我们负责运营什么

四类代理，部署于您业务的各个环节——每一类都只提出建议，绝不单独行动。

它如何受控

差别不在于一块炫目的仪表盘，而在于这道签署——没有任何动作 会擅自以您的名义行事。

可度量，而非空口

各类代理受控的真实方式——绝非杜撰的自主度数字。

构建实况——谁在建议、谁在把关、谁在记录

代理并非主角；这道签署才是。这里是它真实的样貌。
代码保留英文——工程界通用的语言。

"""MatchTop · an agent — it proposes, it never ships on its own.
Standard library only. The agent raises a hand; a person decides."""

from dataclasses import dataclass, field
from datetime import datetime


@dataclass
class Proposal:
    kind: str          # "restock" | "refund" | "reply" | "reconcile"
    detail: dict
    reason: str
    raised_at: datetime = field(default_factory=datetime.utcnow)
    signed: bool = False   # stays False until a human says yes


def watch_stock(store, floor=3):
    """Low stock is not an order. It is a proposal that waits for a signature."""
    for item in store.low_stock(below=floor):
        yield Proposal(
            kind="restock",
            detail={"sku": item.sku, "qty": item.reorder_qty},
            reason=f"{item.sku} at {item.stock}, below floor of {floor}",
        )

"""MatchTop · the sign-off gate — the one door every proposal must pass.
No action reaches the business side of the system unsigned."""

class PermissionError(Exception): pass


def apply(p: Proposal, signer: str | None = None):
    """Raises unless a human has signed. Nothing else gets this proposal through."""
    if not p.signed or signer is None:
        raise PermissionError("no action ships without a human signature")

    store.execute(p)                      # only reachable after sign-off
    log_signature(p, signer)              # every pass through this gate is recorded

"""MatchTop · the signature log — append-only, who signed what, when.
Nothing is edited after the fact; the record is the record."""

import csv
from pathlib import Path
from datetime import datetime

LOG = Path("signatures.csv")


def log_signature(p: Proposal, signer: str) -> None:
    """One line per signed action — auditable by anyone you point at this file."""
    is_new = not LOG.exists()
    with LOG.open("a", newline="") as f:
        w = csv.writer(f)
        if is_new:
            w.writerow(["raised_at", "kind", "reason", "signer", "signed_at"])
        w.writerow([p.raised_at, p.kind, p.reason, signer, datetime.utcnow()])
    return None                            # handed to the record, not to a black box

无法复制之处

为何受签署约束的代理，胜过擅自行动的代理。

自主 AI 无法托付您的钱款——它先行动、后解释。 一个黑箱无法被审计。而一个面目模糊的机器人无法为它所做之事负责。正因 如此，此处没有价目表：我们审视您的业务需要运营什么，加以度量，并按 度量所得报价。

严守保密

在落下第一行代码之前，先明确您的商店及其数据如何受护。这一部分没有商量余地。