From ebb5d410ad2070edef9b190f4487e5d4bc921041 Mon Sep 17 00:00:00 2001
From: yuqei <cyuqei@gmail.com>
Date: Wed, 26 Aug 2026 17:02:55 +0800
Subject: [PATCH] feat: add controlled pilot capacity quality gates

---
 ...°-å�—控试点容é‡�与分层质é‡�评测报告-2026-08-26.md | 146 +++++
 .../packages/ai-openapi/openapi.yaml          | 129 ++++-
 .../services/ai-platform-api/.env.example     |   7 +
 .../services/ai-platform-api/README.md        |  16 +
 ...826_0028_add_stratified_quality_reviews.py | 110 ++++
 .../yuqei_ai_platform_api/api/model_jobs.py   | 130 ++++-
 .../src/yuqei_ai_platform_api/config.py       |   5 +
 .../src/yuqei_ai_platform_api/main.py         |   1 +
 .../src/yuqei_ai_platform_api/model_jobs.py   | 540 ++++++++++++++++--
 .../src/yuqei_ai_platform_api/models.py       |  35 ++
 .../src/yuqei_ai_platform_api/schema_check.py |  22 +
 .../ai-platform-api/tests/test_health.py      |   4 +-
 .../ai-platform-api/tests/test_model_jobs.py  | 248 +++++++-
 yuqei-ai-sdk-python/src/yuqei_sdk/__init__.py |   8 +
 .../src/yuqei_sdk/ai_platform.py              | 120 +++-
 yuqei-ai-sdk-python/tests/test_ai_platform.py |  43 +-
 .../src/app/admin/model-jobs/page.tsx         | 136 ++++-
 .../[jobId]/quality-reviews/route.ts          |  24 +
 .../admin/model-jobs/review-queue/route.ts    |   6 +
 .../src/services/contracts-client.ts          |  43 +-
 .../contract-web/src/services/contracts.ts    |  52 ++
 .../packages/contract-openapi/openapi.yaml    | 125 +++-
 .../yuqei_contract_api/api/contracts_core.py  |  70 ++-
 .../contract-api/tests/test_legal_qa_proxy.py |  47 +-
 yuqei-infra/README.md                         |  17 +
 ...run-controlled-pilot-stratified-quality.py | 439 ++++++++++++++
 ...est_controlled_pilot_stratified_quality.py |  81 +++
 27 files changed, 2541 insertions(+), 63 deletions(-)
 create mode 100644 project-docs/AI��平�-�控试点容�与分层质�评测报告-2026-08-26.md
 create mode 100644 yuqei-ai-platform/services/ai-platform-api/migrations/versions/20260826_0028_add_stratified_quality_reviews.py
 create mode 100644 yuqei-contract-platform/apps/contract-web/src/app/api/contract-platform/admin/model-jobs/[jobId]/quality-reviews/route.ts
 create mode 100644 yuqei-contract-platform/apps/contract-web/src/app/api/contract-platform/admin/model-jobs/review-queue/route.ts
 create mode 100644 yuqei-infra/scripts/run-controlled-pilot-stratified-quality.py
 create mode 100644 yuqei-infra/tests/test_controlled_pilot_stratified_quality.py

diff --git a/project-docs/AI��平�-�控试点容�与分层质�评测报告-2026-08-26.md b/project-docs/AI��平�-�控试点容�与分层质�评测报告-2026-08-26.md
new file mode 100644
index 00000000..e19ca538
--- /dev/null
+++ b/project-docs/AI��平�-�控试点容�与分层质�评测报告-2026-08-26.md
@@ -0,0 +1,146 @@
+# AI ��平��控试点容�与分层质�评测报告
+
+- 日期：2026-08-26
+- �行 ID：`stratified-v1-20260826`
+- 阶段：核心产�上线收�——�控试点容�与分层质�评测
+- 自动评测结论：**通过**
+- 法律内容人工验收：**未完�，�得视为已通过**
+- �布建议：�继续内部和具��控试点；�得�此开放公共注册或宣称法律����法存�或正�生产模型能力已验收
+
+## 一�管�结论
+
+本阶段已�建立租户级模型任务准入�100 �分层真实样本�1/3/5/10 并�阶梯�自动输出门��确定性人工抽样�高风险必审�����核�馈和����下钻能力。
+
+本次 100 �样本全部由本地开�环境中的 `codex-cli-development / gpt-5.6-sol` 真实执行，未把 fallback�模拟�应或未�行质�门�的任务计入基线。自动结构质�和既定容�门�全部通过，但该门���明输出结构�基本完整性和�行稳定性，��明法律事实�法�时效性或具体案件结论正确。
+
+| 结论项 | 结果 | 判定 |
+| --- | ---: | --- |
+| 真实 Provider 样本 | 100 / 100 | 通过 |
+| ��类型覆盖 | 10 类 × �类 10 � | 通过 |
+| 自动结构质�通过 | 100 / 100 | 通过 |
+| 10 并�准入拒� | 0 | 通过 |
+| 模型执行 P95 | 179,040 ms | 通过，接近 180 秒门� |
+| fallback / 失败 / �控�试 | 0 / 0 / 0 | 通过 |
+| 待具�人工�核 | 43 | 待完� |
+| 已完�人工�核 | 0 | 未通过法律内容验收 |
+
+## 二�已�地能力
+
+### 2.1 租户与用户准入
+
+- 默认租户活动任务上� 10��用户活动任务上� 3�租户队列上� 25。
+- 幂等键优先于容�判断；�一请求�试返回原任务，����用��。
+- 超�返回 HTTP 429 和 `Retry-After`，并�供租户活动/队列饱和度与��告警。
+- � API 进程内使用�一临界区完�幂等查询�容�计数和写入，竞�测试中 20 个�时�交严格放行 10 个。
+- 当��制是�控试点� API 进程��；扩展到多个 API 副本�，需� Redis/Lua�数�库咨询�或独立���务�供跨进程原�准入。
+
+### 2.2 分层质�数�
+
+�个任务�以�带�行 ID�样本 ID���类型�风险等级和行业标签。��快照�以按评测�行过滤，并分别按��类型�风险等级和行业计算样本��自动通过率�人工�核进度。
+
+本次固定样本覆盖：采购�销售�劳动�租���密�软件�务�建设工程�数�处��股�交易和�输��；�类 10 �，共 100 �。风险分层为高 40�中 40�低 20；行业覆盖制造�零售�通用�科技�建筑�金�和物�。
+
+### 2.3 人工�核闭环
+
+- 自动质�异常�高风险样本�确定性抽样和人工接管�进入统一�核队列。
+- 高风险样本 100% 必审；其他评测样本按默认 10% 确定性抽样，���行�一任务�会改�抽样决定。
+- �核人必须具�，并记录事实一致性�引用�核验性�高风险���处置结论和说明。
+- �核事件追加写入独立表；模型原输出�被�默覆盖。
+- 数�库写入在�一事务内�时�存�核事件并更新任务状�，��出现“任务已完�但��未�库�或相�状�。
+- 管�页��供模型输出与引用预览�试点租户/�行 ID 下钻和显��核确认框。
+
+## 三�真实容�曲线
+
+| 并� | �交 | 准入�试 | 排队 P95 | 执行 P95 | 波次耗时 |
+| ---: | ---: | ---: | ---: | ---: | ---: |
+| 1 | 1 | 0 | 2,266 ms | 170,774 ms | 176,577 ms |
+| 3 | 3 | 0 | 1,311 ms | 175,488 ms | 180,078 ms |
+| 5 | 5 | 0 | 1,101 ms | 163,726 ms | 164,504 ms |
+| 10 | 10 | 0 | 3,668 ms | 174,452 ms | 176,455 ms |
+
+全体 100 �样本：
+
+- 排队 P50 / P95：1,642 / 4,505 ms；最大 6,567 ms。
+- 模型执行 P50 / P95：156,712 / 179,040 ms；最大 221,713 ms。
+- 总耗时 P50 / P95：158,612 / 179,298 ms；最大 223,004 ms。
+- 3 �执行耗时超过 180 秒，其中 1 �超过 200 秒。P95 门�通过，但长尾�需治�。
+- 57 �任务以 `succeeded` 完�；43 �在模型真实�功和自动门�通过�按策略进入 `awaiting_human`，�属于模型失败。
+- ��输出至少包� 1 �引用；回答字符数最少 1,289，中�数约 1,977。这里�验�结构存在，�代表引用法律有效性已�人工核验。
+
+## 四�分层结果
+
+10 类���为 10/10 自动门�通过。人工�核�求分布如下：
+
+| ��类型 | 样本 | 自动通过 | 待人工�核 |
+| --- | ---: | ---: | ---: |
+| 采购 | 10 | 10 | 5 |
+| 销售 | 10 | 10 | 4 |
+| 劳动 | 10 | 10 | 4 |
+| 租� | 10 | 10 | 4 |
+| �密 | 10 | 10 | 4 |
+| 软件�务 | 10 | 10 | 4 |
+| 建设工程 | 10 | 10 | 5 |
+| 数�处� | 10 | 10 | 4 |
+| 股�交易 | 10 | 10 | 4 |
+| �输 | 10 | 10 | 5 |
+
+风险分层中，高风险 40/40 全部进入人工�核；中风险 40 �抽中 2 �，低风险 20 �抽中 1 �，共 43 �。当�没有自动质�异常触�的�核，人工�核完�数为 0。
+
+## 五�门�判定
+
+| 门� | 阈值 | 实测 | 判定 |
+| --- | --- | ---: | --- |
+| 真实样本数 | ≥ 100 | 100 | 通过 |
+| ��类型覆盖 | 10 类且�类 ≥ 10 | 10 × 10 | 通过 |
+| 总体自动门�通过率 | ≥ 80% | 100% | 通过 |
+| ���类型自动通过率 | ≥ 70% | 全部 100% | 通过 |
+| 模型执行 P95 | ≤ 180 秒 | 179.04 秒 | 通过，黄色边界 |
+| 10 并�准入拒� | 0 | 0 | 通过 |
+| 高风险人工�核完� | 100% | 0 / 40 | 未完� |
+| 全部抽检完� | 100% | 0 / 43 | 未完� |
+
+因此，本阶段�能签署“自动容�和结构质�门�通过�，�能签署“法律内容质�通过�。
+
+## 六��行与工程��
+
+- PostgreSQL Alembic 已从 `20260826_0027` �级到 `20260826_0028 (head)`；全新 SQLite 也已从零�级到�一 head。
+- �行时 schema check 中数�库�版本�核心表�租户列和 30 个模型任务��列�为 `ok`。
+- AI API��� API 和�端分别在 8101�8100�3000 �动；10 个独立 worker �与容��行。
+- AI API 全�测试�worker�Python SDK���代��基础设施测试�Web 测试与 TypeScript 类型检查�通过；�交�会�次执行最终回归。
+- 两套 OpenAPI 3.1 文档��被 YAML 解�，并已�述评测元数��容�快照��核队列��馈对象和跨租户平�管�员下钻。
+- ��密钥扫�的仓库全局结果�因 38 个既有/未跟踪本地环境候选而失败；将扫�结果与本次 27 个�更文件交�核对�，本次�更新增候选为 0。未修改或掩盖既有基线问题。
+- Chrome �读 UAT 使用现有“UAT 法务�会�访问平���页，系统正确返回平�管�员���足，控制�无异常；未使用�管�员账��交�核。平�管�员正��程由自动化代�测试覆盖，�建议由真实超级管�员完�一次最终界�确认。
+- 原始评测 JSON/Markdown �于 `.runtime/controlled-pilot-stratified-quality/`，默认�进入 Git。����存样本/任务/审计 ID�分层�状��字符数�引用数和耗时，��存问题正文或模型回答正文。
+
+## 七�已知�制与上线边界
+
+1. 100% 是自动结构门�通过率，�是法律正确率。43 �具��核未完��，�应对外宣称内容质�已验收。
+2. 执行 P95 � 180 秒�剩 960 ms，且最大值 221.7 秒。�控试点应继续显示��进度��许�消和人工接管，�应���步等待。
+3. 当�模型��是开�期 Codex CLI 与个人订阅会�，�是�供真实客户使用的生产 Provider ���API ��或�务等级�议。
+4. 本地�行时 anti-abuse 为 disabled；真实用户注册�应��关闭。公开试点�至少切� observe/enforce，�置哈希密钥并验��日调用/数�出���。
+5. PostgreSQL 当�缺少 `vector` 扩展和 `knowledge_chunks.embedding`，�阻断本次模型队列容�测试，但会�制真实知识库��检索效果。
+6. 多 API 副本时，当�进程��能作为全局容�硬��；必须先接入共享原�准入。
+7. 本阶段没有执行�云 KMS�外部�����或�法效力验收，相关能力���未执行状�。
+
+## 八�下一步修改方案
+
+### P0：�控试点放行�
+
+1. 指定至少两�具�法律�核人员，完� 40 个高风险样本和 3 个抽样样本；��核对事实�现行法��引用定�和�大��。
+2. 导出 43 �结构化�核�馈，按��类型统计 corrected/rejected���核验引用和高风险��；任一类型出现�大��时�新评测该类型 10 �。
+3. 对 3 �超过 180 秒的任务分� Provider 耗时和�示�长度；将 P95 目标留出至少 10% 余���扩大租户并�。
+4. 用真实超级管�员登录��页，下钻 `controlled-pilot-v1 / stratified-v1-20260826`，验�筛选�输出预览�显�确认和�核�库，但�得用测试人员身份替代法务结论。
+
+### P1：扩大到多租户�
+
+1. 将准入计数�移到 Redis/Lua�数�库咨询�或独立���务，并用两个 API 副本�� 20/50 并�竞�测试。
+2. 增加�人独立�核/仲�数�模型，��首��核人完��第二�无法�交独立结论。
+3. 建立按租户和��类型的错误预算：fallback�失败�P95��大���引用��核验率分别告警。
+4. 接入具备�业 API ������数�处��款和国内�访问性的正�模型 Provider；个人订阅仅�留开�期使用。
+5. 补� pgvector�anti-abuse�正��规�料和�控注册门��，�评估扩大试点。
+
+## ��最终�布决定
+
+本阶段建议状�为：**自动容�与结构质�门� PASS；法律内容验收 PENDING；公共�布 BLOCKED**。
+
+�许继续的范围是内部开�和具��控试点，租户活动任务�超过 10��用户�超过 3，并�留��任务��试�fallback 和人工接管。完� 43 �人工�核�上述 P0 �件�，�开放真实用户自由注册，�将本地评测包装�第三方存���法效力或正�生产�务等级�明。
diff --git a/yuqei-ai-platform/packages/ai-openapi/openapi.yaml b/yuqei-ai-platform/packages/ai-openapi/openapi.yaml
index a8f605e7..cdbf55fa 100644
--- a/yuqei-ai-platform/packages/ai-openapi/openapi.yaml
+++ b/yuqei-ai-platform/packages/ai-openapi/openapi.yaml
@@ -187,6 +187,11 @@ paths:
           in: header
           required: false
           schema: { type: string, maxLength: 128 }
+        - { name: X-Evaluation-Run-Id, in: header, required: false, schema: { type: string, maxLength: 128 } }
+        - { name: X-Evaluation-Case-Id, in: header, required: false, schema: { type: string, maxLength: 128 } }
+        - { name: X-Evaluation-Contract-Type, in: header, required: false, schema: { type: string, maxLength: 64 } }
+        - { name: X-Evaluation-Risk-Level, in: header, required: false, schema: { type: string, enum: [low, medium, high] } }
+        - { name: X-Evaluation-Industry, in: header, required: false, schema: { type: string, maxLength: 64 } }
       requestBody:
         required: true
         content:
@@ -200,6 +205,8 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/ModelInferenceJob"
+        "429":
+          description: Tenant or user admission limit reached; retry after the response Retry-After interval
   /api/v1/legal/contract-review:
     post:
       operationId: runContractReview
@@ -232,6 +239,11 @@ paths:
           in: header
           required: false
           schema: { type: string, maxLength: 128 }
+        - { name: X-Evaluation-Run-Id, in: header, required: false, schema: { type: string, maxLength: 128 } }
+        - { name: X-Evaluation-Case-Id, in: header, required: false, schema: { type: string, maxLength: 128 } }
+        - { name: X-Evaluation-Contract-Type, in: header, required: false, schema: { type: string, maxLength: 64 } }
+        - { name: X-Evaluation-Risk-Level, in: header, required: false, schema: { type: string, enum: [low, medium, high] } }
+        - { name: X-Evaluation-Industry, in: header, required: false, schema: { type: string, maxLength: 64 } }
       requestBody:
         required: true
         content:
@@ -245,6 +257,8 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/ModelInferenceJob"
+        "429":
+          description: Tenant or user admission limit reached; retry after the response Retry-After interval
   /api/v1/model-jobs/history:
     get:
       operationId: listModelInferenceJobHistory
@@ -283,6 +297,9 @@ paths:
         - name: target_sample_count
           in: query
           schema: { type: integer, minimum: 1, maximum: 1000, default: 30 }
+        - name: evaluation_run_id
+          in: query
+          schema: { type: string, maxLength: 128 }
       responses:
         "200":
           description: Model job operational snapshot
@@ -290,6 +307,22 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/ModelJobOperationsSnapshot"
+  /api/v1/model-jobs/review-queue:
+    get:
+      operationId: listModelJobReviewQueue
+      summary: List tenant-scoped outputs requiring structured human quality review
+      parameters:
+        - name: limit
+          in: query
+          schema: { type: integer, minimum: 1, maximum: 100, default: 50 }
+      responses:
+        "200":
+          description: Human quality review queue
+          content:
+            application/json:
+              schema:
+                type: array
+                items: { $ref: "#/components/schemas/ModelInferenceJob" }
   /api/v1/model-jobs/{job_id}:
     get:
       operationId: getModelInferenceJob
@@ -373,6 +406,36 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/ModelInferenceJob"
+  /api/v1/model-jobs/{job_id}/quality-reviews:
+    get:
+      operationId: listModelJobQualityReviews
+      summary: List immutable structured quality feedback for one model job
+      parameters:
+        - { name: job_id, in: path, required: true, schema: { type: string } }
+      responses:
+        "200":
+          description: Quality review feedback dataset
+          content:
+            application/json:
+              schema:
+                type: array
+                items: { $ref: "#/components/schemas/ModelJobQualityReview" }
+    post:
+      operationId: createModelJobQualityReview
+      summary: Complete human review and write structured feedback for rule learning
+      parameters:
+        - { name: job_id, in: path, required: true, schema: { type: string } }
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: "#/components/schemas/ModelJobQualityReviewRequest" }
+      responses:
+        "200":
+          description: Immutable quality review record
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/ModelJobQualityReview" }
   /api/v1/legal/review:
     post:
       operationId: runLegalReview
@@ -1723,6 +1786,16 @@ components:
             $ref: "#/components/schemas/ModelOutputQualityLabel"
         quality_summary: { type: string, nullable: true }
         quality_gate_version: { type: string }
+        evaluation_run_id: { type: string, nullable: true }
+        evaluation_case_id: { type: string, nullable: true }
+        evaluation_contract_type: { type: string, nullable: true }
+        evaluation_risk_level: { type: string, enum: [low, medium, high], nullable: true }
+        evaluation_industry: { type: string, nullable: true }
+        review_status: { type: string, enum: [not_required, required, completed] }
+        review_trigger: { type: string, enum: [quality_gate, high_risk, random_sample, manual], nullable: true }
+        reviewed_at: { type: string, format: date-time, nullable: true }
+        reviewed_by: { type: string, nullable: true }
+        review_disposition: { type: string, enum: [accepted, corrected, rejected], nullable: true }
         queue_latency_ms: { type: integer }
         execution_latency_ms: { type: integer }
         total_latency_ms: { type: integer }
@@ -1784,7 +1857,7 @@ components:
         threshold: { type: number }
     ModelJobOperationsSnapshot:
       type: object
-      required: [metrics, alerts, completed_sample_count, target_sample_count, remaining_sample_count, baseline_ready, quality_passed, quality_needs_review, quality_failed, quality_pass_rate]
+      required: [metrics, alerts, completed_sample_count, target_sample_count, remaining_sample_count, baseline_ready, quality_passed, quality_needs_review, quality_failed, quality_pass_rate, review_required, review_completed, admission, quality_segments]
       properties:
         metrics:
           $ref: "#/components/schemas/ModelInferenceJobMetrics"
@@ -1800,6 +1873,60 @@ components:
         quality_needs_review: { type: integer }
         quality_failed: { type: integer }
         quality_pass_rate: { type: number }
+        review_required: { type: integer }
+        review_completed: { type: integer }
+        evaluation_run_id: { type: string, nullable: true }
+        admission: { $ref: "#/components/schemas/ModelJobAdmissionSnapshot" }
+        quality_segments:
+          type: array
+          items: { $ref: "#/components/schemas/ModelJobQualitySegment" }
+    ModelJobAdmissionSnapshot:
+      type: object
+      required: [running, queued, tenant_active_limit, user_active_limit, tenant_queue_limit, active_saturation_rate, queue_saturation_rate, accepting_submissions]
+      properties:
+        running: { type: integer }
+        queued: { type: integer }
+        tenant_active_limit: { type: integer }
+        user_active_limit: { type: integer }
+        tenant_queue_limit: { type: integer }
+        active_saturation_rate: { type: number }
+        queue_saturation_rate: { type: number }
+        accepting_submissions: { type: boolean }
+    ModelJobQualitySegment:
+      type: object
+      required: [dimension, value, sample_count, quality_passed, quality_needs_review, quality_failed, review_required, review_completed, quality_pass_rate]
+      properties:
+        dimension: { type: string, enum: [contract_type, risk_level, industry] }
+        value: { type: string }
+        sample_count: { type: integer }
+        quality_passed: { type: integer }
+        quality_needs_review: { type: integer }
+        quality_failed: { type: integer }
+        review_required: { type: integer }
+        review_completed: { type: integer }
+        quality_pass_rate: { type: number }
+    ModelJobQualityReviewRequest:
+      type: object
+      required: [legal_fact_consistency, citation_verifiability, high_risk_omission, disposition]
+      properties:
+        legal_fact_consistency: { type: string, enum: [pass, fail, uncertain, not_applicable] }
+        citation_verifiability: { type: string, enum: [pass, fail, uncertain, not_applicable] }
+        high_risk_omission: { type: string, enum: [not_detected, detected, uncertain, not_applicable] }
+        disposition: { type: string, enum: [accepted, corrected, rejected] }
+        feedback_text: { type: string, nullable: true, maxLength: 8000 }
+    ModelJobQualityReview:
+      allOf:
+        - { $ref: "#/components/schemas/ModelJobQualityReviewRequest" }
+        - type: object
+          required: [id, tenant_id, job_id, review_trigger, reviewer_id, quality_gate_version, created_at]
+          properties:
+            id: { type: string }
+            tenant_id: { type: string }
+            job_id: { type: string }
+            review_trigger: { type: string, enum: [quality_gate, high_risk, random_sample, manual] }
+            reviewer_id: { type: string }
+            quality_gate_version: { type: string }
+            created_at: { type: string, format: date-time }
     ContractReviewRequest:
       type: object
       required:
diff --git a/yuqei-ai-platform/services/ai-platform-api/.env.example b/yuqei-ai-platform/services/ai-platform-api/.env.example
index 9bb80b4b..b66f17e3 100644
--- a/yuqei-ai-platform/services/ai-platform-api/.env.example
+++ b/yuqei-ai-platform/services/ai-platform-api/.env.example
@@ -27,6 +27,13 @@ AI_PLATFORM_CODEX_CLI_TIMEOUT_SECONDS=240
 AI_PLATFORM_CODEX_CLI_WORKING_DIR=.runtime/codex-model-provider
 AI_PLATFORM_MODEL_JOB_DISPATCH_MODE=background_tasks
 AI_PLATFORM_MODEL_JOB_MAX_ATTEMPTS=3
+# Controlled-pilot admission and human-sampling policy. Idempotent replays are
+# resolved before these limits, so client retries do not create duplicate work.
+AI_PLATFORM_MODEL_JOB_TENANT_ACTIVE_LIMIT=10
+AI_PLATFORM_MODEL_JOB_USER_ACTIVE_LIMIT=3
+AI_PLATFORM_MODEL_JOB_TENANT_QUEUE_LIMIT=25
+AI_PLATFORM_MODEL_JOB_MANUAL_SAMPLE_RATE_PERCENT=10
+AI_PLATFORM_MODEL_JOB_HIGH_RISK_REVIEW_REQUIRED=true
 # Local-only convenience; protected deployments resolve api_key_secret_ref from a mounted file.
 AI_PLATFORM_PROVIDER_API_KEY=
 AI_PLATFORM_PROVIDER_BASE_URL=
diff --git a/yuqei-ai-platform/services/ai-platform-api/README.md b/yuqei-ai-platform/services/ai-platform-api/README.md
index c57285b6..9313324d 100644
--- a/yuqei-ai-platform/services/ai-platform-api/README.md
+++ b/yuqei-ai-platform/services/ai-platform-api/README.md
@@ -180,11 +180,13 @@ Core MVP endpoints:
 - `POST /api/v1/legal/contract-review/jobs`
 - `GET /api/v1/model-jobs/history`
 - `GET /api/v1/model-jobs/operations`
+- `GET /api/v1/model-jobs/review-queue`
 - `GET /api/v1/model-jobs/{job_id}`
 - `POST /api/v1/model-jobs/{job_id}/cancel`
 - `POST /api/v1/model-jobs/{job_id}/retry`
 - `POST /api/v1/model-jobs/{job_id}/handoff`
 - `POST /api/v1/model-jobs/{job_id}/resolve`
+- `GET|POST /api/v1/model-jobs/{job_id}/quality-reviews`
 - `GET /api/v1/model-jobs/metrics`
 - `GET /api/v1/audit/ai-runs`
 
@@ -205,6 +207,20 @@ or user identity is rejected. Completed outputs pass a deterministic structural
 quality gate before being marked successful, and cancellation preserves the
 job record and prior attempts for operations review.
 
+Controlled pilots can attach an evaluation run, case, contract type, risk
+level, and industry to each submitted job. Admission control applies tenant
+active/queue limits and a per-user active limit, returning HTTP 429 plus
+`Retry-After` when saturated; an idempotent replay is always resolved first.
+High-risk evaluation cases, quality-gate exceptions, and a deterministic sample
+of other evaluation cases enter the structured review queue. Human reviewers
+record fact consistency, citation verifiability, high-risk omissions, and a
+final disposition as immutable feedback instead of overwriting model output.
+`GET /api/v1/model-jobs/operations?evaluation_run_id=...` separates queue,
+execution, and total latency and reports quality by contract type, risk level,
+and industry. The current admission check is designed for the controlled-pilot
+single API process; multiple API replicas require a shared atomic admission
+counter before the same limit can be treated as a hard global guarantee.
+
 Use `GET /api/v1/knowledge-chunks/search/explain` to inspect normalized query
 terms, keyword/vector/hybrid scores, inclusion rank, and filter reasons for the
 candidate chunks considered by retrieval.
diff --git a/yuqei-ai-platform/services/ai-platform-api/migrations/versions/20260826_0028_add_stratified_quality_reviews.py b/yuqei-ai-platform/services/ai-platform-api/migrations/versions/20260826_0028_add_stratified_quality_reviews.py
new file mode 100644
index 00000000..da827220
--- /dev/null
+++ b/yuqei-ai-platform/services/ai-platform-api/migrations/versions/20260826_0028_add_stratified_quality_reviews.py
@@ -0,0 +1,110 @@
+"""add stratified model quality reviews
+
+Revision ID: 20260826_0028
+Revises: 20260826_0027
+Create Date: 2026-08-26
+"""
+
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "20260826_0028"
+down_revision = "20260826_0027"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("model_inference_jobs", sa.Column("evaluation_run_id", sa.String(length=128), nullable=True))
+    op.add_column("model_inference_jobs", sa.Column("evaluation_case_id", sa.String(length=128), nullable=True))
+    op.add_column("model_inference_jobs", sa.Column("evaluation_contract_type", sa.String(length=64), nullable=True))
+    op.add_column("model_inference_jobs", sa.Column("evaluation_risk_level", sa.String(length=16), nullable=True))
+    op.add_column("model_inference_jobs", sa.Column("evaluation_industry", sa.String(length=64), nullable=True))
+    op.add_column(
+        "model_inference_jobs",
+        sa.Column("review_status", sa.String(length=32), nullable=False, server_default="not_required"),
+    )
+    op.add_column("model_inference_jobs", sa.Column("review_trigger", sa.String(length=32), nullable=True))
+    op.add_column("model_inference_jobs", sa.Column("reviewed_at", sa.DateTime(timezone=True), nullable=True))
+    op.add_column("model_inference_jobs", sa.Column("reviewed_by", sa.String(length=128), nullable=True))
+    op.add_column("model_inference_jobs", sa.Column("review_disposition", sa.String(length=32), nullable=True))
+    op.create_index(op.f("ix_model_inference_jobs_evaluation_run_id"), "model_inference_jobs", ["evaluation_run_id"])
+    op.create_index(
+        op.f("ix_model_inference_jobs_evaluation_contract_type"),
+        "model_inference_jobs",
+        ["evaluation_contract_type"],
+    )
+    op.create_index(
+        op.f("ix_model_inference_jobs_evaluation_risk_level"),
+        "model_inference_jobs",
+        ["evaluation_risk_level"],
+    )
+    op.create_index(op.f("ix_model_inference_jobs_review_status"), "model_inference_jobs", ["review_status"])
+    op.create_index(
+        "ix_model_inference_jobs_tenant_evaluation_run_created",
+        "model_inference_jobs",
+        ["tenant_id", "evaluation_run_id", "created_at"],
+    )
+    op.create_index(
+        "ix_model_inference_jobs_tenant_review_status_created",
+        "model_inference_jobs",
+        ["tenant_id", "review_status", "created_at"],
+    )
+
+    op.create_table(
+        "model_job_quality_reviews",
+        sa.Column("id", sa.String(length=64), nullable=False),
+        sa.Column("tenant_id", sa.String(length=64), nullable=False, server_default="default"),
+        sa.Column("job_id", sa.String(length=64), nullable=False),
+        sa.Column("review_trigger", sa.String(length=32), nullable=False),
+        sa.Column("reviewer_id", sa.String(length=128), nullable=False),
+        sa.Column("legal_fact_consistency", sa.String(length=32), nullable=False),
+        sa.Column("citation_verifiability", sa.String(length=32), nullable=False),
+        sa.Column("high_risk_omission", sa.String(length=32), nullable=False),
+        sa.Column("disposition", sa.String(length=32), nullable=False),
+        sa.Column("feedback_text", sa.Text(), nullable=True),
+        sa.Column("quality_gate_version", sa.String(length=32), nullable=False, server_default="model-job-v1"),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(op.f("ix_model_job_quality_reviews_tenant_id"), "model_job_quality_reviews", ["tenant_id"])
+    op.create_index(op.f("ix_model_job_quality_reviews_job_id"), "model_job_quality_reviews", ["job_id"])
+    op.create_index(op.f("ix_model_job_quality_reviews_created_at"), "model_job_quality_reviews", ["created_at"])
+    op.create_index(
+        "ix_model_job_quality_reviews_tenant_job_created",
+        "model_job_quality_reviews",
+        ["tenant_id", "job_id", "created_at"],
+    )
+    op.create_index(
+        "ix_model_job_quality_reviews_tenant_trigger_created",
+        "model_job_quality_reviews",
+        ["tenant_id", "review_trigger", "created_at"],
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ix_model_job_quality_reviews_tenant_trigger_created", table_name="model_job_quality_reviews")
+    op.drop_index("ix_model_job_quality_reviews_tenant_job_created", table_name="model_job_quality_reviews")
+    op.drop_index(op.f("ix_model_job_quality_reviews_created_at"), table_name="model_job_quality_reviews")
+    op.drop_index(op.f("ix_model_job_quality_reviews_job_id"), table_name="model_job_quality_reviews")
+    op.drop_index(op.f("ix_model_job_quality_reviews_tenant_id"), table_name="model_job_quality_reviews")
+    op.drop_table("model_job_quality_reviews")
+    op.drop_index("ix_model_inference_jobs_tenant_review_status_created", table_name="model_inference_jobs")
+    op.drop_index("ix_model_inference_jobs_tenant_evaluation_run_created", table_name="model_inference_jobs")
+    op.drop_index(op.f("ix_model_inference_jobs_review_status"), table_name="model_inference_jobs")
+    op.drop_index(op.f("ix_model_inference_jobs_evaluation_risk_level"), table_name="model_inference_jobs")
+    op.drop_index(op.f("ix_model_inference_jobs_evaluation_contract_type"), table_name="model_inference_jobs")
+    op.drop_index(op.f("ix_model_inference_jobs_evaluation_run_id"), table_name="model_inference_jobs")
+    op.drop_column("model_inference_jobs", "review_disposition")
+    op.drop_column("model_inference_jobs", "reviewed_by")
+    op.drop_column("model_inference_jobs", "reviewed_at")
+    op.drop_column("model_inference_jobs", "review_trigger")
+    op.drop_column("model_inference_jobs", "review_status")
+    op.drop_column("model_inference_jobs", "evaluation_industry")
+    op.drop_column("model_inference_jobs", "evaluation_risk_level")
+    op.drop_column("model_inference_jobs", "evaluation_contract_type")
+    op.drop_column("model_inference_jobs", "evaluation_case_id")
+    op.drop_column("model_inference_jobs", "evaluation_run_id")
diff --git a/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/api/model_jobs.py b/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/api/model_jobs.py
index 3f1aa0ff..8900805f 100644
--- a/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/api/model_jobs.py
+++ b/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/api/model_jobs.py
@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import asyncio
+import hashlib
 from collections.abc import Callable
 from typing import Any
 
@@ -11,6 +12,7 @@ from yuqei_ai_platform_api.contract_review import ContractReviewRequest
 from yuqei_ai_platform_api.legal_qa import LegalQaRequest
 from yuqei_ai_platform_api.model_jobs import (
     ModelInferenceJob,
+    ModelJobAdmissionRejected,
     ModelInferenceJobCancelRequest,
     ModelInferenceJobHandoffRequest,
     ModelInferenceJobHistoryPage,
@@ -20,6 +22,8 @@ from yuqei_ai_platform_api.model_jobs import (
     ModelInferenceJobRetryRequest,
     ModelInferenceJobStore,
     ModelInferenceJobRecord,
+    ModelJobQualityReview,
+    ModelJobQualityReviewRequest,
 )
 from yuqei_ai_platform_api.model_output_quality import evaluate_model_output_quality
 from yuqei_ai_platform_api.repository import AiPlatformRepository
@@ -48,6 +52,11 @@ def register_model_job_routes(
         background_tasks: BackgroundTasks,
         http_request: Request,
         idempotency_key: str | None = Header(default=None, alias="Idempotency-Key", max_length=128),
+        evaluation_run_id: str | None = Header(default=None, alias="X-Evaluation-Run-Id", max_length=128),
+        evaluation_case_id: str | None = Header(default=None, alias="X-Evaluation-Case-Id", max_length=128),
+        evaluation_contract_type: str | None = Header(default=None, alias="X-Evaluation-Contract-Type", max_length=64),
+        evaluation_risk_level: str | None = Header(default=None, alias="X-Evaluation-Risk-Level", max_length=16),
+        evaluation_industry: str | None = Header(default=None, alias="X-Evaluation-Industry", max_length=64),
     ) -> ModelInferenceJob:
         tenant_id = current_tenant_id()
         try:
@@ -58,7 +67,23 @@ def register_model_job_routes(
                 max_attempts=settings.model_job_max_attempts,
                 created_by=http_request.headers.get("X-User-Id"),
                 idempotency_key=idempotency_key,
+                evaluation_metadata={
+                    "run_id": evaluation_run_id,
+                    "case_id": evaluation_case_id,
+                    "contract_type": evaluation_contract_type,
+                    "risk_level": evaluation_risk_level,
+                    "industry": evaluation_industry,
+                },
+                tenant_active_limit=settings.model_job_tenant_active_limit,
+                user_active_limit=settings.model_job_user_active_limit,
+                tenant_queue_limit=settings.model_job_tenant_queue_limit,
             )
+        except ModelJobAdmissionRejected as error:
+            raise HTTPException(
+                status_code=429,
+                detail={"code": error.code, "message": str(error)},
+                headers={"Retry-After": str(error.retry_after_seconds)},
+            ) from error
         except ValueError as error:
             raise HTTPException(status_code=409, detail=str(error)) from error
         if created:
@@ -76,6 +101,11 @@ def register_model_job_routes(
         background_tasks: BackgroundTasks,
         http_request: Request,
         idempotency_key: str | None = Header(default=None, alias="Idempotency-Key", max_length=128),
+        evaluation_run_id: str | None = Header(default=None, alias="X-Evaluation-Run-Id", max_length=128),
+        evaluation_case_id: str | None = Header(default=None, alias="X-Evaluation-Case-Id", max_length=128),
+        evaluation_contract_type: str | None = Header(default=None, alias="X-Evaluation-Contract-Type", max_length=64),
+        evaluation_risk_level: str | None = Header(default=None, alias="X-Evaluation-Risk-Level", max_length=16),
+        evaluation_industry: str | None = Header(default=None, alias="X-Evaluation-Industry", max_length=64),
     ) -> ModelInferenceJob:
         tenant_id = current_tenant_id()
         try:
@@ -86,7 +116,23 @@ def register_model_job_routes(
                 max_attempts=settings.model_job_max_attempts,
                 created_by=http_request.headers.get("X-User-Id"),
                 idempotency_key=idempotency_key,
+                evaluation_metadata={
+                    "run_id": evaluation_run_id,
+                    "case_id": evaluation_case_id,
+                    "contract_type": evaluation_contract_type,
+                    "risk_level": evaluation_risk_level,
+                    "industry": evaluation_industry,
+                },
+                tenant_active_limit=settings.model_job_tenant_active_limit,
+                user_active_limit=settings.model_job_user_active_limit,
+                tenant_queue_limit=settings.model_job_tenant_queue_limit,
             )
+        except ModelJobAdmissionRejected as error:
+            raise HTTPException(
+                status_code=429,
+                detail={"code": error.code, "message": str(error)},
+                headers={"Retry-After": str(error.retry_after_seconds)},
+            ) from error
         except ValueError as error:
             raise HTTPException(status_code=409, detail=str(error)) from error
         if created:
@@ -152,13 +198,26 @@ def register_model_job_routes(
     def get_model_job_operations(
         window_hours: int = Query(default=24 * 7, ge=1, le=24 * 90),
         target_sample_count: int = Query(default=30, ge=1, le=1000),
+        evaluation_run_id: str | None = Query(default=None, max_length=128),
     ) -> ModelJobOperationsSnapshot:
         return job_store.operations_snapshot(
             tenant_id=current_tenant_id(),
             window_hours=window_hours,
             target_sample_count=target_sample_count,
+            evaluation_run_id=evaluation_run_id,
+            tenant_active_limit=settings.model_job_tenant_active_limit,
+            user_active_limit=settings.model_job_user_active_limit,
+            tenant_queue_limit=settings.model_job_tenant_queue_limit,
         )
 
+    @app.get(
+        f"{settings.api_prefix}/model-jobs/review-queue",
+        response_model=list[ModelInferenceJob],
+        tags=["model-jobs", "operations"],
+    )
+    def get_model_job_review_queue(limit: int = Query(default=50, ge=1, le=100)) -> list[ModelInferenceJob]:
+        return job_store.review_queue(tenant_id=current_tenant_id(), limit=limit)
+
     @app.get(
         f"{settings.api_prefix}/model-jobs/{{job_id}}",
         response_model=ModelInferenceJob,
@@ -254,6 +313,40 @@ def register_model_job_routes(
         except ValueError as error:
             raise HTTPException(status_code=409, detail=str(error)) from error
 
+    @app.post(
+        f"{settings.api_prefix}/model-jobs/{{job_id}}/quality-reviews",
+        response_model=ModelJobQualityReview,
+        tags=["model-jobs", "operations"],
+    )
+    def create_model_job_quality_review(
+        job_id: str,
+        payload: ModelJobQualityReviewRequest,
+        request: Request,
+    ) -> ModelJobQualityReview:
+        try:
+            _job, review = job_store.record_quality_review(
+                job_id,
+                tenant_id=current_tenant_id(),
+                reviewer_id=request.headers.get("X-User-Id") or "",
+                request=payload,
+            )
+            return review
+        except KeyError as error:
+            raise HTTPException(status_code=404, detail="Model job not found.") from error
+        except ValueError as error:
+            raise HTTPException(status_code=409, detail=str(error)) from error
+
+    @app.get(
+        f"{settings.api_prefix}/model-jobs/{{job_id}}/quality-reviews",
+        response_model=list[ModelJobQualityReview],
+        tags=["model-jobs", "operations"],
+    )
+    def list_model_job_quality_reviews(job_id: str) -> list[ModelJobQualityReview]:
+        try:
+            return job_store.quality_reviews(job_id, tenant_id=current_tenant_id())
+        except KeyError as error:
+            raise HTTPException(status_code=404, detail="Model job not found.") from error
+
 
 def execute_model_job(
     *,
@@ -319,16 +412,18 @@ def execute_model_job(
                 error_message=audit.provider_error if audit is not None else "The provider run failed.",
                 **quality_fields,
             )
+        review_trigger = _automatic_review_trigger(claimed, quality.status, app.state.ai_platform_settings)
         if quality.status == "failed":
             return job_store.finish(
                 job_id,
                 tenant_id=tenant_id,
                 result=result,
-                status="failed",
+                status="awaiting_human",
                 provider_status=provider_status,
                 audit_run_id=audit_run_id,
                 error_code="output_quality_gate_failed",
                 error_message=quality.summary,
+                review_trigger="quality_gate",
                 **quality_fields,
             )
         if audit_status == "fallback":
@@ -353,6 +448,20 @@ def execute_model_job(
                 audit_run_id=audit_run_id,
                 error_code="output_quality_review_required",
                 error_message=quality.summary,
+                review_trigger="quality_gate",
+                **quality_fields,
+            )
+        if review_trigger is not None:
+            return job_store.finish(
+                job_id,
+                tenant_id=tenant_id,
+                result=result,
+                status="awaiting_human",
+                provider_status=provider_status,
+                audit_run_id=audit_run_id,
+                error_code="high_risk_review_required" if review_trigger == "high_risk" else "manual_sample_review_required",
+                error_message="�控试点输出需�人工抽检。",
+                review_trigger=review_trigger,
                 **quality_fields,
             )
         return job_store.finish(
@@ -373,6 +482,25 @@ def execute_model_job(
         reset_current_tenant_id(tenant_token)
 
 
+def _automatic_review_trigger(
+    job: ModelInferenceJobRecord,
+    quality_status: str,
+    settings: AiPlatformSettings,
+) -> str | None:
+    if quality_status in {"failed", "needs_review"}:
+        return "quality_gate"
+    if settings.model_job_high_risk_review_required and job.evaluation_risk_level == "high":
+        return "high_risk"
+    sample_rate = max(0, min(settings.model_job_manual_sample_rate_percent, 100))
+    if (
+        job.evaluation_run_id
+        and sample_rate
+        and int(hashlib.sha256(job.id.encode("utf-8")).hexdigest()[:8], 16) % 100 < sample_rate
+    ):
+        return "random_sample"
+    return None
+
+
 def _dispatch_if_enabled(
     app: FastAPI,
     settings: AiPlatformSettings,
diff --git a/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/config.py b/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/config.py
index f18ce94d..e9c9c3ea 100644
--- a/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/config.py
+++ b/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/config.py
@@ -25,6 +25,11 @@ class AiPlatformSettings(BaseSettings):
     provider_fallback_enabled: bool = True
     model_job_dispatch_mode: Literal["background_tasks", "worker"] = "background_tasks"
     model_job_max_attempts: int = 3
+    model_job_tenant_active_limit: int = 10
+    model_job_user_active_limit: int = 3
+    model_job_tenant_queue_limit: int = 25
+    model_job_manual_sample_rate_percent: int = 10
+    model_job_high_risk_review_required: bool = True
     codex_cli_path: str | None = None
     codex_cli_model: Literal["gpt-5.6-sol"] = "gpt-5.6-sol"
     codex_cli_timeout_seconds: float = 240.0
diff --git a/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/main.py b/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/main.py
index fc3f4e1d..fd7494cb 100644
--- a/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/main.py
+++ b/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/main.py
@@ -71,6 +71,7 @@ def create_app(
         redis_url=resolved_settings.redis_url,
     )
     app.state.anti_abuse_guard = anti_abuse_guard
+    app.state.ai_platform_settings = resolved_settings
     egress_budget_limits = EgressBudgetLimits(
         s3_records_per_day=resolved_settings.anti_abuse_s3_records_daily_limit,
         s4_records_per_day=resolved_settings.anti_abuse_s4_records_daily_limit,
diff --git a/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/model_jobs.py b/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/model_jobs.py
index ab77dd3c..196e8cb3 100644
--- a/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/model_jobs.py
+++ b/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/model_jobs.py
@@ -5,7 +5,7 @@ import binascii
 import hashlib
 import json
 from datetime import UTC, datetime, timedelta
-from threading import Lock
+from threading import RLock
 from typing import Any, Literal
 from uuid import uuid4
 
@@ -15,7 +15,7 @@ from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session, sessionmaker
 
 from yuqei_ai_platform_api.model_output_quality import ModelOutputQualityLabel
-from yuqei_ai_platform_api.models import ModelInferenceJobModel
+from yuqei_ai_platform_api.models import ModelInferenceJobModel, ModelJobQualityReviewModel
 
 
 ModelJobOperation = Literal["legal_qa", "contract_review"]
@@ -32,6 +32,17 @@ ModelJobStatus = Literal[
 
 TERMINAL_MODEL_JOB_STATUSES = {"succeeded", "fallback", "failed", "awaiting_human", "resolved", "cancelled"}
 RETRYABLE_MODEL_JOB_STATUSES = {"fallback", "failed", "awaiting_human"}
+ReviewTrigger = Literal["quality_gate", "high_risk", "random_sample", "manual"]
+ReviewDisposition = Literal["accepted", "corrected", "rejected"]
+ReviewAssessment = Literal["pass", "fail", "uncertain", "not_applicable"]
+HighRiskOmissionAssessment = Literal["not_detected", "detected", "uncertain", "not_applicable"]
+
+
+class ModelJobAdmissionRejected(ValueError):
+    def __init__(self, code: str, detail: str, *, retry_after_seconds: int = 10) -> None:
+        super().__init__(detail)
+        self.code = code
+        self.retry_after_seconds = retry_after_seconds
 
 
 class ModelInferenceJob(BaseModel):
@@ -65,6 +76,16 @@ class ModelInferenceJob(BaseModel):
     quality_labels: list[ModelOutputQualityLabel] = Field(default_factory=list)
     quality_summary: str | None = None
     quality_gate_version: str = "model-job-v1"
+    evaluation_run_id: str | None = None
+    evaluation_case_id: str | None = None
+    evaluation_contract_type: str | None = None
+    evaluation_risk_level: Literal["low", "medium", "high"] | None = None
+    evaluation_industry: str | None = None
+    review_status: Literal["not_required", "required", "completed"] = "not_required"
+    review_trigger: ReviewTrigger | None = None
+    reviewed_at: datetime | None = None
+    reviewed_by: str | None = None
+    review_disposition: ReviewDisposition | None = None
     queue_latency_ms: int = 0
     execution_latency_ms: int = 0
     total_latency_ms: int = 0
@@ -100,6 +121,29 @@ class ModelInferenceJobCancelRequest(BaseModel):
     reason: str | None = Field(default=None, max_length=1000)
 
 
+class ModelJobQualityReviewRequest(BaseModel):
+    legal_fact_consistency: ReviewAssessment
+    citation_verifiability: ReviewAssessment
+    high_risk_omission: HighRiskOmissionAssessment
+    disposition: ReviewDisposition
+    feedback_text: str | None = Field(default=None, max_length=8000)
+
+
+class ModelJobQualityReview(BaseModel):
+    id: str
+    tenant_id: str
+    job_id: str
+    review_trigger: ReviewTrigger
+    reviewer_id: str
+    legal_fact_consistency: ReviewAssessment
+    citation_verifiability: ReviewAssessment
+    high_risk_omission: HighRiskOmissionAssessment
+    disposition: ReviewDisposition
+    feedback_text: str | None = None
+    quality_gate_version: str
+    created_at: datetime
+
+
 class ModelInferenceJobHistoryPage(BaseModel):
     items: list[ModelInferenceJob]
     next_cursor: str | None = None
@@ -138,6 +182,29 @@ class ModelJobOperationalAlert(BaseModel):
     threshold: float
 
 
+class ModelJobAdmissionSnapshot(BaseModel):
+    running: int
+    queued: int
+    tenant_active_limit: int
+    user_active_limit: int
+    tenant_queue_limit: int
+    active_saturation_rate: float
+    queue_saturation_rate: float
+    accepting_submissions: bool
+
+
+class ModelJobQualitySegment(BaseModel):
+    dimension: Literal["contract_type", "risk_level", "industry"]
+    value: str
+    sample_count: int
+    quality_passed: int
+    quality_needs_review: int
+    quality_failed: int
+    review_required: int
+    review_completed: int
+    quality_pass_rate: float
+
+
 class ModelJobOperationsSnapshot(BaseModel):
     metrics: ModelInferenceJobMetrics
     alerts: list[ModelJobOperationalAlert]
@@ -149,6 +216,11 @@ class ModelJobOperationsSnapshot(BaseModel):
     quality_needs_review: int
     quality_failed: int
     quality_pass_rate: float
+    review_required: int = 0
+    review_completed: int = 0
+    evaluation_run_id: str | None = None
+    admission: ModelJobAdmissionSnapshot
+    quality_segments: list[ModelJobQualitySegment] = Field(default_factory=list)
 
 
 class ModelInferenceJobStore:
@@ -158,9 +230,14 @@ class ModelInferenceJobStore:
         self._engine = engine
         self._session_factory = sessionmaker(bind=engine, expire_on_commit=False) if engine is not None else None
         self._records: dict[str, ModelInferenceJobRecord] = {}
-        self._lock = Lock()
+        self._reviews: dict[str, ModelJobQualityReview] = {}
+        # A re-entrant process lock makes idempotency lookup, admission counting,
+        # and insertion one critical section for the controlled-pilot API process.
+        # Database uniqueness remains the final idempotency guard.
+        self._lock = RLock()
         if engine is not None and auto_create:
             ModelInferenceJobModel.__table__.create(engine, checkfirst=True)
+            ModelJobQualityReviewModel.__table__.create(engine, checkfirst=True)
 
     def create(
         self,
@@ -171,6 +248,10 @@ class ModelInferenceJobStore:
         max_attempts: int = 3,
         created_by: str | None = None,
         idempotency_key: str | None = None,
+        evaluation_metadata: dict[str, str | None] | None = None,
+        tenant_active_limit: int = 10,
+        user_active_limit: int = 3,
+        tenant_queue_limit: int = 25,
     ) -> ModelInferenceJob:
         job, _created = self.create_or_get(
             tenant_id=tenant_id,
@@ -179,6 +260,10 @@ class ModelInferenceJobStore:
             max_attempts=max_attempts,
             created_by=created_by,
             idempotency_key=idempotency_key,
+            evaluation_metadata=evaluation_metadata,
+            tenant_active_limit=tenant_active_limit,
+            user_active_limit=user_active_limit,
+            tenant_queue_limit=tenant_queue_limit,
         )
         return job
 
@@ -191,11 +276,46 @@ class ModelInferenceJobStore:
         max_attempts: int = 3,
         created_by: str | None = None,
         idempotency_key: str | None = None,
+        evaluation_metadata: dict[str, str | None] | None = None,
+        tenant_active_limit: int = 10,
+        user_active_limit: int = 3,
+        tenant_queue_limit: int = 25,
+    ) -> tuple[ModelInferenceJob, bool]:
+        with self._lock:
+            return self._create_or_get_locked(
+                tenant_id=tenant_id,
+                operation=operation,
+                request_payload=request_payload,
+                max_attempts=max_attempts,
+                created_by=created_by,
+                idempotency_key=idempotency_key,
+                evaluation_metadata=evaluation_metadata,
+                tenant_active_limit=tenant_active_limit,
+                user_active_limit=user_active_limit,
+                tenant_queue_limit=tenant_queue_limit,
+            )
+
+    def _create_or_get_locked(
+        self,
+        *,
+        tenant_id: str,
+        operation: ModelJobOperation,
+        request_payload: dict[str, Any],
+        max_attempts: int = 3,
+        created_by: str | None = None,
+        idempotency_key: str | None = None,
+        evaluation_metadata: dict[str, str | None] | None = None,
+        tenant_active_limit: int = 10,
+        user_active_limit: int = 3,
+        tenant_queue_limit: int = 25,
     ) -> tuple[ModelInferenceJob, bool]:
         now = datetime.now(UTC)
         normalized_creator = (created_by or "").strip() or None
         normalized_key = _normalize_idempotency_key(idempotency_key)
-        fingerprint = _request_fingerprint({"created_by": normalized_creator, "request_payload": request_payload})
+        metadata = _normalize_evaluation_metadata(evaluation_metadata)
+        fingerprint = _request_fingerprint(
+            {"created_by": normalized_creator, "request_payload": request_payload, "evaluation_metadata": metadata}
+        )
         if normalized_key:
             existing = self._find_by_idempotency(
                 tenant_id=tenant_id,
@@ -205,6 +325,13 @@ class ModelInferenceJobStore:
             if existing is not None:
                 _ensure_same_fingerprint(existing, fingerprint)
                 return _view(existing), False
+        self.enforce_admission(
+            tenant_id=tenant_id,
+            created_by=normalized_creator,
+            tenant_active_limit=tenant_active_limit,
+            user_active_limit=user_active_limit,
+            tenant_queue_limit=tenant_queue_limit,
+        )
         record = ModelInferenceJobRecord(
             id=f"model-job-{uuid4().hex[:16]}",
             tenant_id=tenant_id,
@@ -213,6 +340,11 @@ class ModelInferenceJobStore:
             display_title=_display_title(operation, request_payload),
             idempotency_key=normalized_key,
             request_fingerprint=fingerprint,
+            evaluation_run_id=metadata.get("run_id"),
+            evaluation_case_id=metadata.get("case_id"),
+            evaluation_contract_type=metadata.get("contract_type"),
+            evaluation_risk_level=metadata.get("risk_level"),
+            evaluation_industry=metadata.get("industry"),
             status="queued",
             stage="queued",
             progress_percent=0,
@@ -261,6 +393,70 @@ class ModelInferenceJobStore:
                     return _view(existing), False
         return _view(record), True
 
+    def admission_snapshot(
+        self,
+        *,
+        tenant_id: str,
+        tenant_active_limit: int,
+        user_active_limit: int,
+        tenant_queue_limit: int,
+    ) -> ModelJobAdmissionSnapshot:
+        records = self._tenant_records(tenant_id=tenant_id)
+        running = sum(item.status == "running" for item in records)
+        queued = sum(item.status == "queued" for item in records)
+        active_limit = max(1, tenant_active_limit)
+        queue_limit = max(1, tenant_queue_limit)
+        return ModelJobAdmissionSnapshot(
+            running=running,
+            queued=queued,
+            tenant_active_limit=active_limit,
+            user_active_limit=max(1, user_active_limit),
+            tenant_queue_limit=queue_limit,
+            active_saturation_rate=round((running + queued) / active_limit, 4),
+            queue_saturation_rate=round(queued / queue_limit, 4),
+            accepting_submissions=(running + queued) < active_limit and queued < queue_limit,
+        )
+
+    def enforce_admission(
+        self,
+        *,
+        tenant_id: str,
+        created_by: str | None,
+        tenant_active_limit: int,
+        user_active_limit: int,
+        tenant_queue_limit: int,
+    ) -> None:
+        records = self._tenant_records(tenant_id=tenant_id)
+        active = [item for item in records if item.status in {"queued", "running"}]
+        active_limit = max(1, tenant_active_limit)
+        queue_limit = max(1, tenant_queue_limit)
+        user_limit = max(1, user_active_limit)
+        if len(active) >= active_limit:
+            raise ModelJobAdmissionRejected(
+                "tenant_active_limit_reached",
+                f"Tenant has reached the controlled-pilot limit of {active_limit} active model jobs.",
+            )
+        if sum(item.status == "queued" for item in active) >= queue_limit:
+            raise ModelJobAdmissionRejected(
+                "tenant_queue_limit_reached",
+                f"Tenant queue has reached the controlled-pilot limit of {queue_limit} jobs.",
+            )
+        if created_by and sum(item.created_by == created_by for item in active) >= user_limit:
+            raise ModelJobAdmissionRejected(
+                "user_active_limit_reached",
+                f"User has reached the controlled-pilot limit of {user_limit} active model jobs.",
+            )
+
+    def _tenant_records(self, *, tenant_id: str) -> list[ModelInferenceJobRecord]:
+        if self._session_factory is None:
+            with self._lock:
+                return [item for item in self._records.values() if item.tenant_id == tenant_id]
+        with self._session_factory() as session:
+            rows = session.scalars(
+                select(ModelInferenceJobModel).where(ModelInferenceJobModel.tenant_id == tenant_id)
+            ).all()
+            return [_row_to_record(row) for row in rows]
+
     def _find_by_idempotency(
         self,
         *,
@@ -518,6 +714,7 @@ class ModelInferenceJobStore:
         quality_labels: list[ModelOutputQualityLabel] | None = None,
         quality_summary: str | None = None,
         quality_gate_version: str = "model-job-v1",
+        review_trigger: ReviewTrigger | None = None,
     ) -> ModelInferenceJob:
         now = datetime.now(UTC)
         existing = self.get_record(job_id, tenant_id=tenant_id)
@@ -550,7 +747,12 @@ class ModelInferenceJobStore:
             quality_labels=quality_labels or [],
             quality_summary=quality_summary,
             quality_gate_version=quality_gate_version,
-            handoff_reason="output_quality_review_required" if status == "awaiting_human" else existing.handoff_reason,
+            review_status="required" if status == "awaiting_human" else "not_required",
+            review_trigger=review_trigger if status == "awaiting_human" else None,
+            reviewed_at=None,
+            reviewed_by=None,
+            review_disposition=None,
+            handoff_reason=(review_trigger or "manual_review_required") if status == "awaiting_human" else existing.handoff_reason,
             handoff_note=quality_summary if status == "awaiting_human" else existing.handoff_note,
             execution_latency_ms=_elapsed_ms(started_at, now),
             total_latency_ms=_elapsed_ms(existing.created_at, now),
@@ -606,6 +808,11 @@ class ModelInferenceJobStore:
             quality_score=0,
             quality_labels=[],
             quality_summary=None,
+            review_status="not_required",
+            review_trigger=None,
+            reviewed_at=None,
+            reviewed_by=None,
+            review_disposition=None,
             cancel_requested_at=None,
             cancelled_by=None,
             cancel_reason=None,
@@ -670,6 +877,8 @@ class ModelInferenceJobStore:
             handoff_reason=reason,
             handoff_note=note,
             handoff_assignee=assignee,
+            review_status="required",
+            review_trigger="manual",
         )
 
     def resolve(self, job_id: str, *, tenant_id: str, resolution_note: str) -> ModelInferenceJob:
@@ -682,8 +891,109 @@ class ModelInferenceJobStore:
             progress_percent=100,
             retryable=False,
             resolution_note=resolution_note,
+            review_status="completed",
+            reviewed_at=datetime.now(UTC),
+            review_disposition="accepted",
         )
 
+    def review_queue(self, *, tenant_id: str, limit: int = 50) -> list[ModelInferenceJob]:
+        records = [
+            item for item in self._tenant_records(tenant_id=tenant_id)
+            if item.status == "awaiting_human" and item.review_status == "required"
+        ]
+        records.sort(key=lambda item: (_aware(item.updated_at), item.id))
+        return [_view(item) for item in records[: max(1, min(limit, 100))]]
+
+    def record_quality_review(
+        self,
+        job_id: str,
+        *,
+        tenant_id: str,
+        reviewer_id: str,
+        request: ModelJobQualityReviewRequest,
+    ) -> tuple[ModelInferenceJob, ModelJobQualityReview]:
+        normalized_reviewer = reviewer_id.strip()
+        if not normalized_reviewer:
+            raise ValueError("Reviewer identity is required.")
+        now = datetime.now(UTC)
+        summary = (
+            f"事实一致性={request.legal_fact_consistency}; 引用�核验={request.citation_verifiability}; "
+            f"高风险��={request.high_risk_omission}; 处置={request.disposition}"
+        )
+        with self._lock:
+            if self._session_factory is None:
+                existing = self._records.get(job_id)
+                if existing is None or existing.tenant_id != tenant_id:
+                    raise KeyError(job_id)
+                _ensure_reviewable(existing)
+                review = _new_quality_review(
+                    existing,
+                    reviewer_id=normalized_reviewer,
+                    request=request,
+                    created_at=now,
+                )
+                self._reviews[review.id] = review
+                updated = existing.model_copy(
+                    update={
+                        "status": "resolved",
+                        "stage": "quality_review_completed",
+                        "retryable": False,
+                        "review_status": "completed",
+                        "reviewed_at": now,
+                        "reviewed_by": normalized_reviewer,
+                        "review_disposition": request.disposition,
+                        "resolution_note": summary,
+                        "updated_at": now,
+                    }
+                )
+                self._records[job_id] = updated
+                return _view(updated), review
+
+            with self._session_factory.begin() as session:
+                row = _locked_row(session, job_id)
+                if row is None or row.tenant_id != tenant_id:
+                    raise KeyError(job_id)
+                existing = _row_to_record(row)
+                _ensure_reviewable(existing)
+                review = _new_quality_review(
+                    existing,
+                    reviewer_id=normalized_reviewer,
+                    request=request,
+                    created_at=now,
+                )
+                session.add(_review_to_row(review))
+                row.status = "resolved"
+                row.stage = "quality_review_completed"
+                row.retryable = False
+                row.review_status = "completed"
+                row.reviewed_at = now
+                row.reviewed_by = normalized_reviewer
+                row.review_disposition = request.disposition
+                row.resolution_note = summary
+                row.updated_at = now
+                session.flush()
+                return _view(_row_to_record(row)), review
+
+    def quality_reviews(self, job_id: str, *, tenant_id: str) -> list[ModelJobQualityReview]:
+        if self.get_record(job_id, tenant_id=tenant_id) is None:
+            raise KeyError(job_id)
+        if self._session_factory is None:
+            with self._lock:
+                records = [
+                    item for item in self._reviews.values()
+                    if item.tenant_id == tenant_id and item.job_id == job_id
+                ]
+        else:
+            with self._session_factory() as session:
+                rows = session.scalars(
+                    select(ModelJobQualityReviewModel).where(
+                        ModelJobQualityReviewModel.tenant_id == tenant_id,
+                        ModelJobQualityReviewModel.job_id == job_id,
+                    ).order_by(ModelJobQualityReviewModel.created_at.asc())
+                ).all()
+                records = [_review_from_row(row) for row in rows]
+        return sorted(records, key=lambda item: (_aware(item.created_at), item.id))
+
     def metrics(self, *, tenant_id: str, window_hours: int) -> ModelInferenceJobMetrics:
         cutoff = datetime.now(UTC) - timedelta(hours=max(1, min(window_hours, 24 * 90)))
         if self._session_factory is None:
@@ -701,38 +1011,7 @@ class ModelInferenceJobStore:
                     )
                 ).all()
                 records = [_row_to_record(row) for row in rows]
-        total = len(records)
-        completed = [
-            record
-            for record in records
-            if record.status in TERMINAL_MODEL_JOB_STATUSES and record.status != "cancelled"
-        ]
-        denominator = max(len(completed), 1)
-        return ModelInferenceJobMetrics(
-            window_hours=window_hours,
-            total=total,
-            queued=sum(record.status == "queued" for record in records),
-            running=sum(record.status == "running" for record in records),
-            succeeded=sum(record.status == "succeeded" for record in records),
-            fallback=sum(record.fallback_used for record in records),
-            failed=sum(record.status == "failed" for record in records),
-            awaiting_human=sum(record.status == "awaiting_human" for record in records),
-            resolved=sum(record.status == "resolved" for record in records),
-            cancelled=sum(record.status == "cancelled" for record in records),
-            fallback_rate=round(sum(record.fallback_used for record in records) / denominator, 4),
-            failure_rate=round(sum(record.status == "failed" for record in records) / denominator, 4),
-            manual_handoff_rate=round(
-                sum(record.status in {"awaiting_human", "resolved"} for record in records) / denominator,
-                4,
-            ),
-            retry_rate=round(sum(record.attempt_count > 1 for record in records) / max(total, 1), 4),
-            queue_latency_p50_ms=_percentile([record.queue_latency_ms for record in records], 0.50),
-            queue_latency_p95_ms=_percentile([record.queue_latency_ms for record in records], 0.95),
-            execution_latency_p50_ms=_percentile([record.execution_latency_ms for record in completed], 0.50),
-            execution_latency_p95_ms=_percentile([record.execution_latency_ms for record in completed], 0.95),
-            total_latency_p50_ms=_percentile([record.total_latency_ms for record in completed], 0.50),
-            total_latency_p95_ms=_percentile([record.total_latency_ms for record in completed], 0.95),
-        )
+        return _metrics_from_records(records, window_hours=window_hours)
 
     def operations_snapshot(
         self,
@@ -740,8 +1019,11 @@ class ModelInferenceJobStore:
         tenant_id: str,
         window_hours: int = 24 * 7,
         target_sample_count: int = 30,
+        evaluation_run_id: str | None = None,
+        tenant_active_limit: int = 10,
+        user_active_limit: int = 3,
+        tenant_queue_limit: int = 25,
     ) -> ModelJobOperationsSnapshot:
-        metrics = self.metrics(tenant_id=tenant_id, window_hours=window_hours)
         cutoff = datetime.now(UTC) - timedelta(hours=max(1, min(window_hours, 24 * 90)))
         if self._session_factory is None:
             with self._lock:
@@ -758,7 +1040,12 @@ class ModelInferenceJobStore:
                     )
                 ).all()
                 records = [_row_to_record(row) for row in rows]
-        completed = [item for item in records if item.status in TERMINAL_MODEL_JOB_STATUSES]
+        evaluation_records = [
+            item for item in records
+            if evaluation_run_id is None or item.evaluation_run_id == evaluation_run_id
+        ]
+        metrics = _metrics_from_records(evaluation_records, window_hours=window_hours)
+        completed = [item for item in evaluation_records if item.status in TERMINAL_MODEL_JOB_STATUSES]
         evaluated = [
             item
             for item in completed
@@ -768,6 +1055,14 @@ class ModelInferenceJobStore:
         quality_passed = sum(item.quality_status == "passed" for item in evaluated)
         quality_needs_review = sum(item.quality_status == "needs_review" for item in evaluated)
         quality_failed = sum(item.quality_status == "failed" for item in evaluated)
+        review_required = sum(item.review_status in {"required", "completed"} for item in evaluated)
+        review_completed = sum(item.review_status == "completed" for item in evaluated)
+        admission = self.admission_snapshot(
+            tenant_id=tenant_id,
+            tenant_active_limit=tenant_active_limit,
+            user_active_limit=user_active_limit,
+            tenant_queue_limit=tenant_queue_limit,
+        )
         stale_cutoff = datetime.now(UTC) - timedelta(minutes=10)
         stale_active = sum(
             item.status in {"queued", "running"} and _aware(item.updated_at) < stale_cutoff
@@ -798,6 +1093,28 @@ class ModelInferenceJobStore:
             alerts.append(_alert("manual_queue_backlog", "warning", "人工�核队列积压", "等待人工�核的任务达到 5 个。", metrics.awaiting_human, 5))
         if stale_active:
             alerts.append(_alert("stale_active_jobs", "error", "存在�滞任务", "有排队或�行任务超过 10 分钟未更新。", stale_active, 0))
+        if admission.active_saturation_rate >= 1:
+            alerts.append(
+                _alert(
+                    "tenant_model_capacity_saturated",
+                    "warning",
+                    "租户模型容�已饱和",
+                    "排队和�行中的模型任务已达到�控试点上�。",
+                    admission.running + admission.queued,
+                    admission.tenant_active_limit,
+                )
+            )
+        if admission.queue_saturation_rate >= 0.8:
+            alerts.append(
+                _alert(
+                    "tenant_model_queue_near_limit",
+                    "warning",
+                    "租户模型队列接近上�",
+                    "排队任务已达到�控试点队列上�的 80%。",
+                    admission.queued,
+                    admission.tenant_queue_limit * 0.8,
+                )
+            )
         quality_pass_rate = round(quality_passed / max(len(evaluated), 1), 4)
         return ModelJobOperationsSnapshot(
             metrics=metrics,
@@ -810,6 +1127,11 @@ class ModelInferenceJobStore:
             quality_needs_review=quality_needs_review,
             quality_failed=quality_failed,
             quality_pass_rate=quality_pass_rate,
+            review_required=review_required,
+            review_completed=review_completed,
+            evaluation_run_id=evaluation_run_id,
+            admission=admission,
+            quality_segments=_quality_segments(evaluated),
         )
 
     def _update(
@@ -919,6 +1241,16 @@ def _row_to_record(row: ModelInferenceJobModel) -> ModelInferenceJobRecord:
         quality_labels=[ModelOutputQualityLabel.model_validate(item) for item in json.loads(row.quality_labels_json or "[]")],
         quality_summary=row.quality_summary,
         quality_gate_version=row.quality_gate_version,
+        evaluation_run_id=row.evaluation_run_id,
+        evaluation_case_id=row.evaluation_case_id,
+        evaluation_contract_type=row.evaluation_contract_type,
+        evaluation_risk_level=row.evaluation_risk_level,
+        evaluation_industry=row.evaluation_industry,
+        review_status=row.review_status,
+        review_trigger=row.review_trigger,
+        reviewed_at=_aware(row.reviewed_at) if row.reviewed_at else None,
+        reviewed_by=row.reviewed_by,
+        review_disposition=row.review_disposition,
         queue_latency_ms=row.queue_latency_ms,
         execution_latency_ms=row.execution_latency_ms,
         total_latency_ms=row.total_latency_ms,
@@ -945,6 +1277,45 @@ def _elapsed_ms(start: datetime, end: datetime) -> int:
     return max(0, int((_aware(end) - _aware(start)).total_seconds() * 1000))
 
 
+def _metrics_from_records(
+    records: list[ModelInferenceJobRecord],
+    *,
+    window_hours: int,
+) -> ModelInferenceJobMetrics:
+    total = len(records)
+    completed = [
+        record
+        for record in records
+        if record.status in TERMINAL_MODEL_JOB_STATUSES and record.status != "cancelled"
+    ]
+    denominator = max(len(completed), 1)
+    return ModelInferenceJobMetrics(
+        window_hours=window_hours,
+        total=total,
+        queued=sum(record.status == "queued" for record in records),
+        running=sum(record.status == "running" for record in records),
+        succeeded=sum(record.status == "succeeded" for record in records),
+        fallback=sum(record.fallback_used for record in records),
+        failed=sum(record.status == "failed" for record in records),
+        awaiting_human=sum(record.status == "awaiting_human" for record in records),
+        resolved=sum(record.status == "resolved" for record in records),
+        cancelled=sum(record.status == "cancelled" for record in records),
+        fallback_rate=round(sum(record.fallback_used for record in records) / denominator, 4),
+        failure_rate=round(sum(record.status == "failed" for record in records) / denominator, 4),
+        manual_handoff_rate=round(
+            sum(record.status in {"awaiting_human", "resolved"} for record in records) / denominator,
+            4,
+        ),
+        retry_rate=round(sum(record.attempt_count > 1 for record in records) / max(total, 1), 4),
+        queue_latency_p50_ms=_percentile([record.queue_latency_ms for record in records], 0.50),
+        queue_latency_p95_ms=_percentile([record.queue_latency_ms for record in records], 0.95),
+        execution_latency_p50_ms=_percentile([record.execution_latency_ms for record in completed], 0.50),
+        execution_latency_p95_ms=_percentile([record.execution_latency_ms for record in completed], 0.95),
+        total_latency_p50_ms=_percentile([record.total_latency_ms for record in completed], 0.50),
+        total_latency_p95_ms=_percentile([record.total_latency_ms for record in completed], 0.95),
+    )
+
+
 def _percentile(values: list[int], percentile: float) -> int:
     normalized = sorted(value for value in values if value >= 0)
     if not normalized:
@@ -967,6 +1338,48 @@ def _request_fingerprint(payload: dict[str, Any]) -> str:
     return hashlib.sha256(canonical.encode("utf-8")).hexdigest()
 
 
+def _normalize_evaluation_metadata(value: dict[str, str | None] | None) -> dict[str, str | None]:
+    raw = value or {}
+    result: dict[str, str | None] = {}
+    limits = {"run_id": 128, "case_id": 128, "contract_type": 64, "risk_level": 16, "industry": 64}
+    for key, limit in limits.items():
+        normalized = (raw.get(key) or "").strip() or None
+        if normalized and len(normalized) > limit:
+            raise ValueError(f"Evaluation metadata field {key} exceeds {limit} characters.")
+        result[key] = normalized
+    if result["risk_level"] not in {None, "low", "medium", "high"}:
+        raise ValueError("Evaluation risk level must be low, medium, or high.")
+    return result
+
+
+def _quality_segments(records: list[ModelInferenceJobRecord]) -> list[ModelJobQualitySegment]:
+    dimensions = {
+        "contract_type": "evaluation_contract_type",
+        "risk_level": "evaluation_risk_level",
+        "industry": "evaluation_industry",
+    }
+    result: list[ModelJobQualitySegment] = []
+    for dimension, field_name in dimensions.items():
+        values = sorted({str(getattr(item, field_name)) for item in records if getattr(item, field_name)})
+        for value in values:
+            selected = [item for item in records if getattr(item, field_name) == value]
+            passed = sum(item.quality_status == "passed" for item in selected)
+            result.append(
+                ModelJobQualitySegment(
+                    dimension=dimension,  # type: ignore[arg-type]
+                    value=value,
+                    sample_count=len(selected),
+                    quality_passed=passed,
+                    quality_needs_review=sum(item.quality_status == "needs_review" for item in selected),
+                    quality_failed=sum(item.quality_status == "failed" for item in selected),
+                    review_required=sum(item.review_status in {"required", "completed"} for item in selected),
+                    review_completed=sum(item.review_status == "completed" for item in selected),
+                    quality_pass_rate=round(passed / max(len(selected), 1), 4),
+                )
+            )
+    return result
+
+
 def _ensure_same_fingerprint(record: ModelInferenceJobRecord, fingerprint: str) -> None:
     if record.request_fingerprint and record.request_fingerprint != fingerprint:
         raise ValueError("This idempotency key was already used with a different request payload.")
@@ -981,6 +1394,55 @@ def _display_title(operation: ModelJobOperation, payload: dict[str, Any]) -> str
     return value[:256]
 
 
+def _review_to_row(review: ModelJobQualityReview) -> ModelJobQualityReviewModel:
+    return ModelJobQualityReviewModel(**review.model_dump())
+
+
+def _ensure_reviewable(record: ModelInferenceJobRecord) -> None:
+    if record.status != "awaiting_human" or record.review_status != "required":
+        raise ValueError("Only jobs in the required human-review queue can receive quality feedback.")
+
+
+def _new_quality_review(
+    record: ModelInferenceJobRecord,
+    *,
+    reviewer_id: str,
+    request: ModelJobQualityReviewRequest,
+    created_at: datetime,
+) -> ModelJobQualityReview:
+    return ModelJobQualityReview(
+        id=f"model-review-{uuid4().hex[:16]}",
+        tenant_id=record.tenant_id,
+        job_id=record.id,
+        review_trigger=record.review_trigger or "manual",
+        reviewer_id=reviewer_id,
+        legal_fact_consistency=request.legal_fact_consistency,
+        citation_verifiability=request.citation_verifiability,
+        high_risk_omission=request.high_risk_omission,
+        disposition=request.disposition,
+        feedback_text=(request.feedback_text or "").strip() or None,
+        quality_gate_version=record.quality_gate_version,
+        created_at=created_at,
+    )
+
+
+def _review_from_row(row: ModelJobQualityReviewModel) -> ModelJobQualityReview:
+    return ModelJobQualityReview(
+        id=row.id,
+        tenant_id=row.tenant_id,
+        job_id=row.job_id,
+        review_trigger=row.review_trigger,
+        reviewer_id=row.reviewer_id,
+        legal_fact_consistency=row.legal_fact_consistency,
+        citation_verifiability=row.citation_verifiability,
+        high_risk_omission=row.high_risk_omission,
+        disposition=row.disposition,
+        feedback_text=row.feedback_text,
+        quality_gate_version=row.quality_gate_version,
+        created_at=_aware(row.created_at),
+    )
+
+
 def _history_key(record: ModelInferenceJobRecord) -> tuple[datetime, str]:
     return _aware(record.created_at), record.id
 
diff --git a/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/models.py b/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/models.py
index f473e6b2..c1b31ddf 100644
--- a/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/models.py
+++ b/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/models.py
@@ -357,6 +357,16 @@ class ModelInferenceJobModel(Base):
     quality_labels_json: Mapped[str] = mapped_column(Text, default="[]")
     quality_summary: Mapped[str | None] = mapped_column(Text, nullable=True)
     quality_gate_version: Mapped[str] = mapped_column(String(32), default="model-job-v1")
+    evaluation_run_id: Mapped[str | None] = mapped_column(String(128), nullable=True, index=True)
+    evaluation_case_id: Mapped[str | None] = mapped_column(String(128), nullable=True)
+    evaluation_contract_type: Mapped[str | None] = mapped_column(String(64), nullable=True, index=True)
+    evaluation_risk_level: Mapped[str | None] = mapped_column(String(16), nullable=True, index=True)
+    evaluation_industry: Mapped[str | None] = mapped_column(String(64), nullable=True)
+    review_status: Mapped[str] = mapped_column(String(32), default="not_required", index=True)
+    review_trigger: Mapped[str | None] = mapped_column(String(32), nullable=True)
+    reviewed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    reviewed_by: Mapped[str | None] = mapped_column(String(128), nullable=True)
+    review_disposition: Mapped[str | None] = mapped_column(String(32), nullable=True)
     queue_latency_ms: Mapped[int] = mapped_column(Integer, default=0)
     execution_latency_ms: Mapped[int] = mapped_column(Integer, default=0)
     total_latency_ms: Mapped[int] = mapped_column(Integer, default=0)
@@ -374,6 +384,31 @@ class ModelInferenceJobModel(Base):
     completed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
 
 
+class ModelJobQualityReviewModel(Base):
+    __tablename__ = "model_job_quality_reviews"
+    __table_args__ = (
+        Index("ix_model_job_quality_reviews_tenant_job_created", "tenant_id", "job_id", "created_at"),
+        Index("ix_model_job_quality_reviews_tenant_trigger_created", "tenant_id", "review_trigger", "created_at"),
+    )
+
+    id: Mapped[str] = mapped_column(String(64), primary_key=True)
+    tenant_id: Mapped[str] = mapped_column(String(64), default=DEFAULT_TENANT_ID, index=True)
+    job_id: Mapped[str] = mapped_column(String(64), index=True)
+    review_trigger: Mapped[str] = mapped_column(String(32))
+    reviewer_id: Mapped[str] = mapped_column(String(128))
+    legal_fact_consistency: Mapped[str] = mapped_column(String(32))
+    citation_verifiability: Mapped[str] = mapped_column(String(32))
+    high_risk_omission: Mapped[str] = mapped_column(String(32))
+    disposition: Mapped[str] = mapped_column(String(32))
+    feedback_text: Mapped[str | None] = mapped_column(Text, nullable=True)
+    quality_gate_version: Mapped[str] = mapped_column(String(32), default="model-job-v1")
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True),
+        default=lambda: datetime.now(UTC),
+        index=True,
+    )
+
+
 class AiRunAuditModel(Base):
     __tablename__ = "ai_run_audits"
 
diff --git a/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/schema_check.py b/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/schema_check.py
index c0ae1585..37c49915 100644
--- a/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/schema_check.py
+++ b/yuqei-ai-platform/services/ai-platform-api/src/yuqei_ai_platform_api/schema_check.py
@@ -36,6 +36,7 @@ CORE_TABLES = (
     "knowledge_reindex_executions",
     "knowledge_ingestion_jobs",
     "model_inference_jobs",
+    "model_job_quality_reviews",
     "ai_run_audits",
     "provider_acceptance_runs",
     "ai_quality_improvement_actions",
@@ -47,6 +48,7 @@ TENANT_COLUMNS_BY_TABLE = {
     "knowledge_reindex_executions": ("tenant_id",),
     "knowledge_ingestion_jobs": ("tenant_id",),
     "model_inference_jobs": ("tenant_id",),
+    "model_job_quality_reviews": ("tenant_id",),
     "ai_run_audits": ("tenant_id",),
     "provider_acceptance_runs": ("tenant_id",),
     "ai_quality_improvement_actions": ("tenant_id",),
@@ -89,6 +91,26 @@ MODEL_JOB_OPERATION_COLUMNS_BY_TABLE = {
         "quality_labels_json",
         "quality_summary",
         "quality_gate_version",
+        "evaluation_run_id",
+        "evaluation_case_id",
+        "evaluation_contract_type",
+        "evaluation_risk_level",
+        "evaluation_industry",
+        "review_status",
+        "review_trigger",
+        "reviewed_at",
+        "reviewed_by",
+        "review_disposition",
+    ),
+    "model_job_quality_reviews": (
+        "job_id",
+        "review_trigger",
+        "reviewer_id",
+        "legal_fact_consistency",
+        "citation_verifiability",
+        "high_risk_omission",
+        "disposition",
+        "quality_gate_version",
     ),
 }
 PGVECTOR_REQUIRED_COLUMNS_BY_TABLE = {
diff --git a/yuqei-ai-platform/services/ai-platform-api/tests/test_health.py b/yuqei-ai-platform/services/ai-platform-api/tests/test_health.py
index a17619a0..ba7b5323 100644
--- a/yuqei-ai-platform/services/ai-platform-api/tests/test_health.py
+++ b/yuqei-ai-platform/services/ai-platform-api/tests/test_health.py
@@ -95,13 +95,13 @@ def test_runtime_schema_check_warns_for_local_sqlite_auto_created_schema(tmp_pat
     assert checks["alembic_version"]["status"] == "warning"
     assert checks["core_tables"]["status"] == "ok"
     assert checks["tenant_columns"]["status"] == "ok"
-    assert checks["tenant_columns"]["details"]["checked_tables"] == 12
+    assert checks["tenant_columns"]["details"]["checked_tables"] == 13
     assert checks["trace_governance_columns"]["status"] == "ok"
     assert checks["trace_governance_columns"]["details"]["checked_columns"] == 11
     assert checks["secret_ref_columns"]["status"] == "ok"
     assert checks["secret_ref_columns"]["details"]["checked_columns"] == 2
     assert checks["model_job_operation_columns"]["status"] == "ok"
-    assert checks["model_job_operation_columns"]["details"]["checked_columns"] == 12
+    assert checks["model_job_operation_columns"]["details"]["checked_columns"] == 30
     assert checks["pgvector_schema"]["status"] == "warning"
 
 
diff --git a/yuqei-ai-platform/services/ai-platform-api/tests/test_model_jobs.py b/yuqei-ai-platform/services/ai-platform-api/tests/test_model_jobs.py
index 1bf91272..bbb56d0b 100644
--- a/yuqei-ai-platform/services/ai-platform-api/tests/test_model_jobs.py
+++ b/yuqei-ai-platform/services/ai-platform-api/tests/test_model_jobs.py
@@ -1,12 +1,21 @@
-from fastapi.testclient import TestClient
+from concurrent.futures import ThreadPoolExecutor
 
-from yuqei_ai_platform_api.api.model_jobs import execute_model_job
+from fastapi.testclient import TestClient
+from sqlalchemy import create_engine
+from sqlalchemy.pool import StaticPool
+
+from yuqei_ai_platform_api.api.model_jobs import _automatic_review_trigger, execute_model_job
 from yuqei_ai_platform_api.config import AiPlatformSettings
 from yuqei_ai_platform_api.main import create_app
+from yuqei_ai_platform_api.model_jobs import (
+    ModelInferenceJobStore,
+    ModelJobAdmissionRejected,
+    ModelJobQualityReviewRequest,
+)
 from yuqei_ai_platform_api.repository import InMemoryAiPlatformRepository
 
 
-def _app_and_client():
+def _app_and_client(**setting_overrides):
     repository = InMemoryAiPlatformRepository()
     repository.seed_defaults()
     app = create_app(
@@ -16,12 +25,245 @@ def _app_and_client():
             provider_call_mode="disabled",
             provider_fallback_enabled=True,
             model_job_dispatch_mode="worker",
+            **setting_overrides,
         ),
         repository=repository,
     )
     return app, repository, TestClient(app)
 
 
+def test_controlled_pilot_admission_limits_are_idempotency_safe() -> None:
+    _app, _repository, client = _app_and_client(
+        model_job_tenant_active_limit=3,
+        model_job_user_active_limit=2,
+        model_job_tenant_queue_limit=3,
+    )
+    headers = {"X-User-Id": "pilot-user-a", "Idempotency-Key": "pilot-a-1"}
+    first = client.post("/api/v1/legal/qa/jobs", headers=headers, json={"question": "问题一如何处�？"})
+    assert first.status_code == 202
+    repeated = client.post("/api/v1/legal/qa/jobs", headers=headers, json={"question": "问题一如何处�？"})
+    assert repeated.status_code == 202
+    assert repeated.json()["id"] == first.json()["id"]
+    assert client.post(
+        "/api/v1/legal/qa/jobs",
+        headers={"X-User-Id": "pilot-user-a", "Idempotency-Key": "pilot-a-2"},
+        json={"question": "问题二如何处�？"},
+    ).status_code == 202
+    user_limited = client.post(
+        "/api/v1/legal/qa/jobs",
+        headers={"X-User-Id": "pilot-user-a", "Idempotency-Key": "pilot-a-3"},
+        json={"question": "问题三如何处�？"},
+    )
+    assert user_limited.status_code == 429
+    assert user_limited.headers["Retry-After"] == "10"
+    assert user_limited.json()["detail"]["code"] == "user_active_limit_reached"
+    assert client.post(
+        "/api/v1/legal/qa/jobs",
+        headers={"X-User-Id": "pilot-user-b", "Idempotency-Key": "pilot-b-1"},
+        json={"question": "问题四如何处�？"},
+    ).status_code == 202
+    tenant_limited = client.post(
+        "/api/v1/legal/qa/jobs",
+        headers={"X-User-Id": "pilot-user-c", "Idempotency-Key": "pilot-c-1"},
+        json={"question": "问题五如何处�？"},
+    )
+    assert tenant_limited.status_code == 429
+    assert tenant_limited.json()["detail"]["code"] == "tenant_active_limit_reached"
+
+
+def test_concurrent_admission_never_exceeds_single_process_tenant_limit() -> None:
+    app, _repository, _client = _app_and_client()
+    store = app.state.model_job_store
+
+    def submit(index: int) -> str:
+        try:
+            job, _created = store.create_or_get(
+                tenant_id="capacity-race-test",
+                operation="legal_qa",
+                request_payload={"question": f"并�容�问题 {index}"},
+                created_by=f"capacity-user-{index}",
+                idempotency_key=f"capacity-race-{index}",
+                tenant_active_limit=10,
+                user_active_limit=3,
+                tenant_queue_limit=25,
+            )
+            return job.id
+        except ModelJobAdmissionRejected:
+            return "rejected"
+
+    with ThreadPoolExecutor(max_workers=20) as executor:
+        results = list(executor.map(submit, range(20)))
+
+    assert sum(item != "rejected" for item in results) == 10
+    assert sum(item == "rejected" for item in results) == 10
+
+
+def test_stratified_quality_review_queue_and_feedback_dataset() -> None:
+    app, _repository, client = _app_and_client()
+    created = client.post(
+        "/api/v1/legal/qa/jobs",
+        headers={
+            "X-User-Id": "pilot-runner-01",
+            "Idempotency-Key": "stratified-purchase-high-01",
+            "X-Evaluation-Run-Id": "stratified-v1",
+            "X-Evaluation-Case-Id": "purchase-high-01",
+            "X-Evaluation-Contract-Type": "purchase",
+            "X-Evaluation-Risk-Level": "high",
+            "X-Evaluation-Industry": "manufacturing",
+        },
+        json={"question": "高�预付款缺少履约�障时如何控制风险？"},
+    ).json()
+    store = app.state.model_job_store
+    store.claim(created["id"], tenant_id="default", worker_name="pilot-worker")
+    stored = store.finish(
+        created["id"],
+        tenant_id="default",
+        result={"answer": "�审阅回答", "citations": [{"title": "示例��"}]},
+        status="awaiting_human",
+        provider_status="succeeded",
+        audit_run_id="audit-stratified-01",
+        quality_status="passed",
+        quality_score=100,
+        quality_summary="自动质�门�通过，高风险样本需人工�核。",
+        review_trigger="high_risk",
+    )
+    assert stored.review_status == "required"
+    queue = client.get("/api/v1/model-jobs/review-queue").json()
+    assert [item["id"] for item in queue] == [created["id"]]
+    assert client.post(
+        "/api/v1/legal/qa/jobs",
+        headers={"Idempotency-Key": "outside-stratified-run"},
+        json={"question": "�应计入该评测�行的任务是什么？"},
+    ).status_code == 202
+    snapshot = client.get(
+        "/api/v1/model-jobs/operations?target_sample_count=1&evaluation_run_id=stratified-v1"
+    ).json()
+    assert snapshot["baseline_ready"] is True
+    assert snapshot["metrics"]["total"] == 1
+    assert snapshot["admission"]["queued"] == 1
+    assert snapshot["review_required"] == 1
+    assert snapshot["quality_segments"] == [
+        {
+            "dimension": "contract_type",
+            "value": "purchase",
+            "sample_count": 1,
+            "quality_passed": 1,
+            "quality_needs_review": 0,
+            "quality_failed": 0,
+            "review_required": 1,
+            "review_completed": 0,
+            "quality_pass_rate": 1.0,
+        },
+        {
+            "dimension": "risk_level",
+            "value": "high",
+            "sample_count": 1,
+            "quality_passed": 1,
+            "quality_needs_review": 0,
+            "quality_failed": 0,
+            "review_required": 1,
+            "review_completed": 0,
+            "quality_pass_rate": 1.0,
+        },
+        {
+            "dimension": "industry",
+            "value": "manufacturing",
+            "sample_count": 1,
+            "quality_passed": 1,
+            "quality_needs_review": 0,
+            "quality_failed": 0,
+            "review_required": 1,
+            "review_completed": 0,
+            "quality_pass_rate": 1.0,
+        },
+    ]
+    review = client.post(
+        f"/api/v1/model-jobs/{created['id']}/quality-reviews",
+        headers={"X-User-Id": "legal-reviewer-a"},
+        json={
+            "legal_fact_consistency": "pass",
+            "citation_verifiability": "uncertain",
+            "high_risk_omission": "not_detected",
+            "disposition": "accepted",
+            "feedback_text": "事实一致，引用�需在正�法�库�核。",
+        },
+    )
+    assert review.status_code == 200
+    assert review.json()["reviewer_id"] == "legal-reviewer-a"
+    assert client.get(f"/api/v1/model-jobs/{created['id']}").json()["status"] == "resolved"
+    assert len(client.get(f"/api/v1/model-jobs/{created['id']}/quality-reviews").json()) == 1
+
+
+def test_automatic_review_policy_covers_quality_high_risk_and_sampling() -> None:
+    app, _repository, client = _app_and_client(
+        model_job_manual_sample_rate_percent=100,
+        model_job_high_risk_review_required=True,
+    )
+    created = client.post(
+        "/api/v1/legal/qa/jobs",
+        headers={
+            "X-Evaluation-Run-Id": "policy-test-v1",
+            "X-Evaluation-Case-Id": "case-001",
+            "X-Evaluation-Risk-Level": "high",
+        },
+        json={"question": "高风险�款如何审查？"},
+    ).json()
+    record = app.state.model_job_store.get_record(created["id"], tenant_id="default")
+    assert record is not None
+    assert _automatic_review_trigger(record, "failed", app.state.ai_platform_settings) == "quality_gate"
+    assert _automatic_review_trigger(record, "passed", app.state.ai_platform_settings) == "high_risk"
+    sampled = record.model_copy(update={"evaluation_risk_level": "medium"})
+    assert _automatic_review_trigger(sampled, "passed", app.state.ai_platform_settings) == "random_sample"
+    settings = app.state.ai_platform_settings.model_copy(
+        update={"model_job_manual_sample_rate_percent": 0}
+    )
+    assert _automatic_review_trigger(sampled, "passed", settings) is None
+
+
+def test_sqlalchemy_quality_review_is_persisted_with_resolved_job() -> None:
+    engine = create_engine(
+        "sqlite+pysqlite:///:memory:",
+        connect_args={"check_same_thread": False},
+        poolclass=StaticPool,
+    )
+    store = ModelInferenceJobStore(engine, auto_create=True)
+    job = store.create(
+        tenant_id="review-db-test",
+        operation="legal_qa",
+        request_payload={"question": "数�库�核事务如何验�？"},
+    )
+    store.claim(job.id, tenant_id="review-db-test", worker_name="review-db-worker")
+    store.finish(
+        job.id,
+        tenant_id="review-db-test",
+        result={"answer": "待具�人员�核", "citations": []},
+        status="awaiting_human",
+        provider_status="succeeded",
+        audit_run_id="review-db-audit",
+        quality_status="passed",
+        quality_score=100,
+        quality_summary="高风险抽检。",
+        review_trigger="high_risk",
+    )
+    resolved, event = store.record_quality_review(
+        job.id,
+        tenant_id="review-db-test",
+        reviewer_id="reviewer-db-test",
+        request=ModelJobQualityReviewRequest(
+            legal_fact_consistency="uncertain",
+            citation_verifiability="uncertain",
+            high_risk_omission="uncertain",
+            disposition="rejected",
+            feedback_text="测试数�库事务，�代表法务结论。",
+        ),
+    )
+
+    assert resolved.status == "resolved"
+    assert resolved.reviewed_by == "reviewer-db-test"
+    assert store.quality_reviews(job.id, tenant_id="review-db-test") == [event]
+    engine.dispose()
+
+
 def test_model_job_is_queued_polled_and_completed_with_explicit_fallback() -> None:
     app, repository, client = _app_and_client()
 
diff --git a/yuqei-ai-sdk-python/src/yuqei_sdk/__init__.py b/yuqei-ai-sdk-python/src/yuqei_sdk/__init__.py
index cdf5d55a..71e16c13 100644
--- a/yuqei-ai-sdk-python/src/yuqei_sdk/__init__.py
+++ b/yuqei-ai-sdk-python/src/yuqei_sdk/__init__.py
@@ -41,8 +41,12 @@ from yuqei_sdk.ai_platform import (
     ModelInferenceJob,
     ModelInferenceJobHistoryPage,
     ModelInferenceJobMetrics,
+    ModelJobAdmissionSnapshot,
     ModelJobOperationalAlert,
     ModelJobOperationsSnapshot,
+    ModelJobQualityReview,
+    ModelJobQualityReviewRequest,
+    ModelJobQualitySegment,
     ModelOutputQualityLabel,
     PromptTemplate,
     PromptTemplateChange,
@@ -104,8 +108,12 @@ __all__ = [
     "ModelInferenceJob",
     "ModelInferenceJobHistoryPage",
     "ModelInferenceJobMetrics",
+    "ModelJobAdmissionSnapshot",
     "ModelJobOperationalAlert",
     "ModelJobOperationsSnapshot",
+    "ModelJobQualityReview",
+    "ModelJobQualityReviewRequest",
+    "ModelJobQualitySegment",
     "ModelOutputQualityLabel",
     "PromptTemplate",
     "PromptTemplateChange",
diff --git a/yuqei-ai-sdk-python/src/yuqei_sdk/ai_platform.py b/yuqei-ai-sdk-python/src/yuqei_sdk/ai_platform.py
index 4a98f5dd..04f1a521 100644
--- a/yuqei-ai-sdk-python/src/yuqei_sdk/ai_platform.py
+++ b/yuqei-ai-sdk-python/src/yuqei_sdk/ai_platform.py
@@ -1,5 +1,5 @@
 from datetime import datetime
-from typing import Any
+from typing import Any, Literal
 
 import httpx
 from pydantic import BaseModel, Field
@@ -77,6 +77,16 @@ class ModelInferenceJob(BaseModel):
     quality_labels: list[ModelOutputQualityLabel] = Field(default_factory=list)
     quality_summary: str | None = None
     quality_gate_version: str = "model-job-v1"
+    evaluation_run_id: str | None = None
+    evaluation_case_id: str | None = None
+    evaluation_contract_type: str | None = None
+    evaluation_risk_level: Literal["low", "medium", "high"] | None = None
+    evaluation_industry: str | None = None
+    review_status: Literal["not_required", "required", "completed"] = "not_required"
+    review_trigger: Literal["quality_gate", "high_risk", "random_sample", "manual"] | None = None
+    reviewed_at: datetime | None = None
+    reviewed_by: str | None = None
+    review_disposition: Literal["accepted", "corrected", "rejected"] | None = None
     queue_latency_ms: int = 0
     execution_latency_ms: int = 0
     total_latency_ms: int = 0
@@ -125,6 +135,47 @@ class ModelJobOperationalAlert(BaseModel):
     threshold: float
 
 
+class ModelJobAdmissionSnapshot(BaseModel):
+    running: int
+    queued: int
+    tenant_active_limit: int
+    user_active_limit: int
+    tenant_queue_limit: int
+    active_saturation_rate: float
+    queue_saturation_rate: float
+    accepting_submissions: bool
+
+
+class ModelJobQualitySegment(BaseModel):
+    dimension: Literal["contract_type", "risk_level", "industry"]
+    value: str
+    sample_count: int
+    quality_passed: int
+    quality_needs_review: int
+    quality_failed: int
+    review_required: int
+    review_completed: int
+    quality_pass_rate: float
+
+
+class ModelJobQualityReviewRequest(BaseModel):
+    legal_fact_consistency: Literal["pass", "fail", "uncertain", "not_applicable"]
+    citation_verifiability: Literal["pass", "fail", "uncertain", "not_applicable"]
+    high_risk_omission: Literal["not_detected", "detected", "uncertain", "not_applicable"]
+    disposition: Literal["accepted", "corrected", "rejected"]
+    feedback_text: str | None = None
+
+
+class ModelJobQualityReview(ModelJobQualityReviewRequest):
+    id: str
+    tenant_id: str
+    job_id: str
+    review_trigger: Literal["quality_gate", "high_risk", "random_sample", "manual"]
+    reviewer_id: str
+    quality_gate_version: str
+    created_at: datetime
+
+
 class ModelJobOperationsSnapshot(BaseModel):
     metrics: ModelInferenceJobMetrics
     alerts: list[ModelJobOperationalAlert] = Field(default_factory=list)
@@ -136,6 +187,11 @@ class ModelJobOperationsSnapshot(BaseModel):
     quality_needs_review: int
     quality_failed: int
     quality_pass_rate: float
+    review_required: int = 0
+    review_completed: int = 0
+    evaluation_run_id: str | None = None
+    admission: ModelJobAdmissionSnapshot
+    quality_segments: list[ModelJobQualitySegment] = Field(default_factory=list)
 
 
 class ContractReviewRequest(BaseModel):
@@ -790,11 +846,24 @@ class AiPlatformClient:
         request: LegalQaRequest,
         *,
         idempotency_key: str | None = None,
+        evaluation_run_id: str | None = None,
+        evaluation_case_id: str | None = None,
+        evaluation_contract_type: str | None = None,
+        evaluation_risk_level: str | None = None,
+        evaluation_industry: str | None = None,
         context: RequestContext | None = None,
     ) -> ModelInferenceJob:
         headers = (context or RequestContext()).to_headers()
         if idempotency_key:
             headers["Idempotency-Key"] = idempotency_key
+        evaluation_headers = {
+            "X-Evaluation-Run-Id": evaluation_run_id,
+            "X-Evaluation-Case-Id": evaluation_case_id,
+            "X-Evaluation-Contract-Type": evaluation_contract_type,
+            "X-Evaluation-Risk-Level": evaluation_risk_level,
+            "X-Evaluation-Industry": evaluation_industry,
+        }
+        headers.update({key: value for key, value in evaluation_headers.items() if value})
         response = self._client.post(
             f"{self._api_prefix}/legal/qa/jobs",
             json=request.model_dump(exclude_none=True),
@@ -880,16 +949,63 @@ class AiPlatformClient:
         *,
         window_hours: int = 24 * 7,
         target_sample_count: int = 30,
+        evaluation_run_id: str | None = None,
         context: RequestContext | None = None,
     ) -> ModelJobOperationsSnapshot:
         response = self._client.get(
             f"{self._api_prefix}/model-jobs/operations",
-            params={"window_hours": window_hours, "target_sample_count": target_sample_count},
+            params={
+                "window_hours": window_hours,
+                "target_sample_count": target_sample_count,
+                **({"evaluation_run_id": evaluation_run_id} if evaluation_run_id else {}),
+            },
             headers=(context or RequestContext()).to_headers(),
         )
         response.raise_for_status()
         return ModelJobOperationsSnapshot.model_validate(response.json())
 
+    def list_model_job_review_queue(
+        self,
+        *,
+        limit: int = 50,
+        context: RequestContext | None = None,
+    ) -> list[ModelInferenceJob]:
+        response = self._client.get(
+            f"{self._api_prefix}/model-jobs/review-queue",
+            params={"limit": limit},
+            headers=(context or RequestContext()).to_headers(),
+        )
+        response.raise_for_status()
+        return [ModelInferenceJob.model_validate(item) for item in response.json()]
+
+    def create_model_job_quality_review(
+        self,
+        job_id: str,
+        request: ModelJobQualityReviewRequest,
+        *,
+        context: RequestContext | None = None,
+    ) -> ModelJobQualityReview:
+        response = self._client.post(
+            f"{self._api_prefix}/model-jobs/{job_id}/quality-reviews",
+            json=request.model_dump(exclude_none=True),
+            headers=(context or RequestContext()).to_headers(),
+        )
+        response.raise_for_status()
+        return ModelJobQualityReview.model_validate(response.json())
+
+    def list_model_job_quality_reviews(
+        self,
+        job_id: str,
+        *,
+        context: RequestContext | None = None,
+    ) -> list[ModelJobQualityReview]:
+        response = self._client.get(
+            f"{self._api_prefix}/model-jobs/{job_id}/quality-reviews",
+            headers=(context or RequestContext()).to_headers(),
+        )
+        response.raise_for_status()
+        return [ModelJobQualityReview.model_validate(item) for item in response.json()]
+
     def handoff_model_job(
         self,
         job_id: str,
diff --git a/yuqei-ai-sdk-python/tests/test_ai_platform.py b/yuqei-ai-sdk-python/tests/test_ai_platform.py
index 313df3df..b30e1bcd 100644
--- a/yuqei-ai-sdk-python/tests/test_ai_platform.py
+++ b/yuqei-ai-sdk-python/tests/test_ai_platform.py
@@ -15,6 +15,7 @@ from yuqei_sdk import (
     KnowledgeImportBatchCreate,
     KnowledgeReindexRequest,
     LegalQaRequest,
+    ModelJobQualityReviewRequest,
     PromptTemplateCreate,
     PromptTemplatePublishRequest,
     PromptTemplateRollbackRequest,
@@ -143,6 +144,19 @@ def test_ai_platform_client_supports_model_job_operations() -> None:
             return httpx.Response(202, json=job_payload())
         if request.url.path.endswith("/model-jobs/history"):
             return httpx.Response(200, json={"items": [job_payload()], "next_cursor": None, "has_more": False})
+        if request.url.path.endswith("/model-jobs/review-queue"):
+            return httpx.Response(200, json=[job_payload("awaiting_human")])
+        if request.url.path.endswith("/quality-reviews") and request.method == "POST":
+            return httpx.Response(200, json={
+                "id": "model-review-1", "tenant_id": "tenant-1", "job_id": "model-job-1",
+                "review_trigger": "high_risk", "reviewer_id": "user-1",
+                "legal_fact_consistency": "pass", "citation_verifiability": "uncertain",
+                "high_risk_omission": "not_detected", "disposition": "accepted",
+                "feedback_text": "引用待正�法�库�核。", "quality_gate_version": "model-job-v1",
+                "created_at": "2026-08-26T08:10:00Z",
+            })
+        if request.url.path.endswith("/quality-reviews") and request.method == "GET":
+            return httpx.Response(200, json=[])
         if request.url.path.endswith("/cancel"):
             return httpx.Response(200, json=job_payload("cancelled"))
         if request.url.path.endswith("/model-jobs/operations"):
@@ -159,6 +173,13 @@ def test_ai_platform_client_supports_model_job_operations() -> None:
                 "remaining_sample_count": 30, "baseline_ready": False,
                 "quality_passed": 0, "quality_needs_review": 0, "quality_failed": 0,
                 "quality_pass_rate": 0,
+                "review_required": 0, "review_completed": 0, "evaluation_run_id": "stratified-v1",
+                "admission": {
+                    "running": 0, "queued": 1, "tenant_active_limit": 10, "user_active_limit": 3,
+                    "tenant_queue_limit": 25, "active_saturation_rate": 0.1,
+                    "queue_saturation_rate": 0.04, "accepting_submissions": True,
+                },
+                "quality_segments": [],
             })
         return httpx.Response(404)
 
@@ -167,17 +188,37 @@ def test_ai_platform_client_supports_model_job_operations() -> None:
     created = client.create_legal_qa_job(
         LegalQaRequest(question="付款期�如何约定？"),
         idempotency_key="submit-1",
+        evaluation_run_id="stratified-v1",
+        evaluation_case_id="purchase-01",
+        evaluation_contract_type="purchase",
+        evaluation_risk_level="high",
+        evaluation_industry="manufacturing",
         context=context,
     )
     history = client.list_model_jobs(operation="legal_qa", context=context)
     cancelled = client.cancel_model_job(created.id, reason="��需�", context=context)
-    operations = client.get_model_job_operations(context=context)
+    operations = client.get_model_job_operations(evaluation_run_id="stratified-v1", context=context)
+    review_queue = client.list_model_job_review_queue(context=context)
+    review = client.create_model_job_quality_review(
+        created.id,
+        ModelJobQualityReviewRequest(
+            legal_fact_consistency="pass",
+            citation_verifiability="uncertain",
+            high_risk_omission="not_detected",
+            disposition="accepted",
+            feedback_text="引用待正�法�库�核。",
+        ),
+        context=context,
+    )
 
     assert created.id == "model-job-1"
     assert history.items[0].display_title == "付款期�如何约定？"
     assert cancelled.status == "cancelled"
     assert operations.remaining_sample_count == 30
+    assert review_queue[0].status == "awaiting_human"
+    assert review.reviewer_id == "user-1"
     assert seen_requests[0].headers["Idempotency-Key"] == "submit-1"
+    assert seen_requests[0].headers["X-Evaluation-Contract-Type"] == "purchase"
     history_query = parse_qs(seen_requests[1].url.query.decode())
     assert history_query["operation"] == ["legal_qa"]
     assert "status" not in history_query
diff --git a/yuqei-contract-platform/apps/contract-web/src/app/admin/model-jobs/page.tsx b/yuqei-contract-platform/apps/contract-web/src/app/admin/model-jobs/page.tsx
index 53b67a79..654236ad 100644
--- a/yuqei-contract-platform/apps/contract-web/src/app/admin/model-jobs/page.tsx
+++ b/yuqei-contract-platform/apps/contract-web/src/app/admin/model-jobs/page.tsx
@@ -2,11 +2,16 @@
 
 import { Activity, AlertTriangle, CheckCircle2, Clock3, RefreshCw, ShieldAlert } from "lucide-react";
 import { useCallback, useEffect, useState } from "react";
-import type { ModelJobOperationsSnapshot } from "@/services/contracts";
-import { getModelJobOperations } from "@/services/contracts-client";
+import type { ModelInferenceJob, ModelJobOperationsSnapshot, ModelJobQualityReviewRequest } from "@/services/contracts";
+import { getModelJobOperations, getModelJobReviewQueue, submitModelJobQualityReview } from "@/services/contracts-client";
 
 export default function ModelJobOperationsPage() {
   const [snapshot, setSnapshot] = useState<ModelJobOperationsSnapshot | null>(null);
+  const [reviewQueue, setReviewQueue] = useState<ModelInferenceJob[]>([]);
+  const [runIdInput, setRunIdInput] = useState("");
+  const [evaluationRunId, setEvaluationRunId] = useState("");
+  const [tenantIdInput, setTenantIdInput] = useState("");
+  const [targetTenantId, setTargetTenantId] = useState("");
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
 
@@ -14,13 +19,18 @@ export default function ModelJobOperationsPage() {
     setLoading(true);
     setError(null);
     try {
-      setSnapshot(await getModelJobOperations());
+      const [nextSnapshot, nextReviewQueue] = await Promise.all([
+        getModelJobOperations(evaluationRunId, targetTenantId),
+        getModelJobReviewQueue(50, targetTenantId),
+      ]);
+      setSnapshot(nextSnapshot);
+      setReviewQueue(nextReviewQueue);
     } catch (requestError) {
       setError(requestError instanceof Error ? requestError.message : "模型任务��指标加载失败。");
     } finally {
       setLoading(false);
     }
-  }, []);
+  }, [evaluationRunId, targetTenantId]);
 
   useEffect(() => { void loadSnapshot(); }, [loadSnapshot]);
 
@@ -41,17 +51,25 @@ export default function ModelJobOperationsPage() {
 
       {snapshot && (
         <>
+          <section className="panel">
+            <div className="panel-header"><div><h2 className="panel-title">试点租户与评测�行筛选</h2><p className="item-meta">平�管�员�下钻到指定试点租户和�行；留空查看当�租户窗�全�。</p></div></div>
+            <div className="panel-body">
+              <div className="form-actions"><input aria-label="试点租户 ID" value={tenantIdInput} onChange={(event) => setTenantIdInput(event.target.value)} placeholder="试点租户 ID，例如 controlled-pilot-v1" /><input aria-label="评测�行 ID" value={runIdInput} onChange={(event) => setRunIdInput(event.target.value)} placeholder="�行 ID，例如 stratified-v1-20260826" /><button className="button button-secondary" onClick={() => { setTargetTenantId(tenantIdInput.trim()); setEvaluationRunId(runIdInput.trim()); }} type="button">应用筛选</button>{(evaluationRunId || targetTenantId) && <button className="button button-ghost" onClick={() => { setRunIdInput(""); setEvaluationRunId(""); setTenantIdInput(""); setTargetTenantId(""); }} type="button">清除</button>}</div>
+              {(targetTenantId || snapshot.evaluation_run_id) && <p className="item-meta">当�范围：租户 {targetTenantId || "当�租户"} · �行 {snapshot.evaluation_run_id || "全部"}</p>}
+            </div>
+          </section>
+
           <div className="metric-row">
             <Metric icon={Activity} label="窗�任务" value={String(snapshot.metrics.total)} />
             <Metric icon={Clock3} label="总耗时 P95" value={formatDuration(snapshot.metrics.total_latency_p95_ms)} />
-            <Metric icon={CheckCircle2} label="质�通过率" value={formatRate(snapshot.quality_pass_rate)} />
+            <Metric icon={CheckCircle2} label="自动门�通过率" value={formatRate(snapshot.quality_pass_rate)} />
             <Metric icon={ShieldAlert} label="开放告警" value={String(snapshot.alerts.length)} />
           </div>
 
           <div className="grid-two">
             <section className="panel">
               <div className="panel-header">
-                <div><h2 className="panel-title">30 �真实样本基线</h2><p className="item-meta">�计入已�行质�门�的完�任务。</p></div>
+                <div><h2 className="panel-title">分层真实样本基线</h2><p className="item-meta">�计入真实 Provider 且已�行质�门�的完�任务。</p></div>
                 <span className={snapshot.baseline_ready ? "tag tag-success" : "tag tag-warning"}>
                   {snapshot.baseline_ready ? "基线已就绪" : `还差 ${snapshot.remaining_sample_count} �`}
                 </span>
@@ -76,12 +94,39 @@ export default function ModelJobOperationsPage() {
                     <tr><th>执行 P50 / P95</th><td>{formatDuration(snapshot.metrics.execution_latency_p50_ms)} / {formatDuration(snapshot.metrics.execution_latency_p95_ms)}</td></tr>
                     <tr><th>fallback / 失败率</th><td>{formatRate(snapshot.metrics.fallback_rate)} / {formatRate(snapshot.metrics.failure_rate)}</td></tr>
                     <tr><th>�试率</th><td>{formatRate(snapshot.metrics.retry_rate)}</td></tr>
+                    <tr><th>抽检�求 / 已完�</th><td>{snapshot.review_required} / {snapshot.review_completed}</td></tr>
                   </tbody>
                 </table>
               </div>
             </section>
           </div>
 
+          <div className="grid-two">
+            <section className="panel">
+              <div className="panel-header"><h2 className="panel-title">�控试点容�</h2><span className={snapshot.admission.accepting_submissions ? "tag tag-success" : "tag tag-warning"}>{snapshot.admission.accepting_submissions ? "�接收" : "已��"}</span></div>
+              <div className="panel-body table-wrap">
+                <table className="data-table"><tbody>
+                  <tr><th>�行 / 排队</th><td>{snapshot.admission.running} / {snapshot.admission.queued}</td></tr>
+                  <tr><th>租户活动上�</th><td>{snapshot.admission.tenant_active_limit}</td></tr>
+                  <tr><th>�用户活动上�</th><td>{snapshot.admission.user_active_limit}</td></tr>
+                  <tr><th>队列上�</th><td>{snapshot.admission.tenant_queue_limit}</td></tr>
+                  <tr><th>活动 / 队列饱和度</th><td>{formatRate(snapshot.admission.active_saturation_rate)} / {formatRate(snapshot.admission.queue_saturation_rate)}</td></tr>
+                </tbody></table>
+              </div>
+            </section>
+
+            <section className="panel">
+              <div className="panel-header"><h2 className="panel-title">分层质�结果</h2><span className="tag">{snapshot.quality_segments.length} 个分层</span></div>
+              <div className="panel-body table-wrap">
+                {snapshot.quality_segments.length === 0 ? <div className="empty-state empty-state-compact">当�窗�尚无带分层标签的样本。</div> : (
+                  <table className="data-table"><thead><tr><th>维度</th><th>分层</th><th>样本</th><th>通过率</th><th>抽检</th></tr></thead><tbody>
+                    {snapshot.quality_segments.map((segment) => <tr key={`${segment.dimension}-${segment.value}`}><td>{dimensionLabel(segment.dimension)}</td><td>{segment.value}</td><td>{segment.sample_count}</td><td>{formatRate(segment.quality_pass_rate)}</td><td>{segment.review_completed}/{segment.review_required}</td></tr>)}
+                  </tbody></table>
+                )}
+              </div>
+            </section>
+          </div>
+
           <section className="panel">
             <div className="panel-header"><h2 className="panel-title">��告警</h2><span className="tag">{snapshot.alerts.length} �</span></div>
             <div className="panel-body">
@@ -102,12 +147,91 @@ export default function ModelJobOperationsPage() {
               )}
             </div>
           </section>
+
+          <section className="panel">
+            <div className="panel-header"><div><h2 className="panel-title">人工抽检与接管队列</h2><p className="item-meta">记录事实一致性�引用�核验性和高风险��，形�规则迭代数�。</p></div><span className={reviewQueue.length ? "tag tag-warning" : "tag tag-success"}>{reviewQueue.length} �</span></div>
+            <div className="panel-body">
+              {reviewQueue.length === 0 ? <div className="empty-state empty-state-compact">当�没有待人工抽检任务。</div> : (
+                <div className="task-list">
+                  {reviewQueue.map((job) => <QualityReviewCard job={job} key={job.id} onReviewed={loadSnapshot} />)}
+                </div>
+              )}
+            </div>
+          </section>
         </>
       )}
     </>
   );
 }
 
+function QualityReviewCard({ job, onReviewed }: { job: ModelInferenceJob; onReviewed: () => Promise<void> }) {
+  const result = job.result && typeof job.result === "object" ? job.result as Record<string, unknown> : null;
+  const answer = typeof result?.answer === "string" ? result.answer : typeof result?.summary === "string" ? result.summary : "";
+  const citations = Array.isArray(result?.citations) ? result.citations.filter((item): item is Record<string, unknown> => Boolean(item) && typeof item === "object") : [];
+  const [payload, setPayload] = useState<ModelJobQualityReviewRequest>({
+    legal_fact_consistency: "uncertain",
+    citation_verifiability: "uncertain",
+    high_risk_omission: "uncertain",
+    disposition: "accepted",
+    feedback_text: "",
+  });
+  const [submitting, setSubmitting] = useState(false);
+  const [confirmed, setConfirmed] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  async function submit() {
+    setSubmitting(true);
+    setError(null);
+    try {
+      await submitModelJobQualityReview(job.id, payload, job.tenant_id);
+      await onReviewed();
+    } catch (requestError) {
+      setError(requestError instanceof Error ? requestError.message : "抽检结论�交失败。");
+    } finally {
+      setSubmitting(false);
+    }
+  }
+
+  return <article className="task-card">
+    <div style={{ flex: 1 }}>
+      <strong>{job.display_title}</strong>
+      <p>{job.evaluation_contract_type ?? "未分层"} · 风险 {job.evaluation_risk_level ?? "未知"} · 触� {reviewTriggerLabel(job.review_trigger)}</p>
+      <details style={{ marginTop: 12 }}><summary>查看模型输出与引用（{citations.length} �）</summary><div className="notice" style={{ display: "block", marginTop: 8, maxHeight: 360, overflow: "auto", whiteSpace: "pre-wrap" }}>{answer || "当�任务没有�审阅的文本输出。"}{citations.length > 0 && <><h4 style={{ marginBottom: 6 }}>引用</h4><ol>{citations.map((citation, index) => <li key={`${job.id}-citation-${index}`}>{citationLabel(citation)}</li>)}</ol></>}</div></details>
+      {job.quality_summary && <p className="item-meta">自动门�：{job.quality_summary}</p>}
+      <div className="grid-two" style={{ marginTop: 12 }}>
+        <ReviewSelect label="事实一致性" value={payload.legal_fact_consistency} options={assessmentOptions} onChange={(value) => setPayload((current) => ({ ...current, legal_fact_consistency: value }))} />
+        <ReviewSelect label="引用�核验" value={payload.citation_verifiability} options={assessmentOptions} onChange={(value) => setPayload((current) => ({ ...current, citation_verifiability: value }))} />
+        <ReviewSelect label="高风险��" value={payload.high_risk_omission} options={omissionOptions} onChange={(value) => setPayload((current) => ({ ...current, high_risk_omission: value }))} />
+        <ReviewSelect label="处置结论" value={payload.disposition} options={dispositionOptions} onChange={(value) => setPayload((current) => ({ ...current, disposition: value }))} />
+      </div>
+      <label className="field" style={{ marginTop: 12 }}><span>�核说明</span><textarea value={payload.feedback_text ?? ""} onChange={(event) => setPayload((current) => ({ ...current, feedback_text: event.target.value }))} placeholder="记录事实�引用核验结果和修订建议。" rows={3} /></label>
+      <label style={{ alignItems: "center", display: "flex", gap: 8, marginTop: 12 }}><input checked={confirmed} onChange={(event) => setConfirmed(event.target.checked)} style={{ width: "auto" }} type="checkbox" /><span>我已核对模型输出��用法�和本案事实，并确认以上结论。</span></label>
+      {error && <div className="notice notice-error"><AlertTriangle size={16} />{error}</div>}
+      <button className="button button-primary" disabled={submitting || !confirmed} onClick={() => void submit()} type="button"><CheckCircle2 size={16} />{submitting ? "�交中…" : "�交抽检结论"}</button>
+    </div>
+  </article>;
+}
+
+type ReviewOption<T extends string> = { value: T; label: string };
+
+function ReviewSelect<T extends string>({ label, value, options, onChange }: { label: string; value: T; options: Array<ReviewOption<T>>; onChange: (value: T) => void }) {
+  return <label className="field"><span>{label}</span><select value={value} onChange={(event) => onChange(event.target.value as T)}>{options.map((option) => <option key={option.value} value={option.value}>{option.label}</option>)}</select></label>;
+}
+
+const assessmentOptions: Array<ReviewOption<ModelJobQualityReviewRequest["legal_fact_consistency"]>> = [
+  { value: "pass", label: "通过" }, { value: "fail", label: "�通过" }, { value: "uncertain", label: "待确认" }, { value: "not_applicable", label: "�适用" },
+];
+const omissionOptions: Array<ReviewOption<ModelJobQualityReviewRequest["high_risk_omission"]>> = [
+  { value: "not_detected", label: "未�现��" }, { value: "detected", label: "�现��" }, { value: "uncertain", label: "待确认" }, { value: "not_applicable", label: "�适用" },
+];
+const dispositionOptions: Array<ReviewOption<ModelJobQualityReviewRequest["disposition"]>> = [
+  { value: "accepted", label: "接�输出" }, { value: "corrected", label: "修订�接�" }, { value: "rejected", label: "拒�输出" },
+];
+
+function citationLabel(citation: Record<string, unknown>) { return [citation.title, citation.source, citation.locator].filter((value) => typeof value === "string" && value.trim()).join(" · ") || "未命�引用"; }
+function dimensionLabel(value: string) { return value === "contract_type" ? "��类型" : value === "risk_level" ? "风险等级" : "行业"; }
+function reviewTriggerLabel(value: ModelInferenceJob["review_trigger"]) { return value === "quality_gate" ? "质�异常" : value === "high_risk" ? "高风险必审" : value === "random_sample" ? "�机抽检" : "人工接管"; }
+
 function Metric({ icon: Icon, label, value }: { icon: typeof Activity; label: string; value: string }) {
   return <div className="metric"><Icon size={18} /><div className="metric-value">{value}</div><div className="metric-label">{label}</div></div>;
 }
diff --git a/yuqei-contract-platform/apps/contract-web/src/app/api/contract-platform/admin/model-jobs/[jobId]/quality-reviews/route.ts b/yuqei-contract-platform/apps/contract-web/src/app/api/contract-platform/admin/model-jobs/[jobId]/quality-reviews/route.ts
new file mode 100644
index 00000000..39134dd2
--- /dev/null
+++ b/yuqei-contract-platform/apps/contract-web/src/app/api/contract-platform/admin/model-jobs/[jobId]/quality-reviews/route.ts
@@ -0,0 +1,24 @@
+import { buildContractApiUrl, proxyContractApiResponse } from "@/lib/contract-api";
+
+type RouteContext = { params: Promise<{ jobId: string }> };
+
+export async function POST(request: Request, context: RouteContext) {
+  const { jobId } = await context.params;
+  const search = new URL(request.url).search;
+  return proxyContractApiResponse(
+    buildContractApiUrl(`/api/v1/admin/model-jobs/${encodeURIComponent(jobId)}/quality-reviews${search}`),
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: await request.text(),
+    },
+  );
+}
+
+export async function GET(request: Request, context: RouteContext) {
+  const { jobId } = await context.params;
+  const search = new URL(request.url).search;
+  return proxyContractApiResponse(
+    buildContractApiUrl(`/api/v1/admin/model-jobs/${encodeURIComponent(jobId)}/quality-reviews${search}`),
+  );
+}
diff --git a/yuqei-contract-platform/apps/contract-web/src/app/api/contract-platform/admin/model-jobs/review-queue/route.ts b/yuqei-contract-platform/apps/contract-web/src/app/api/contract-platform/admin/model-jobs/review-queue/route.ts
new file mode 100644
index 00000000..3283769b
--- /dev/null
+++ b/yuqei-contract-platform/apps/contract-web/src/app/api/contract-platform/admin/model-jobs/review-queue/route.ts
@@ -0,0 +1,6 @@
+import { buildContractApiUrl, proxyContractApiResponse } from "@/lib/contract-api";
+
+export async function GET(request: Request) {
+  const search = new URL(request.url).search;
+  return proxyContractApiResponse(buildContractApiUrl(`/api/v1/admin/model-jobs/review-queue${search}`));
+}
diff --git a/yuqei-contract-platform/apps/contract-web/src/services/contracts-client.ts b/yuqei-contract-platform/apps/contract-web/src/services/contracts-client.ts
index 9cd7e96f..d58fc930 100644
--- a/yuqei-contract-platform/apps/contract-web/src/services/contracts-client.ts
+++ b/yuqei-contract-platform/apps/contract-web/src/services/contracts-client.ts
@@ -5,6 +5,8 @@ import type {
   ModelInferenceJob,
   ModelInferenceJobHistoryPage,
   ModelJobOperationsSnapshot,
+  ModelJobQualityReview,
+  ModelJobQualityReviewRequest,
   PlatformAdministratorPage,
   PrivilegedIdentityDeliveryStatusPage,
   PrivilegedIdentityOutboxDeadLetterPage,
@@ -116,8 +118,11 @@ async function fetchLegalQaJob(url: string, init?: RequestInit): Promise<ModelIn
   return await response.json() as ModelInferenceJob;
 }
 
-export async function getModelJobOperations(): Promise<ModelJobOperationsSnapshot> {
-  const response = await fetch("/api/contract-platform/admin/model-jobs/operations", { cache: "no-store" });
+export async function getModelJobOperations(evaluationRunId?: string, tenantId?: string): Promise<ModelJobOperationsSnapshot> {
+  const search = new URLSearchParams({ target_sample_count: "100" });
+  if (evaluationRunId?.trim()) search.set("evaluation_run_id", evaluationRunId.trim());
+  if (tenantId?.trim()) search.set("tenant_id", tenantId.trim());
+  const response = await fetch(`/api/contract-platform/admin/model-jobs/operations?${search.toString()}`, { cache: "no-store" });
   if (!response.ok) {
     const payload = await response.json().catch(() => null) as { detail?: string; message?: string } | null;
     throw new Error(payload?.detail || payload?.message || "模型任务��指标加载失败。");
@@ -125,6 +130,40 @@ export async function getModelJobOperations(): Promise<ModelJobOperationsSnapsho
   return await response.json() as ModelJobOperationsSnapshot;
 }
 
+export async function getModelJobReviewQueue(limit = 50, tenantId?: string): Promise<ModelInferenceJob[]> {
+  const search = new URLSearchParams({ limit: String(limit) });
+  if (tenantId?.trim()) search.set("tenant_id", tenantId.trim());
+  const response = await fetch(`/api/contract-platform/admin/model-jobs/review-queue?${search.toString()}`, { cache: "no-store" });
+  if (!response.ok) {
+    const payload = await response.json().catch(() => null) as { detail?: string; message?: string } | null;
+    throw new Error(payload?.detail || payload?.message || "人工抽检队列加载失败。");
+  }
+  return await response.json() as ModelInferenceJob[];
+}
+
+export async function submitModelJobQualityReview(
+  jobId: string,
+  request: ModelJobQualityReviewRequest,
+  tenantId?: string,
+): Promise<ModelJobQualityReview> {
+  const search = new URLSearchParams();
+  if (tenantId?.trim()) search.set("tenant_id", tenantId.trim());
+  const suffix = search.size ? `?${search.toString()}` : "";
+  const response = await fetch(
+    `/api/contract-platform/admin/model-jobs/${encodeURIComponent(jobId)}/quality-reviews${suffix}`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(request),
+    },
+  );
+  if (!response.ok) {
+    const payload = await response.json().catch(() => null) as { detail?: string; message?: string } | null;
+    throw new Error(payload?.detail || payload?.message || "人工抽检结论�交失败。");
+  }
+  return await response.json() as ModelJobQualityReview;
+}
+
 export async function getIdentityTenants(): Promise<TenantPage> {
   const payload = await fetchClientJson<TenantPage>("/api/contract-platform/identity/tenants");
   return payload ?? { items: [], total: 0 };
diff --git a/yuqei-contract-platform/apps/contract-web/src/services/contracts.ts b/yuqei-contract-platform/apps/contract-web/src/services/contracts.ts
index 4df193e6..a2acc30d 100644
--- a/yuqei-contract-platform/apps/contract-web/src/services/contracts.ts
+++ b/yuqei-contract-platform/apps/contract-web/src/services/contracts.ts
@@ -197,6 +197,16 @@ export type ModelInferenceJob = {
   }>;
   quality_summary?: string | null;
   quality_gate_version: string;
+  evaluation_run_id?: string | null;
+  evaluation_case_id?: string | null;
+  evaluation_contract_type?: string | null;
+  evaluation_risk_level?: "low" | "medium" | "high" | null;
+  evaluation_industry?: string | null;
+  review_status: "not_required" | "required" | "completed";
+  review_trigger?: "quality_gate" | "high_risk" | "random_sample" | "manual" | null;
+  reviewed_at?: string | null;
+  reviewed_by?: string | null;
+  review_disposition?: "accepted" | "corrected" | "rejected" | null;
   queue_latency_ms: number;
   execution_latency_ms: number;
   total_latency_ms: number;
@@ -252,6 +262,48 @@ export type ModelJobOperationsSnapshot = {
   quality_needs_review: number;
   quality_failed: number;
   quality_pass_rate: number;
+  review_required: number;
+  review_completed: number;
+  evaluation_run_id?: string | null;
+  admission: {
+    running: number;
+    queued: number;
+    tenant_active_limit: number;
+    user_active_limit: number;
+    tenant_queue_limit: number;
+    active_saturation_rate: number;
+    queue_saturation_rate: number;
+    accepting_submissions: boolean;
+  };
+  quality_segments: Array<{
+    dimension: "contract_type" | "risk_level" | "industry";
+    value: string;
+    sample_count: number;
+    quality_passed: number;
+    quality_needs_review: number;
+    quality_failed: number;
+    review_required: number;
+    review_completed: number;
+    quality_pass_rate: number;
+  }>;
+};
+
+export type ModelJobQualityReviewRequest = {
+  legal_fact_consistency: "pass" | "fail" | "uncertain" | "not_applicable";
+  citation_verifiability: "pass" | "fail" | "uncertain" | "not_applicable";
+  high_risk_omission: "not_detected" | "detected" | "uncertain" | "not_applicable";
+  disposition: "accepted" | "corrected" | "rejected";
+  feedback_text?: string | null;
+};
+
+export type ModelJobQualityReview = ModelJobQualityReviewRequest & {
+  id: string;
+  tenant_id: string;
+  job_id: string;
+  review_trigger: "quality_gate" | "high_risk" | "random_sample" | "manual";
+  reviewer_id: string;
+  quality_gate_version: string;
+  created_at: string;
 };
 
 export type ContractPermissions = {
diff --git a/yuqei-contract-platform/packages/contract-openapi/openapi.yaml b/yuqei-contract-platform/packages/contract-openapi/openapi.yaml
index ccd90829..5000a4ab 100644
--- a/yuqei-contract-platform/packages/contract-openapi/openapi.yaml
+++ b/yuqei-contract-platform/packages/contract-openapi/openapi.yaml
@@ -1395,6 +1395,13 @@ paths:
         - name: target_sample_count
           in: query
           schema: { type: integer, minimum: 1, maximum: 1000, default: 30 }
+        - name: evaluation_run_id
+          in: query
+          schema: { type: string, maxLength: 128 }
+        - name: tenant_id
+          in: query
+          description: Platform-admin target tenant; defaults to the current tenant
+          schema: { type: string, pattern: "^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$" }
       responses:
         "200":
           description: Model task operational snapshot
@@ -1402,6 +1409,58 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/ModelJobOperationsSnapshot"
+  /api/v1/admin/model-jobs/review-queue:
+    get:
+      operationId: getModelJobReviewQueue
+      summary: List platform-admin structured human review queue
+      parameters:
+        - name: limit
+          in: query
+          schema: { type: integer, minimum: 1, maximum: 100, default: 50 }
+        - name: tenant_id
+          in: query
+          description: Platform-admin target tenant; defaults to the current tenant
+          schema: { type: string, pattern: "^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$" }
+      responses:
+        "200":
+          description: Human review queue
+          content:
+            application/json:
+              schema:
+                type: array
+                items: { $ref: "#/components/schemas/ModelInferenceJob" }
+  /api/v1/admin/model-jobs/{job_id}/quality-reviews:
+    get:
+      operationId: listAdminModelJobQualityReviews
+      summary: List immutable quality review feedback
+      parameters:
+        - { name: job_id, in: path, required: true, schema: { type: string } }
+        - { name: tenant_id, in: query, required: false, schema: { type: string, pattern: "^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$" } }
+      responses:
+        "200":
+          description: Quality review dataset
+          content:
+            application/json:
+              schema:
+                type: array
+                items: { $ref: "#/components/schemas/ModelJobQualityReview" }
+    post:
+      operationId: createAdminModelJobQualityReview
+      summary: Complete a human review and write structured quality feedback
+      parameters:
+        - { name: job_id, in: path, required: true, schema: { type: string } }
+        - { name: tenant_id, in: query, required: false, schema: { type: string, pattern: "^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$" } }
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: "#/components/schemas/ModelJobQualityReviewRequest" }
+      responses:
+        "200":
+          description: Immutable quality review record
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/ModelJobQualityReview" }
   /api/v1/search:
     get:
       operationId: search
@@ -9013,6 +9072,16 @@ components:
             $ref: "#/components/schemas/ModelOutputQualityLabel"
         quality_summary: { type: string, nullable: true }
         quality_gate_version: { type: string }
+        evaluation_run_id: { type: string, nullable: true }
+        evaluation_case_id: { type: string, nullable: true }
+        evaluation_contract_type: { type: string, nullable: true }
+        evaluation_risk_level: { type: string, enum: [low, medium, high], nullable: true }
+        evaluation_industry: { type: string, nullable: true }
+        review_status: { type: string, enum: [not_required, required, completed] }
+        review_trigger: { type: string, enum: [quality_gate, high_risk, random_sample, manual], nullable: true }
+        reviewed_at: { type: string, format: date-time, nullable: true }
+        reviewed_by: { type: string, nullable: true }
+        review_disposition: { type: string, enum: [accepted, corrected, rejected], nullable: true }
         queue_latency_ms: { type: integer }
         execution_latency_ms: { type: integer }
         total_latency_ms: { type: integer }
@@ -9074,7 +9143,7 @@ components:
         threshold: { type: number }
     ModelJobOperationsSnapshot:
       type: object
-      required: [metrics, alerts, completed_sample_count, target_sample_count, remaining_sample_count, baseline_ready, quality_passed, quality_needs_review, quality_failed, quality_pass_rate]
+      required: [metrics, alerts, completed_sample_count, target_sample_count, remaining_sample_count, baseline_ready, quality_passed, quality_needs_review, quality_failed, quality_pass_rate, review_required, review_completed, admission, quality_segments]
       properties:
         metrics:
           $ref: "#/components/schemas/ModelInferenceJobMetrics"
@@ -9090,6 +9159,60 @@ components:
         quality_needs_review: { type: integer }
         quality_failed: { type: integer }
         quality_pass_rate: { type: number }
+        review_required: { type: integer }
+        review_completed: { type: integer }
+        evaluation_run_id: { type: string, nullable: true }
+        admission: { $ref: "#/components/schemas/ModelJobAdmissionSnapshot" }
+        quality_segments:
+          type: array
+          items: { $ref: "#/components/schemas/ModelJobQualitySegment" }
+    ModelJobAdmissionSnapshot:
+      type: object
+      required: [running, queued, tenant_active_limit, user_active_limit, tenant_queue_limit, active_saturation_rate, queue_saturation_rate, accepting_submissions]
+      properties:
+        running: { type: integer }
+        queued: { type: integer }
+        tenant_active_limit: { type: integer }
+        user_active_limit: { type: integer }
+        tenant_queue_limit: { type: integer }
+        active_saturation_rate: { type: number }
+        queue_saturation_rate: { type: number }
+        accepting_submissions: { type: boolean }
+    ModelJobQualitySegment:
+      type: object
+      required: [dimension, value, sample_count, quality_passed, quality_needs_review, quality_failed, review_required, review_completed, quality_pass_rate]
+      properties:
+        dimension: { type: string, enum: [contract_type, risk_level, industry] }
+        value: { type: string }
+        sample_count: { type: integer }
+        quality_passed: { type: integer }
+        quality_needs_review: { type: integer }
+        quality_failed: { type: integer }
+        review_required: { type: integer }
+        review_completed: { type: integer }
+        quality_pass_rate: { type: number }
+    ModelJobQualityReviewRequest:
+      type: object
+      required: [legal_fact_consistency, citation_verifiability, high_risk_omission, disposition]
+      properties:
+        legal_fact_consistency: { type: string, enum: [pass, fail, uncertain, not_applicable] }
+        citation_verifiability: { type: string, enum: [pass, fail, uncertain, not_applicable] }
+        high_risk_omission: { type: string, enum: [not_detected, detected, uncertain, not_applicable] }
+        disposition: { type: string, enum: [accepted, corrected, rejected] }
+        feedback_text: { type: string, nullable: true, maxLength: 8000 }
+    ModelJobQualityReview:
+      allOf:
+        - { $ref: "#/components/schemas/ModelJobQualityReviewRequest" }
+        - type: object
+          required: [id, tenant_id, job_id, review_trigger, reviewer_id, quality_gate_version, created_at]
+          properties:
+            id: { type: string }
+            tenant_id: { type: string }
+            job_id: { type: string }
+            review_trigger: { type: string, enum: [quality_gate, high_risk, random_sample, manual] }
+            reviewer_id: { type: string }
+            quality_gate_version: { type: string }
+            created_at: { type: string, format: date-time }
     SearchResult:
       type: object
       required:
diff --git a/yuqei-contract-platform/services/contract-api/src/yuqei_contract_api/api/contracts_core.py b/yuqei-contract-platform/services/contract-api/src/yuqei_contract_api/api/contracts_core.py
index 16774273..59f0a890 100644
--- a/yuqei-contract-platform/services/contract-api/src/yuqei_contract_api/api/contracts_core.py
+++ b/yuqei-contract-platform/services/contract-api/src/yuqei_contract_api/api/contracts_core.py
@@ -10,6 +10,8 @@ from yuqei_sdk import (
     ModelInferenceJob,
     ModelInferenceJobHistoryPage,
     ModelJobOperationsSnapshot,
+    ModelJobQualityReview,
+    ModelJobQualityReviewRequest,
     RequestContext,
 )
 
@@ -472,6 +474,8 @@ def register_contract_core_routes(
     def get_model_job_operations(
         window_hours: int = Query(default=24 * 7, ge=1, le=24 * 90),
         target_sample_count: int = Query(default=30, ge=1, le=1000),
+        evaluation_run_id: str | None = Query(default=None, max_length=128),
+        tenant_id: str | None = Query(default=None, pattern=r"^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$"),
     ) -> ModelJobOperationsSnapshot:
         _require_platform_administrator(repository)
         with AiPlatformClient(
@@ -482,13 +486,73 @@ def register_contract_core_routes(
             return client.get_model_job_operations(
                 window_hours=window_hours,
                 target_sample_count=target_sample_count,
-                context=_ai_request_context(),
+                evaluation_run_id=evaluation_run_id,
+                context=_ai_request_context(tenant_id=tenant_id),
+            )
+
+    @app.get(
+        f"{settings.api_prefix}/admin/model-jobs/review-queue",
+        response_model=list[ModelInferenceJob],
+        tags=["admin", "model-jobs"],
+    )
+    def get_model_job_review_queue(
+        limit: int = Query(default=50, ge=1, le=100),
+        tenant_id: str | None = Query(default=None, pattern=r"^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$"),
+    ) -> list[ModelInferenceJob]:
+        _require_platform_administrator(repository)
+        with AiPlatformClient(
+            settings.ai_platform_base_url,
+            timeout=settings.ai_platform_timeout_seconds,
+            service_key=settings.ai_platform_service_key or None,
+        ) as client:
+            return client.list_model_job_review_queue(limit=limit, context=_ai_request_context(tenant_id=tenant_id))
+
+    @app.post(
+        f"{settings.api_prefix}/admin/model-jobs/{{job_id}}/quality-reviews",
+        response_model=ModelJobQualityReview,
+        tags=["admin", "model-jobs"],
+    )
+    def create_model_job_quality_review(
+        job_id: str,
+        request: ModelJobQualityReviewRequest,
+        tenant_id: str | None = Query(default=None, pattern=r"^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$"),
+    ) -> ModelJobQualityReview:
+        _require_platform_administrator(repository)
+        with AiPlatformClient(
+            settings.ai_platform_base_url,
+            timeout=settings.ai_platform_timeout_seconds,
+            service_key=settings.ai_platform_service_key or None,
+        ) as client:
+            return client.create_model_job_quality_review(
+                job_id,
+                request,
+                context=_ai_request_context(tenant_id=tenant_id),
+            )
+
+    @app.get(
+        f"{settings.api_prefix}/admin/model-jobs/{{job_id}}/quality-reviews",
+        response_model=list[ModelJobQualityReview],
+        tags=["admin", "model-jobs"],
+    )
+    def list_model_job_quality_reviews(
+        job_id: str,
+        tenant_id: str | None = Query(default=None, pattern=r"^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$"),
+    ) -> list[ModelJobQualityReview]:
+        _require_platform_administrator(repository)
+        with AiPlatformClient(
+            settings.ai_platform_base_url,
+            timeout=settings.ai_platform_timeout_seconds,
+            service_key=settings.ai_platform_service_key or None,
+        ) as client:
+            return client.list_model_job_quality_reviews(
+                job_id,
+                context=_ai_request_context(tenant_id=tenant_id),
             )
 
 
-def _ai_request_context() -> RequestContext:
+def _ai_request_context(*, tenant_id: str | None = None) -> RequestContext:
     return RequestContext(
-        tenant_id=get_request_tenant_id() or "default",
+        tenant_id=(tenant_id or "").strip() or get_request_tenant_id() or "default",
         user_id=get_user_context() or "contract-api",
     )
 
diff --git a/yuqei-contract-platform/services/contract-api/tests/test_legal_qa_proxy.py b/yuqei-contract-platform/services/contract-api/tests/test_legal_qa_proxy.py
index f5b9adb1..6d37120a 100644
--- a/yuqei-contract-platform/services/contract-api/tests/test_legal_qa_proxy.py
+++ b/yuqei-contract-platform/services/contract-api/tests/test_legal_qa_proxy.py
@@ -109,13 +109,30 @@ def test_contract_api_proxies_legal_qa_job_lifecycle(monkeypatch) -> None:
     def handler(request: httpx.Request) -> httpx.Response:
         nonlocal captured_idempotency_key
         captured_paths.append((request.method, request.url.path))
-        assert request.headers["x-tenant-id"] in {"tenant-qa", "default"}
+        assert request.headers["x-tenant-id"] in {"tenant-qa", "default", "controlled-pilot-v1"}
         if request.url.path.endswith("/legal/qa/jobs"):
             captured_idempotency_key = request.headers.get("idempotency-key")
             return httpx.Response(202, json=job_payload("queued", progress=0))
         if request.url.path.endswith("/model-jobs/history"):
             return httpx.Response(200, json={"items": [job_payload("running", progress=35)], "next_cursor": None, "has_more": False})
+        if request.url.path.endswith("/model-jobs/review-queue"):
+            assert request.headers["x-tenant-id"] == "controlled-pilot-v1"
+            return httpx.Response(200, json=[job_payload("awaiting_human", progress=100)])
+        if request.url.path.endswith("/quality-reviews") and request.method == "POST":
+            assert request.headers["x-tenant-id"] == "controlled-pilot-v1"
+            return httpx.Response(200, json={
+                "id": "model-review-proxy-1", "tenant_id": "default", "job_id": "model-job-proxy-1",
+                "review_trigger": "high_risk", "reviewer_id": "user-current-admin",
+                "legal_fact_consistency": "pass", "citation_verifiability": "uncertain",
+                "high_risk_omission": "not_detected", "disposition": "accepted",
+                "feedback_text": "已完�人工抽检。", "quality_gate_version": "model-job-v1",
+                "created_at": "2026-08-26T00:10:00Z",
+            })
+        if request.url.path.endswith("/quality-reviews") and request.method == "GET":
+            return httpx.Response(200, json=[])
         if request.url.path.endswith("/model-jobs/operations"):
+            assert request.headers["x-tenant-id"] == "controlled-pilot-v1"
+            assert request.url.params["evaluation_run_id"] == "stratified-v1"
             return httpx.Response(200, json={
                 "metrics": {
                     "window_hours": 168, "total": 1, "queued": 0, "running": 1, "succeeded": 0,
@@ -129,6 +146,13 @@ def test_contract_api_proxies_legal_qa_job_lifecycle(monkeypatch) -> None:
                 "remaining_sample_count": 30, "baseline_ready": False,
                 "quality_passed": 0, "quality_needs_review": 0, "quality_failed": 0,
                 "quality_pass_rate": 0,
+                "review_required": 0, "review_completed": 0,
+                "admission": {
+                    "running": 1, "queued": 0, "tenant_active_limit": 10, "user_active_limit": 3,
+                    "tenant_queue_limit": 25, "active_saturation_rate": 0.1,
+                    "queue_saturation_rate": 0, "accepting_submissions": True,
+                },
+                "quality_segments": [],
             })
         if request.url.path.endswith("/cancel"):
             return httpx.Response(200, json=job_payload("cancelled", progress=100))
@@ -172,9 +196,24 @@ def test_contract_api_proxies_legal_qa_job_lifecycle(monkeypatch) -> None:
         json={"reason": "模型未�功，需�人工�核。"},
     )
     operations = client.get(
-        "/api/v1/admin/model-jobs/operations",
+        "/api/v1/admin/model-jobs/operations?tenant_id=controlled-pilot-v1&evaluation_run_id=stratified-v1",
         headers={"X-Tenant-Id": "default", "X-User-Id": "user-current-admin"},
     )
+    review_queue = client.get(
+        "/api/v1/admin/model-jobs/review-queue?tenant_id=controlled-pilot-v1",
+        headers={"X-Tenant-Id": "default", "X-User-Id": "user-current-admin"},
+    )
+    review = client.post(
+        "/api/v1/admin/model-jobs/model-job-proxy-1/quality-reviews?tenant_id=controlled-pilot-v1",
+        headers={"X-Tenant-Id": "default", "X-User-Id": "user-current-admin"},
+        json={
+            "legal_fact_consistency": "pass",
+            "citation_verifiability": "uncertain",
+            "high_risk_omission": "not_detected",
+            "disposition": "accepted",
+            "feedback_text": "已完�人工抽检。",
+        },
+    )
 
     assert created.status_code == 202
     assert history.json()["items"][0]["status"] == "running"
@@ -184,6 +223,8 @@ def test_contract_api_proxies_legal_qa_job_lifecycle(monkeypatch) -> None:
     assert handed_off.json()["status"] == "awaiting_human"
     assert operations.status_code == 200
     assert operations.json()["remaining_sample_count"] == 30
+    assert review_queue.json()[0]["status"] == "awaiting_human"
+    assert review.json()["reviewer_id"] == "user-current-admin"
     assert captured_idempotency_key == "proxy-submit-1"
     assert captured_paths == [
         ("POST", "/api/v1/legal/qa/jobs"),
@@ -193,4 +234,6 @@ def test_contract_api_proxies_legal_qa_job_lifecycle(monkeypatch) -> None:
         ("POST", "/api/v1/model-jobs/model-job-proxy-1/retry"),
         ("POST", "/api/v1/model-jobs/model-job-proxy-1/handoff"),
         ("GET", "/api/v1/model-jobs/operations"),
+        ("GET", "/api/v1/model-jobs/review-queue"),
+        ("POST", "/api/v1/model-jobs/model-job-proxy-1/quality-reviews"),
     ]
diff --git a/yuqei-infra/README.md b/yuqei-infra/README.md
index f1d5b4ff..e4af54f7 100644
--- a/yuqei-infra/README.md
+++ b/yuqei-infra/README.md
@@ -138,6 +138,23 @@ requirement. JSON and Markdown evidence is written under
 `.runtime/model-job-quality-baseline` and is intentionally excluded from source
 control.
 
+For the controlled-pilot capacity and stratified quality gate, plan the fixed
+100-case suite first, then execute it only against an isolated tenant with up
+to ten current-code model workers:
+
+```powershell
+python yuqei-infra\scripts\run-controlled-pilot-stratified-quality.py
+python yuqei-infra\scripts\run-controlled-pilot-stratified-quality.py `
+  --execute `
+  --base-url http://127.0.0.1:8101 `
+  --run-id stratified-v1-20260826
+```
+
+The runner covers ten contract types with ten cases each, runs 1/3/5/10
+concurrency waves, retries only Provider failures or fallback, and leaves
+high-risk or sampled outputs in the auditable human-review queue. Its ignored
+artifact contains metrics and identifiers only, not question or answer text.
+
 After a named legal reviewer signs the exact `collect` output, the `finalize`
 step validates that package, registers it in shared staging, fetches the
 server-normalized receipt payload, and signs receipt v2 with a CI-held Ed25519 key:
diff --git a/yuqei-infra/scripts/run-controlled-pilot-stratified-quality.py b/yuqei-infra/scripts/run-controlled-pilot-stratified-quality.py
new file mode 100644
index 00000000..3e6b7bf9
--- /dev/null
+++ b/yuqei-infra/scripts/run-controlled-pilot-stratified-quality.py
@@ -0,0 +1,439 @@
+#!/usr/bin/env python3
+"""Run a resumable 100-case stratified quality baseline and 1/3/5/10 capacity waves."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import time
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from dataclasses import dataclass
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import Any
+from urllib.error import HTTPError, URLError
+from urllib.parse import urlparse
+from urllib.request import Request, urlopen
+
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+DEFAULT_OUTPUT_DIR = REPO_ROOT / ".runtime" / "controlled-pilot-stratified-quality"
+TERMINAL_STATUSES = {"succeeded", "fallback", "failed", "awaiting_human", "resolved", "cancelled"}
+RETRYABLE_EXECUTION_STATUSES = {"fallback", "failed"}
+SAFE_ID = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$")
+CAPACITY_STEPS = (1, 3, 5, 10)
+
+
+@dataclass(frozen=True)
+class StratifiedCase:
+    case_id: str
+    contract_type: str
+    risk_level: str
+    industry: str
+    question: str
+    matter_context: str
+
+
+TYPE_SCENARIOS = {
+    "purchase": ("采购��", "manufacturing", "首次�作供应商�求高�预付款，验收�交付和分包�件��完整"),
+    "sales": ("销售��", "retail", "客户�求赊销和分期付款，产�质�异议�退�货�径尚未统一"),
+    "employment": ("劳动��", "general", "岗�涉��密信�和绩效考核，工作地点�培训�离�义务需�明确"),
+    "lease": ("租���", "retail", "办公或��场地需�装修，许��维修�押金和��解约安排尚未确定"),
+    "confidentiality": ("�密�议", "technology", "�作方将接触�代��客户信�和长期形�的工艺秘密"),
+    "software": ("软件�务��", "technology", "核心SaaS系统涉��用性�数�处��开�组件和�续�级"),
+    "construction": ("建设工程��", "construction", "项目存在工程�更��料涨价�分包�工期和结算审计风险"),
+    "data_processing": ("数�处��议", "technology", "�务商处�个人信�并使用分包商和多地域备份"),
+    "equity": ("股�交易��", "finance", "交易涉�分期付款�先决�件�历�担�和交割�责任"),
+    "transport": ("�输��", "logistics", "货物�过中转和分包�输，签收�货��异常��规则�清"),
+}
+
+FOCUS_PROMPTS = (
+    ("high", "该场景最�能被��的三项�大风险是什么，应设置哪些阻断性�款？"),
+    ("medium", "如何把验收�异议期�和��留存写��执行�款？"),
+    ("low", "通知��达和�系人�更机制应如何约定�便于日常执行？"),
+    ("medium", "付款�件��票和结算争议应如何形�闭环？"),
+    ("high", "�生严��约或�规事件时，暂�履行和解除�应如何设置？"),
+    ("medium", "第三方或分包商�与履行时，责任和审计�应如何安排？"),
+    ("low", "��文件优先顺�和�更�程应如何约定？"),
+    ("high", "责任�制��约金和实际�失之间应如何平衡并��无效风险？"),
+    ("medium", "��终止�的返还�删除�交接和�续义务应如何衔接？"),
+    ("high", "争议�生�，为��事实和引用�核验，应���留哪些�料？"),
+)
+
+
+def build_stratified_cases() -> list[StratifiedCase]:
+    cases: list[StratifiedCase] = []
+    for contract_type, (label, industry, context) in TYPE_SCENARIOS.items():
+        for index, (risk_level, focus) in enumerate(FOCUS_PROMPTS, 1):
+            cases.append(
+                StratifiedCase(
+                    case_id=f"{contract_type}-{index:02d}",
+                    contract_type=contract_type,
+                    risk_level=risk_level,
+                    industry=industry,
+                    question=f"对于{label}，{focus}",
+                    matter_context=context,
+                )
+            )
+    return cases
+
+
+STRATIFIED_CASES = build_stratified_cases()
+
+
+class ApiRequestError(RuntimeError):
+    def __init__(self, status_code: int, detail: str, retry_after: int = 0) -> None:
+        super().__init__(f"HTTP {status_code}: {detail}")
+        self.status_code = status_code
+        self.retry_after = retry_after
+
+
+class PilotApiClient:
+    def __init__(self, base_url: str, *, tenant_id: str, user_id: str, service_key: str = "", timeout: float = 30) -> None:
+        parsed = urlparse(base_url)
+        if parsed.scheme not in {"http", "https"} or not parsed.hostname or parsed.username or parsed.password:
+            raise ValueError("base URL must be an HTTP(S) origin without embedded credentials")
+        if not SAFE_ID.fullmatch(tenant_id) or not SAFE_ID.fullmatch(user_id):
+            raise ValueError("tenant and user IDs contain unsupported characters")
+        self.base_url = base_url.rstrip("/")
+        self.timeout = timeout
+        self.headers = {
+            "Accept": "application/json",
+            "Content-Type": "application/json",
+            "X-Tenant-Id": tenant_id,
+            "X-User-Id": user_id,
+        }
+        if service_key:
+            self.headers["X-AI-Platform-Service-Key"] = service_key
+
+    def get(self, path: str) -> dict[str, Any]:
+        return self._request("GET", path, None, {})
+
+    def post(self, path: str, payload: dict[str, Any], *, extra_headers: dict[str, str] | None = None) -> dict[str, Any]:
+        return self._request("POST", path, payload, extra_headers or {})
+
+    def _request(self, method: str, path: str, payload: dict[str, Any] | None, extra_headers: dict[str, str]) -> dict[str, Any]:
+        request = Request(
+            f"{self.base_url}{path}",
+            method=method,
+            headers={**self.headers, **extra_headers},
+            data=json.dumps(payload, ensure_ascii=False).encode("utf-8") if payload is not None else None,
+        )
+        try:
+            with urlopen(request, timeout=self.timeout) as response:  # nosec B310
+                result = json.loads(response.read(5 * 1024 * 1024).decode("utf-8"))
+        except HTTPError as error:
+            detail = error.read(4096).decode("utf-8", errors="replace")
+            retry_after = int(error.headers.get("Retry-After", "0") or 0)
+            raise ApiRequestError(error.code, detail, retry_after) from error
+        except (URLError, TimeoutError) as error:
+            raise RuntimeError(f"request failed: {error.reason if isinstance(error, URLError) else error}") from error
+        if not isinstance(result, dict):
+            raise RuntimeError("API response must be a JSON object")
+        return result
+
+
+def run_controlled_pilot(
+    client_factory,
+    *,
+    cases: list[StratifiedCase],
+    run_id: str,
+    capacity_steps: tuple[int, ...] = CAPACITY_STEPS,
+    quality_concurrency: int = 10,
+    poll_seconds: float = 3,
+    timeout_seconds: float = 4 * 60 * 60,
+    retry_limit: int = 1,
+) -> dict[str, Any]:
+    if len(cases) < 100:
+        raise ValueError("controlled pilot requires at least 100 stratified cases")
+    if not SAFE_ID.fullmatch(run_id):
+        raise ValueError("run ID contains unsupported characters")
+    if any(step not in {1, 3, 5, 10} for step in capacity_steps):
+        raise ValueError("capacity steps must be selected from 1, 3, 5, and 10")
+    cursor = 0
+    jobs: dict[str, dict[str, Any]] = {}
+    capacity_waves: list[dict[str, Any]] = []
+    for step in capacity_steps:
+        selected = cases[cursor:cursor + step]
+        cursor += len(selected)
+        wave = _run_wave(
+            client_factory,
+            cases=selected,
+            run_id=run_id,
+            concurrency=step,
+            poll_seconds=poll_seconds,
+            timeout_seconds=timeout_seconds,
+            retry_limit=retry_limit,
+        )
+        jobs.update(wave.pop("jobs"))
+        capacity_waves.append(wave)
+        print(json.dumps({"event": "capacity_wave_completed", **wave}, ensure_ascii=False), flush=True)
+    remaining = cases[cursor:]
+    batch_size = max(1, min(quality_concurrency, 10))
+    for offset in range(0, len(remaining), batch_size):
+        wave = _run_wave(
+            client_factory,
+            cases=remaining[offset:offset + batch_size],
+            run_id=run_id,
+            concurrency=min(batch_size, len(remaining[offset:offset + batch_size])),
+            poll_seconds=poll_seconds,
+            timeout_seconds=timeout_seconds,
+            retry_limit=retry_limit,
+        )
+        jobs.update(wave.pop("jobs"))
+        print(
+            json.dumps(
+                {
+                    "event": "quality_batch_completed",
+                    "completed_cases": min(offset + batch_size + cursor, len(cases)),
+                    "target_cases": len(cases),
+                },
+                ensure_ascii=False,
+            ),
+            flush=True,
+        )
+
+    rows = [_result_row(case.case_id, jobs[case.case_id]) for case in cases if case.case_id in jobs]
+    eligible = [row for row in rows if row["eligible_real_sample"]]
+    segments = _segment_rows(eligible)
+    contract_segments = [row for row in segments if row["dimension"] == "contract_type"]
+    quality_passed = sum(row["quality_status"] == "passed" for row in eligible)
+    acceptance = {
+        "at_least_100_real_samples": len(eligible) >= 100,
+        "ten_contract_types_with_ten_samples": len(contract_segments) >= 10 and all(row["sample_count"] >= 10 for row in contract_segments),
+        "overall_quality_pass_rate_at_least_80_percent": quality_passed / max(len(eligible), 1) >= 0.80,
+        "each_contract_type_pass_rate_at_least_70_percent": bool(contract_segments) and all(row["quality_pass_rate"] >= 0.70 for row in contract_segments),
+        "execution_latency_p95_at_most_3_minutes": _percentile([row["execution_latency_ms"] for row in eligible], 0.95) <= 180_000,
+        "capacity_wave_10_has_no_admission_rejection": any(wave["concurrency"] == 10 and wave["admission_rejections"] == 0 for wave in capacity_waves),
+    }
+    return {
+        "schema_version": "controlled-pilot-stratified-quality-v1",
+        "run_id": run_id,
+        "generated_at": datetime.now(UTC).astimezone().isoformat(),
+        "submitted_count": len(rows),
+        "eligible_real_sample_count": len(eligible),
+        "quality_passed": quality_passed,
+        "quality_needs_review": sum(row["quality_status"] == "needs_review" for row in eligible),
+        "quality_failed": sum(row["quality_status"] == "failed" for row in eligible),
+        "quality_pass_rate": round(quality_passed / max(len(eligible), 1), 4),
+        "review_required": sum(row["review_status"] in {"required", "completed"} for row in eligible),
+        "review_completed": sum(row["review_status"] == "completed" for row in eligible),
+        "queue_latency_p50_ms": _percentile([row["queue_latency_ms"] for row in eligible], 0.50),
+        "queue_latency_p95_ms": _percentile([row["queue_latency_ms"] for row in eligible], 0.95),
+        "execution_latency_p50_ms": _percentile([row["execution_latency_ms"] for row in eligible], 0.50),
+        "execution_latency_p95_ms": _percentile([row["execution_latency_ms"] for row in eligible], 0.95),
+        "total_latency_p50_ms": _percentile([row["total_latency_ms"] for row in eligible], 0.50),
+        "total_latency_p95_ms": _percentile([row["total_latency_ms"] for row in eligible], 0.95),
+        "capacity_waves": capacity_waves,
+        "segments": segments,
+        "acceptance": acceptance,
+        "passed": all(acceptance.values()),
+        "samples": rows,
+    }
+
+
+def _run_wave(
+    client_factory,
+    *,
+    cases: list[StratifiedCase],
+    run_id: str,
+    concurrency: int,
+    poll_seconds: float,
+    timeout_seconds: float,
+    retry_limit: int,
+) -> dict[str, Any]:
+    started = time.monotonic()
+    jobs: dict[str, dict[str, Any]] = {}
+    admission_rejections = 0
+
+    def submit(index_and_case: tuple[int, StratifiedCase]) -> tuple[StratifiedCase, dict[str, Any], int]:
+        index, case = index_and_case
+        client = client_factory(f"pilot-runner-{index % 20 + 1:02d}")
+        headers = {
+            "Idempotency-Key": f"{run_id}-{case.case_id}",
+            "X-Evaluation-Run-Id": run_id,
+            "X-Evaluation-Case-Id": case.case_id,
+            "X-Evaluation-Contract-Type": case.contract_type,
+            "X-Evaluation-Risk-Level": case.risk_level,
+            "X-Evaluation-Industry": case.industry,
+        }
+        rejected = 0
+        for attempt in range(4):
+            try:
+                job = client.post(
+                    "/api/v1/legal/qa/jobs",
+                    {"question": case.question, "matter_context": case.matter_context, "retrieval_strategy": "hybrid"},
+                    extra_headers=headers,
+                )
+                return case, job, rejected
+            except ApiRequestError as error:
+                if error.status_code != 429 or attempt >= 3:
+                    raise
+                rejected += 1
+                time.sleep(max(1, error.retry_after))
+        raise RuntimeError("unreachable admission retry state")
+
+    with ThreadPoolExecutor(max_workers=max(1, concurrency)) as executor:
+        futures = [executor.submit(submit, item) for item in enumerate(cases)]
+        for future in as_completed(futures):
+            case, job, rejected = future.result()
+            admission_rejections += rejected
+            jobs[case.case_id] = {"case": case, "job": job, "retries": 0}
+
+    deadline = time.monotonic() + timeout_seconds
+    pending = set(jobs)
+    poll_client = client_factory("pilot-operations")
+    while pending:
+        for case_id in list(pending):
+            entry = jobs[case_id]
+            job = poll_client.get(f"/api/v1/model-jobs/{entry['job']['id']}")
+            entry["job"] = job
+            if job.get("status") not in TERMINAL_STATUSES:
+                continue
+            if job.get("status") in RETRYABLE_EXECUTION_STATUSES and job.get("retryable") is True and entry["retries"] < retry_limit:
+                entry["job"] = poll_client.post(
+                    f"/api/v1/model-jobs/{job['id']}/retry",
+                    {"triggered_by": "controlled-pilot", "reason": "One controlled provider retry."},
+                )
+                entry["retries"] += 1
+                continue
+            pending.remove(case_id)
+        if pending:
+            if time.monotonic() >= deadline:
+                raise TimeoutError(f"capacity wave timed out with {len(pending)} active jobs")
+            time.sleep(poll_seconds)
+    rows = [_result_row(case_id, entry) for case_id, entry in jobs.items()]
+    return {
+        "concurrency": concurrency,
+        "submitted": len(cases),
+        "admission_rejections": admission_rejections,
+        "wall_time_ms": int((time.monotonic() - started) * 1000),
+        "queue_latency_p50_ms": _percentile([row["queue_latency_ms"] for row in rows], 0.50),
+        "queue_latency_p95_ms": _percentile([row["queue_latency_ms"] for row in rows], 0.95),
+        "execution_latency_p50_ms": _percentile([row["execution_latency_ms"] for row in rows], 0.50),
+        "execution_latency_p95_ms": _percentile([row["execution_latency_ms"] for row in rows], 0.95),
+        "jobs": jobs,
+    }
+
+
+def _result_row(case_id: str, entry: dict[str, Any]) -> dict[str, Any]:
+    case: StratifiedCase = entry["case"]
+    job: dict[str, Any] = entry["job"]
+    result = job.get("result") if isinstance(job.get("result"), dict) else {}
+    provider_real = job.get("provider_status") == "succeeded"
+    quality_evaluated = job.get("quality_status") in {"passed", "needs_review", "failed"}
+    return {
+        "case_id": case_id,
+        "contract_type": case.contract_type,
+        "risk_level": case.risk_level,
+        "industry": case.industry,
+        "job_id": job.get("id"),
+        "audit_run_id": job.get("audit_run_id"),
+        "status": job.get("status"),
+        "provider_status": job.get("provider_status"),
+        "quality_status": job.get("quality_status"),
+        "quality_score": job.get("quality_score", 0),
+        "review_status": job.get("review_status", "not_required"),
+        "review_trigger": job.get("review_trigger"),
+        "answer_character_count": len(str(result.get("answer") or result.get("summary") or "")),
+        "citation_count": len(result.get("citations") or []),
+        "attempt_count": job.get("attempt_count", 0),
+        "controlled_retries": entry.get("retries", 0),
+        "queue_latency_ms": int(job.get("queue_latency_ms") or 0),
+        "execution_latency_ms": int(job.get("execution_latency_ms") or 0),
+        "total_latency_ms": int(job.get("total_latency_ms") or 0),
+        "eligible_real_sample": provider_real and quality_evaluated,
+    }
+
+
+def _segment_rows(rows: list[dict[str, Any]]) -> list[dict[str, Any]]:
+    result: list[dict[str, Any]] = []
+    for dimension in ("contract_type", "risk_level", "industry"):
+        for value in sorted({str(row[dimension]) for row in rows}):
+            selected = [row for row in rows if row[dimension] == value]
+            passed = sum(row["quality_status"] == "passed" for row in selected)
+            result.append({
+                "dimension": dimension,
+                "value": value,
+                "sample_count": len(selected),
+                "quality_passed": passed,
+                "quality_needs_review": sum(row["quality_status"] == "needs_review" for row in selected),
+                "quality_failed": sum(row["quality_status"] == "failed" for row in selected),
+                "review_required": sum(row["review_status"] in {"required", "completed"} for row in selected),
+                "review_completed": sum(row["review_status"] == "completed" for row in selected),
+                "quality_pass_rate": round(passed / max(len(selected), 1), 4),
+            })
+    return result
+
+
+def _percentile(values: list[int], percentile: float) -> int:
+    normalized = sorted(value for value in values if value >= 0)
+    if not normalized:
+        return 0
+    return normalized[round((len(normalized) - 1) * percentile)]
+
+
+def write_artifacts(report: dict[str, Any], output_dir: Path) -> tuple[Path, Path]:
+    output_dir.mkdir(parents=True, exist_ok=True)
+    stamp = datetime.now(UTC).strftime("%Y%m%dT%H%M%SZ")
+    base = output_dir / f"{report['run_id']}-{stamp}"
+    json_path = base.with_suffix(".json")
+    markdown_path = base.with_suffix(".md")
+    json_path.write_text(json.dumps(report, ensure_ascii=False, indent=2), encoding="utf-8")
+    lines = [
+        "# �控试点容�与分层质�评测", "", f"- �行 ID：`{report['run_id']}`",
+        f"- 真实 Provider 样本：{report['eligible_real_sample_count']} / {report['submitted_count']}",
+        f"- 自动质�通过率：{report['quality_pass_rate']:.1%}",
+        f"- �求人工抽检：{report['review_required']}，已完�：{report['review_completed']}",
+        f"- 执行 P50 / P95：{report['execution_latency_p50_ms']} / {report['execution_latency_p95_ms']} ms",
+        f"- 排队 P50 / P95：{report['queue_latency_p50_ms']} / {report['queue_latency_p95_ms']} ms",
+        f"- 总体门�：{'通过' if report['passed'] else '未通过'}", "", "## 并�阶梯", "",
+        "| 并� | �交 | 准入�试 | 排队 P95 | 执行 P95 | 波次耗时 |", "| ---: | ---: | ---: | ---: | ---: | ---: |",
+    ]
+    for wave in report["capacity_waves"]:
+        lines.append(f"| {wave['concurrency']} | {wave['submitted']} | {wave['admission_rejections']} | {wave['queue_latency_p95_ms']} ms | {wave['execution_latency_p95_ms']} ms | {wave['wall_time_ms']} ms |")
+    lines.extend(["", "## 分层结果", "", "| 维度 | 分层 | 样本 | 通过率 | 抽检完�/�求 |", "| --- | --- | ---: | ---: | ---: |"])
+    for row in report["segments"]:
+        lines.append(f"| {row['dimension']} | {row['value']} | {row['sample_count']} | {row['quality_pass_rate']:.1%} | {row['review_completed']}/{row['review_required']} |")
+    markdown_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+    return json_path, markdown_path
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--execute", action="store_true", help="Submit real model jobs; otherwise print the plan.")
+    parser.add_argument("--base-url", default="http://127.0.0.1:8101")
+    parser.add_argument("--tenant-id", default="controlled-pilot-v1")
+    parser.add_argument("--run-id", default=f"stratified-v1-{datetime.now().strftime('%Y%m%d')}")
+    parser.add_argument("--service-key", default=os.getenv("AI_PLATFORM_SERVICE_SHARED_SECRET", ""))
+    parser.add_argument("--quality-concurrency", type=int, default=10)
+    parser.add_argument("--poll-seconds", type=float, default=3)
+    parser.add_argument("--timeout-seconds", type=float, default=4 * 60 * 60)
+    parser.add_argument("--retry-limit", type=int, default=1)
+    parser.add_argument("--output-dir", type=Path, default=DEFAULT_OUTPUT_DIR)
+    return parser.parse_args()
+
+
+def main() -> int:
+    args = parse_args()
+    if not args.execute:
+        print(json.dumps({"mode": "plan", "case_count": len(STRATIFIED_CASES), "contract_types": sorted(TYPE_SCENARIOS), "capacity_steps": CAPACITY_STEPS, "run_id": args.run_id}, ensure_ascii=False))
+        return 0
+
+    def client_factory(user_id: str) -> PilotApiClient:
+        return PilotApiClient(args.base_url, tenant_id=args.tenant_id, user_id=user_id, service_key=args.service_key)
+
+    report = run_controlled_pilot(
+        client_factory, cases=STRATIFIED_CASES, run_id=args.run_id,
+        quality_concurrency=args.quality_concurrency, poll_seconds=args.poll_seconds,
+        timeout_seconds=args.timeout_seconds, retry_limit=args.retry_limit,
+    )
+    json_path, markdown_path = write_artifacts(report, args.output_dir)
+    print(json.dumps({"passed": report["passed"], "json": str(json_path), "markdown": str(markdown_path)}, ensure_ascii=False))
+    return 0 if report["passed"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/yuqei-infra/tests/test_controlled_pilot_stratified_quality.py b/yuqei-infra/tests/test_controlled_pilot_stratified_quality.py
new file mode 100644
index 00000000..eecdfb3b
--- /dev/null
+++ b/yuqei-infra/tests/test_controlled_pilot_stratified_quality.py
@@ -0,0 +1,81 @@
+from __future__ import annotations
+
+import importlib.util
+import sys
+from collections import Counter
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+SCRIPT_PATH = REPO_ROOT / "yuqei-infra" / "scripts" / "run-controlled-pilot-stratified-quality.py"
+SPEC = importlib.util.spec_from_file_location("controlled_pilot_stratified_quality", SCRIPT_PATH)
+assert SPEC and SPEC.loader
+pilot = importlib.util.module_from_spec(SPEC)
+sys.modules[SPEC.name] = pilot
+SPEC.loader.exec_module(pilot)
+
+
+class FakeClient:
+    def __init__(self, jobs: dict[str, dict]) -> None:
+        self.jobs = jobs
+
+    def post(self, path: str, payload: dict, *, extra_headers: dict[str, str] | None = None) -> dict:
+        if path.endswith("/retry"):
+            return self.jobs[path.split("/")[-2]]
+        headers = extra_headers or {}
+        case_id = headers["X-Evaluation-Case-Id"]
+        review_required = headers["X-Evaluation-Risk-Level"] == "high"
+        job = {
+            "id": f"job-{case_id}", "status": "awaiting_human" if review_required else "succeeded",
+            "provider_status": "succeeded", "quality_status": "passed", "quality_score": 100,
+            "review_status": "required" if review_required else "not_required",
+            "review_trigger": "high_risk" if review_required else None,
+            "retryable": False, "attempt_count": 1, "audit_run_id": f"audit-{case_id}",
+            "queue_latency_ms": 10, "execution_latency_ms": 1000, "total_latency_ms": 1010,
+            "result": {"answer": "包�充分分��风险�示和修改建议的测试回答。" * 4, "citations": [{"title": "民法典"}]},
+        }
+        self.jobs[job["id"]] = job
+        return job
+
+    def get(self, path: str) -> dict:
+        return self.jobs[path.rsplit("/", 1)[-1]]
+
+
+def test_stratified_library_has_one_hundred_balanced_cases() -> None:
+    cases = pilot.STRATIFIED_CASES
+    assert len(cases) == 100
+    assert len({case.case_id for case in cases}) == 100
+    counts = Counter(case.contract_type for case in cases)
+    assert len(counts) == 10
+    assert set(counts.values()) == {10}
+    assert {case.risk_level for case in cases} == {"low", "medium", "high"}
+    assert all(case.question and case.matter_context and case.industry for case in cases)
+
+
+def test_controlled_pilot_passes_balanced_real_provider_fixture() -> None:
+    jobs: dict[str, dict] = {}
+    report = pilot.run_controlled_pilot(
+        lambda _user_id: FakeClient(jobs), cases=pilot.STRATIFIED_CASES,
+        run_id="stratified-test-v1", poll_seconds=0, timeout_seconds=1, retry_limit=0,
+    )
+    assert report["submitted_count"] == 100
+    assert report["eligible_real_sample_count"] == 100
+    assert report["quality_pass_rate"] == 1.0
+    assert report["execution_latency_p95_ms"] == 1000
+    assert report["review_required"] > 0
+    assert report["passed"] is True
+
+
+def test_artifacts_do_not_store_questions_or_model_answer_text(tmp_path: Path) -> None:
+    report = {
+        "run_id": "safe-artifact-v1", "eligible_real_sample_count": 100, "submitted_count": 100,
+        "quality_pass_rate": 1.0, "review_required": 30, "review_completed": 0,
+        "execution_latency_p50_ms": 1000, "execution_latency_p95_ms": 1100,
+        "queue_latency_p50_ms": 10, "queue_latency_p95_ms": 20, "passed": True,
+        "capacity_waves": [], "segments": [], "samples": [{"case_id": "purchase-01", "answer_character_count": 100}],
+    }
+    json_path, _markdown_path = pilot.write_artifacts(report, tmp_path)
+    content = json_path.read_text(encoding="utf-8")
+    assert "question" not in content
+    assert "matter_context" not in content
+    assert "answer\"" not in content