feat(constraints): 操作约束抽取→注入 planner/worker 提示→总览管理

- 新表 task_constraints(allow/deny),CREATE TABLE IF NOT EXISTS 无需迁移
- 新工具 set_constraints:目标拆解器 round-0 先抽约束再拆目标、主 agent 运行时可补;
  拆解器提示词要求约束自包含(把「当前目标」等指代替换成具体域名/端口)
- constraintBlock 按最高优先级注入 planner+worker 系统提示;去偏:多样性/拓面显式服从约束
- 注入范围可配置(constraints_inject_planner/worker,默认都开,每轮读、即时生效)
- 总览「约束管理」卡片 + CRUD 接口(增删改不通知 planner,下轮规划自然读到)
- goals 提示词把抽约束步并入可编辑正文;旧库经 flag 守卫的一次性 reseed 追加新默认版本

db/constraints.go

@@ -0,0 +1,85 @@
+package db
+
+import (
+	"fmt"
+	"time"
+)
+
+// Constraint is one operator-authored operation constraint for a task: kind=allow
+// (permitted operations) or kind=deny (forbidden operations), free-text. Stored in
+// task_constraints, keyed by exploration_id (cascades with the exploration).
+type Constraint struct {
+	ID        int64     `json:"id"`
+	Kind      string    `json:"kind"` // allow | deny
+	Text      string    `json:"text"`
+	Origin    string    `json:"origin,omitempty"` // goals | human | system
+	CreatedAt time.Time `json:"created_at"`
+}
+
+// ListConstraints returns this exploration's constraints, allow before deny, oldest
+// first within each group (stable render order for the prompt block + UI).
+func (s *ExplorationStore) ListConstraints() ([]Constraint, error) {
+	rows, err := s.db.Query(`
+SELECT id, kind, text, COALESCE(origin,''), created_at
+FROM task_constraints WHERE exploration_id=$1
+ORDER BY (kind='deny'), id`, s.expID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []Constraint
+	for rows.Next() {
+		var c Constraint
+		if err := rows.Scan(&c.ID, &c.Kind, &c.Text, &c.Origin, &c.CreatedAt); err != nil {
+			return nil, err
+		}
+		out = append(out, c)
+	}
+	return out, rows.Err()
+}
+
+// AddConstraint inserts one constraint (kind must be allow|deny) and returns its id.
+func (s *ExplorationStore) AddConstraint(kind, text, origin string) (int64, error) {
+	if kind != "allow" && kind != "deny" {
+		return 0, fmt.Errorf("kind 必须是 allow 或 deny")
+	}
+	if origin == "" {
+		origin = "system"
+	}
+	var id int64
+	err := s.db.QueryRow(`
+INSERT INTO task_constraints(exploration_id, kind, text, origin)
+VALUES ($1, $2, $3, $4) RETURNING id`, s.expID, kind, text, origin).Scan(&id)
+	return id, err
+}
+
+// UpdateConstraint rewrites a constraint's kind + text; scoped to this exploration.
+// Returns an error if no such constraint exists.
+func (s *ExplorationStore) UpdateConstraint(id int64, kind, text string) error {
+	if kind != "allow" && kind != "deny" {
+		return fmt.Errorf("kind 必须是 allow 或 deny")
+	}
+	res, err := s.db.Exec(`
+UPDATE task_constraints SET kind=$1, text=$2, updated_at=now()
+WHERE id=$3 AND exploration_id=$4`, kind, text, id, s.expID)
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return fmt.Errorf("约束不存在")
+	}
+	return nil
+}
+
+// DeleteConstraint removes a constraint; scoped to this exploration. Returns an
+// error if no such constraint exists.
+func (s *ExplorationStore) DeleteConstraint(id int64) error {
+	res, err := s.db.Exec(`DELETE FROM task_constraints WHERE id=$1 AND exploration_id=$2`, id, s.expID)
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return fmt.Errorf("约束不存在")
+	}
+	return nil
+}

db/schema.sql

@@ -220,6 +220,21 @@ CREATE TABLE IF NOT EXISTS exploration_anchors (
 );
 CREATE INDEX IF NOT EXISTS idx_anchor_asset ON exploration_anchors(asset_id);
 
+-- task_constraints: operator-authored operation constraints (allow/deny) for a task.
+-- Extracted by the goals decomposer at round 0 (from goal/description), editable at
+-- runtime by the main agent + 总览「约束管理」. Injected into the planner/worker system
+-- prompt each round (config-gated) to keep exploration within the operator's boundary.
+CREATE TABLE IF NOT EXISTS task_constraints (
+    id             BIGSERIAL PRIMARY KEY,
+    exploration_id BIGINT NOT NULL REFERENCES explorations(id) ON DELETE CASCADE,
+    kind           TEXT NOT NULL CHECK (kind IN ('allow','deny')),
+    text           TEXT NOT NULL,
+    origin         TEXT,
+    created_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at     TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS idx_task_constraints_exp ON task_constraints(exploration_id);
+
 CREATE TABLE IF NOT EXISTS activity (
     id                 BIGSERIAL PRIMARY KEY,
     exploration_id     BIGINT NOT NULL REFERENCES explorations(id) ON DELETE CASCADE,