feat(ops): 增加运行时性能看板

docs/architecture.md

@@ -147,6 +147,15 @@ V2.6 introduces a database-backed background job runtime for server-side refresh
 
 This runtime is intentionally DB-backed first. Redis is already available in deployment, but V2.6 jobs need transactional dedupe with domain writes more than high-throughput queue semantics.
 
+## Runtime Ops Dashboard (V2.6)
+
+V2.6 adds an Ops runtime surface for local operators and future production admins:
+
+- Backend: `OpsModule` exposes `GET /api/v1/ops/runtime`, reading recent in-memory slow API request events, recent in-memory slow Prisma query events, `background_jobs` queue rows, and dirty `xiaobao_risk_summaries` count.
+- Capture: `ApiTimingInterceptor` and `PrismaService` still log slow events, and also append redacted bounded previews into the Ops runtime buffer. SQL query parameters are not exposed; request query strings and key-like values are stripped or redacted.
+- Jobs: the dashboard summarizes queued/running/succeeded/failed jobs by type and shows recent terminal failures with redacted `lastError`.
+- Permissions: the frontend route is guarded by `ops:view`. Backend RBAC is represented by `OpsPermissionAdapter` until the V2.5 RBAC contract lands, so the replacement point is explicit instead of hard-coupled to temporary role data.
+
 ## 生产部署层（2026-07-01）
 
 当前仓库已补齐云服务器生产部署基线：

docs/decisions.md

@@ -621,3 +621,17 @@
 - Worker 不修改 Version、Requirement、DevTask、TestCase、Bug、Member 等业务实体，也不写通知。V2.7 通知如需消费结果，应通过 insight cache 或 adapter 读取。
 
 **理由**：AI 解读是对确定性规则结果的解释层，不是业务事实源。把它做成 summary 后置队列，能让无人打开页面时也生成解释，同时通过 signature/cooldown/escalation 控制成本和重复调用。只写 cache 能保持 AI 与业务实体解耦，后续通知和审计可以复用缓存，而不是让 AI worker 直接参与业务状态流转。
+
+## 48. V2.6 运维看板先做轻量运行时快照，RBAC 通过 adapter 衔接
+
+**问题**：V2.6 增加了性能 harness、后台 job runtime、小宝 summary refresh 和 AI 解读队列。如果没有一个运行时入口，慢请求、慢查询、job 堆积和 dirty summary 数只能从日志或数据库手工排查。与此同时，V2.5 后端 RBAC/audit 合同尚未落地，不能为了看板临时硬编码一套后端权限结构。
+
+**决策**：
+- 新增 `OpsModule`，提供 `GET /api/v1/ops/runtime`，返回慢请求、慢 Prisma 查询、后台任务队列、失败任务和 dirty summary 数。
+- 慢请求继续由 `ApiTimingInterceptor` 识别；慢查询继续由 `PrismaService` query event 识别。二者额外写入进程内 ring buffer，作为轻量 dashboard 数据源。
+- 看板只保留最近事件，不做长期审计。长期审计和多实例聚合等待 V2.5 audit 或后续 observability 方案。
+- 请求 URL 去掉 query string；SQL 只展示截断后的 query preview；`sk-*`、token、secret、password、authorization 等 key-like 文本统一 redacted；不展示 AI provider apiKey、请求参数或环境变量。
+- Job 队列从 `background_jobs` 最近 200 行聚合，按 type 展示 queued/running/succeeded/failed，并展示最近 failed job 的脱敏 `lastError`。
+- 前端 `/admin/ops` 使用 `RouteGuard permission="ops:view"`；权限字典新增 `ops:view`，但不默认授给非管理员 preset。后端通过 `OpsPermissionAdapter` 保留 `ops:view` 校验入口，待 V2.5 RBAC guard 落地后替换。
+
+**理由**：当前目标是让 V2.6 的性能和后台化能力可观察，而不是建设完整监控平台。进程内 ring buffer 成本低、对生产数据无额外写放大；结合脱敏规则可避免把 secrets 带进管理端。权限 adapter 明确了未来替换点，避免 Ops 看板和未定型 RBAC/audit 合同互相绑死。

docs/performance.md

@@ -77,6 +77,26 @@ The medium fixture is the V2.6 acceptance target. Large fixture runs are for ind
 
 See `docs/performance-hot-queries.md` for query budgets, partition-key contracts, and required indexes.
 
+## Runtime Ops Dashboard
+
+`/admin/ops` provides the V2.6 runtime view for checking whether the hot paths and background workers stay healthy after fixture/perf runs.
+
+It reads `GET /api/v1/ops/runtime` and shows:
+
+- recent slow API requests captured by `ApiTimingInterceptor`
+- recent slow Prisma query previews captured by `PrismaService`
+- `background_jobs` totals and per-type queued/running/succeeded/failed counts
+- recent failed jobs with redacted `lastError`
+- dirty `xiaobao_risk_summaries` count
+
+Access is guarded in the frontend by `ops:view`. Backend RBAC is currently an explicit `OpsPermissionAdapter` placeholder until the V2.5 RBAC contract lands.
+
+Secret handling:
+
+- request query strings are stripped before display
+- SQL is shown only as a bounded query preview, without Prisma parameters
+- key-like text such as `sk-*`, token, secret, password, and authorization is redacted
+
 ## Notes
 
 - `seed-large-dataset` uses deterministic IDs and dates so repeated runs are comparable.

docs/roadmap.md

@@ -19,10 +19,12 @@ V2.4 已完成高增长和核心业务领域从“AppData 主写 + 关系表同
 - V2.6.3 已新增 PostgreSQL-backed `background_jobs` 运行时、去重/lease/retry 语义和 jobs 单元测试。
 - V2.6.4 已新增服务端小宝风险 summary refresh、后台 job handler，以及领域写入 dirty/enqueue 桥接。
 - V2.6.5 已新增服务端小宝 AI 解读队列，summary 刷新后按 signature/cooldown/escalation policy 入队，只写 `xiaobao_risk_insights` 缓存。
+- V2.6.6 已新增 `/admin/ops` 运行时看板和 `GET /api/v1/ops/runtime`，展示慢请求、慢查询、job 队列和 dirty summary 数。
 
 ### 已完成（按时间倒序）
 
 **2026-07-08**
+- V2.6.6 added the Ops runtime dashboard with `ops:view`, redacted slow request/query buffers, background job queue summary, failed job list, and dirty Xiaobao summary count.
 - V2.6.5 moved Xiaobao AI interpretation behind the background job runtime, reusing `AiService.interpretRisk()` and writing only insight cache rows.
 - V2.6.4 moved deterministic Xiaobao risk summary refresh into the server, registered the `xiaobao.summary.refresh` background job handler, and enqueue refresh jobs from dirty domain writes.
 - V2.6.3 added DB-backed background jobs with active dedupe keys, lease-based claiming, expired lock recovery, retry/terminal-failure handling, and a small handler worker.