feat(orchestrator): enforce Page Data validation gate

scripts/agent-run-worker.mjs

@@ -8,6 +8,8 @@ import { createLlmProviderService } from '../llm-providers.mjs';
 import { createTkmindProxy } from '../tkmind-proxy.mjs';
 import { createToolGateway } from '../tool-gateway.mjs';
 import { createUserAuth } from '../user-auth.mjs';
+import { createOrchestratorAdminConfigService } from '../services/orchestrator/admin-config.mjs';
+import { createWorkflowShadowObserver } from '../services/orchestrator/shadow-observer.mjs';
 
 const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -32,6 +34,12 @@ function parseTargets() {
   return [process.env.TKMIND_API_TARGET ?? 'https://127.0.0.1:18006'];
 }
 
+function isEnabledFlag(value) {
+  return ['1', 'true', 'yes', 'on'].includes(
+    String(value ?? '').trim().toLowerCase(),
+  );
+}
+
 function parseArgs(argv) {
   const args = {
     once: false,
@@ -87,6 +95,15 @@ if (args.help) {
 }
 
 const pool = createDbPool();
+const workflowShadowEnabled = isEnabledFlag(
+  process.env.MEMIND_ORCHESTRATOR_SHADOW_OBSERVATION_ENABLED,
+);
+const workflowShadowObserver = workflowShadowEnabled
+  ? createWorkflowShadowObserver({
+      configService: createOrchestratorAdminConfigService(pool),
+      serviceToken: process.env.MEMIND_ORCHESTRATOR_SERVICE_TOKEN,
+    })
+  : null;
 const baseUserAuth = createUserAuth(pool, {
   usersRoot: process.env.H5_USERS_ROOT ?? path.join(root, 'users'),
   h5Root: root,
@@ -124,6 +141,14 @@ const gateway = createAgentRunGateway({
   autoDispatch: false,
   maxConcurrentRuns: Number(process.env.MEMIND_AGENT_RUN_QUEUE_CONCURRENCY ?? 1),
   runTimeoutMs: Number(process.env.MEMIND_AGENT_RUN_TIMEOUT_MS ?? 15 * 60 * 1000),
+  observeWorkflowRun: workflowShadowObserver,
+  observeWorkflowValidation:
+    workflowShadowObserver?.observeValidation ?? null,
+  enforcePageDataWorkflowValidation:
+    workflowShadowEnabled
+    && isEnabledFlag(
+      process.env.MEMIND_ORCHESTRATOR_PAGE_DATA_VALIDATION_GATE_ENABLED,
+    ),
 });
 
 let stopping = false;