3 Commits

Include renames

Author	SHA1	Message	Date
weichen	adcd8fefd2	Fence U3 account writes and stabilize directory cursors ... Why: Account disable could be followed by late Backend business writes, API key creation could implicitly create users, account bootstrap locks could invert, and directory cursors were process-local or leaked out-of-scope changes. Evidence: Local go test ./... and isolated PostgreSQL package suites passed on the staged candidate; exact committed-head SELF replay and stage 6 human review remain pending. Impact: Adds final account transactions and external-effect checks across HTTP, Host, Bus and run manager; tightens API key issuance and persists versioned cursor signing. Delegated RDM rename still needs the separately proposed real-operator contract, so A1 and stage 6 are not complete. Refs: Documents U3 r1, approved A1-A4 amendment fb3a821, pending delegated-projection amendment 5783940, Dev feature/iam-u3-account-directory-recovery.	2026-10-14 07:33:54 +00:00
weichen	f5eb27df86	Add the surface action pipeline: ledger, guards, dispatch, submit (U5) ... Why: The approved U5 scope needs the action half of the loop: an idempotent ledger (migration v24), a single-choke SubmitAction (plugin activation, current-revision, action whitelist, params-hash idempotency), dispatch through the command bus so DangerHigh lands on the existing inline confirm card with no Confirmed passthrough (the endpoint does not even bind the field), the button-only generative-ui.submit storing form data in the plugin KV ledger, and catalog discipline rejecting unknown action ids at present time. Evidence: go build/vet clean; full go test ./... green; surfacesvc/ genui/store suites also green under AGENT_PG_TEST_DSN; red matrix covers disabled/stale-revision/cross-owner/unknown-action/idempotent same-and-different-params/danger-high-await-confirm and the endpoint forged-confirmed case. Impact: Additive migration v24 + new endpoint/command; existing endpoints and command semantics untouched (B-class whitelist starts empty per the approved scope). Refs: U5 action-scope r2 (approved, Documents #71); UI #46/#47; Frontend #56; Dev task feature/generative-ui-u5	2026-10-11 14:24:31 +00:00
weichen	75829fa442	Add the Surface store, activation guard, and EXT-17 host capability ... Why: Generative UI proposal U2 needs the host side of the contract: owner-isolated surface storage with revision CAS, an execution-level enable/disable ledger (default-off, epoch bumped on every transition so in-flight submits after a disable are rejected), a single-choke-point service that validates specs (strict decode + catalog rules) before saving, event publish with pending recovery, the optional SurfaceHost extension capability, and direct API endpoints that share the same guard (no bypass by entrance). Evidence: go build/vet clean; full go test ./... passes (SQLite); surface store tests also pass under AGENT_PG_TEST_DSN (PostgreSQL); surface.txt regenerated via the AST snapshot test. Impact: Additive migration v22 (new tables only); existing endpoints and plugin_grants semantics untouched; old consumers unaffected. U3+ (data binding, actions, frontend) deliberately out of scope. Refs: Documents proposal 2026-10-10-generative-ui-plugin.md (r2 U2); Core PR #25; Dev task feature/generative-ui-u2	2026-10-11 08:26:24 +00:00