feat: 增强规则资产管理与审计页面运行时调试

后端新增规则资产版本管理和规则文件 CRUD 接口，优化风险
规则生成模板执行和员工数据模型字段，知识库 RAG 增强本
地回退和文档提取能力，清理旧风险规则文件统一由生成引擎
管理，前端审计页面增加运行时调试面板和规则资产编辑交互，
补充单元测试覆盖。

server/src/app/models/__init__.py

@@ -11,6 +11,8 @@ from app.models.financial_record import (
     ExpenseClaim,
     ExpenseClaimItem,
 )
+from app.models.hermes_config import HermesTaskConfig, HermesTaskExecutionLog
+from app.models.hermes_report import HermesRiskReport
 from app.models.organization import OrganizationUnit
 from app.models.reimbursement import ReimbursementRequest
 from app.models.role import Role
@@ -34,6 +36,9 @@ __all__ = [
     "EmployeeChangeLog",
     "ExpenseClaim",
     "ExpenseClaimItem",
+    "HermesTaskConfig",
+    "HermesTaskExecutionLog",
+    "HermesRiskReport",
     "OrganizationUnit",
     "ReimbursementRequest",
     "Role",

server/src/app/models/agent_asset.py

@@ -4,7 +4,7 @@ import uuid
 from datetime import datetime
 from typing import Any
 
-from sqlalchemy import DateTime, ForeignKey, String, Text, UniqueConstraint, func
+from sqlalchemy import Boolean, DateTime, ForeignKey, String, Text, UniqueConstraint, func
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 from sqlalchemy.types import JSON
 
@@ -46,6 +46,12 @@ class AgentAsset(Base):
         order_by="desc(AgentAssetReview.created_at)",
     )
     scheduled_runs = relationship("AgentRun", back_populates="task_asset")
+    test_runs = relationship(
+        "AgentAssetTestRun",
+        back_populates="asset",
+        cascade="all, delete-orphan",
+        order_by="desc(AgentAssetTestRun.created_at)",
+    )
 
 
 class AgentAssetVersion(Base):
@@ -79,3 +85,21 @@ class AgentAssetReview(Base):
     created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
 
     asset = relationship("AgentAsset", back_populates="reviews")
+
+
+class AgentAssetTestRun(Base):
+    __tablename__ = "agent_asset_test_runs"
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
+    asset_id: Mapped[str] = mapped_column(ForeignKey("agent_assets.id"), index=True)
+    version: Mapped[str] = mapped_column(String(30), index=True)
+    test_type: Mapped[str] = mapped_column(String(30), index=True)
+    status: Mapped[str] = mapped_column(String(20), index=True)
+    passed: Mapped[bool] = mapped_column(Boolean, default=False, index=True)
+    summary: Mapped[str] = mapped_column(Text(), default="")
+    input_json: Mapped[dict[str, Any]] = mapped_column(JSON, default=dict)
+    result_json: Mapped[dict[str, Any]] = mapped_column(JSON, default=dict)
+    created_by: Mapped[str] = mapped_column(String(100))
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
+
+    asset = relationship("AgentAsset", back_populates="test_runs")

server/src/app/models/employee.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import uuid
 from datetime import date, datetime
 
-from sqlalchemy import Boolean, Column, Date, DateTime, ForeignKey, String, Table, func
+from sqlalchemy import Boolean, Column, Date, DateTime, ForeignKey, Integer, String, Table, func
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from app.db.base_class import Base
@@ -35,6 +35,7 @@ class Employee(Base):
     password_hash: Mapped[str | None] = mapped_column(String(255), nullable=True)
     employment_status: Mapped[str] = mapped_column(String(30), default="在职", index=True)
     sync_state: Mapped[str] = mapped_column(String(30), default="已同步")
+    compliance_score: Mapped[int] = mapped_column(Integer, default=100)
     spotlight: Mapped[bool] = mapped_column(Boolean, default=False)
     last_sync_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
     organization_unit_id: Mapped[str | None] = mapped_column(

server/src/app/models/financial_record.py

@@ -5,7 +5,7 @@ from datetime import date, datetime
 from decimal import Decimal
 from typing import Any
 
-from sqlalchemy import Date, DateTime, ForeignKey, Integer, Numeric, String, Text, func
+from sqlalchemy import Boolean, Date, DateTime, ForeignKey, Integer, Numeric, String, Text, func
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 from sqlalchemy.types import JSON
 
@@ -39,6 +39,8 @@ class ExpenseClaim(Base):
     status: Mapped[str] = mapped_column(String(30), index=True)
     approval_stage: Mapped[str | None] = mapped_column(String(50), nullable=True)
     risk_flags_json: Mapped[list[Any]] = mapped_column(JSON, default=list)
+    hermes_scanned_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    hermes_risk_flag: Mapped[bool] = mapped_column(Boolean, default=False, index=True)
     created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
     updated_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), server_default=func.now(), onupdate=func.now()

server/src/app/models/hermes_config.py

@@ -0,0 +1,48 @@
+from __future__ import annotations
+
+import uuid
+from datetime import datetime
+from typing import Any
+
+from sqlalchemy import Boolean, DateTime, ForeignKey, String, Text, func
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+from sqlalchemy.types import JSON
+
+from app.db.base_class import Base
+
+
+class HermesTaskConfig(Base):
+    __tablename__ = "hermes_task_configs"
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
+    task_type: Mapped[str] = mapped_column(String(50), index=True)
+    cron_expression: Mapped[str] = mapped_column(String(100))
+    is_enabled: Mapped[bool] = mapped_column(Boolean, default=True)
+    payload_template: Mapped[dict[str, Any]] = mapped_column(JSON, default=dict)
+    
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now()
+    )
+
+    execution_logs = relationship(
+        "HermesTaskExecutionLog",
+        back_populates="config",
+        cascade="all, delete-orphan",
+        order_by="desc(HermesTaskExecutionLog.started_at)",
+    )
+
+
+class HermesTaskExecutionLog(Base):
+    __tablename__ = "hermes_task_execution_logs"
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
+    config_id: Mapped[str] = mapped_column(String(36), ForeignKey("hermes_task_configs.id"), index=True)
+    status: Mapped[str] = mapped_column(String(30), index=True)
+    result_summary: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    error_trace: Mapped[str | None] = mapped_column(Text(), nullable=True)
+    
+    started_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
+    completed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+
+    config = relationship("HermesTaskConfig", back_populates="execution_logs")

server/src/app/models/hermes_report.py

@@ -0,0 +1,34 @@
+from __future__ import annotations
+
+import uuid
+from datetime import datetime
+from typing import Any
+
+from sqlalchemy import DateTime, ForeignKey, String, Text, func
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+from sqlalchemy.types import JSON
+
+from app.db.base_class import Base
+
+
+class HermesRiskReport(Base):
+    __tablename__ = "hermes_risk_reports"
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
+    claim_id: Mapped[str] = mapped_column(ForeignKey("expense_claims.id"), index=True)
+    execution_log_id: Mapped[str] = mapped_column(ForeignKey("hermes_task_execution_logs.id"), index=True)
+    
+    risk_level: Mapped[str] = mapped_column(String(20), index=True)
+    risk_type: Mapped[str] = mapped_column(String(50), index=True)
+    risk_description: Mapped[str] = mapped_column(Text())
+    
+    related_claim_ids: Mapped[list[str]] = mapped_column(JSON, default=list)
+    status: Mapped[str] = mapped_column(String(30), default="pending_review", index=True)
+    
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now()
+    )
+
+    claim = relationship("ExpenseClaim", foreign_keys=[claim_id])
+    execution_log = relationship("HermesTaskExecutionLog", foreign_keys=[execution_log_id])