From 251536db137cd36057ee6bb8035e006cd991cc10 Mon Sep 17 00:00:00 2001 From: weichen Date: Mon, 19 Oct 2026 08:27:58 +0000 Subject: [PATCH] Record U7A canonical-project-identity completion MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Why: U7A (split sub-unit from U7) succeeded with cursor-agent attempt 1 (run_id=cc68d698…) terminal_status=success; transport refs/agent-exec/cc68d698…/4b4d8a620021 fast-forwarded to feature/iam-link-u2-single-role-authority @ a00466fb on Agent-System-RDM, then pushed to origin. Evidence: agent-exec run receipt /tmp/iam-link-u7a-run.json terminal_status=success, transport.commit=a00466fbac4b2bc80d6bfee3831d4187be76c248; host verification receipt /tmp/iam-link-u7a-verify-20261019.json (projects+rdmapp+dhffidelity+dhfmatrix all-ok). Impact: U7A implementation complete in RDM (project identity uniqueness + project_resource_authz decoupling from doc.read/publishedKnowledgeSource); U7B sub-unit (perms_api/member_search/doc_visibility/cockpit + plugins/rdm + body-level shared reads) deferred until U7A transport lands. Refs: plan revision 3 U7; PR #628. --- ...bilities-u7a-canonical-project-identity.md | 29 ++++++++++++++----- ...iam-role-permission-linked-capabilities.md | 2 +- 2 files changed, 23 insertions(+), 8 deletions(-) diff --git a/.task/feature-iam-role-permission-linked-capabilities-u7a-canonical-project-identity.md b/.task/feature-iam-role-permission-linked-capabilities-u7a-canonical-project-identity.md index 1ddd5d60..0de71108 100644 --- a/.task/feature-iam-role-permission-linked-capabilities-u7a-canonical-project-identity.md +++ b/.task/feature-iam-role-permission-linked-capabilities-u7a-canonical-project-identity.md @@ -46,10 +46,10 @@ | 需求表确认 | 本卡 | 已完成 | host | 2026-10-19 | 范围 | | 方案设计 | 单元包 JSON | 已完成 | host | 2026-10-19 | KTD2/KTD5/KTD6/KTD8/KTD10 | | 实施计划 | 单元包 JSON | 已完成 | host | 2026-10-19 | allowed_paths/verification/timeout_seconds | -| 实施与自检 | 待 worker | 待执行 | — | — | `scripts/agent-exec run` | -| 正式测试与验收 | 待 worker 自检 + host 验证 | 待执行 | — | — | 子单元验证 + 既有不退化 | +| 实施与自检 | RDM `a00466fb` (transport `cc68d698…/4b4d8a620021`) | 已完成 | cursor-agent-stable | 2026-10-19 | `scripts/agent-exec run` terminal_status=success，8 文件改动全在 allowed_paths | +| 正式测试与验收 | RDM `a00466fb` SELF | PASS | host | 2026-10-19 | `make evidence` exit=0，projects + rdmapp + dhffidelity + dhfmatrix 全 ok | | 代码 Review | 待独立会话 | 待执行 | — | — | fresh session, `--role review` | -| 合入 | 待 host | 待执行 | — | — | RDM L1 transport apply + Dev gitlink bump | +| 合入 | 待 host | 待执行 | — | — | RDM L1 transport apply 已完成；待 host 后续 bump Dev `modules/rdm` gitlink | | 合入核验与收口 | 待 host | 待执行 | — | — | L1 PR #628 base gate | ## 同步记录 @@ -67,13 +67,28 @@ | 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 | |---|---|---|---|---|---|---|---|---|---|---| -| iam-link-u7a | RDM `internal/projects/*` + `internal/rdmapp/{project_resource_authz,system_projects,projects_api,*_test,member_guards_test,project_creator_permissions_test,host_projection_test,dhf_template_instance_test,e2e_test}.go` + `pins/{agent-system-backend,agent-system-core,agent-document-renderer}` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c | implementation | [cursor, antigravity, pi] | 1 | 待记录 | 待记录 | 待记录 | 否 | 待记录 | +| iam-link-u7a | RDM `internal/projects/*` + `internal/rdmapp/{project_resource_authz,system_projects,projects_api,*_test,member_guards_test,project_creator_permissions_test,host_projection_test,dhf_template_instance_test,e2e_test}.go` + `pins/{agent-system-backend,agent-system-core,agent-document-renderer}` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c | implementation | [cursor, antigravity, pi] | 1 | cursor-agent-stable 2026.10.14-0f9edde | completed (success) | refs/agent-exec/cc68d698…/4b4d8a620021 → RDM commit a00466fbac4b2bc80d6bfee3831d4187be76c248 | 否 | /tmp/iam-link-u7a-run.json (run_id cc68d698… attempt 1) | ## 结果与验证（完成后填写） -- 结果： -- 验证：PASS/FAIL/SKIP/NOT_RUN 逐项 -- 影响与剩余项：U7B 子单元待派发 +- 结果：U7A 实施成功。RDM L1 子分支 `feature/iam-link-u2-single-role-authority` @ `a00466fb` 已推送（Agent-System-RDM origin）；与 U2A（`1d9de39`）+ U2B（`8725ed3f`）累积。8 文件改动 643+/56-，分布： + - `internal/projects/projects.go` +32（项目身份唯一性强化） + - `internal/projects/projects_test.go` +114（新表） + - `internal/rdmapp/project_resource_authz.go` 95+/-（解耦 `perms.ActDocRead` 与 `publishedKnowledgeSource`，改为成员关系判断） + - `internal/rdmapp/project_resource_authz_test.go` +145（新表覆盖 author/published filter removed） + - `internal/rdmapp/project_creator_permissions_test.go` +180（既有 + 新表覆盖 creator-only management / owner-label-not-authority） + - `internal/rdmapp/projects_api.go` +38（项目元数据路径接入） + - `internal/rdmapp/system_projects.go` +12（ListSystemProjects / verifyPhysicalProject 解耦 doc.read） + - `internal/rdmapp/system_projects_test.go` +83 +- 验证：PASS + - `internal/projects`：ok（含新表） + - `internal/rdmapp`：ok（78.7s，含既有 + 新表） + - `internal/rdmapp/dhffidelity` / `dhfmatrix`：ok + - `go vet ./internal/...` exit=0；`git diff --check` exit=0 +- 影响与剩余项： + - U7B 子单元（`perms_api.go`、`member_search.go`、`doc_visibility.go`、`cockpit.go`、`accountdir*`、`plugins/rdm/*` + body-level 共享测试）尚未派发，依赖 U7A 的 `project_resource_authz` 解耦稳定 + - 独立 Review 待 fresh session `--role review`（同时覆盖 U2A+U2B+U7A） + - Dev `modules/rdm` gitlink bump + RDM L1→main 合入待 host 后续 ## 合入与清理 diff --git a/.task/feature-iam-role-permission-linked-capabilities.md b/.task/feature-iam-role-permission-linked-capabilities.md index c1447ac6..e698a4aa 100644 --- a/.task/feature-iam-role-permission-linked-capabilities.md +++ b/.task/feature-iam-role-permission-linked-capabilities.md @@ -64,7 +64,7 @@ | feature/iam-role-permission-linked-capabilities-u2a-perms-and-perms-api | 是 | 已完成（RDM L1 子分支 1d9de398 推送，待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U2A（U2 拆分） | RDM `internal/perms/*` + `internal/rdmapp/{perms_api,member_search,accountdir*,*_test}.go`；KTD7；U2A 子表 | | feature/iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins | 是 | 已完成（RDM L1 子分支 8725ed3 推送，待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U2B（U2 拆分） | RDM `internal/rdmapp/{system_projects,projects_api,project_resource_authz,settings_duties,runtime}` + `plugins/rdm/{plugin,system_projects,*}`；KTD7 | | feature/iam-role-permission-linked-capabilities-u7-canonical-two-trees | 是 | blocked（cursor 3/3 fail-stop；拆分为 U7A + U7B + U7C 重新派发；U7A 已登记卡片待 agent 派发） | —（child 不开 PR） | U7 | RDM `internal/projects/{projects,provisioning,projection_rename}.go`、`internal/rdmapp/{projects_api,system_projects,project_resource_authz}.go`；Backend `internal/server/{project_lifecycle,server}.go`；KTD2/KTD5/KTD6/KTD8/KTD10；C01-C05/C11-C17/C19-C21/C26-C31 | -| feature/iam-role-permission-linked-capabilities-u7a-canonical-project-identity | 是 | 已登记卡片，待 agent 派发 | —（child 不开 PR） | U7A（U7 拆分） | RDM `internal/projects/*` + `internal/rdmapp/{project_resource_authz,system_projects,projects_api,*_test,member_guards_test,project_creator_permissions_test,host_projection_test,dhf_template_instance_test,e2e_test}.go`；KTD2/KTD5/KTD6/KTD8/KTD10；C01-C05/C17/C26-C28 | +| feature/iam-role-permission-linked-capabilities-u7a-canonical-project-identity | 是 | 已完成（RDM L1 子分支 a00466fb 推送，待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U7A（U7 拆分） | RDM `internal/projects/*` + `internal/rdmapp/{project_resource_authz,system_projects,projects_api,*_test,member_guards_test,project_creator_permissions_test,host_projection_test,dhf_template_instance_test,e2e_test}.go`；KTD2/KTD5/KTD6/KTD8/KTD10；C01-C05/C17/C26-C28 | | feature/iam-role-permission-linked-capabilities-u7b-two-trees-and-plugins | 是 | 待登记（U7A 完成后） | —（child 不开 PR） | U7B（U7 拆分） | RDM `internal/rdmapp/{perms_api,member_search,accountdir*,doc_visibility,cockpit,*_test}.go` + `plugins/rdm/*`；C11-C17/C26-C31 | | feature/iam-role-permission-linked-capabilities-u7c-knowledge-and-doc-shared-reads | 是 | 待登记（U7A 完成后） | —（child 不开 PR） | U7C（U7 拆分） | RDM `internal/rdmapp/{private_doc_views_test,resource_authz_test,queued_publication_revocation_test,draft_visibility_test,iam_i1_*,e2e_test,knowledge_publication_test}.go` + 两树一网共享读取 | | feature/iam-role-permission-linked-capabilities-u3-capability-exposure | 是 | 待启动 | — | U3 | Backend/RDM 解释接口、HTTP/command 错误分类、创建/添加成员/对话失败原因；KTD1/KTD2/KTD6 |