[Colafornia]

English

Summary

Evaluating Maka must drive its released Host composition, provider routing, and public client APIs rather than benchmark-only shims or auto-approved permission bypasses. This PR integrates the native Maka Host subject adapter, adds the maka-eval CLI binary (run, report, and internal host-subject), and wires CI helper dependencies.

Refs #6667. Builds on #6850 (until it merges, review commit 1f4d3aae1 for this layer alone).

#	Layer	Links
1	Contracts, metering gateway, and attempt store	#6849
2	Harbor trial environment, runner, and reporting	#6850 · diff
3	Native Maka Host subject and CLI entrypoint	#6852 (this PR) · diff
4	Product parity and binary identity gates	#6853 · diff

• subject::maka & native: Configure Maka via public settings only, resolve outbound routes through maka-providers before attaching the local metering gateway, bootstrap isolated roots via maka host init --settings-stdin without secret leaks, and drive execution via public Settings, Session, and draft/receipt APIs.
• Unattended semantics & identity: Settle pending approvals or questions explicitly as unattended-interaction-blocked, report host/sandbox constraints as environment-limitation, export paginated transcripts with cycle detection, and record the executed maka SHA-256 digest in settled artifacts.
• CLI & CI wiring: Add the maka-eval binary (run, report) and register maka-eval in scripts/ci/suites.mjs (taskHelperConsumers and products/eval/tests/support).

Verification

Validated at 1f4d3aae1 with local maka and maka-python-worker binaries against local fake HTTP providers:

• cargo test --locked -p maka-eval — 22 passed (2 unit tests and 20 integration tests covering public-client Host execution, secret-free maka host init, two-arm retries, unknown-model cost preservation, paginated transcript export, unattended interaction preservation, and Zenmux/Cohere route resolution).
• node --test scripts/ci.test.mjs — 18 passed, including helper-consumer selection for maka-eval.
• cargo clippy --locked -p maka-eval --no-deps --all-targets -- -D warnings — passed.
• RUSTDOCFLAGS="-D warnings" cargo doc --locked -p maka-eval --no-deps — passed.
• node scripts/asf-license-headers.mjs check and git diff --check — passed.

Dependency-inclusive Clippy hits the existing clippy::needless_update in plugins/agent/provider-protocol/src/chat_completions/response.rs:87 outside this PR's diff. Live Docker Harbor cohorts, paid model endpoints, and full just check were not run.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex authored the initial maka subject scaffolding and CLI commands. Google Antigravity implemented native public-client Host execution, provider route resolution, unattended interaction handling, CI wiring, and regression tests. Both Generated-by trailers are preserved.

Checklist

• Tests cover the change and fail without it
• Format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

概述

对 Maka 的评测必须驱动已发布的原生 Host 组合、提供商路由与公开客户端接口，而不能使用评测专用垫片或静默放行审批。本 PR 接入原生 Maka Host 适配器，新增 maka-eval CLI 可执行入口（run、report 及内部 host-subject），并接线 CI 辅助程序依赖。

关联 #6667。基于 #6850（合入前可直接查看提交 1f4d3aae1 以仅审阅本层改动）。

#	分层职责	链接
1	实验契约、计量网关与尝试存储	#6849
2	Harbor 试验环境、编排器与规范报告	#6850 · 增量对比
3	原生 Maka Host 适配器与 CLI 入口	#6852（本 PR） · 增量对比
4	产品等价性校验与二进制身份门禁	#6853 · 增量对比

• subject::maka 与 native：仅通过公开设置配置 Maka，先经由 maka-providers 解析出站模型路由再接入本地计量网关，通过 maka host init --settings-stdin 初始化隔离 Root（命令行无密钥泄露），并经公开 Settings、Session 及草稿回执接口执行任务。
• 无人值守语义与身份记录：挂起的审批或提问显式结算为 unattended-interaction-blocked，环境受限上报为 environment-limitation，支持带环检测的分页记录导出，并在结算产物中记录实际运行的 maka 二进制 SHA-256 摘要。
• CLI 与 CI 接线：新增 maka-eval 可执行程序（run 与 report），并在 scripts/ci/suites.mjs 中登记 maka-eval 辅助二进制依赖及 products/eval/tests/support。

验证

在提交 1f4d3aae1 上配合本地构建的 maka、maka-python-worker 及本地模拟 HTTP 提供商验证：

• cargo test --locked -p maka-eval — 22 项通过（2 项单测与 20 项集成测试，覆盖公开客户端 Host 执行、无密钥泄露 maka host init、双臂重试、未知模型成本保留、分页导出、无人值守交互语义及 Zenmux/Cohere 路由解析）。
• node --test scripts/ci.test.mjs — 18 项通过，覆盖 maka-eval 辅助二进制消费者路由。
• cargo clippy --locked -p maka-eval --no-deps --all-targets -- -D warnings — 通过。
• RUSTDOCFLAGS="-D warnings" cargo doc --locked -p maka-eval --no-deps — 通过。
• node scripts/asf-license-headers.mjs check 与 git diff --check — 通过。

包含依赖的 Clippy 受基线已有的 plugins/agent/provider-protocol/src/chat_completions/response.rs:87（clippy::needless_update，不在本 PR 改动范围内）阻断。未运行真实 Docker Harbor 队列、付费模型端点及完整 just check。

AI 使用

• 没有生成式工具作出实质性贡献
• 生成式工具作出了实质性贡献

工具及范围：OpenAI Codex 编写初始 maka 适配器框架与 CLI 命令；Google Antigravity 实现原生公开客户端 Host 执行、提供商路由解析、无人值守交互保留、CI 接线及回归测试。提交保留两个工具的 Generated-by 标记。

检查清单

• 测试覆盖改动，且在缺少改动时会失败
• 格式、类型检查及受影响的测试套件均在本地通过

本 PR 是否改变行为？

• 是 — 已在上方概述中说明
• 否

[Colafornia]

Parked until the preceding layer merges into rust-preview so each PR shows a single-layer diff; will reopen sequentially.