapi"
                  spec:
                    image: "node:20-alpine"
                    shell: "sh"
                    command: |
                      npm install -g @redocly/cli
                      redocly lint specs/api/openapi.yaml --config .redocly.yaml
              
              - step:
                  type: "Run"
                  name: "Validate Database Schema"
                  identifier: "validate_schema"
                  spec:
                    image: "node:20-alpine"
                    shell: "sh"
                    command: |
                      npx prisma validate --schema specs/database/schema.prisma
              
              - step:
                  type: "Run"
                  name: "Validate SLO"
                  identifier: "validate_slo"
                  spec:
                    image: "node:20-alpine"
                    shell: "sh"
                    command: |
                      npm run validate:slo

    # 阶段2: AI 代码生成
    - stage:
        name: "AI Code Generation"
        identifier: "ai_code_gen"
        type: "CI"
        dependsOn: ["spec_validation"]
        spec:
          execution:
            steps:
              - step:
                  type: "Run"
                  name: "Generate API Client"
                  identifier: "gen_api_client"
                  spec:
                    image: "node:20-alpine"
                    shell: "sh"
                    command: |
                      npm run generate:api
                      npm run generate:types
              
              - step:
                  type: "Run"
                  name: "AI Enhanced Code"
                  identifier: "ai_enhance"
                  spec:
                    image: "node:20-alpine"
                    shell: "sh"
                    envVariables:
                      OPENAI_API_KEY: <+secrets.getValue("openai_api_key")>
                    command: |
                      npm run ai:generate -- \
                        --spec specs/api/openapi.yaml \
                        --output src/generated
              
              - step:
                  type: "Run"
                  name: "Generate Tests"
                  identifier: "gen_tests"
                  spec:
                    image: "node:20-alpine"
                    shell: "sh"
                    command: |
                      npm run ai:generate:tests

    # 阶段3: 构建 & 质量门禁
    - stage:
        name: "Build & Quality"
        identifier: "build_quality"
        type: "CI"
        dependsOn: ["ai_code_gen"]
        spec:
          execution:
            steps:
              - step:
                  type: "Run"
                  name: "Install Dependencies"
                  identifier: "install"
                  spec:
                    image: "node:20-alpine"
                    shell: "sh"
                    command: |
                      npm ci --cache .npm --prefer-offline
              
              - step:
                  type: "Run"
                  name: "Type Check"
                  identifier: "typecheck"
                  spec:
                    image: "node:20-alpine"
                    shell: "sh"
                    command: |
                      npm run type-check
              
              - step:
                  type: "Run"
                  name: "Unit Tests"
                  identifier: "unit_tests"
                  spec:
                    image: "node:20-alpine"
                    shell: "sh"
                    command: |
                      npm run test:coverage
              
              - step:
                  type: "Run"
                  name: "Contract Tests"
                  identifier: "contract_tests"
                  spec:
                    image: "node:20-alpine"
                    shell: "sh"
                    command: |
                      npm run test:contract
              
              - step:
                  type: "Run"
                  name: "Security Scan"
                  identifier: "security_scan"
                  spec:
                    image: "aquasec/trivy:latest"
                    shell: "sh"
                    command: |
                      trivy fs --severity HIGH,CRITICAL --exit-code 1 .
              
              - step:
                  type: "Run"
                  name: "Quality Gate Check"
                  identifier: "quality_gate"
                  spec:
                    image: "node:20-alpine"
                    shell: "sh"
                    command: |
                      npm run quality:check
                      # 检查覆盖率 >= 80%
                      node scripts/check-coverage.js --threshold 80

    # 阶段4: 容器镜像构建
    - stage:
        name: "Build Images"
        identifier: "build_images"
        type: "CI"
        dependsOn: ["build_quality"]
        spec:
          execution:
            steps:
              - step:
                  type: "BuildAndPushDocker"
                  name: "Build Backend"
                  identifier: "build_backend"
                  spec:
                    dockerfile: "Dockerfile.backend"
                    context: "."
                    tags:
                      - "latest"
                      - "<+pipeline.sequenceId>"
                      - "<+git.commitSha>"
                    cacheFrom:
                      - "registry:latest"
              
              - step:
                  type: "BuildAndPushDocker"
                  name: "Build Frontend"
                  identifier: "build_frontend"
                  spec:
                    dockerfile: "Dockerfile.frontend"
                    context: "."
                    tags:
                      - "latest"
                      - "<+pipeline.sequenceId>"
                      - "<+git.commitSha>"

    # 阶段5: 部署到 Staging
    - stage:
        name: "Deploy Staging"
        identifier: "deploy_staging"
        type: "CD"
        dependsOn: ["build_images"]
        spec:
          serviceIdentifier: "taskflow-ai"
          envIdentifier: "staging"
          gitOps:
            type: "MANIFEST"
            spec:
              manifestFiles:
                - "infra/k8s/staging/*.yaml"
          execution:
            steps:
              - step:
                  type: "K8sRollingDeploy"
                  name: "Deploy Staging"
                  identifier: "deploy"
                  spec:
                    skipDryRun: false
                    canary:
                      percentage: 20
                      duration: "5m"
              
              - step:
                  type: "Run"
                  name: "Database Migration"
                  identifier: "migrate"
                  spec:
                    image: "taskflow-backend:<+pipeline.sequenceId>"
                    command: |
                      npx prisma migrate deploy
              
              - step:
                  type: "Run"
                  name: "AI Smoke Test"
                  identifier: "ai_smoke"
                  spec:
                    image: "node:20-alpine"
                    shell: "sh"
                    envVariables:
                      API_URL: "https://staging-api.taskflow.dev"
                    command: |
                      npm run test:smoke
              
              - step:
                  type: "Verify"
                  name: "Verify SLO Compliance"
                  identifier: "verify_slo"
                  spec:
                    type: "Custom"
                    script: |
                      # 验证 SLO 指标
                      curl -X POST https://harness.taskflow.dev/verify-slo \
                        -H "Authorization: Bearer <+secrets.getValue("harness_token")>" \
                        -d '{"environment":"staging","slo_file":"specs/deployment/slo.yaml"}'

    # 阶段6: 部署到 Production (带审批)
    - stage:
        name: "Deploy Production"
        identifier: "deploy_production"
        type: "CD"
        dependsOn: ["deploy_staging"]
        when:
          pipelineStatus: "SUCCESS"
        spec:
          serviceIdentifier: "taskflow-ai"
          envIdentifier: "production"
          gitOps:
            type: "MANIFEST"
            spec:
              manifestFiles:
                - "infra/k8s/production/*.yaml"
          execution:
            steps:
              - step:
                  type: "Approval"
                  name: "Manual Approval"
                  identifier: "approval"
                  spec:
                    approvers:
                      userGroups: ["platform-team", "tech-leads", "sre"]
                    timeout: "2h"
                    message: |
                      📋 生产部署审批
                      版本: <+pipeline.sequenceId>
                      提交: <+git.commitSha>
                      变更说明: <+pipeline.variables.changeDescription>
                      SLO状态: ✅ 通过
                      
                      请确认以下事项：
                      1. 测试结果全部通过
                      2. SLO 指标正常
                      3. 已通知相关团队
              
              - step:
                  type: "K8sRollingDeploy"
                  name: "Production Deployment"
                  identifier: "deploy"
                  spec:
                    canary:
                      percentage: 10
                      duration: "10m"
                    blueGreen: false
              
              - step:
                  type: "Run"
                  name: "Rollback on Failure"
                  identifier: "rollback"
                  spec:
                    image: "bitnami/kubectl:latest"
                    command: |
                      # 如果部署失败，自动回滚
                      kubectl rollout undo deployment/backend -n production
              
              - step:
                  type: "Verify"
                  name: "Post-Deployment Verification"
                  identifier: "post_deploy_verify"
                  spec:
                    type: "HTTP"
                    url: "https://api.taskflow.dev/health"
                    responseCodes: ["200"]
                    timeout: "5m"
                    retry: 3

  variables:
    - name: "changeDescription"
      type: "STRING"
      value: ""
    - name: "enableAI"
      type: "BOOLEAN"
      value: true
    - name: "enableCanary"
      type: "BOOLEAN"
      value: true
    - name: "canaryPercentage"
      type: "NUMBER"
      value: 10

// src/features/ai-features.ts
import { CfClient } from '@harnessio/ff-nodejs-server-sdk';

export class AIFeatureManager {
  private client: CfClient;
  private cache: Map<string, any> = new Map();

  constructor(apiKey: string, environment: string) {
    this.client = new CfClient(apiKey, environment);
    this.initialize();
  }

  async initialize() {
    await this.client.waitForInitialization();
  }

  // 1. 基于用户上下文的 AI 功能开关
  async isAIEnabled(userId: string, feature: string): Promise<boolean> {
    const key = `${userId}:${feature}`;
    if (this.cache.has(key)) {
      return this.cache.get(key);
    }

    const target = {
      identifier: userId,
      attributes: {
        // 从用户上下文推断 AI 能力
        userTier: await this.getUserTier(userId),
        usageFrequency: await this.getUserUsageFrequency(userId),
        betaTester: await this.isBetaTester(userId),
      },
    };

    const enabled = await this.client.boolVariation(feature, target, false);
    this.cache.set(key, enabled);
    return enabled;
  }

  // 2. AI 模型选择 (A/B 测试)
  async getAIModel(userId: string): Promise<string> {
    const modelFeature = 'ai_model_selection';
    const variants = await this.client.variation(
      modelFeature,
      { identifier: userId },
      'gpt-4'
    );
    return variants as string;
  }

  // 3. AI 功能渐进式发布
  async getAIFeatures(userId: string): Promise<AIFeatures> {
    return {
      autoDescription: await this.isAIEnabled(userId, 'ai_auto_description'),
      smartPriority: await this.isAIEnabled(userId, 'ai_smart_priority'),
      semanticSearch: await this.isAIEnabled(userId, 'ai_semantic_search'),
      autoTagging: await this.isAIEnabled(userId, 'ai_auto_tagging'),
      dueDatePrediction: await this.isAIEnabled(userId, 'ai_due_date_prediction'),
      model: await this.getAIModel(userId),
    };
  }

  // 4. AI 特性回滚监控
  async monitorAIFeature(flagName: string, userId: string, errorRate: number) {
    if (errorRate > 0.05) {
      // 自动回滚：将 Flag 设置为 false
      await this.client.updateFlag(flagName, {
        environment: 'production',
        value: false,
        reason: `Error rate exceeded threshold: ${errorRate}`,
      });
      
      // 记录事件
      console.error(`🚨 AI Feature ${flagName} auto-rolled back for user ${userId}`);
      
      // 通知团队
      await this.notifyTeam(flagName, errorRate);
    }
  }

  private async getUserTier(userId: string): Promise<string> {
    // 获取用户订阅等级
    return 'premium';
  }

  private async getUserUsageFrequency(userId: string): Promise<string> {
    return 'high';
  }

  private async isBetaTester(userId: string): Promise<boolean> {
    return true;
  }

  private async notifyTeam(flagName: string, errorRate: number) {
    // Slack 通知等
  }
}

# specs/security/policies.yaml
policies:
  # 1. 部署策略
  deployment:
    - name: "Require SLO Approval"
      identifier: "slo_approval_policy"
      type: "Deployment"
      severity: "ERROR"
      when: "stage == 'production'"
      statement: |
        // 要求 SLO 通过才能部署
        const sloStatus = context.sloVerification.status;
        if (sloStatus !== 'PASSED') {
          throw new Error('SLO verification must pass before deployment');
        }

    - name: "Canary Duration Check"
      identifier: "canary_duration_policy"
      type: "Deployment"
      severity: "WARNING"
      when: "stage == 'production'"
      statement: |
        const canaryDuration = context.canaryDuration;
        if (canaryDuration < 300) { // 5分钟
          console.warn('Canary duration is too short for critical services');
        }

  # 2. 成本策略
  cost:
    - name: "Budget Threshold"
      identifier: "budget_threshold_policy"
      type: "Cost"
      severity: "ERROR"
      statement: |
        const monthlyCost = context.monthlyCost;
        const budget = context.budget;
        if (monthlyCost > budget * 0.8) {
          throw new Error('Monthly cost exceeds 80% of budget');
        }

  # 3. 质量策略
  quality:
    - name: "Test Coverage"
      identifier: "test_coverage_policy"
      type: "Quality"
      severity: "ERROR"
      statement: |
        const coverage = context.testCoverage;
        if (coverage < 80) {
          throw new Error(`Test coverage ${coverage}% is below 80% threshold`);
        }

    - name: "Contract Test Pass"
      identifier: "contract_test_policy"
      type: "Quality"
      severity: "ERROR"
      statement: |
        const contractResults = context.contractTests;
        if (contractResults.failed > 0) {
          throw new Error(`${contractResults.failed} contract tests failed`);
        }

  # 4. 安全策略
  security:
    - name: "No Critical Vulnerabilities"
      identifier: "security_policy"
      type: "Security"
      severity: "ERROR"
      statement: |
        const criticalVulns = context.securityScan.critical;
        if (criticalVulns > 0) {
          throw new Error(`${criticalVulns} critical vulnerabilities found`);
        }

    - name: "Image Scan Required"
      identifier: "image_scan_policy"
      type: "Security"
      severity: "ERROR"
      when: "stage == 'production'"
      statement: |
        if (!context.imageScanCompleted) {
          throw new Error('Image scan must be completed before production deployment');
        }

# specs/deployment/slo.yaml
slo:
  version: "v1.0"
  name: "TaskFlow AI Platform SLOs"
  owner: "platform-team"
  environment: "production"

  objectives:
    - name: "API Availability"
      target: 99.95
      window: "30d"
      measurement: "availability"
      service: "taskflow-backend"
      method: "prometheus"
      query: |
        100 * (
          1 - (
            sum(rate(http_requests_total{status=~"5.."}[5m])) / 
            sum(rate(http_requests_total[5m]))
          )
        )
      alert:
        threshold: 99.0
        severity: critical

    - name: "API Latency (p95)"
      target: 300ms
      window: "7d"
      measurement: "latency"
      service: "taskflow-backend"
      method: "prometheus"
      query: |
        histogram_quantile(0.95, sum(rate(http_request_duration_seconds_bucket[5m])) by (le))
      alert:
        threshold: 500ms
        severity: warning

    - name: "AI Feature Latency"
      target: 1000ms
      window: "7d"
      measurement: "latency"
      service: "ai-service"
      method: "prometheus"
      query: |
        histogram_quantile(0.95, sum(rate(ai_request_duration_seconds_bucket[5m])) by (le))

    - name: "Error Rate"
      target: 0.1%
      window: "7d"
      measurement: "error_rate"
      service: "taskflow-backend"
      method: "prometheus"
      query: |
        sum(rate(http_requests_total{status=~"5.."}[5m])) / 
        sum(rate(http_requests_total[5m])) * 100
      alert:
        threshold: 0.5%
        severity: critical

    - name: "Database Connection Pool"
      target: 80%
      window: "1h"
      measurement: "resource"
      service: "database"
      method: "prometheus"
      query: |
        pg_stat_database_numbackends / pg_settings.max_connections * 100

    - name: "AI Model Accuracy"
      target: 85%
      window: "7d"
      measurement: "quality"
      service: "ai-service"
      method: "custom"
      query: |
        # 从 AI 模型反馈中计算准确率
        sum(ai_predictions_correct) / sum(ai_predictions_total) * 100
      alert:
        threshold: 80%
        severity: warning

  errorBudget:
    policy: "conservative"
    alertThreshold: 70%
    autoRemediation:
      enabled: true
      actions:
        - "rollback_deployment"
        - "scale_up"
        - "notify_sre"

  reporting:
    - type: "prometheus"
      endpoint: "http://prometheus.monitoring:9090"
      interval: "5m"

    - type: "grafana"
      dashboard: "taskflow-slo"
      refresh: "1m"

    - type: "slack"
      channel: "#slo-alerts"
      frequency: "daily"