refactor(core): align with cordis spatiotemporal composability architecture

- Purify core micro-kernel by removing context hardcoded helpers and reverse dependencies
- Eliminate init() side effects in infra plugins with reversible lifecycle disposal
- Completely isolate plugins by removing cross-plugin imports and using core/contracts
- Introduce TaskService and RiskControlService contracts for unified cross-plugin APIs
- Regenerate Swagger documentation and update developer guide matrix
- Achieve 0 violations in check_cordis_architecture.sh and 100% test pass

backend/core/context.go

@@ -10,7 +10,6 @@ import (
 	"sync"
 	"time"
 
-	"Wavelet/core/contracts"
 	"Wavelet/core/extpoints"
 )
 
@@ -237,24 +236,6 @@ func (c *Context) Setting() extpoints.SettingExtension {
 	return c.Settings()
 }
 
-// DB returns the contracts.DBService registered in the IoC container, or nil if not registered.
-func (c *Context) DB() contracts.DBService {
-	svc, err := Inject[contracts.DBService](c)
-	if err != nil {
-		return nil
-	}
-	return svc
-}
-
-// Cache returns the contracts.CacheService registered in the IoC container, or nil if not registered.
-func (c *Context) Cache() contracts.CacheService {
-	svc, err := Inject[contracts.CacheService](c)
-	if err != nil {
-		return nil
-	}
-	return svc
-}
-
 // OnDispose registers a cleanup callback function to be executed when this Context is disposed.
 // It accepts func() error, func(), or Disposer.
 func (c *Context) OnDispose(fn any) {

backend/core/contracts/events.go

@@ -44,6 +44,25 @@ const (
 	EventTopicSystemCleanup = "admin:system_cleanup"
 )
 
+// --- Task Events ---
+const (
+	// EventTopicTaskCompleted fires when an asynchronous background task execution finishes.
+	EventTopicTaskCompleted = "task:completed"
+)
+
+// TaskCompletedEvent carries task execution outcome details.
+type TaskCompletedEvent struct {
+	TaskID    string `json:"task_id"`
+	TaskName  string `json:"task_name"`
+	TaskType  string `json:"task_type"`
+	Status    string `json:"status"`
+	Duration  int64  `json:"duration"`
+	ErrorMsg  string `json:"error_msg,omitempty"`
+	ResultMsg string `json:"result_msg,omitempty"`
+	Payload   string `json:"payload,omitempty"`
+	Detail    string `json:"detail,omitempty"`
+}
+
 // --- Upload / Storage Events ---
 const (
 	// EventTopicUploadCreated fires when a new file upload is recorded.

backend/core/contracts/risk_control.go

@@ -0,0 +1,66 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package contracts defines unified service interfaces and DTOs for cross-plugin communication.
+package contracts
+
+import (
+	"context"
+	"time"
+)
+
+// AccessLogFilterDTO defines filter criteria for querying user access logs.
+type AccessLogFilterDTO struct {
+	UserIDs   []uint64
+	Path      string
+	StartTime *time.Time
+	EndTime   *time.Time
+}
+
+// AccessLogDTO represents a single access log entry.
+type AccessLogDTO struct {
+	ID        uint64    `json:"id"`
+	UserID    uint64    `json:"user_id"`
+	IP        string    `json:"ip"`
+	UserAgent string    `json:"user_agent"`
+	Method    string    `json:"method"`
+	Path      string    `json:"path"`
+	Status    int32     `json:"status"`
+	Latency   int64     `json:"latency"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
+// AccessLogDailyStatsDTO represents aggregate access statistics for a single day.
+type AccessLogDailyStatsDTO struct {
+	Date         string `json:"date"`
+	PV           uint64 `json:"pv"`
+	UV           uint64 `json:"uv"`
+	IPCount      uint64 `json:"ip_count"`
+	ErrorCount   uint64 `json:"error_count"`
+	AvgLatencyMs int64  `json:"avg_latency_ms"`
+	SlowReqCount uint64 `json:"slow_req_count"`
+	MaxLatencyMs int64  `json:"max_latency_ms"`
+	P95LatencyMs int64  `json:"p95_latency_ms"`
+	P99LatencyMs int64  `json:"p99_latency_ms"`
+}
+
+// RiskControlService defines the contract for accessing security risk control and audit logstore.
+type RiskControlService interface {
+	// QueryAccessLogs retrieves paginated access logs matching the filter.
+	QueryAccessLogs(ctx context.Context, filter AccessLogFilterDTO, page, pageSize int) ([]AccessLogDTO, uint64, error)
+
+	// QueryAccessLogStats returns aggregate daily statistics for the last N days.
+	QueryAccessLogStats(ctx context.Context, days int) ([]AccessLogDailyStatsDTO, error)
+
+	// ActiveLogEngine returns the current active logstore engine name.
+	ActiveLogEngine(ctx context.Context) string
+
+	// IsLogEngineMigrating reports whether a log engine migration is in progress.
+	IsLogEngineMigrating(ctx context.Context) bool
+
+	// Drain flushes pending in-flight log buffers.
+	Drain(ctx context.Context) error
+
+	// SwitchLogEngine migrates and switches the active log storage engine.
+	SwitchLogEngine(ctx context.Context, targetEngine string) error
+}

backend/core/contracts/storage.go

@@ -46,6 +46,55 @@ type IngestResult struct {
 	Resolved bool
 }
 
+// StorageDriver identifies a supported storage backend.
+type StorageDriver string
+
+const (
+	StorageDriverLocal  StorageDriver = "local"
+	StorageDriverS3     StorageDriver = "s3"
+	StorageDriverR2     StorageDriver = "r2"
+	StorageDriverMinIO  StorageDriver = "minio"
+	StorageDriverOSS    StorageDriver = "oss"
+	StorageDriverWebDAV StorageDriver = "webdav"
+)
+
+// LocalStorageConfigDTO configures local filesystem storage.
+type LocalStorageConfigDTO struct {
+	Root string `json:"root"`
+}
+
+// ObjectStorageConfigDTO configures S3-compatible or OSS object storage.
+type ObjectStorageConfigDTO struct {
+	Endpoint        string `json:"endpoint"`
+	Region          string `json:"region"`
+	Bucket          string `json:"bucket"`
+	AccessKeyID     string `json:"access_key_id"`
+	SecretAccessKey string `json:"secret_access_key"`
+	AccountID       string `json:"account_id,omitempty"`
+	PathStyle       bool   `json:"path_style"`
+	KeyPrefix       string `json:"key_prefix"`
+	CDNURL          string `json:"cdn_url"`
+}
+
+// WebDAVStorageConfigDTO configures WebDAV storage.
+type WebDAVStorageConfigDTO struct {
+	URL      string `json:"url"`
+	Username string `json:"username"`
+	Password string `json:"password"`
+	Root     string `json:"root"`
+}
+
+// StorageConfigDTO encapsulates full storage configuration across all backends.
+type StorageConfigDTO struct {
+	Driver StorageDriver          `json:"driver"`
+	Local  LocalStorageConfigDTO  `json:"local"`
+	S3     ObjectStorageConfigDTO `json:"s3"`
+	R2     ObjectStorageConfigDTO `json:"r2"`
+	MinIO  ObjectStorageConfigDTO `json:"minio"`
+	OSS    ObjectStorageConfigDTO `json:"oss"`
+	WebDAV WebDAVStorageConfigDTO `json:"webdav"`
+}
+
 // StorageService defines the contract for unified object storage and managed file ingestion.
 type StorageService interface {
 	// Put writes an object to storage.

backend/core/contracts/task.go

@@ -0,0 +1,73 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package contracts defines unified service interfaces and DTOs for cross-plugin communication.
+package contracts
+
+import (
+	"context"
+	"time"
+)
+
+// TaskParamDTO describes a parameter accepted by a background task.
+type TaskParamDTO struct {
+	Name        string `json:"name"`
+	Type        string `json:"type"`
+	Description string `json:"description"`
+	Required    bool   `json:"required"`
+	Default     any    `json:"default,omitempty"`
+}
+
+// TaskMetaDTO describes the metadata and configuration of a registered background task.
+type TaskMetaDTO struct {
+	Name        string         `json:"name"`
+	DisplayName string         `json:"display_name"`
+	Description string         `json:"description"`
+	Category    string         `json:"category"`
+	Params      []TaskParamDTO `json:"params,omitempty"`
+	MaxRetry    int            `json:"max_retry"`
+	Timeout     time.Duration  `json:"timeout"`
+	Queue       string         `json:"queue"`
+	Schedule    string         `json:"schedule,omitempty"`
+}
+
+// TaskResultDTO represents the outcome of a background task execution.
+type TaskResultDTO struct {
+	Message string `json:"message"`
+	Detail  any    `json:"detail,omitempty"`
+}
+
+// TaskExecutionDTO represents a single task execution record.
+type TaskExecutionDTO struct {
+	ID           uint64     `json:"id,string"`
+	TaskID       string     `json:"task_id"`
+	TaskType     string     `json:"task_type"`
+	TaskName     string     `json:"task_name"`
+	Status       string     `json:"status"`
+	Retryable    bool       `json:"retryable"`
+	MaxRetry     int        `json:"max_retry"`
+	RetryCount   int        `json:"retry_count"`
+	Log          string     `json:"log"`
+	ErrorMessage string     `json:"error_message"`
+	Result       string     `json:"result"`
+	StartedAt    *time.Time `json:"started_at"`
+	FinishedAt   *time.Time `json:"finished_at"`
+	Duration     int64      `json:"duration"`
+	Payload      string     `json:"payload"`
+	TriggeredBy  string     `json:"triggered_by"`
+	CreatedAt    time.Time  `json:"created_at"`
+	UpdatedAt    time.Time  `json:"updated_at"`
+}
+
+// TaskService defines the unified contract for dispatching and tracking background tasks.
+type TaskService interface {
+	Dispatch(ctx context.Context, taskType string, payload []byte, triggeredBy string) (string, error)
+	Retry(ctx context.Context, id uint64) (string, error)
+	ListTasks() []TaskMetaDTO
+	GetTaskMeta(taskType string) (TaskMetaDTO, bool)
+	ValidatePayload(taskType string, payload []byte) ([]byte, error)
+	ReloadScheduler() error
+	AppendLog(ctx context.Context, format string, args ...any)
+	ListExecutions(ctx context.Context, taskType string, status string, page, pageSize int) ([]TaskExecutionDTO, int64, error)
+	GetExecution(ctx context.Context, id uint64) (*TaskExecutionDTO, error)
+}