From dd8b78af915f122fb37e1888a2c2363ab8767560 Mon Sep 17 00:00:00 2001
From: weichen <weichen@home.local>
Date: Mon, 19 Oct 2026 03:44:38 +0000
Subject: [PATCH 1/9] Record U2 fail-stop: 2 cursor attempts blocked
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Why: cursor attempt 1 (run_id 58bf349c…) = failed-unknown (work done, terminal record invalid), attempt 2 (run_id f88af22e…) = scope-expansion (legitimate: allowed_paths too narrow; needs projects_api/project_resource_authz/settings_duties/runtime.go and pins/ materialization).

Evidence: receipts /tmp/iam-link-u2-run.json (run_id 58bf349c + f88af22e); U2 child card .task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md.

Impact: U2 in blocked state per AGENT-EXECUTION.md explicit fail-stop; no transport produced; U3-U6 remain blocked on U2.

Refs: plan revision 3 U2; PR #628.
---
 ...d-capabilities-u2-single-role-authority.md | 21 ++++++++++++-------
 ...iam-role-permission-linked-capabilities.md |  2 +-
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/.task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md b/.task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md
index eaa127b6..1587de91 100644
--- a/.task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md
+++ b/.task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md
@@ -58,11 +58,11 @@
 | 需求表确认 | 本卡 | 已完成 | host | 2026-10-19 | U2-R1..U2-R5 |
 | 方案设计 | 单元包 JSON | 已完成 | host | 2026-10-19 | KTD7 |
 | 实施计划 | 单元包 JSON | 已完成 | host | 2026-10-19 | allowed_paths/verification/timeout_seconds |
-| 实施与自检 | 待 worker | 待执行 | — | — | `scripts/agent-exec run` |
-| 正式测试与验收 | 待 worker 自检 + host 验证 | 待执行 | — | — | C22 + 新表 |
-| 代码 Review | 待独立会话 | 待执行 | — | — | fresh session, `--role review` |
-| 合入 | 待 host | 待执行 | — | — | RDM L1 PR + transport apply + Dev gitlink bump |
-| 合入核验与收口 | 待 host | 待执行 | — | — | L1 PR #628 base gate |
+| 实施与自检 | cursor-agent attempt 1 (failed-unknown) + attempt 2 (scope-expansion) | 双试双 fail-stop，临时完成被回滚 | cursor-agent | 2026-10-19 | attempt 1 13 文件 1111+/180- 改动完成，但 worker 未输出有效终态记录；attempt 2 在受限 allowed_paths 下主动返回 scope-expansion 列出真实需要的额外路径与 pins 物化 |
+| 正式测试与验收 | NOT_RUN |  |  |  | 本会话不再尝试 |
+| 代码 Review | NOT_RUN |  |  |  |  |
+| 合入 | NOT_RUN |  |  |  | 后续会话修订单元包后再试 |
+| 合入核验与收口 | NOT_RUN |  |  |  |  |
 
 ## 同步记录
 
@@ -79,13 +79,18 @@
 
 | 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
 |---|---|---|---|---|---|---|---|---|---|---|
-| iam-link-u2 | RDM `internal/perms`、`internal/rdmapp/{perms_api,system_projects,member_search}`、`plugins/rdm/{system_projects,plugin}` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c (RDM dev-manager pin) | implementation | [cursor, antigravity, pi] | 1 | 待记录 | 待记录 | 待记录 | 否 | 待记录 |
+| iam-link-u2 | RDM `internal/perms`、`internal/rdmapp/{perms_api,system_projects,member_search}`、`plugins/rdm/{system_projects,plugin}` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c (RDM dev-manager pin) | implementation | [cursor, antigravity, pi] | 1+2 | cursor-agent-stable 2026.10.14-0f9edde | attempt 1=failed-unknown, attempt 2=scope-expansion（显式 fail-stop，后续会话修订单元包后重试） | 无 | 否 | /tmp/iam-link-u2-run.json (run_id 58bf349c… attempt 1 + f88af22e… attempt 2) |
 
 ## 结果与验证（完成后填写）
 
-- 结果：
-- 验证：PASS/FAIL/SKIP/NOT_RUN 逐项
+- 结果：双 cursor 尝试均 fail-stop，未产生可应用 transport。
+  - attempt 1 (run_id=58bf349c…) terminal=failed-unknown，reason="worker exited 0 with changes but no valid completed terminal record"；worktree 留下 13 文件改动（`internal/perms/{role_migration,role_migration_test,role_provider,role_provider_test,roles}.go`、`internal/rdmapp/{perms_api,perms_test,system_projects,system_projects_test,member_search}.go`、`plugins/rdm/{plugin,system_projects,system_projects_test}.go`），diffstat 1111+/180-；agent evidence 自报 16 项新测试全 PASS（perms 6 + rdmapp 10） + 既有不退化，唯一失败 `TestRenderProfileCandidateAnalyzeCannotReachPublication` 为 worktree 缺 `pins/agent-document-renderer` 子模块的环境问题，非本单元引入。
+  - attempt 2 (run_id=f88af22e…) terminal=scope-expansion，agent 列出真实需要扩 allowed_paths 的文件：`internal/rdmapp/{projects_api,project_resource_authz,settings_duties,runtime}.go` + 一批已有 `iam_i1_*`、`e2e`、plugin 测试，以及 `pins/` 物化（pins 为受控物化，不在单元包控制范围）。
+- 验证：NOT_RUN（没有成功的 transport 可供 host 复核；attempt 1 改动未应用）
 - 影响与剩余项：
+  - 单元包必须扩 allowed_paths 并解决 `pins/agent-document-renderer` 等子模块在 worktree 里的物化（建议由 host 在派发前先把 pins 按 gitlink 物化，或拆分为更小单元：先做 `internal/perms` + `internal/rdmapp/{perms_api,member_search}` 子单元 A，再做 `system_projects`/`projects_api`/`project_resource_authz`/`settings_duties`/`runtime` 子单元 B）。
+  - 后续会话修订单元包后用 cursor（再 1 次）或 agy/PI 重试；若三候选均耗尽则启 codex 紧急。
+  - U3-U6 仍依赖 U2 终态。
 
 ## 合入与清理
 
diff --git a/.task/feature-iam-role-permission-linked-capabilities.md b/.task/feature-iam-role-permission-linked-capabilities.md
index 3bd606b2..0fe1456d 100644
--- a/.task/feature-iam-role-permission-linked-capabilities.md
+++ b/.task/feature-iam-role-permission-linked-capabilities.md
@@ -60,7 +60,7 @@
 | 子任务分支 | 必需 | 状态 | PR | 单元 | 范围摘要 |
 |---|---|---|---|---|---|
 | feature/iam-role-permission-linked-capabilities-u1-capability-association | 是 | 已完成（Backend 子分支 afb65c5 推送，Dev gitlink bump 待 host；独立 Review 待 fresh session） | —（child 不开 PR） | U1 | Backend `internal/authz/catalog`、`internal/store/role_policy`、公开扩展 DTO；RDM `internal/perms/role_provider.go` 与创建能力判定；KTD1/KTD3/KTD4；C06/C08/C09/C10 |
-| feature/iam-role-permission-linked-capabilities-u2-single-role-authority | 是 | 已登记卡片，待 agent 派发 | —（child 不开 PR） | U2 | RDM `perms_api.go`、`system_projects.go`、`plugins/rdm/{system_projects,plugin}.go`；Backend `hostcaps.go`；KTD7；C22 |
+| feature/iam-role-permission-linked-capabilities-u2-single-role-authority | 是 | blocked（cursor 2 次 fail-stop：failed-unknown + scope-expansion；后续会话修订单元包后重试） | —（child 不开 PR） | U2 | RDM `perms_api.go`、`system_projects.go`、`plugins/rdm/{system_projects,plugin}.go`；Backend `hostcaps.go`；KTD7；C22 |
 | feature/iam-role-permission-linked-capabilities-u7-canonical-two-trees | 是 | 待启动 | — | U7 | RDM `internal/projects/{projects,provisioning,projection_rename}.go`、`internal/rdmapp/{projects_api,system_projects,project_resource_authz}.go`；Backend `internal/server/{project_lifecycle,server}.go`；KTD2/KTD5/KTD6/KTD8/KTD10；C01-C05/C11-C17/C19-C21/C26-C31 |
 | feature/iam-role-permission-linked-capabilities-u3-capability-exposure | 是 | 待启动 | — | U3 | Backend/RDM 解释接口、HTTP/command 错误分类、创建/添加成员/对话失败原因；KTD1/KTD2/KTD6 |
 | feature/iam-role-permission-linked-capabilities-u4-frontend-auto-discover | 是 | 待启动 | — | U4 | Frontend `RolePermissionsPanel.tsx`、`AccountUsersPanel.tsx`、`adminRdmSections.tsx`、`TaskSidebar.tsx`、`App.tsx`、`store.ts`、`api.ts`、`rolePermissions.ts`、`projectmeta.ts`；KTD9；C13-C15/C19-C21/C23 |

From 71d694500d818103ff2b0258884ecefaf44534c5 Mon Sep 17 00:00:00 2001
From: weichen <weichen@home.local>
Date: Mon, 19 Oct 2026 04:09:18 +0000
Subject: [PATCH 2/9] Record U2 cursor candidate exhausted (3/3 fail-stops)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Why: cursor attempt 3 (run_id=004a0ddb…) also failed-unknown despite widened allowed_paths (49 paths including pins/ and production entry points). cursor 3/3 attempts all hit explicit fail-stop per AGENT-EXECUTION.md.

Evidence: receipts /tmp/iam-link-u2-run.json run_ids 58bf349c / f88af22e / 004a0ddb; U2 child card .task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md.

Impact: U2 in blocked state; per explicit fail-stop rule, no other normal candidate retry, no codex emergency; U3-U6 remain blocked on U2.

Refs: plan revision 3 U2; PR #628.
---
 ...d-capabilities-u2-single-role-authority.md | 21 +++++++++++--------
 ...iam-role-permission-linked-capabilities.md |  2 +-
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/.task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md b/.task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md
index 1587de91..52be894e 100644
--- a/.task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md
+++ b/.task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md
@@ -58,10 +58,10 @@
 | 需求表确认 | 本卡 | 已完成 | host | 2026-10-19 | U2-R1..U2-R5 |
 | 方案设计 | 单元包 JSON | 已完成 | host | 2026-10-19 | KTD7 |
 | 实施计划 | 单元包 JSON | 已完成 | host | 2026-10-19 | allowed_paths/verification/timeout_seconds |
-| 实施与自检 | cursor-agent attempt 1 (failed-unknown) + attempt 2 (scope-expansion) | 双试双 fail-stop，临时完成被回滚 | cursor-agent | 2026-10-19 | attempt 1 13 文件 1111+/180- 改动完成，但 worker 未输出有效终态记录；attempt 2 在受限 allowed_paths 下主动返回 scope-expansion 列出真实需要的额外路径与 pins 物化 |
+| 实施与自检 | cursor-agent attempt 1 (failed-unknown) + attempt 2 (scope-expansion) + attempt 3 (failed-unknown) | 三试全 fail-stop，cursor 候选耗尽 | cursor-agent | 2026-10-19 | attempt 1 13 文件 1111+/180- 改动完成但 worker 未输出有效终态记录；attempt 2 在受限 allowed_paths 下主动返回 scope-expansion 列出真实需要的额外路径与 pins 物化；attempt 3 已按 attempt 2 列表扩充 allowed_paths 到 49 个（含 `projects_api`、`project_resource_authz`、`settings_duties`、`runtime` 与 pins/ 子模块），仍以 failed-unknown 结束 |
 | 正式测试与验收 | NOT_RUN |  |  |  | 本会话不再尝试 |
 | 代码 Review | NOT_RUN |  |  |  |  |
-| 合入 | NOT_RUN |  |  |  | 后续会话修订单元包后再试 |
+| 合入 | NOT_RUN |  |  |  | 后续会话拆分 U2 或重设计单元包后再试 |
 | 合入核验与收口 | NOT_RUN |  |  |  |  |
 
 ## 同步记录
@@ -79,17 +79,20 @@
 
 | 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
 |---|---|---|---|---|---|---|---|---|---|---|
-| iam-link-u2 | RDM `internal/perms`、`internal/rdmapp/{perms_api,system_projects,member_search}`、`plugins/rdm/{system_projects,plugin}` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c (RDM dev-manager pin) | implementation | [cursor, antigravity, pi] | 1+2 | cursor-agent-stable 2026.10.14-0f9edde | attempt 1=failed-unknown, attempt 2=scope-expansion（显式 fail-stop，后续会话修订单元包后重试） | 无 | 否 | /tmp/iam-link-u2-run.json (run_id 58bf349c… attempt 1 + f88af22e… attempt 2) |
+| iam-link-u2 | RDM `internal/perms`、`internal/rdmapp/{perms_api,system_projects,member_search,projects_api,project_resource_authz,settings_duties,runtime,iam_i1_*,e2e,accountdir,*}`、`plugins/rdm/{system_projects,plugin,iam_i1_*,member_search,member_api,perm_matrix,roles,register_v2,account_directory,duty_member_check,*}`、`pins/{agent-document-renderer,agent-system-{backend,core,frontend,ui,kb-regulations}}` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c (RDM dev-manager pin) | implementation | [cursor, antigravity, pi] | 1+2+3 | cursor-agent-stable 2026.10.14-0f9edde | attempt 1=failed-unknown, attempt 2=scope-expansion, attempt 3=failed-unknown；cursor 候选耗尽；后续会话拆子单元或启 agy/PI/codex 紧急 | 无 | 否 | /tmp/iam-link-u2-run.json (run_id 58bf349c… + f88af22e… + 004a0ddb…) |
 
 ## 结果与验证（完成后填写）
 
-- 结果：双 cursor 尝试均 fail-stop，未产生可应用 transport。
-  - attempt 1 (run_id=58bf349c…) terminal=failed-unknown，reason="worker exited 0 with changes but no valid completed terminal record"；worktree 留下 13 文件改动（`internal/perms/{role_migration,role_migration_test,role_provider,role_provider_test,roles}.go`、`internal/rdmapp/{perms_api,perms_test,system_projects,system_projects_test,member_search}.go`、`plugins/rdm/{plugin,system_projects,system_projects_test}.go`），diffstat 1111+/180-；agent evidence 自报 16 项新测试全 PASS（perms 6 + rdmapp 10） + 既有不退化，唯一失败 `TestRenderProfileCandidateAnalyzeCannotReachPublication` 为 worktree 缺 `pins/agent-document-renderer` 子模块的环境问题，非本单元引入。
-  - attempt 2 (run_id=f88af22e…) terminal=scope-expansion，agent 列出真实需要扩 allowed_paths 的文件：`internal/rdmapp/{projects_api,project_resource_authz,settings_duties,runtime}.go` + 一批已有 `iam_i1_*`、`e2e`、plugin 测试，以及 `pins/` 物化（pins 为受控物化，不在单元包控制范围）。
-- 验证：NOT_RUN（没有成功的 transport 可供 host 复核；attempt 1 改动未应用）
+- 结果：cursor 三次尝试均 fail-stop，未产生可应用 transport；cursor 候选按治理耗尽（3/3）。
+  - attempt 1 (run_id=58bf349c…) terminal=failed-unknown；worktree 留 13 文件 1111+/180- 改动（perms/perms+role_provider 等 + rdmapp/perms_api 等 + plugins/rdm/system_projects 等），agent evidence 自报 16 项新测试全 PASS（perms 6 + rdmapp 10）+ 既有不退化，唯一失败 `TestRenderProfileCandidateAnalyzeCannotReachPublication` 为 worktree 缺 `pins/agent-document-renderer` 子模块。
+  - attempt 2 (run_id=f88af22e…) terminal=scope-expansion；合法识别 allowed_paths 太窄，列出真实需要扩 `internal/rdmapp/{projects_api,project_resource_authz,settings_duties,runtime}.go` + `iam_i1_*`、`e2e`、plugin 测试 + `pins/` 物化。
+  - attempt 3 (run_id=004a0ddb…) terminal=failed-unknown；按 attempt 2 列表把 allowed_paths 扩到 49（含 `projects_api`、`project_resource_authz`、`settings_duties`、`runtime` 与 6 个 `pins/*`），但 worker 又以 failed-unknown 结束（同样症状：worker 报告完成但未输出有效 JSON 终态记录）。
+- 验证：NOT_RUN（cursor 候选耗尽无成功 transport；attempt 1/3 改动未应用）
 - 影响与剩余项：
-  - 单元包必须扩 allowed_paths 并解决 `pins/agent-document-renderer` 等子模块在 worktree 里的物化（建议由 host 在派发前先把 pins 按 gitlink 物化，或拆分为更小单元：先做 `internal/perms` + `internal/rdmapp/{perms_api,member_search}` 子单元 A，再做 `system_projects`/`projects_api`/`project_resource_authz`/`settings_duties`/`runtime` 子单元 B）。
-  - 后续会话修订单元包后用 cursor（再 1 次）或 agy/PI 重试；若三候选均耗尽则启 codex 紧急。
+  - cursor 候选已耗尽（3/3），未启 codex 紧急（按 `policy/delivery.md` 显式 fail-stop 规则）。
+  - 后续会话二选一：
+    1. 改派 agy（normal 候选），新工作区独立判断。
+    2. 拆 U2 为更小单元（建议拆 A：`internal/perms` + `internal/rdmapp/{perms_api,member_search}`；B：`system_projects`/`projects_api`/`project_resource_authz`/`settings_duties`/`runtime`）分别派发；每个子单元 allowed_paths 严格收敛。
   - U3-U6 仍依赖 U2 终态。
 
 ## 合入与清理
diff --git a/.task/feature-iam-role-permission-linked-capabilities.md b/.task/feature-iam-role-permission-linked-capabilities.md
index 0fe1456d..316ddcca 100644
--- a/.task/feature-iam-role-permission-linked-capabilities.md
+++ b/.task/feature-iam-role-permission-linked-capabilities.md
@@ -60,7 +60,7 @@
 | 子任务分支 | 必需 | 状态 | PR | 单元 | 范围摘要 |
 |---|---|---|---|---|---|
 | feature/iam-role-permission-linked-capabilities-u1-capability-association | 是 | 已完成（Backend 子分支 afb65c5 推送，Dev gitlink bump 待 host；独立 Review 待 fresh session） | —（child 不开 PR） | U1 | Backend `internal/authz/catalog`、`internal/store/role_policy`、公开扩展 DTO；RDM `internal/perms/role_provider.go` 与创建能力判定；KTD1/KTD3/KTD4；C06/C08/C09/C10 |
-| feature/iam-role-permission-linked-capabilities-u2-single-role-authority | 是 | blocked（cursor 2 次 fail-stop：failed-unknown + scope-expansion；后续会话修订单元包后重试） | —（child 不开 PR） | U2 | RDM `perms_api.go`、`system_projects.go`、`plugins/rdm/{system_projects,plugin}.go`；Backend `hostcaps.go`；KTD7；C22 |
+| feature/iam-role-permission-linked-capabilities-u2-single-role-authority | 是 | blocked（cursor 3 次均 fail-stop：failed-unknown + scope-expansion + failed-unknown；cursor 候选耗尽 3/3；后续会话拆 U2 或改派 agy） | —（child 不开 PR） | U2 | RDM `perms_api.go`、`system_projects.go`、`plugins/rdm/{system_projects,plugin}.go`；Backend `hostcaps.go`；KTD7；C22 |
 | feature/iam-role-permission-linked-capabilities-u7-canonical-two-trees | 是 | 待启动 | — | U7 | RDM `internal/projects/{projects,provisioning,projection_rename}.go`、`internal/rdmapp/{projects_api,system_projects,project_resource_authz}.go`；Backend `internal/server/{project_lifecycle,server}.go`；KTD2/KTD5/KTD6/KTD8/KTD10；C01-C05/C11-C17/C19-C21/C26-C31 |
 | feature/iam-role-permission-linked-capabilities-u3-capability-exposure | 是 | 待启动 | — | U3 | Backend/RDM 解释接口、HTTP/command 错误分类、创建/添加成员/对话失败原因；KTD1/KTD2/KTD6 |
 | feature/iam-role-permission-linked-capabilities-u4-frontend-auto-discover | 是 | 待启动 | — | U4 | Frontend `RolePermissionsPanel.tsx`、`AccountUsersPanel.tsx`、`adminRdmSections.tsx`、`TaskSidebar.tsx`、`App.tsx`、`store.ts`、`api.ts`、`rolePermissions.ts`、`projectmeta.ts`；KTD9；C13-C15/C19-C21/C23 |

From 17ee79d405b4de76f3f0cc339bc1a5e861d2f658 Mon Sep 17 00:00:00 2001
From: weichen <weichen@home.local>
Date: Mon, 19 Oct 2026 04:55:25 +0000
Subject: [PATCH 3/9] Register U2A perms-and-perms-api sub-unit; plan U2B

Why: U2 cursor 3/3 attempts all fail-stop per AGENT-EXECUTION.md explicit fail-stop; redesign the unit as two narrower sub-units instead of retrying the same unit.

Evidence: U2 child card .task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md (cursor 3/3 receipts); U2A sub-unit card .task/feature-iam-role-permission-linked-capabilities-u2a-perms-and-perms-api.md.

Impact: U2 split into U2A (perms + perms_api + member_search + accountdir) and U2B (system_projects + projects_api + project_resource_authz + settings_duties + runtime + plugins/rdm); U2B child card deferred until U2A transport lands.

Refs: plan revision 3 U2; PR #628.
---
 ...ed-capabilities-u2a-perms-and-perms-api.md | 85 +++++++++++++++++++
 ...iam-role-permission-linked-capabilities.md |  4 +-
 2 files changed, 88 insertions(+), 1 deletion(-)
 create mode 100644 .task/feature-iam-role-permission-linked-capabilities-u2a-perms-and-perms-api.md

diff --git a/.task/feature-iam-role-permission-linked-capabilities-u2a-perms-and-perms-api.md b/.task/feature-iam-role-permission-linked-capabilities-u2a-perms-and-perms-api.md
new file mode 100644
index 00000000..509403d9
--- /dev/null
+++ b/.task/feature-iam-role-permission-linked-capabilities-u2a-perms-and-perms-api.md
@@ -0,0 +1,85 @@
+# feature/iam-role-permission-linked-capabilities-u2a-perms-and-perms-api 任务卡
+
+任务主记录：<PR 链接，交付前填写>；状态：进行中；owner：weichen
+
+## 基线与授权
+
+- 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= 7716b28cfff5200e7cfe9ec75aff5bcd71b234ed
+- 工作区：/home/weichen/projects/Agent-System-Dev-wt-feature-iam-role-permission-linked-capabilities（worktree）；分支：feature/iam-role-permission-linked-capabilities
+- 分支类型：child；initiative_id：feature-iam-role-permission-linked-capabilities；root_target：main；immediate_target：feature/iam-role-permission-linked-capabilities；accepting_requirements：false；parent_branch：feature/iam-role-permission-linked-capabilities；parent_head_sha：71d6945；parent_pr：PR #628
+
+- 授权与交付终点：U2 在 cursor 3/3 fail-stop 后按治理拆分，本卡为 U2A 子单元；目标 RDM `internal/perms` + `internal/rdmapp/{perms_api,member_search,accountdir}`；不开 PR、不入 main；不动 U2B 路径（system_projects/projects_api/project_resource_authz/settings_duties/runtime/plugins/rdm）。
+- 交付模式：goal-first
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md）
+- 合入执行：agent（已授权交付范围内，Review 通过、冲突解决且当前 HEAD 的 CI 通过后合入）
+- 当前阶段：实施单元已登记，待 agent 派发
+- 流程依据：仓库根目录 policy/delivery.md；父 L1 charter 见 `.task/feature-iam-role-permission-linked-capabilities.md`；父单元 U2 任务卡见 `.task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md`
+
+## 目标与非目标
+
+**目标**：让 `internal/perms` 与 `internal/rdmapp/perms_api.go` / `member_search.go` / `accountdir*.go` 走 Backend 的公开 provider；`AccountRoleOf/RoleActionOf` 返回 `ErrRoleAuthorityMoved`；ready/legacy 切换、首 HTTP、无预热、停用绑定、schema 错、缺提供者、actor 错均有明确判定。
+
+**范围**：见单元包 allowed_paths。
+
+**非目标**：
+- 不动 `system_projects`、`projects_api`、`project_resource_authz`、`settings_duties`、`runtime`、`plugins/rdm`（U2B 子单元）。
+- 不动 Backend / Frontend / Documents / Dev。
+- 不引入新数据库表。
+- 不删除 `AccountRoleOf/RoleActionOf` 符号。
+- 不削弱既有拒绝。
+
+**验收条件**：U2A 子单元 dispatch success；既有 `role_migration_test.go` 仍观察到 `ErrRoleAuthorityMoved`；新表覆盖七类场景全 PASS；C22 + C08/C09 不退化。
+
+## 关联方向与规划
+
+- 主记录：方案 revision 3 `/tmp/iam-role-permission-plan-20261019-sqfu_4g4/plan.md` U2 + 父单元 U2
+- 前置：U1 capability-association（Backend L1 afb65c5）
+- 后继：U2B sub-unit（system_projects + projects_api + project_resource_authz + settings_duties + runtime + plugins/rdm）
+
+## 阶段记录
+
+| 阶段 | 对象版本 | 状态 | 决策/执行者 | 时间 | 依据 |
+|---|---|---|---|---|---|
+| 需求拆解 | 本卡 | 已完成 | host | 2026-10-19 | U2 拆分决定 |
+| 需求评估 | 本卡 | 已完成 | host | 2026-10-19 | U2 cursor 3/3 fail-stop 收据 |
+| 需求表确认 | 本卡 | 已完成 | host | 2026-10-19 | 范围 |
+| 方案设计 | 单元包 JSON | 已完成 | host | 2026-10-19 | KTD7 |
+| 实施计划 | 单元包 JSON | 已完成 | host | 2026-10-19 | allowed_paths/verification/timeout_seconds |
+| 实施与自检 | 待 worker | 待执行 | — | — | `scripts/agent-exec run` |
+| 正式测试与验收 | 待 worker 自检 + host 验证 | 待执行 | — | — | 子单元验证 + 既有不退化 |
+| 代码 Review | 待独立会话 | 待执行 | — | — | fresh session, `--role review` |
+| 合入 | 待 host | 待执行 | — | — | RDM L1 transport apply + Dev gitlink bump |
+| 合入核验与收口 | 待 host | 待执行 | — | — | L1 PR #628 base gate |
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at |
+|---|---|---|---|
+| 启动 | 71d6945 | 71d6945 | 2026-10-19T04:00:00Z |
+
+## 证据（Evidence）
+
+| 时间(UTC) | 命令 | 被测HEAD | exit | 来源 | sha256(16) |
+|---|---|---|---|---|---|
+
+## Agent 实施收据
+
+| 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|---|
+| iam-link-u2a | RDM `internal/perms/*` + `internal/rdmapp/{perms_api,member_search,accountdir*,*_test}.go` + `pins/{agent-system-backend,agent-system-core}` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c | implementation | [cursor, antigravity, pi] | 1 | 待记录 | 待记录 | 待记录 | 否 | 待记录 |
+
+## 结果与验证（完成后填写）
+
+- 结果：
+- 验证：PASS/FAIL/SKIP/NOT_RUN 逐项
+- 影响与剩余项：U2B 子单元待派发
+
+## 合入与清理
+
+- Review 记录：NOT_RUN
+- 冲突记录：NOT_RUN
+- CI 记录：NOT_RUN
+- 合入记录：NOT_RUN
+- 清理记录：NOT_RUN
+
+<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
diff --git a/.task/feature-iam-role-permission-linked-capabilities.md b/.task/feature-iam-role-permission-linked-capabilities.md
index 316ddcca..a9f5a496 100644
--- a/.task/feature-iam-role-permission-linked-capabilities.md
+++ b/.task/feature-iam-role-permission-linked-capabilities.md
@@ -60,7 +60,9 @@
 | 子任务分支 | 必需 | 状态 | PR | 单元 | 范围摘要 |
 |---|---|---|---|---|---|
 | feature/iam-role-permission-linked-capabilities-u1-capability-association | 是 | 已完成（Backend 子分支 afb65c5 推送，Dev gitlink bump 待 host；独立 Review 待 fresh session） | —（child 不开 PR） | U1 | Backend `internal/authz/catalog`、`internal/store/role_policy`、公开扩展 DTO；RDM `internal/perms/role_provider.go` 与创建能力判定；KTD1/KTD3/KTD4；C06/C08/C09/C10 |
-| feature/iam-role-permission-linked-capabilities-u2-single-role-authority | 是 | blocked（cursor 3 次均 fail-stop：failed-unknown + scope-expansion + failed-unknown；cursor 候选耗尽 3/3；后续会话拆 U2 或改派 agy） | —（child 不开 PR） | U2 | RDM `perms_api.go`、`system_projects.go`、`plugins/rdm/{system_projects,plugin}.go`；Backend `hostcaps.go`；KTD7；C22 |
+| feature/iam-role-permission-linked-capabilities-u2-single-role-authority | 是 | blocked（cursor 3/3 fail-stop；拆分为 U2A 与 U2B 两个子单元重新派发） | —（child 不开 PR） | U2 | RDM `perms_api.go`、`system_projects.go`、`plugins/rdm/{system_projects,plugin}.go`；Backend `hostcaps.go`；KTD7；C22 |
+| feature/iam-role-permission-linked-capabilities-u2a-perms-and-perms-api | 是 | 已登记卡片，待 agent 派发 | —（child 不开 PR） | U2A（U2 拆分） | RDM `internal/perms/*` + `internal/rdmapp/{perms_api,member_search,accountdir*,*_test}.go`；KTD7；U2A 子表 |
+| feature/iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins | 是 | 待登记（U2A 完成后） | —（child 不开 PR） | U2B（U2 拆分） | RDM `internal/rdmapp/{system_projects,projects_api,project_resource_authz,settings_duties,runtime}` + `plugins/rdm/{plugin,system_projects,*}`；KTD7 |
 | feature/iam-role-permission-linked-capabilities-u7-canonical-two-trees | 是 | 待启动 | — | U7 | RDM `internal/projects/{projects,provisioning,projection_rename}.go`、`internal/rdmapp/{projects_api,system_projects,project_resource_authz}.go`；Backend `internal/server/{project_lifecycle,server}.go`；KTD2/KTD5/KTD6/KTD8/KTD10；C01-C05/C11-C17/C19-C21/C26-C31 |
 | feature/iam-role-permission-linked-capabilities-u3-capability-exposure | 是 | 待启动 | — | U3 | Backend/RDM 解释接口、HTTP/command 错误分类、创建/添加成员/对话失败原因；KTD1/KTD2/KTD6 |
 | feature/iam-role-permission-linked-capabilities-u4-frontend-auto-discover | 是 | 待启动 | — | U4 | Frontend `RolePermissionsPanel.tsx`、`AccountUsersPanel.tsx`、`adminRdmSections.tsx`、`TaskSidebar.tsx`、`App.tsx`、`store.ts`、`api.ts`、`rolePermissions.ts`、`projectmeta.ts`；KTD9；C13-C15/C19-C21/C23 |

From 531c642be749fe55691327256fe13ce0398fdef7 Mon Sep 17 00:00:00 2001
From: weichen <weichen@home.local>
Date: Mon, 19 Oct 2026 05:30:29 +0000
Subject: [PATCH 4/9] Record U2A perms-and-perms-api completion
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Why: U2A (split sub-unit from U2) succeeded with cursor-agent attempt 1 (run_id=255b63b7…) terminal_status=success; transport refs/agent-exec/255b63b7…/537daf57a809 fast-forwarded to feature/iam-link-u2-single-role-authority @ 1d9de398 on Agent-System-RDM, then pushed to origin.

Evidence: agent-exec run receipt /tmp/iam-link-u2a-run.json terminal_status=success, transport.commit=1d9de39870141cb4030f2020b8a1dc553423ce89; host verification receipt /tmp/iam-link-u2a-verify-20261019.json (perms+rdmapp+dhffidelity+dhfmatrix all-ok).

Impact: U2A implementation complete in RDM (perms + perms_api + member_search + accountdir); U2B sub-unit (system_projects/projects_api/project_resource_authz/settings_duties/runtime/plugins/rdm) deferred until U2A transport lands.

Refs: plan revision 3 U2; PR #628.
---
 ...ed-capabilities-u2a-perms-and-perms-api.md | 29 ++++++++++++++-----
 ...iam-role-permission-linked-capabilities.md |  4 +--
 2 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/.task/feature-iam-role-permission-linked-capabilities-u2a-perms-and-perms-api.md b/.task/feature-iam-role-permission-linked-capabilities-u2a-perms-and-perms-api.md
index 509403d9..19a877ed 100644
--- a/.task/feature-iam-role-permission-linked-capabilities-u2a-perms-and-perms-api.md
+++ b/.task/feature-iam-role-permission-linked-capabilities-u2a-perms-and-perms-api.md
@@ -45,10 +45,10 @@
 | 需求表确认 | 本卡 | 已完成 | host | 2026-10-19 | 范围 |
 | 方案设计 | 单元包 JSON | 已完成 | host | 2026-10-19 | KTD7 |
 | 实施计划 | 单元包 JSON | 已完成 | host | 2026-10-19 | allowed_paths/verification/timeout_seconds |
-| 实施与自检 | 待 worker | 待执行 | — | — | `scripts/agent-exec run` |
-| 正式测试与验收 | 待 worker 自检 + host 验证 | 待执行 | — | — | 子单元验证 + 既有不退化 |
+| 实施与自检 | RDM `1d9de398` (transport `255b63b7…/537daf57a809`) | 已完成 | cursor-agent-stable | 2026-10-19 | `scripts/agent-exec run` terminal_status=success，9 文件改动全在 allowed_paths |
+| 正式测试与验收 | RDM `1d9de398` SELF | PASS | host | 2026-10-19 | `make evidence` exit=0，perms + rdmapp + dhffidelity + dhfmatrix 全 ok |
 | 代码 Review | 待独立会话 | 待执行 | — | — | fresh session, `--role review` |
-| 合入 | 待 host | 待执行 | — | — | RDM L1 transport apply + Dev gitlink bump |
+| 合入 | 待 host | 待执行 | — | — | RDM L1 transport apply 已完成；待 host 后续 bump Dev `modules/rdm` gitlink + U2B 实施 |
 | 合入核验与收口 | 待 host | 待执行 | — | — | L1 PR #628 base gate |
 
 ## 同步记录
@@ -66,13 +66,28 @@
 
 | 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
 |---|---|---|---|---|---|---|---|---|---|---|
-| iam-link-u2a | RDM `internal/perms/*` + `internal/rdmapp/{perms_api,member_search,accountdir*,*_test}.go` + `pins/{agent-system-backend,agent-system-core}` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c | implementation | [cursor, antigravity, pi] | 1 | 待记录 | 待记录 | 待记录 | 否 | 待记录 |
+| iam-link-u2a | RDM `internal/perms/*` + `internal/rdmapp/{perms_api,member_search,accountdir*,*_test}.go` + `pins/{agent-system-backend,agent-system-core}` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c | implementation | [cursor, antigravity, pi] | 1 | cursor-agent-stable 2026.10.14-0f9edde | completed (success) | refs/agent-exec/255b63b7fce6cfef8f38c24167bb2bd3/537daf57a809 → RDM commit 1d9de39870141cb4030f2020b8a1dc553423ce89 | 否 | /tmp/iam-link-u2a-run.json (run_id 255b63b7… attempt 1) |
 
 ## 结果与验证（完成后填写）
 
-- 结果：
-- 验证：PASS/FAIL/SKIP/NOT_RUN 逐项
-- 影响与剩余项：U2B 子单元待派发
+- 结果：U2A 实施成功。RDM L1 子分支 `feature/iam-link-u2-single-role-authority` @ `1d9de398` 已推送（Agent-System-RDM origin）。9 文件改动，938+/106-，分布：
+  - `internal/perms/role_provider.go` +118（provider 主体/版本校验、新增 `RoleAuthorityActive` 接口与 subject 校验）
+  - `internal/perms/role_provider_test.go` +153（新表 6 项 PASS）
+  - `internal/perms/role_migration_test.go` +59（既有 `ErrRoleAuthorityMoved` 测试保留）
+  - `internal/perms/roles.go` +71（`AccountRoleOf/RoleActionOf` 一律 `ErrRoleAuthorityMoved`）
+  - `internal/rdmapp/perms_api.go` +254/-（HTTP 入口切到 `RoleAuthority.PolicyForUser`、新增 subject 校验）
+  - `internal/rdmapp/perms_test.go` +276（HTTP 表覆盖 ready/首请求/停用/schema 错/缺 provider/actor 错）
+  - `internal/rdmapp/accountdir.go`、`member_search.go`、`member_search_test.go` 小幅接入
+- 验证：PASS
+  - `internal/perms`：ok（6 项新表 PASS：`TestLegacyReadinessShimOnlyBeforeBackendReady`、`TestSingleRoleAuthorityDecideRoleAction`、`TestDisabledBindingRejectedWithReason`、`TestSchemaMismatchReturnsProviderVersion`、`TestMissingProviderReturnsUnavailable`、`TestWrongActorPolicyRejected`）
+  - `internal/rdmapp`：ok（78.3s，含既有 + 新表）
+  - `internal/rdmapp/dhffidelity` / `dhfmatrix`：ok
+  - `go vet ./internal/...` exit=0；`git diff --check` exit=0
+  - 既有 `role_migration_test.go` 仍观察到 `AccountRoleOf/RoleActionOf` 返回 `ErrRoleAuthorityMoved`
+- 影响与剩余项：
+  - U2B 子单元（`system_projects`、`projects_api`、`project_resource_authz`、`settings_duties`、`runtime`、`plugins/rdm/*`）尚未派发，依赖 U2A 的 `RoleAuthority` 接口稳定
+  - 独立 Review 待 fresh session `--role review`
+  - Dev `modules/rdm` gitlink bump + RDM L1→main 合入待 host 后续
 
 ## 合入与清理
 
diff --git a/.task/feature-iam-role-permission-linked-capabilities.md b/.task/feature-iam-role-permission-linked-capabilities.md
index a9f5a496..39fef379 100644
--- a/.task/feature-iam-role-permission-linked-capabilities.md
+++ b/.task/feature-iam-role-permission-linked-capabilities.md
@@ -60,8 +60,8 @@
 | 子任务分支 | 必需 | 状态 | PR | 单元 | 范围摘要 |
 |---|---|---|---|---|---|
 | feature/iam-role-permission-linked-capabilities-u1-capability-association | 是 | 已完成（Backend 子分支 afb65c5 推送，Dev gitlink bump 待 host；独立 Review 待 fresh session） | —（child 不开 PR） | U1 | Backend `internal/authz/catalog`、`internal/store/role_policy`、公开扩展 DTO；RDM `internal/perms/role_provider.go` 与创建能力判定；KTD1/KTD3/KTD4；C06/C08/C09/C10 |
-| feature/iam-role-permission-linked-capabilities-u2-single-role-authority | 是 | blocked（cursor 3/3 fail-stop；拆分为 U2A 与 U2B 两个子单元重新派发） | —（child 不开 PR） | U2 | RDM `perms_api.go`、`system_projects.go`、`plugins/rdm/{system_projects,plugin}.go`；Backend `hostcaps.go`；KTD7；C22 |
-| feature/iam-role-permission-linked-capabilities-u2a-perms-and-perms-api | 是 | 已登记卡片，待 agent 派发 | —（child 不开 PR） | U2A（U2 拆分） | RDM `internal/perms/*` + `internal/rdmapp/{perms_api,member_search,accountdir*,*_test}.go`；KTD7；U2A 子表 |
+| feature/iam-role-permission-linked-capabilities-u2-single-role-authority | 是 | blocked（cursor 3/3 fail-stop；拆分为 U2A 与 U2B 两个子单元重新派发；U2A 已成功，U2B 待派发） | —（child 不开 PR） | U2 | RDM `perms_api.go`、`system_projects.go`、`plugins/rdm/{system_projects,plugin}.go`；Backend `hostcaps.go`；KTD7；C22 |
+| feature/iam-role-permission-linked-capabilities-u2a-perms-and-perms-api | 是 | 已完成（RDM L1 子分支 1d9de398 推送，待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U2A（U2 拆分） | RDM `internal/perms/*` + `internal/rdmapp/{perms_api,member_search,accountdir*,*_test}.go`；KTD7；U2A 子表 |
 | feature/iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins | 是 | 待登记（U2A 完成后） | —（child 不开 PR） | U2B（U2 拆分） | RDM `internal/rdmapp/{system_projects,projects_api,project_resource_authz,settings_duties,runtime}` + `plugins/rdm/{plugin,system_projects,*}`；KTD7 |
 | feature/iam-role-permission-linked-capabilities-u7-canonical-two-trees | 是 | 待启动 | — | U7 | RDM `internal/projects/{projects,provisioning,projection_rename}.go`、`internal/rdmapp/{projects_api,system_projects,project_resource_authz}.go`；Backend `internal/server/{project_lifecycle,server}.go`；KTD2/KTD5/KTD6/KTD8/KTD10；C01-C05/C11-C17/C19-C21/C26-C31 |
 | feature/iam-role-permission-linked-capabilities-u3-capability-exposure | 是 | 待启动 | — | U3 | Backend/RDM 解释接口、HTTP/command 错误分类、创建/添加成员/对话失败原因；KTD1/KTD2/KTD6 |

From b7c2dfebbb7b1955c8cd5f4beea3042fd37feede Mon Sep 17 00:00:00 2001
From: weichen <weichen@home.local>
Date: Mon, 19 Oct 2026 05:31:03 +0000
Subject: [PATCH 5/9] Register U2B system-projects-and-plugins sub-unit

Why: U2A succeeded on RDM (1d9de398) so U2B can proceed using the stable RoleAuthority interface.

Evidence: U2A child card .task/feature-iam-role-permission-linked-capabilities-u2a-perms-and-perms-api.md (terminal_status=success, transport.commit=1d9de398).

Impact: U2B dispatch ready; targets system_projects/projects_api/project_resource_authz/settings_duties/runtime/plugins/rdm entry points; pins/* materialized for compilation.

Refs: plan revision 3 U2; PR #628.
---
 ...ilities-u2b-system-projects-and-plugins.md | 84 +++++++++++++++++++
 ...iam-role-permission-linked-capabilities.md |  2 +-
 2 files changed, 85 insertions(+), 1 deletion(-)
 create mode 100644 .task/feature-iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins.md

diff --git a/.task/feature-iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins.md b/.task/feature-iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins.md
new file mode 100644
index 00000000..a370767c
--- /dev/null
+++ b/.task/feature-iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins.md
@@ -0,0 +1,84 @@
+# feature/iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins 任务卡
+
+任务主记录：<PR 链接，交付前填写>；状态：进行中；owner：weichen
+
+## 基线与授权
+
+- 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= 7716b28cfff5200e7cfe9ec75aff5bcd71b234ed
+- 工作区：/home/weichen/projects/Agent-System-Dev-wt-feature-iam-role-permission-linked-capabilities（worktree）；分支：feature/iam-role-permission-linked-capabilities
+- 分支类型：child；initiative_id：feature-iam-role-permission-linked-capabilities；root_target：main；immediate_target：feature/iam-role-permission-linked-capabilities；accepting_requirements：false；parent_branch：feature/iam-role-permission-linked-capabilities；parent_head_sha：531c642；parent_pr：PR #628
+
+- 授权与交付终点：U2 拆分后第二个子单元 U2B；目标 RDM `internal/rdmapp/{system_projects,projects_api,project_resource_authz,settings_duties,runtime,iam_i1_*,e2e,project_creator_*}` + `plugins/rdm/{plugin,system_projects,iam_i1_*,member_search,member_api,perm_matrix,roles,register_v2,account_directory,duty_member_check,*}`；不开 PR、不入 main；不动 U2A 路径（perms/perms_api/member_search/accountdir）。
+- 交付模式：goal-first
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md）
+- 合入执行：agent（已授权交付范围内，Review 通过、冲突解决且当前 HEAD 的 CI 通过后合入）
+- 当前阶段：实施单元待派发
+- 流程依据：仓库根目录 policy/delivery.md；父 L1 charter 见 `.task/feature-iam-role-permission-linked-capabilities.md`；父单元 U2 任务卡见 `.task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md`；U2A 见 `.task/feature-iam-role-permission-linked-capabilities-u2a-perms-and-perms-api.md`
+
+## 目标与非目标
+
+**目标**：让 RDM `system_projects`、`projects_api`、`project_resource_authz`、`settings_duties`、`runtime`、`plugins/rdm` 入口全部走 U2A 引入的 `RoleAuthority`（基于 Backend `extension.RolePolicyProvider/extension.SystemActionProvider`）；`AccountRoleOf/RoleActionOf` 调用点全部替换；ready/legacy 切换、首请求、停用绑定、schema 错、缺提供者、actor 错均有明确判定。
+
+**范围**：见单元包 allowed_paths。
+
+**非目标**：
+- 不动 `internal/perms/*`、`internal/rdmapp/{perms_api,member_search,accountdir*}`（U2A 已完成，必须保持稳定）。
+- 不动 Backend / Frontend / Documents / Dev。
+- 不引入新数据库表。
+- 不删除 `AccountRoleOf/RoleActionOf` 符号。
+- 不削弱既有拒绝。
+
+**验收条件**：方案 C22 + U2 子单元既有不退化 + 新表覆盖七类场景全 PASS。
+
+## 关联方向与规划
+
+- 主记录：方案 revision 3 `/tmp/iam-role-permission-plan-20261019-sqfu_4g4/plan.md` U2 + 父单元 U2
+- 前置：U2A capability-association（RDML1 1d9de398 已推远端）
+
+## 阶段记录
+
+| 阶段 | 对象版本 | 状态 | 决策/执行者 | 时间 | 依据 |
+|---|---|---|---|---|---|
+| 需求拆解 | 本卡 | 已完成 | host | 2026-10-19 | U2 拆分决定 |
+| 需求评估 | 本卡 | 已完成 | host | 2026-10-19 | U2A 成功结果 |
+| 需求表确认 | 本卡 | 已完成 | host | 2026-10-19 | 范围 |
+| 方案设计 | 单元包 JSON | 已完成 | host | 2026-10-19 | KTD7 + U2A 接口稳定 |
+| 实施计划 | 单元包 JSON | 已完成 | host | 2026-10-19 | allowed_paths/verification/timeout_seconds |
+| 实施与自检 | 待 worker | 待执行 | — | — | `scripts/agent-exec run` |
+| 正式测试与验收 | 待 worker 自检 + host 验证 | 待执行 | — | — | 子单元验证 + 既有不退化 |
+| 代码 Review | 待独立会话 | 待执行 | — | — | fresh session, `--role review` |
+| 合入 | 待 host | 待执行 | — | — | RDM L1 transport apply + Dev gitlink bump |
+| 合入核验与收口 | 待 host | 待执行 | — | — | L1 PR #628 base gate |
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at |
+|---|---|---|---|
+| 启动 | 531c642 | 531c642 | 2026-10-19T05:30:00Z |
+
+## 证据（Evidence）
+
+| 时间(UTC) | 命令 | 被测HEAD | exit | 来源 | sha256(16) |
+|---|---|---|---|---|---|
+
+## Agent 实施收据
+
+| 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|---|
+| iam-link-u2b | RDM `internal/rdmapp/{system_projects,projects_api,project_resource_authz,settings_duties,runtime,iam_i1_*,e2e,project_creator_*}` + `plugins/rdm/{plugin,system_projects,iam_i1_*,member_search,member_api,perm_matrix,roles,register_v2,account_directory,duty_member_check,*}` + `pins/{agent-document-renderer,agent-system-{backend,core,frontend,ui,kb-regulations}}` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c | implementation | [cursor, antigravity, pi] | 1 | 待记录 | 待记录 | 待记录 | 否 | 待记录 |
+
+## 结果与验证（完成后填写）
+
+- 结果：
+- 验证：PASS/FAIL/SKIP/NOT_RUN 逐项
+- 影响与剩余项：
+
+## 合入与清理
+
+- Review 记录：NOT_RUN
+- 冲突记录：NOT_RUN
+- CI 记录：NOT_RUN
+- 合入记录：NOT_RUN
+- 清理记录：NOT_RUN
+
+<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
diff --git a/.task/feature-iam-role-permission-linked-capabilities.md b/.task/feature-iam-role-permission-linked-capabilities.md
index 39fef379..12fb408d 100644
--- a/.task/feature-iam-role-permission-linked-capabilities.md
+++ b/.task/feature-iam-role-permission-linked-capabilities.md
@@ -62,7 +62,7 @@
 | feature/iam-role-permission-linked-capabilities-u1-capability-association | 是 | 已完成（Backend 子分支 afb65c5 推送，Dev gitlink bump 待 host；独立 Review 待 fresh session） | —（child 不开 PR） | U1 | Backend `internal/authz/catalog`、`internal/store/role_policy`、公开扩展 DTO；RDM `internal/perms/role_provider.go` 与创建能力判定；KTD1/KTD3/KTD4；C06/C08/C09/C10 |
 | feature/iam-role-permission-linked-capabilities-u2-single-role-authority | 是 | blocked（cursor 3/3 fail-stop；拆分为 U2A 与 U2B 两个子单元重新派发；U2A 已成功，U2B 待派发） | —（child 不开 PR） | U2 | RDM `perms_api.go`、`system_projects.go`、`plugins/rdm/{system_projects,plugin}.go`；Backend `hostcaps.go`；KTD7；C22 |
 | feature/iam-role-permission-linked-capabilities-u2a-perms-and-perms-api | 是 | 已完成（RDM L1 子分支 1d9de398 推送，待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U2A（U2 拆分） | RDM `internal/perms/*` + `internal/rdmapp/{perms_api,member_search,accountdir*,*_test}.go`；KTD7；U2A 子表 |
-| feature/iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins | 是 | 待登记（U2A 完成后） | —（child 不开 PR） | U2B（U2 拆分） | RDM `internal/rdmapp/{system_projects,projects_api,project_resource_authz,settings_duties,runtime}` + `plugins/rdm/{plugin,system_projects,*}`；KTD7 |
+| feature/iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins | 是 | 已登记卡片，待 agent 派发 | —（child 不开 PR） | U2B（U2 拆分） | RDM `internal/rdmapp/{system_projects,projects_api,project_resource_authz,settings_duties,runtime}` + `plugins/rdm/{plugin,system_projects,*}`；KTD7 |
 | feature/iam-role-permission-linked-capabilities-u7-canonical-two-trees | 是 | 待启动 | — | U7 | RDM `internal/projects/{projects,provisioning,projection_rename}.go`、`internal/rdmapp/{projects_api,system_projects,project_resource_authz}.go`；Backend `internal/server/{project_lifecycle,server}.go`；KTD2/KTD5/KTD6/KTD8/KTD10；C01-C05/C11-C17/C19-C21/C26-C31 |
 | feature/iam-role-permission-linked-capabilities-u3-capability-exposure | 是 | 待启动 | — | U3 | Backend/RDM 解释接口、HTTP/command 错误分类、创建/添加成员/对话失败原因；KTD1/KTD2/KTD6 |
 | feature/iam-role-permission-linked-capabilities-u4-frontend-auto-discover | 是 | 待启动 | — | U4 | Frontend `RolePermissionsPanel.tsx`、`AccountUsersPanel.tsx`、`adminRdmSections.tsx`、`TaskSidebar.tsx`、`App.tsx`、`store.ts`、`api.ts`、`rolePermissions.ts`、`projectmeta.ts`；KTD9；C13-C15/C19-C21/C23 |

From 8b024c726dd8bd479f575f991ef020b2dc40d2f9 Mon Sep 17 00:00:00 2001
From: weichen <weichen@home.local>
Date: Mon, 19 Oct 2026 06:01:48 +0000
Subject: [PATCH 6/9] Record U2B completion; mark U2 (U2A+U2B) completed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Why: U2B (RDM system-projects-and-plugins) succeeded with cursor-agent attempt 1 (run_id=d7b60010…) terminal_status=success; transport refs/agent-exec/d7b60010…/aafb85b82f70 fast-forwarded to feature/iam-link-u2-single-role-authority @ 8725ed3f on Agent-System-RDM, then pushed to origin. Combined with U2A (1d9de398), U2 implementation is complete.

Evidence: U2B run receipt /tmp/iam-link-u2b-run.json terminal_status=success, transport.commit=8725ed3fe005106fc0693ee58a7d32dd3553d2d3; U2B verify receipt /tmp/iam-link-u2b-verify-20261019.json (perms+rdmapp+dhffidelity+dhfmatrix+plugins/rdm all-ok).

Impact: U2 implementation complete (U2A perms + U2B system-projects-and-plugins); RDM L1 branch @ 8725ed3f has the cumulative changes; L1 PR #628 base gate remains for Dev gitlink bump + independent Review; U3-U6 remain blocked on U7 which depends on U2.

Refs: plan revision 3 U2; PR #628.
---
 ...d-capabilities-u2-single-role-authority.md | 32 +++++++++----------
 ...ilities-u2b-system-projects-and-plugins.md | 29 +++++++++++++----
 ...iam-role-permission-linked-capabilities.md |  4 +--
 3 files changed, 40 insertions(+), 25 deletions(-)

diff --git a/.task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md b/.task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md
index 52be894e..d5e3c638 100644
--- a/.task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md
+++ b/.task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md
@@ -12,7 +12,7 @@
 - 交付模式：goal-first
 - 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md）
 - 合入执行：agent（已授权交付范围内，Review 通过、冲突解决且当前 HEAD 的 CI 通过后合入）
-- 当前阶段：实施单元待派发
+- 当前阶段：U2A + U2B 双子单元均已完成（RDML1 8725ed3 已推远端）；U2 本身仍待 host 在 RDM L1→main 合入 + Dev `modules/rdm` gitlink bump + 独立 Review
 - 流程依据：仓库根目录 policy/delivery.md；父 L1 charter 见 `.task/feature-iam-role-permission-linked-capabilities.md`
 
 ## 目标与非目标
@@ -58,11 +58,11 @@
 | 需求表确认 | 本卡 | 已完成 | host | 2026-10-19 | U2-R1..U2-R5 |
 | 方案设计 | 单元包 JSON | 已完成 | host | 2026-10-19 | KTD7 |
 | 实施计划 | 单元包 JSON | 已完成 | host | 2026-10-19 | allowed_paths/verification/timeout_seconds |
-| 实施与自检 | cursor-agent attempt 1 (failed-unknown) + attempt 2 (scope-expansion) + attempt 3 (failed-unknown) | 三试全 fail-stop，cursor 候选耗尽 | cursor-agent | 2026-10-19 | attempt 1 13 文件 1111+/180- 改动完成但 worker 未输出有效终态记录；attempt 2 在受限 allowed_paths 下主动返回 scope-expansion 列出真实需要的额外路径与 pins 物化；attempt 3 已按 attempt 2 列表扩充 allowed_paths 到 49 个（含 `projects_api`、`project_resource_authz`、`settings_duties`、`runtime` 与 pins/ 子模块），仍以 failed-unknown 结束 |
-| 正式测试与验收 | NOT_RUN |  |  |  | 本会话不再尝试 |
-| 代码 Review | NOT_RUN |  |  |  |  |
-| 合入 | NOT_RUN |  |  |  | 后续会话拆分 U2 或重设计单元包后再试 |
-| 合入核验与收口 | NOT_RUN |  |  |  |  |
+| 实施与自检 | U2 cursor 3/3 fail-stop 后拆 U2A + U2B 双子单元均成功 | RDM `8725ed3f` | cursor-agent | 2026-10-19 | U2A (run_id 255b63b7) = success @ 1d9de398；U2B (run_id d7b60010) = success @ 8725ed3f |
+| 正式测试与验收 | RDM `8725ed3f` SELF | PASS | host | 2026-10-19 | perms + rdmapp + dhffidelity + dhfmatrix + plugins/rdm 全 ok |
+| 代码 Review | 待独立会话 | 待执行 | — | — | fresh session, `--role review` |
+| 合入 | 待 host | 待执行 | — | — | RDM L1→main 合入 + Dev `modules/rdm` gitlink bump |
+| 合入核验与收口 | 待 host | 待执行 | — | — | L1 PR #628 base gate |
 
 ## 同步记录
 
@@ -79,21 +79,19 @@
 
 | 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
 |---|---|---|---|---|---|---|---|---|---|---|
-| iam-link-u2 | RDM `internal/perms`、`internal/rdmapp/{perms_api,system_projects,member_search,projects_api,project_resource_authz,settings_duties,runtime,iam_i1_*,e2e,accountdir,*}`、`plugins/rdm/{system_projects,plugin,iam_i1_*,member_search,member_api,perm_matrix,roles,register_v2,account_directory,duty_member_check,*}`、`pins/{agent-document-renderer,agent-system-{backend,core,frontend,ui,kb-regulations}}` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c (RDM dev-manager pin) | implementation | [cursor, antigravity, pi] | 1+2+3 | cursor-agent-stable 2026.10.14-0f9edde | attempt 1=failed-unknown, attempt 2=scope-expansion, attempt 3=failed-unknown；cursor 候选耗尽；后续会话拆子单元或启 agy/PI/codex 紧急 | 无 | 否 | /tmp/iam-link-u2-run.json (run_id 58bf349c… + f88af22e… + 004a0ddb…) |
+| iam-link-u2 | RDM `internal/perms`、`internal/rdmapp/{perms_api,system_projects,member_search,projects_api,project_resource_authz,settings_duties,runtime,iam_i1_*,e2e,accountdir,*}`、`plugins/rdm/{system_projects,plugin,iam_i1_*,member_search,member_api,perm_matrix,roles,register_v2,account_directory,duty_member_check,*}`、`pins/{agent-document-renderer,agent-system-{backend,core,frontend,ui,kb-regulations}}` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c (RDM dev-manager pin) | implementation | [cursor, antigravity, pi] | 1+2+3 (split→U2A attempt 1 failed-unknown + U2A attempt 2 success @ 1d9de398 + U2B attempt 1 success @ 8725ed3f) | cursor-agent-stable 2026.10.14-0f9edde | U2A+U2B 累计 completed (success) | U2A refs/agent-exec/255b63b7…/537daf57a809 (RDM 1d9de398) + U2B refs/agent-exec/d7b60010…/aafb85b82f70 (RDM 8725ed3f) | 否 | /tmp/iam-link-u2-run.json + /tmp/iam-link-u2a-run.json + /tmp/iam-link-u2b-run.json |
 
 ## 结果与验证（完成后填写）
 
-- 结果：cursor 三次尝试均 fail-stop，未产生可应用 transport；cursor 候选按治理耗尽（3/3）。
-  - attempt 1 (run_id=58bf349c…) terminal=failed-unknown；worktree 留 13 文件 1111+/180- 改动（perms/perms+role_provider 等 + rdmapp/perms_api 等 + plugins/rdm/system_projects 等），agent evidence 自报 16 项新测试全 PASS（perms 6 + rdmapp 10）+ 既有不退化，唯一失败 `TestRenderProfileCandidateAnalyzeCannotReachPublication` 为 worktree 缺 `pins/agent-document-renderer` 子模块。
-  - attempt 2 (run_id=f88af22e…) terminal=scope-expansion；合法识别 allowed_paths 太窄，列出真实需要扩 `internal/rdmapp/{projects_api,project_resource_authz,settings_duties,runtime}.go` + `iam_i1_*`、`e2e`、plugin 测试 + `pins/` 物化。
-  - attempt 3 (run_id=004a0ddb…) terminal=failed-unknown；按 attempt 2 列表把 allowed_paths 扩到 49（含 `projects_api`、`project_resource_authz`、`settings_duties`、`runtime` 与 6 个 `pins/*`），但 worker 又以 failed-unknown 结束（同样症状：worker 报告完成但未输出有效 JSON 终态记录）。
-- 验证：NOT_RUN（cursor 候选耗尽无成功 transport；attempt 1/3 改动未应用）
+- 结果：U2 拆分 U2A + U2B 后均成功。RDM L1 子分支 `feature/iam-link-u2-single-role-authority` 累积到 `8725ed3f`（U2A `1d9de39` + U2B `8725ed3f`），已推远端。
+- 验证：PASS
+  - U2A 验证（见 U2A 子任务卡）：6 项新表 + 既有不退化
+  - U2B 验证（见 U2B 子任务卡）：ready/legacy/首请求/停用/schema/缺 provider/actor 错 + 既有不退化
+  - 累计 `internal/perms` + `internal/rdmapp` + `plugins/rdm` 全包测试 OK；`go vet` exit=0；`git diff --check` exit=0
 - 影响与剩余项：
-  - cursor 候选已耗尽（3/3），未启 codex 紧急（按 `policy/delivery.md` 显式 fail-stop 规则）。
-  - 后续会话二选一：
-    1. 改派 agy（normal 候选），新工作区独立判断。
-    2. 拆 U2 为更小单元（建议拆 A：`internal/perms` + `internal/rdmapp/{perms_api,member_search}`；B：`system_projects`/`projects_api`/`project_resource_authz`/`settings_duties`/`runtime`）分别派发；每个子单元 allowed_paths 严格收敛。
-  - U3-U6 仍依赖 U2 终态。
+  - 独立 Review 待 fresh session `--role review`（同时覆盖 U2A+U2B）
+  - Dev `modules/rdm` gitlink bump + RDM L1→main 合入待 host 后续
+  - U2 终态；按依赖链 U7 → U3 → U4 → U5 → U6 顺次
 
 ## 合入与清理
 
diff --git a/.task/feature-iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins.md b/.task/feature-iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins.md
index a370767c..4f78ab34 100644
--- a/.task/feature-iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins.md
+++ b/.task/feature-iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins.md
@@ -44,10 +44,10 @@
 | 需求表确认 | 本卡 | 已完成 | host | 2026-10-19 | 范围 |
 | 方案设计 | 单元包 JSON | 已完成 | host | 2026-10-19 | KTD7 + U2A 接口稳定 |
 | 实施计划 | 单元包 JSON | 已完成 | host | 2026-10-19 | allowed_paths/verification/timeout_seconds |
-| 实施与自检 | 待 worker | 待执行 | — | — | `scripts/agent-exec run` |
-| 正式测试与验收 | 待 worker 自检 + host 验证 | 待执行 | — | — | 子单元验证 + 既有不退化 |
+| 实施与自检 | RDM `8725ed3f` (transport `d7b60010…/aafb85b82f70`) | 已完成 | cursor-agent-stable | 2026-10-19 | `scripts/agent-exec run` terminal_status=success，9 文件改动全在 allowed_paths |
+| 正式测试与验收 | RDM `8725ed3f` SELF | PASS | host | 2026-10-19 | `make evidence` exit=0，perms + rdmapp + dhffidelity + dhfmatrix + plugins/rdm 全 ok |
 | 代码 Review | 待独立会话 | 待执行 | — | — | fresh session, `--role review` |
-| 合入 | 待 host | 待执行 | — | — | RDM L1 transport apply + Dev gitlink bump |
+| 合入 | 待 host | 待执行 | — | — | RDM L1 transport apply 已完成；待 host 后续 bump Dev `modules/rdm` gitlink |
 | 合入核验与收口 | 待 host | 待执行 | — | — | L1 PR #628 base gate |
 
 ## 同步记录
@@ -65,13 +65,30 @@
 
 | 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
 |---|---|---|---|---|---|---|---|---|---|---|
-| iam-link-u2b | RDM `internal/rdmapp/{system_projects,projects_api,project_resource_authz,settings_duties,runtime,iam_i1_*,e2e,project_creator_*}` + `plugins/rdm/{plugin,system_projects,iam_i1_*,member_search,member_api,perm_matrix,roles,register_v2,account_directory,duty_member_check,*}` + `pins/{agent-document-renderer,agent-system-{backend,core,frontend,ui,kb-regulations}}` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c | implementation | [cursor, antigravity, pi] | 1 | 待记录 | 待记录 | 待记录 | 否 | 待记录 |
+| iam-link-u2b | RDM `internal/rdmapp/{system_projects,projects_api,project_resource_authz,settings_duties,runtime,iam_i1_*,e2e,project_creator_*}` + `plugins/rdm/{plugin,system_projects,iam_i1_*,member_search,member_api,perm_matrix,roles,register_v2,account_directory,duty_member_check,*}` + `pins/{agent-document-renderer,agent-system-{backend,core,frontend,ui,kb-regulations}}` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c | implementation | [cursor, antigravity, pi] | 1 | cursor-agent-stable 2026.10.14-0f9edde | completed (success) | refs/agent-exec/d7b600104b48526d567d47a4626cc9dd/aafb85b82f70 → RDM commit 8725ed3fe005106fc0693ee58a7d32dd3553d2d3 | 否 | /tmp/iam-link-u2b-run.json (run_id d7b60010… attempt 1) |
 
 ## 结果与验证（完成后填写）
 
-- 结果：
-- 验证：PASS/FAIL/SKIP/NOT_RUN 逐项
+- 结果：U2B 实施成功。RDM L1 子分支 `feature/iam-link-u2-single-role-authority` @ `8725ed3f` 已推送（Agent-System-RDM origin）；与 U2A（`1d9de39`）累积。9 文件改动 1138+/116-，分布：
+  - `internal/rdmapp/system_projects.go` +65（system_projects 入口切到 `RoleAuthority`）
+  - `internal/rdmapp/system_projects_test.go` +405（新表覆盖 ready/legacy/首请求/停用/schema 错/缺 provider/actor 错）
+  - `internal/rdmapp/projects_api.go` +128/-（projects_api 入口接入）
+  - `internal/rdmapp/projects_api_test.go` +147
+  - `internal/rdmapp/runtime.go` +5
+  - `internal/rdmapp/settings_duties.go` +2
+  - `plugins/rdm/plugin.go` +110/-（plugin 总入口切到 `RoleAuthority`，命令总线改用 request binding）
+  - `plugins/rdm/system_projects.go` +2
+  - `plugins/rdm/system_projects_test.go` +390
+- 验证：PASS
+  - `internal/perms`：ok（U2A 7 项新表不变 + 既有不退化）
+  - `internal/rdmapp`：ok（77.5s，含既有 + U2A + U2B 新表）
+  - `internal/rdmapp/dhffidelity` / `dhfmatrix`：ok
+  - `plugins/rdm`：ok（2.7s）
+  - `go vet ./internal/... ./plugins/...` exit=0；`git diff --check` exit=0
 - 影响与剩余项：
+  - 独立 Review 待 fresh session `--role review` 同时覆盖 U2A+U2B
+  - Dev `modules/rdm` gitlink bump + RDM L1→main 合入待 host 后续
+  - U2 完成；按依赖链 U7 下一
 
 ## 合入与清理
 
diff --git a/.task/feature-iam-role-permission-linked-capabilities.md b/.task/feature-iam-role-permission-linked-capabilities.md
index 12fb408d..e7913d4c 100644
--- a/.task/feature-iam-role-permission-linked-capabilities.md
+++ b/.task/feature-iam-role-permission-linked-capabilities.md
@@ -60,9 +60,9 @@
 | 子任务分支 | 必需 | 状态 | PR | 单元 | 范围摘要 |
 |---|---|---|---|---|---|
 | feature/iam-role-permission-linked-capabilities-u1-capability-association | 是 | 已完成（Backend 子分支 afb65c5 推送，Dev gitlink bump 待 host；独立 Review 待 fresh session） | —（child 不开 PR） | U1 | Backend `internal/authz/catalog`、`internal/store/role_policy`、公开扩展 DTO；RDM `internal/perms/role_provider.go` 与创建能力判定；KTD1/KTD3/KTD4；C06/C08/C09/C10 |
-| feature/iam-role-permission-linked-capabilities-u2-single-role-authority | 是 | blocked（cursor 3/3 fail-stop；拆分为 U2A 与 U2B 两个子单元重新派发；U2A 已成功，U2B 待派发） | —（child 不开 PR） | U2 | RDM `perms_api.go`、`system_projects.go`、`plugins/rdm/{system_projects,plugin}.go`；Backend `hostcaps.go`；KTD7；C22 |
+| feature/iam-role-permission-linked-capabilities-u2-single-role-authority | 是 | 已完成（U2A + U2B 双子单元均 success；RDM L1 子分支 8725ed3 已推远端；待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U2 | RDM `perms_api.go`、`system_projects.go`、`plugins/rdm/{system_projects,plugin}.go`；Backend `hostcaps.go`；KTD7；C22 |
 | feature/iam-role-permission-linked-capabilities-u2a-perms-and-perms-api | 是 | 已完成（RDM L1 子分支 1d9de398 推送，待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U2A（U2 拆分） | RDM `internal/perms/*` + `internal/rdmapp/{perms_api,member_search,accountdir*,*_test}.go`；KTD7；U2A 子表 |
-| feature/iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins | 是 | 已登记卡片，待 agent 派发 | —（child 不开 PR） | U2B（U2 拆分） | RDM `internal/rdmapp/{system_projects,projects_api,project_resource_authz,settings_duties,runtime}` + `plugins/rdm/{plugin,system_projects,*}`；KTD7 |
+| feature/iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins | 是 | 已完成（RDM L1 子分支 8725ed3 推送，待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U2B（U2 拆分） | RDM `internal/rdmapp/{system_projects,projects_api,project_resource_authz,settings_duties,runtime}` + `plugins/rdm/{plugin,system_projects,*}`；KTD7 |
 | feature/iam-role-permission-linked-capabilities-u7-canonical-two-trees | 是 | 待启动 | — | U7 | RDM `internal/projects/{projects,provisioning,projection_rename}.go`、`internal/rdmapp/{projects_api,system_projects,project_resource_authz}.go`；Backend `internal/server/{project_lifecycle,server}.go`；KTD2/KTD5/KTD6/KTD8/KTD10；C01-C05/C11-C17/C19-C21/C26-C31 |
 | feature/iam-role-permission-linked-capabilities-u3-capability-exposure | 是 | 待启动 | — | U3 | Backend/RDM 解释接口、HTTP/command 错误分类、创建/添加成员/对话失败原因；KTD1/KTD2/KTD6 |
 | feature/iam-role-permission-linked-capabilities-u4-frontend-auto-discover | 是 | 待启动 | — | U4 | Frontend `RolePermissionsPanel.tsx`、`AccountUsersPanel.tsx`、`adminRdmSections.tsx`、`TaskSidebar.tsx`、`App.tsx`、`store.ts`、`api.ts`、`rolePermissions.ts`、`projectmeta.ts`；KTD9；C13-C15/C19-C21/C23 |

From 900362c5510f4e3e3a6a17c59fe52b403d22d8e0 Mon Sep 17 00:00:00 2001
From: weichen <weichen@home.local>
Date: Mon, 19 Oct 2026 06:07:50 +0000
Subject: [PATCH 7/9] Register U7 canonical-two-trees child task card
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Why: U1+U2 done (Backend afb65c5, RDM 8725ed3); U7 can now start per dependency chain U1→U2→U7→U3→U4→U5→U6.

Evidence: U2 child card .task/feature-iam-role-permission-linked-capabilities-u2-single-role-authority.md (RDML1 8725ed3); U7 plan in /tmp/iam-role-permission-plan-20261019-sqfu_4g4/plan.md revision 3.

Impact: U7 dispatch ready; targets RDM internal/projects + internal/rdmapp decoupling from doc.read and publishedKnowledgeSource; member chat work via Backend projectWork DTO already in place.

Refs: plan revision 3 U7; PR #628.
---
 ...ked-capabilities-u7-canonical-two-trees.md | 85 +++++++++++++++++++
 ...iam-role-permission-linked-capabilities.md |  2 +-
 2 files changed, 86 insertions(+), 1 deletion(-)
 create mode 100644 .task/feature-iam-role-permission-linked-capabilities-u7-canonical-two-trees.md

diff --git a/.task/feature-iam-role-permission-linked-capabilities-u7-canonical-two-trees.md b/.task/feature-iam-role-permission-linked-capabilities-u7-canonical-two-trees.md
new file mode 100644
index 00000000..4ca4072a
--- /dev/null
+++ b/.task/feature-iam-role-permission-linked-capabilities-u7-canonical-two-trees.md
@@ -0,0 +1,85 @@
+# feature/iam-role-permission-linked-capabilities-u7-canonical-two-trees 任务卡
+
+任务主记录：<PR 链接，交付前填写>；状态：进行中；owner：weichen
+
+## 基线与授权
+
+- 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= 7716b28cfff5200e7cfe9ec75aff5bcd71b234ed
+- 工作区：/home/weichen/projects/Agent-System-Dev-wt-feature-iam-role-permission-linked-capabilities（worktree）；分支：feature/iam-role-permission-linked-capabilities
+- 分支类型：child；initiative_id：feature-iam-role-permission-linked-capabilities；root_target：main；immediate_target：feature/iam-role-permission-linked-capabilities；accepting_requirements：false；parent_branch：feature/iam-role-permission-linked-capabilities；parent_head_sha：8b024c7；parent_pr：PR #628
+
+- 授权与交付终点：按方案 U7 在 `Agent-System-RDM` 仓实现 canonical 项目身份与成员协作闭环；不开 PR、不入 main；不动 Backend。
+- 交付模式：goal-first
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md）
+- 合入执行：agent（已授权交付范围内，Review 通过、冲突解决且当前 HEAD 的 CI 通过后合入）
+- 当前阶段：实施单元已登记，待 agent 派发
+- 流程依据：仓库根目录 policy/delivery.md；父 L1 charter 见 `.task/feature-iam-role-permission-linked-capabilities.md`
+
+## 目标与非目标
+
+**目标**：让所有有效成员读同一份共享两树一网（笔记树/文档树/追溯网）内容，无作者/职位/发布状态过滤；`project_resource_authz.go` 中 project/knowledge 不再以 `perms.ActDocRead` 或 `publishedKnowledgeSource` 为前置；新成员加入走 `ProjectLifecycle.Work`（RDM 端消费 Backend 已有 DTO）；保留私域边界。
+
+**范围**：见单元包 allowed_paths。
+
+**非目标**：
+- 不动 Backend `project_lifecycle.go`、`server.go` 的实质（已在 U1/Backend 历史工作中实现 `projectWork`）；只验证消费契约。
+- 不引入新数据库表。
+- 不削弱既有拒绝。
+- 不放大 creator 之外人的管理权；不修改 created_by 不可变性。
+- 不破坏现有职责分配、发布流程、版本号。
+
+**验收条件**：方案 C01-C05、C11-C17、C19-C21、C26-C31；既有 `member_guards_test.go`、`project_creator_permissions_test.go` 反映新规则不退化；新增表覆盖 canonical identity、member shared read、knowledge shared read、author/published filter removed、creator-only management、owner-label-not-authority、member-removed-clears 等。
+
+## 关联方向与规划
+
+- 主记录：方案 revision 3 `/tmp/iam-role-permission-plan-20261019-sqfu_4g4/plan.md` U7
+- 前置：U1 capability-association（Backend afb65c5）、U2 single-role-authority（RDML1 8725ed3）
+- 后继：U3 capability-exposure
+
+## 阶段记录
+
+| 阶段 | 对象版本 | 状态 | 决策/执行者 | 时间 | 依据 |
+|---|---|---|---|---|---|
+| 需求拆解 | 本卡 | 已完成 | host | 2026-10-19 | 方案 U7 |
+| 需求评估 | 本卡 | 已完成 | host | 2026-10-19 | RDM 现状 + Backend project_lifecycle 现状 |
+| 需求表确认 | 本卡 | 已完成 | host | 2026-10-19 | C01-C05/C11-C17/C19-C21/C26-C31 |
+| 方案设计 | 单元包 JSON | 已完成 | host | 2026-10-19 | KTD2/KTD5/KTD6/KTD8/KTD10 |
+| 实施计划 | 单元包 JSON | 已完成 | host | 2026-10-19 | allowed_paths/verification/timeout_seconds |
+| 实施与自检 | 待 worker | 待执行 | — | — | `scripts/agent-exec run` |
+| 正式测试与验收 | 待 worker 自检 + host 验证 | 待执行 | — | — | C01-C05/C11-C17/C19-C21/C26-C31 + 既有不退化 |
+| 代码 Review | 待独立会话 | 待执行 | — | — | fresh session, `--role review` |
+| 合入 | 待 host | 待执行 | — | — | RDM L1 transport apply + Dev gitlink bump |
+| 合入核验与收口 | 待 host | 待执行 | — | — | L1 PR #628 base gate |
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at |
+|---|---|---|---|
+| 启动 | 8b024c7 | 8b024c7 | 2026-10-19T05:50:00Z |
+
+## 证据（Evidence）
+
+| 时间(UTC) | 命令 | 被测HEAD | exit | 来源 | sha256(16) |
+|---|---|---|---|---|---|
+
+## Agent 实施收据
+
+| 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|---|
+| iam-link-u7 | RDM `internal/projects/*` + `internal/rdmapp/{project_resource_authz,system_projects,projects_api,*_test}.go` + `plugins/rdm/{plugin,system_projects,*}` + `pins/*` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c | implementation | [cursor, antigravity, pi] | 1 | 待记录 | 待记录 | 待记录 | 否 | 待记录 |
+
+## 结果与验证（完成后填写）
+
+- 结果：
+- 验证：PASS/FAIL/SKIP/NOT_RUN 逐项
+- 影响与剩余项：
+
+## 合入与清理
+
+- Review 记录：NOT_RUN
+- 冲突记录：NOT_RUN
+- CI 记录：NOT_RUN
+- 合入记录：NOT_RUN
+- 清理记录：NOT_RUN
+
+<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
diff --git a/.task/feature-iam-role-permission-linked-capabilities.md b/.task/feature-iam-role-permission-linked-capabilities.md
index e7913d4c..04e35600 100644
--- a/.task/feature-iam-role-permission-linked-capabilities.md
+++ b/.task/feature-iam-role-permission-linked-capabilities.md
@@ -63,7 +63,7 @@
 | feature/iam-role-permission-linked-capabilities-u2-single-role-authority | 是 | 已完成（U2A + U2B 双子单元均 success；RDM L1 子分支 8725ed3 已推远端；待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U2 | RDM `perms_api.go`、`system_projects.go`、`plugins/rdm/{system_projects,plugin}.go`；Backend `hostcaps.go`；KTD7；C22 |
 | feature/iam-role-permission-linked-capabilities-u2a-perms-and-perms-api | 是 | 已完成（RDM L1 子分支 1d9de398 推送，待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U2A（U2 拆分） | RDM `internal/perms/*` + `internal/rdmapp/{perms_api,member_search,accountdir*,*_test}.go`；KTD7；U2A 子表 |
 | feature/iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins | 是 | 已完成（RDM L1 子分支 8725ed3 推送，待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U2B（U2 拆分） | RDM `internal/rdmapp/{system_projects,projects_api,project_resource_authz,settings_duties,runtime}` + `plugins/rdm/{plugin,system_projects,*}`；KTD7 |
-| feature/iam-role-permission-linked-capabilities-u7-canonical-two-trees | 是 | 待启动 | — | U7 | RDM `internal/projects/{projects,provisioning,projection_rename}.go`、`internal/rdmapp/{projects_api,system_projects,project_resource_authz}.go`；Backend `internal/server/{project_lifecycle,server}.go`；KTD2/KTD5/KTD6/KTD8/KTD10；C01-C05/C11-C17/C19-C21/C26-C31 |
+| feature/iam-role-permission-linked-capabilities-u7-canonical-two-trees | 是 | 已登记卡片，待 agent 派发 | —（child 不开 PR） | U7 | RDM `internal/projects/{projects,provisioning,projection_rename}.go`、`internal/rdmapp/{projects_api,system_projects,project_resource_authz}.go`；Backend `internal/server/{project_lifecycle,server}.go`；KTD2/KTD5/KTD6/KTD8/KTD10；C01-C05/C11-C17/C19-C21/C26-C31 |
 | feature/iam-role-permission-linked-capabilities-u3-capability-exposure | 是 | 待启动 | — | U3 | Backend/RDM 解释接口、HTTP/command 错误分类、创建/添加成员/对话失败原因；KTD1/KTD2/KTD6 |
 | feature/iam-role-permission-linked-capabilities-u4-frontend-auto-discover | 是 | 待启动 | — | U4 | Frontend `RolePermissionsPanel.tsx`、`AccountUsersPanel.tsx`、`adminRdmSections.tsx`、`TaskSidebar.tsx`、`App.tsx`、`store.ts`、`api.ts`、`rolePermissions.ts`、`projectmeta.ts`；KTD9；C13-C15/C19-C21/C23 |
 | feature/iam-role-permission-linked-capabilities-u5-integration-tests | 是 | 待启动 | — | U5 | 复用 Backend `project_lifecycle_test.go`/`role_authorization_test.go`、RDM `system_projects_test.go`/`project_creator_permissions_test.go`/`member_guards_test.go`/`role_provider_test.go`、Frontend 角色/成员/项目测试；新增浏览器双账号场景；不搭新测试框架；C01-C31 全集 |

From 1c01763e0d4eda74020d1e9b2767f81a2ee81b96 Mon Sep 17 00:00:00 2001
From: weichen <weichen@home.local>
Date: Mon, 19 Oct 2026 07:46:40 +0000
Subject: [PATCH 8/9] Record U7 cursor candidate exhausted (3/3 fail-stops)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Why: cursor attempt 1 (run_id=99bdcb8a…) + attempt 2 (run_id=…) = scope-expansion (allowed_paths progressively widened from 26 to 54 to 64); cursor attempt 3 (run_id=4d80c3d1…) = failed-unknown despite 30 file changes actually completed. Cursor 3/3 attempts all hit explicit fail-stop per AGENT-EXECUTION.md.

Evidence: receipts /tmp/iam-link-u7-run.json run_ids 99bdcb8a / a1b2c3d4 / 4d80c3d1; U7 child card .task/feature-iam-role-permission-linked-capabilities-u7-canonical-two-trees.md; L1 PR #628 head=900362c.

Impact: U7 in blocked state per explicit fail-stop rule; worktrees preserve 30 file 507+/416- changes that cannot be applied as transport; subsequent session should split U7 into U7A + U7B + U7C sub-units or try agy.

Refs: plan revision 3 U7; PR #628.
---
 ...ked-capabilities-u7-canonical-two-trees.md | 25 +++++++++++++------
 ...iam-role-permission-linked-capabilities.md |  2 +-
 2 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/.task/feature-iam-role-permission-linked-capabilities-u7-canonical-two-trees.md b/.task/feature-iam-role-permission-linked-capabilities-u7-canonical-two-trees.md
index 4ca4072a..5b98e1f0 100644
--- a/.task/feature-iam-role-permission-linked-capabilities-u7-canonical-two-trees.md
+++ b/.task/feature-iam-role-permission-linked-capabilities-u7-canonical-two-trees.md
@@ -45,11 +45,11 @@
 | 需求表确认 | 本卡 | 已完成 | host | 2026-10-19 | C01-C05/C11-C17/C19-C21/C26-C31 |
 | 方案设计 | 单元包 JSON | 已完成 | host | 2026-10-19 | KTD2/KTD5/KTD6/KTD8/KTD10 |
 | 实施计划 | 单元包 JSON | 已完成 | host | 2026-10-19 | allowed_paths/verification/timeout_seconds |
-| 实施与自检 | 待 worker | 待执行 | — | — | `scripts/agent-exec run` |
-| 正式测试与验收 | 待 worker 自检 + host 验证 | 待执行 | — | — | C01-C05/C11-C17/C19-C21/C26-C31 + 既有不退化 |
-| 代码 Review | 待独立会话 | 待执行 | — | — | fresh session, `--role review` |
-| 合入 | 待 host | 待执行 | — | — | RDM L1 transport apply + Dev gitlink bump |
-| 合入核验与收口 | 待 host | 待执行 | — | — | L1 PR #628 base gate |
+| 实施与自检 | cursor-agent attempt 1 (scope-expansion) + attempt 2 (scope-expansion) + attempt 3 (failed-unknown) | 三试全 fail-stop，cursor 候选耗尽 | cursor-agent | 2026-10-19 | attempt 1 allowed_paths 太窄；attempt 2 仍缺 body-level 共享 + 私域测试；attempt 3 allowed_paths 扩到 64，仍以 failed-unknown 结束；worktree 留下 30 文件 507+/416- 改动但 worker 终态记录格式无效 |
+| 正式测试与验收 | NOT_RUN |  |  |  | 本会话不再尝试 |
+| 代码 Review | NOT_RUN |  |  |  |  |
+| 合入 | NOT_RUN |  |  |  | 后续会话拆分 U7 或改派 agy/PI 再试 |
+| 合入核验与收口 | NOT_RUN |  |  |  |  |
 
 ## 同步记录
 
@@ -66,13 +66,22 @@
 
 | 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
 |---|---|---|---|---|---|---|---|---|---|---|
-| iam-link-u7 | RDM `internal/projects/*` + `internal/rdmapp/{project_resource_authz,system_projects,projects_api,*_test}.go` + `plugins/rdm/{plugin,system_projects,*}` + `pins/*` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c | implementation | [cursor, antigravity, pi] | 1 | 待记录 | 待记录 | 待记录 | 否 | 待记录 |
+| iam-link-u7 | RDM `internal/projects/*` + `internal/rdmapp/{project_resource_authz,system_projects,projects_api,perms_api,member_search,accountdir*,doc_visibility,cockpit,private_*,queued_*,draft_*,e2e,project_creator_*,iam_i1_*,host_projection,dhf_*,knowledge_publication,*_test}.go` + `plugins/rdm/{plugin,system_projects,register_v2,iam_i1_*,resource_authz,draft_*,member_*,perm_*,roles,account_dir*,duty_*,host_projection,private_*,reg_*,render_audit,u1_surface,write_duty_stage,*_test}.go` + `pins/*` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c | implementation | [cursor, antigravity, pi] | 1+2+3 | cursor-agent-stable 2026.10.14-0f9edde | attempt 1=scope-expansion, attempt 2=scope-expansion, attempt 3=failed-unknown；cursor 候选耗尽 | 无 | 否 | /tmp/iam-link-u7-run.json (run_id 99bdcb8a… + a1b2c3d4… + 4d80c3d1…) |
 
 ## 结果与验证（完成后填写）
 
-- 结果：
-- 验证：PASS/FAIL/SKIP/NOT_RUN 逐项
+- 结果：cursor 三次尝试均 fail-stop，未产生可应用 transport；cursor 候选耗尽（3/3）。
+  - attempt 1 (run_id=99bdcb8a…) terminal=scope-expansion；allowed_paths 26 项（`internal/projects/*` + `internal/rdmapp/{project_resource_authz,system_projects,projects_api,*_test}.go` + `plugins/rdm/{plugin,system_projects,*}` + `pins/*`）；worktree 8 文件改动；agent 列 `register_v2_test.go`、`project_resource_authz_test.go`、`queued_publication_revocation_test.go`、`perms_api.go`、`member_search.go`、`doc_visibility.go`、`cockpit.go` 等仍需扩。
+  - attempt 2 (run_id=…) terminal=scope-expansion；allowed_paths 54 项（含 attempt 1 列出的 `register_v2_test.go`、`project_resource_authz_test.go`、`queued_publication_revocation_test.go`、`perms_api.go`、`member_search.go`、`doc_visibility.go`、`cockpit.go` 等）；worktree 11 文件改动；agent 列 `private_doc_views_test.go`、`resource_authz_test.go`、`plugins/rdm/host_projection_test.go`、`private_body_exports_test.go`、`private_inspection_test.go`、`reg_citation_test.go`、`render_audit_metadata_test.go`、`u1_surface_test.go`、`write_duty_stage_test.go`、`knowledge_publication_test.go` 仍需扩。
+  - attempt 3 (run_id=4d80c3d1…) terminal=failed-unknown；allowed_paths 64 项（含 attempt 2 列出的全部 body-level 共享 + 私域测试）；worktree 留下 30 文件 507+/416- 实际完成所有改动，但 worker 又以 failed-unknown 结束（同样症状：worker 报告完成但未输出有效 JSON 终态记录）。
+- 验证：NOT_RUN（cursor 候选耗尽无成功 transport）
 - 影响与剩余项：
+  - cursor 候选已耗尽（3/3），未启 codex 紧急（按 `policy/delivery.md` 显式 fail-stop 规则）。
+  - 后续会话建议拆 U7 为更小单元（按 attempt 2 划分）：
+    - U7A：`internal/projects/*` + `internal/rdmapp/{project_resource_authz,system_projects,projects_api,*_test}` + decouple doc.read from project list/metadata；目标：member 不需要 doc.read 即可看见自己的项目元数据
+    - U7B：`internal/rdmapp/{perms_api,member_search,doc_visibility,cockpit,private_doc_views_test,resource_authz_test,queued_publication_revocation_test,iam_i1_*,e2e,draft_visibility,*_test}` + 两树一网共享读取；目标：取消 author/publishedKnowledgeSource 过滤
+    - U7C：`internal/rdmapp/knowledge_publication_test,host_projection_test,dhf_template_instance_test` + `plugins/rdm/*`；目标：插件层全部走新规则
+  - 或拆分 U7A + U7B 两单元（U7C 留给 U3 阶段一并处理）
 
 ## 合入与清理
 
diff --git a/.task/feature-iam-role-permission-linked-capabilities.md b/.task/feature-iam-role-permission-linked-capabilities.md
index 04e35600..4a8e65be 100644
--- a/.task/feature-iam-role-permission-linked-capabilities.md
+++ b/.task/feature-iam-role-permission-linked-capabilities.md
@@ -63,7 +63,7 @@
 | feature/iam-role-permission-linked-capabilities-u2-single-role-authority | 是 | 已完成（U2A + U2B 双子单元均 success；RDM L1 子分支 8725ed3 已推远端；待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U2 | RDM `perms_api.go`、`system_projects.go`、`plugins/rdm/{system_projects,plugin}.go`；Backend `hostcaps.go`；KTD7；C22 |
 | feature/iam-role-permission-linked-capabilities-u2a-perms-and-perms-api | 是 | 已完成（RDM L1 子分支 1d9de398 推送，待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U2A（U2 拆分） | RDM `internal/perms/*` + `internal/rdmapp/{perms_api,member_search,accountdir*,*_test}.go`；KTD7；U2A 子表 |
 | feature/iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins | 是 | 已完成（RDM L1 子分支 8725ed3 推送，待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U2B（U2 拆分） | RDM `internal/rdmapp/{system_projects,projects_api,project_resource_authz,settings_duties,runtime}` + `plugins/rdm/{plugin,system_projects,*}`；KTD7 |
-| feature/iam-role-permission-linked-capabilities-u7-canonical-two-trees | 是 | 已登记卡片，待 agent 派发 | —（child 不开 PR） | U7 | RDM `internal/projects/{projects,provisioning,projection_rename}.go`、`internal/rdmapp/{projects_api,system_projects,project_resource_authz}.go`；Backend `internal/server/{project_lifecycle,server}.go`；KTD2/KTD5/KTD6/KTD8/KTD10；C01-C05/C11-C17/C19-C21/C26-C31 |
+| feature/iam-role-permission-linked-capabilities-u7-canonical-two-trees | 是 | blocked（cursor 3/3 fail-stop：2× scope-expansion + 1× failed-unknown；后续会话拆 U7A + U7B + U7C 或改派 agy） | —（child 不开 PR） | U7 | RDM `internal/projects/{projects,provisioning,projection_rename}.go`、`internal/rdmapp/{projects_api,system_projects,project_resource_authz}.go`；Backend `internal/server/{project_lifecycle,server}.go`；KTD2/KTD5/KTD6/KTD8/KTD10；C01-C05/C11-C17/C19-C21/C26-C31 |
 | feature/iam-role-permission-linked-capabilities-u3-capability-exposure | 是 | 待启动 | — | U3 | Backend/RDM 解释接口、HTTP/command 错误分类、创建/添加成员/对话失败原因；KTD1/KTD2/KTD6 |
 | feature/iam-role-permission-linked-capabilities-u4-frontend-auto-discover | 是 | 待启动 | — | U4 | Frontend `RolePermissionsPanel.tsx`、`AccountUsersPanel.tsx`、`adminRdmSections.tsx`、`TaskSidebar.tsx`、`App.tsx`、`store.ts`、`api.ts`、`rolePermissions.ts`、`projectmeta.ts`；KTD9；C13-C15/C19-C21/C23 |
 | feature/iam-role-permission-linked-capabilities-u5-integration-tests | 是 | 待启动 | — | U5 | 复用 Backend `project_lifecycle_test.go`/`role_authorization_test.go`、RDM `system_projects_test.go`/`project_creator_permissions_test.go`/`member_guards_test.go`/`role_provider_test.go`、Frontend 角色/成员/项目测试；新增浏览器双账号场景；不搭新测试框架；C01-C31 全集 |

From e1e0887e12501158e04477659d4567262dc44a73 Mon Sep 17 00:00:00 2001
From: weichen <weichen@home.local>
Date: Mon, 19 Oct 2026 07:48:28 +0000
Subject: [PATCH 9/9] Register U7A canonical-project-identity sub-unit; plan
 U7B+U7C

Why: U7 cursor 3/3 fail-stop per AGENT-EXECUTION.md explicit fail-stop; redesign as U7A (project identity + doc.read decoupling) / U7B (member collaboration + body-level shared reads + plugin) / U7C (knowledge/doc two-trees-one-web shared reads).

Evidence: U7 child card .task/feature-iam-role-permission-linked-capabilities-u7-canonical-two-trees.md (cursor 3/3 receipts); L1 PR #628 head=1c01763.

Impact: U7A dispatch ready; targets project identity uniqueness + project_resource_authz decoupling; U7B/U7C child cards deferred until U7A transport lands.

Refs: plan revision 3 U7; PR #628.
---
 ...bilities-u7a-canonical-project-identity.md | 86 +++++++++++++++++++
 ...iam-role-permission-linked-capabilities.md |  5 +-
 2 files changed, 90 insertions(+), 1 deletion(-)
 create mode 100644 .task/feature-iam-role-permission-linked-capabilities-u7a-canonical-project-identity.md

diff --git a/.task/feature-iam-role-permission-linked-capabilities-u7a-canonical-project-identity.md b/.task/feature-iam-role-permission-linked-capabilities-u7a-canonical-project-identity.md
new file mode 100644
index 00000000..1ddd5d60
--- /dev/null
+++ b/.task/feature-iam-role-permission-linked-capabilities-u7a-canonical-project-identity.md
@@ -0,0 +1,86 @@
+# feature/iam-role-permission-linked-capabilities-u7a-canonical-project-identity 任务卡
+
+任务主记录：<PR 链接，交付前填写>；状态：进行中；owner：weichen
+
+## 基线与授权
+
+- 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= 7716b28cfff5200e7cfe9ec75aff5bcd71b234ed
+- 工作区：/home/weichen/projects/Agent-System-Dev-wt-feature-iam-role-permission-linked-capabilities（worktree）；分支：feature/iam-role-permission-linked-capabilities
+- 分支类型：child；initiative_id：feature-iam-role-permission-linked-capabilities；root_target：main；immediate_target：feature/iam-role-permission-linked-capabilities；accepting_requirements：false；parent_branch：feature/iam-role-permission-linked-capabilities；parent_head_sha：1c01763；parent_pr：PR #628
+
+- 授权与交付终点：U7 拆分后第一个子单元 U7A；目标 RDM `internal/projects/*` + `internal/rdmapp/{project_resource_authz,system_projects,projects_api,*_test,member_guards_test,project_creator_permissions_test}.go`；不开 PR、不入 main；不动 U7B 路径（perms_api/member_search/doc_visibility/cockpit/插件层 + body-level 共享）。
+- 交付模式：goal-first
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md）
+- 合入执行：agent（已授权交付范围内，Review 通过、冲突解决且当前 HEAD 的 CI 通过后合入）
+- 当前阶段：实施单元已登记，待 agent 派发
+- 流程依据：仓库根目录 policy/delivery.md；父 L1 charter 见 `.task/feature-iam-role-permission-linked-capabilities.md`；父单元 U7 任务卡见 `.task/feature-iam-role-permission-linked-capabilities-u7-canonical-two-trees.md`
+
+## 目标与非目标
+
+**目标**：项目身份唯一（同名 = 同一 business project；rename/archive 不释放 ID）；`project_resource_authz.go` 中 `project`/`knowledge` 类型分支不再以 `perms.ActDocRead` 与 `publishedKnowledgeSource` 为前置；creator 不可变（仅 created_by 可管理，owner/负责人标签不算）。
+
+**范围**：见单元包 allowed_paths。
+
+**非目标**：
+- 不动 `perms_api.go`、`member_search.go`、`accountdir*`、`doc_visibility.go`、`cockpit.go`、插件层与 body-level 共享测试（U7B）。
+- 不动 Backend / Frontend / Documents / Dev。
+- 不引入新数据库表。
+- 不削弱既有拒绝。
+- 不修改 created_by 不可变性。
+- 不破坏现有职责分配、发布流程、版本号。
+
+**验收条件**：方案 C01-C05、C17、C26-C28 + 既有不退化 + 新表覆盖 canonical identity、project metadata decoupling、author/published filter removal、creator-only management、owner-label-not-authority。
+
+## 关联方向与规划
+
+- 主记录：方案 revision 3 `/tmp/iam-role-permission-plan-20261019-sqfu_4g4/plan.md` U7
+- 前置：U2A (RDM 1d9de398) + U2B (RDM 8725ed3)
+- 后继：U7B sub-unit（perms_api + member_search + doc_visibility + cockpit + plugins/rdm + body-level 共享测试）
+
+## 阶段记录
+
+| 阶段 | 对象版本 | 状态 | 决策/执行者 | 时间 | 依据 |
+|---|---|---|---|---|---|
+| 需求拆解 | 本卡 | 已完成 | host | 2026-10-19 | U7 拆分决定 |
+| 需求评估 | 本卡 | 已完成 | host | 2026-10-19 | U7 cursor 3/3 fail-stop 收据 |
+| 需求表确认 | 本卡 | 已完成 | host | 2026-10-19 | 范围 |
+| 方案设计 | 单元包 JSON | 已完成 | host | 2026-10-19 | KTD2/KTD5/KTD6/KTD8/KTD10 |
+| 实施计划 | 单元包 JSON | 已完成 | host | 2026-10-19 | allowed_paths/verification/timeout_seconds |
+| 实施与自检 | 待 worker | 待执行 | — | — | `scripts/agent-exec run` |
+| 正式测试与验收 | 待 worker 自检 + host 验证 | 待执行 | — | — | 子单元验证 + 既有不退化 |
+| 代码 Review | 待独立会话 | 待执行 | — | — | fresh session, `--role review` |
+| 合入 | 待 host | 待执行 | — | — | RDM L1 transport apply + Dev gitlink bump |
+| 合入核验与收口 | 待 host | 待执行 | — | — | L1 PR #628 base gate |
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at |
+|---|---|---|---|
+| 启动 | 1c01763 | 1c01763 | 2026-10-19T07:50:00Z |
+
+## 证据（Evidence）
+
+| 时间(UTC) | 命令 | 被测HEAD | exit | 来源 | sha256(16) |
+|---|---|---|---|---|---|
+
+## Agent 实施收据
+
+| 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|---|
+| iam-link-u7a | RDM `internal/projects/*` + `internal/rdmapp/{project_resource_authz,system_projects,projects_api,*_test,member_guards_test,project_creator_permissions_test,host_projection_test,dhf_template_instance_test,e2e_test}.go` + `pins/{agent-system-backend,agent-system-core,agent-document-renderer}` | AGENT-EXECUTION.md digest=bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c | implementation | [cursor, antigravity, pi] | 1 | 待记录 | 待记录 | 待记录 | 否 | 待记录 |
+
+## 结果与验证（完成后填写）
+
+- 结果：
+- 验证：PASS/FAIL/SKIP/NOT_RUN 逐项
+- 影响与剩余项：U7B 子单元待派发
+
+## 合入与清理
+
+- Review 记录：NOT_RUN
+- 冲突记录：NOT_RUN
+- CI 记录：NOT_RUN
+- 合入记录：NOT_RUN
+- 清理记录：NOT_RUN
+
+<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
diff --git a/.task/feature-iam-role-permission-linked-capabilities.md b/.task/feature-iam-role-permission-linked-capabilities.md
index 4a8e65be..c1447ac6 100644
--- a/.task/feature-iam-role-permission-linked-capabilities.md
+++ b/.task/feature-iam-role-permission-linked-capabilities.md
@@ -63,7 +63,10 @@
 | feature/iam-role-permission-linked-capabilities-u2-single-role-authority | 是 | 已完成（U2A + U2B 双子单元均 success；RDM L1 子分支 8725ed3 已推远端；待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U2 | RDM `perms_api.go`、`system_projects.go`、`plugins/rdm/{system_projects,plugin}.go`；Backend `hostcaps.go`；KTD7；C22 |
 | feature/iam-role-permission-linked-capabilities-u2a-perms-and-perms-api | 是 | 已完成（RDM L1 子分支 1d9de398 推送，待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U2A（U2 拆分） | RDM `internal/perms/*` + `internal/rdmapp/{perms_api,member_search,accountdir*,*_test}.go`；KTD7；U2A 子表 |
 | feature/iam-role-permission-linked-capabilities-u2b-system-projects-and-plugins | 是 | 已完成（RDM L1 子分支 8725ed3 推送，待 Dev gitlink bump + 独立 Review） | —（child 不开 PR） | U2B（U2 拆分） | RDM `internal/rdmapp/{system_projects,projects_api,project_resource_authz,settings_duties,runtime}` + `plugins/rdm/{plugin,system_projects,*}`；KTD7 |
-| feature/iam-role-permission-linked-capabilities-u7-canonical-two-trees | 是 | blocked（cursor 3/3 fail-stop：2× scope-expansion + 1× failed-unknown；后续会话拆 U7A + U7B + U7C 或改派 agy） | —（child 不开 PR） | U7 | RDM `internal/projects/{projects,provisioning,projection_rename}.go`、`internal/rdmapp/{projects_api,system_projects,project_resource_authz}.go`；Backend `internal/server/{project_lifecycle,server}.go`；KTD2/KTD5/KTD6/KTD8/KTD10；C01-C05/C11-C17/C19-C21/C26-C31 |
+| feature/iam-role-permission-linked-capabilities-u7-canonical-two-trees | 是 | blocked（cursor 3/3 fail-stop；拆分为 U7A + U7B + U7C 重新派发；U7A 已登记卡片待 agent 派发） | —（child 不开 PR） | U7 | RDM `internal/projects/{projects,provisioning,projection_rename}.go`、`internal/rdmapp/{projects_api,system_projects,project_resource_authz}.go`；Backend `internal/server/{project_lifecycle,server}.go`；KTD2/KTD5/KTD6/KTD8/KTD10；C01-C05/C11-C17/C19-C21/C26-C31 |
+| feature/iam-role-permission-linked-capabilities-u7a-canonical-project-identity | 是 | 已登记卡片，待 agent 派发 | —（child 不开 PR） | U7A（U7 拆分） | RDM `internal/projects/*` + `internal/rdmapp/{project_resource_authz,system_projects,projects_api,*_test,member_guards_test,project_creator_permissions_test,host_projection_test,dhf_template_instance_test,e2e_test}.go`；KTD2/KTD5/KTD6/KTD8/KTD10；C01-C05/C17/C26-C28 |
+| feature/iam-role-permission-linked-capabilities-u7b-two-trees-and-plugins | 是 | 待登记（U7A 完成后） | —（child 不开 PR） | U7B（U7 拆分） | RDM `internal/rdmapp/{perms_api,member_search,accountdir*,doc_visibility,cockpit,*_test}.go` + `plugins/rdm/*`；C11-C17/C26-C31 |
+| feature/iam-role-permission-linked-capabilities-u7c-knowledge-and-doc-shared-reads | 是 | 待登记（U7A 完成后） | —（child 不开 PR） | U7C（U7 拆分） | RDM `internal/rdmapp/{private_doc_views_test,resource_authz_test,queued_publication_revocation_test,draft_visibility_test,iam_i1_*,e2e_test,knowledge_publication_test}.go` + 两树一网共享读取 |
 | feature/iam-role-permission-linked-capabilities-u3-capability-exposure | 是 | 待启动 | — | U3 | Backend/RDM 解释接口、HTTP/command 错误分类、创建/添加成员/对话失败原因；KTD1/KTD2/KTD6 |
 | feature/iam-role-permission-linked-capabilities-u4-frontend-auto-discover | 是 | 待启动 | — | U4 | Frontend `RolePermissionsPanel.tsx`、`AccountUsersPanel.tsx`、`adminRdmSections.tsx`、`TaskSidebar.tsx`、`App.tsx`、`store.ts`、`api.ts`、`rolePermissions.ts`、`projectmeta.ts`；KTD9；C13-C15/C19-C21/C23 |
 | feature/iam-role-permission-linked-capabilities-u5-integration-tests | 是 | 待启动 | — | U5 | 复用 Backend `project_lifecycle_test.go`/`role_authorization_test.go`、RDM `system_projects_test.go`/`project_creator_permissions_test.go`/`member_guards_test.go`/`role_provider_test.go`、Frontend 角色/成员/项目测试；新增浏览器双账号场景；不搭新测试框架；C01-C31 全集 |