受治理的能力演化：基于AI组件的系统的生命周期兼容性检查与回滚——以具身智能体为例
Governed Capability Evolution: Lifecycle-Time Compatibility Checking and Rollback for AI-Component-Based Systems, with a Proof-of-Concept Evaluation on Embodied Agents
AI总结：
针对基于AI组件的系统，提出一种受治理的能力演化框架，通过四类兼容性检查和七阶段升级管线实现安全部署，在具身智能体实验中实现零不安全激活。
摘要：
由版本化AI组件构建的软件系统越来越需要生命周期治理：当能力模块演化到新版本时，宿主系统必须决定新版本是否可以安全激活、应在何种部署条件下运行、如何监控以及何时回滚。现有的软件部署模式（金丝雀发布、蓝绿部署、特性标志和MLOps管线）解决了这一循环的部分问题，但它们是针对无状态Web服务而非驱动现场AI组件的带状态、策略约束运行时设计的。我们将受治理的能力演化形式化为基于AI组件的系统的一等软件生命周期问题，并提出一个分阶段升级框架，其中每个新能力版本被视为受治理的部署候选，而非立即可执行的替换。该框架引入了四类升级兼容性检查（接口、策略、行为、恢复），并将其组织成七阶段管线（候选验证、沙箱评估、影子部署、门控激活、在线监控、回滚、审计）。我们在带有ROS 2中间件的PyBullet操作测试平台上实现了参考原型，并在15个随机种子的6轮能力升级中进行了评估。朴素升级实现了72.9%的任务成功率，但到最后一轮不安全激活率升至60%；受治理升级保持了可比的成功率（67.4%），同时在所有轮次中保持零不安全激活（Wilcoxon p=0.003）。影子部署揭示了40%的升级回归问题，这些问题是单独沙箱评估无法发现的，并且在79.8%的激活后漂移场景中回滚成功。
英文摘要：
Systems built from versioned AI components need lifecycle-time governance over how a new module version is admitted, monitored, and withdrawn. Established deployment patterns (canary, blue-green, feature flags, MLOps) monitor aggregate service-level signals of stateless services, not the stateful, policy-constrained runtimes that drive AI components. We formulate governed capability evolution as a software-lifecycle problem and ask whether staged upgrade governance prevents unsafe activations where practice-adapted canary and blue-green deployment do not, and at what cost. We propose four compatibility checks (interface, policy, behavioral, recovery) and a seven-stage pipeline (validation, sandbox, shadow, gated activation, monitoring, rollback, audit). A reference prototype is evaluated in a behavioral simulation of an embodied manipulation stack; a PyBullet backend replicates the strategy ordering. Upgrade candidates come from a seeded fault-operator generator, including out-of-taxonomy probes, and thresholds are fixed on a disjoint development set. Across five strategies, five upgrade rounds and 15 seeds, naive upgrade reaches 73.3% final-round success but activates unsafe versions in 74.7% of rounds. Canary and blue-green adaptations keep comparable success yet still admit faulty versions in 61.3% and 64.0% of rounds, because aggregate success hides policy and recovery regressions. Governed upgrade admits no in-taxonomy fault and one out-of-taxonomy probe in 75 rounds, at a 4.6-point success cost (Holm-adjusted p<=0.024 against all three baselines); the full pre-activation stack detects 97.3-100% of in-taxonomy faults across deployment profiles, and rollback restores verified operation in 72.4% of drift scenarios. Bounded-window aggregate-success gating proved insufficient against these fault operators; staged governance closes the gap at a modest, tunable cost.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
