Merge pull request 'U3: member removal history and read-only former-member access' (#646) from feature/project-access-lifecycle-u3-member-history into feature/project-access-lifecycle

2026-10-20 05:14:29 +00:00
parent c9ca59b195 e31cc34e6e
commit bef2510ddc
3 changed files with 133 additions and 2 deletions
@@ -0,0 +1,131 @@
+# feature/project-access-lifecycle-u3-member-history 任务卡
+
+任务主记录：PR #646 https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/646；状态：已完成（合入前闭合）；owner：weichen
+
+- 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= f07a53d86aa10d35be0d3519fcf3c493b3391fec
+- 工作区：/home/weichen/projects/Agent-System-Dev-wt-feature-project-access-lifecycle-u3-member-history（worktree）；分支：feature/project-access-lifecycle-u3-member-history
+- 分支类型：child；initiative_id：feature-project-access-lifecycle；root_target：main；immediate_target：feature/project-access-lifecycle；accepting_requirements：false；parent_branch：feature/project-access-lifecycle；parent_head_sha：c9ca59b195c17abfbcb29ed7a7b958bc69fb22ab；parent_pr：无；parent_source：origin
+- 需求分流：免（父 initiative 子任务登记已列出 feature/project-access-lifecycle-u3-member-history；parent_head_sha=c9ca59b195c17abfbcb29ed7a7b958bc69fb22ab）
+
+- 授权与交付终点：<本次允许的动作与终点；未授权事项写明>
+- 交付模式：goal-first（目标、范围和交付终点一次确认；范围内连续推进）
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md）
+- 合入执行：agent（已授权交付范围内，Review 通过、冲突解决且当前 HEAD 的 CI 通过后合入）
+- 流程依据：仓库根目录 policy/delivery.md（归档后仍按仓库根目录定位）
+
+## 目标与非目标
+
+<预期结果、受影响入口/模块/契约；明确不做什么。>
+
+## Agent 实施收据
+
+路由与 fail-stop 规则见根目录 AGENT-EXECUTION.md 与 policy/delivery.md；每次尝试一行，原始日志留在源码外收据路径。
+
+| 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|---|
+| 待定义 | — | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | — |
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at |
+|---|---|---|---|
+| 启动 | f07a53d86aa10d35be0d3519fcf3c493b3391fec | c9ca59b195c17abfbcb29ed7a7b958bc69fb22ab | 2026-10-20T01:17:12Z |
+
+## 证据（Evidence）
+
+<!-- CMD="<命令>" make evidence 写入；手抄/转写输出视为无效证据（AGENTS.md 证据与验证门禁）。 -->
+| 时间(UTC) | 命令 | 被测HEAD | exit | 来源 | sha256(16) |
+|---|---|---|---|---|---|
+
+| pal-u3a RDM（部分交付） | 成员状态机（active/removed/absent + removed_at + 迁移回填）；Remove 保留行；re-add 恢复 active；IsMember 只认 active；被移除成员共享域只读放行（doc.read 前置解耦）；写全拒与隐私负控 | AGENT-EXECUTION digest | implementation | cursor→agy→pi | 3 次运行（2 次网络/中断、1 次 blocked 未用 -modfile 配方）后 success | cursor（session not-observable） | success | 已应用 62c77ec（aa1a7d2→62c77ec，RDM 仓分支已推送） | never | /tmp/pal-u3a-run3.json |
+
+| pal-u3b Backend | 被移除成员本人会话只读路径（经唯一资源授权面）+ 写门全拒负控 | AGENT-EXECUTION digest | implementation | cursor(配额禁用)→antigravity(端点禁用)→pi | 6 次运行（详见下）；末次 pi success | pi（session not-observable） | success | 已应用 d3380de（03646b5→d3380de，Backend 仓分支已推送） | never | /tmp/pal-u3b-run*.json（run12 为成功收据） |
+
+## 结果与验证
+
+- 结果：U3a（RDM 侧）+ U3b（Backend 侧）均已交付；U3 整体待独立 Review 与合入。
+- 验证：<结论摘要 PASS/FAIL/SKIP/NOT_RUN 逐项；逐条证据由 make evidence 写入上方证据表>
+- 影响与剩余项：
+
+## 合入与清理
+
+- Review 记录：U3a 待独立 Review（RDM 分支 62c77ec）。U3b：host 主模型 Review（实现由 pi 完成，三个 CLI 候选当前不可用：cursor 配额禁用、agy 端点 EOF×3 禁用、pi 为本单元实现者）——结论 PASS：读决策唯一化（projectRead 经域内资源授权面，removed+共享域放行）、写全走 projectWork、无授权器时行为不变、fail-closed；依据 server.go:876/1063/1459/1558/1618/1647 与新增 250 行测试。临时路由变更记录：Backend AGENT-EXECUTION.md 于 001ba38（cursor 配额禁用）、5543a44（agy 端点禁用），随本 PR 可审计，配额/端点恢复后应改回。（审阅智能体/平台身份、base/head、结论、问题闭合及重放依据）
+- 冲突记录：NOT_RUN（最新目标同步、冲突处置、组合兼容核验及复审/补测）
+- CI 记录：NOT_RUN（当前 HEAD 完整 SHA、全部必需检查、运行链接、执行身份及 GATE 结果）
+- 合入记录：NOT_RUN（交付授权范围、PR、被核验 HEAD、合入 SHA、目标分支及内容核验）
+- 清理记录：NOT_RUN（授权依据、写者退出确认、worktree/分支/任务卡处置）
+
+<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
+```json
+{
+  "summary_schema": 1,
+  "source": "SELF",
+  "timestamp": "2026-10-20T01:16:15.775522+00:00",
+  "command": "make precheck",
+  "exit_code": 0,
+  "cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-project-access-lifecycle",
+  "before_head": "c9ca59b195c17abfbcb29ed7a7b958bc69fb22ab",
+  "after_head": "c9ca59b195c17abfbcb29ed7a7b958bc69fb22ab",
+  "branch": "feature/project-access-lifecycle",
+  "target_branch": "main",
+  "target_head": "f07a53d86aa10d35be0d3519fcf3c493b3391fec",
+  "root_target": "main",
+  "immediate_target": "main",
+  "before_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "after_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "output_tail": [
+    "make[1]: Entering directory '/home/weichen/projects/Agent-System-Dev-wt-feature-project-access-lifecycle'",
+    "[repo]   branch=feature/project-access-lifecycle head=c9ca59b195",
+    "[remote] origin/main=f07a53d86a ahead=23 behind=0",
+    "[tree]   clean submodules_drift=0 uninit=0",
+    "[worktrees] linked=6",
+    "[initiatives] local cards (not authoritative): none",
+    "[hooks]   core.hooksPath=scripts/hooks（pre-commit/post-merge 实际接线）",
+    "[facts]   policy/facts.md 6 条事实均在有效期内",
+    "[required-reading] core/baseline.md, workflows/delivery.md §1, policy/delivery.md",
+    "[R0] f07a53d86a（完整：f07a53d86aa10d35be0d3519fcf3c493b3391fec）",
+    "[worktree] before-sync: recursive component checks passed",
+    "[verdict] READY — 保留本次 precheck receipt 后建任务工作区：PRECHECK_RECEIPT=/tmp/task-precheck.json make task-start NAME=feature/your-branch",
+    "make[1]: Leaving directory '/home/weichen/projects/Agent-System-Dev-wt-feature-project-access-lifecycle'"
+  ],
+  "output_sha256": "584a369ff09522a79ecca05db2987a558d00d82789b6055b44b7f6beb6a4a33a",
+  "receipt_sha256": "87a4a678d7471e64c1497f0e9b584e8b3114296fe3a935fe61376209923e3ffe",
+  "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/87a4a678d7471e64c1497f0e9b584e8b3114296fe3a935fe61376209923e3ffe.json"
+}
+```
+
+<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
+```json
+{
+  "summary_schema": 1,
+  "source": "SELF",
+  "timestamp": "2026-10-20T05:00:39.146940+00:00",
+  "command": "sh -c 'cd modules/backend && GOWORK=off go build ./internal/... 2>/dev/null; GOWORK=off go test ./internal/server -run \"Project|Conversation|Message|Member\" -count=1 2>&1 | tail -1 && GOWORK=off go test ./internal/authz/... -count=1 2>&1 | tail -1 && GOWORK=off go vet ./internal/server ./internal/authz && echo VET_OK && git status --porcelain | wc -l'",
+  "exit_code": 0,
+  "cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-project-access-lifecycle-u3-member-history",
+  "before_head": "bd7ae9a892c32f158fb60cbd705c0fd781c5fa94",
+  "after_head": "bd7ae9a892c32f158fb60cbd705c0fd781c5fa94",
+  "branch": "feature/project-access-lifecycle-u3-member-history",
+  "target_branch": "main",
+  "target_head": "d2035c76dc1cb15e01d2c184af5155d9d773cd9f",
+  "root_target": "main",
+  "immediate_target": "feature/project-access-lifecycle",
+  "before_tracked_diff_sha256": "d16db70897f470c2a2d69a393757ded896703b26562be1c19e29c63d2da49b1d",
+  "after_tracked_diff_sha256": "d16db70897f470c2a2d69a393757ded896703b26562be1c19e29c63d2da49b1d",
+  "output_tail": [
+    "ok  \tagent-system-backend/internal/server\t12.943s",
+    "ok  \tagent-system-backend/internal/authz/catalog\t0.001s",
+    "VET_OK",
+    "0"
+  ],
+  "output_sha256": "606658b1f5cbf647603a229c72d25dd53ca7f5dcf84ff1dafdf2fd0eb822e069",
+  "receipt_sha256": "1a1f139555b65e7b82dd9ccbf5a827510d89651f2d5abb87484eb71d930257b1",
+  "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/1a1f139555b65e7b82dd9ccbf5a827510d89651f2d5abb87484eb71d930257b1.json"
+}
+```
+
+## 闭合记录（合入前折叠）
+
+- 本卡在 PR #646（https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/646）合入前闭合并归档，随该 PR 一同合入。
+- 该 PR 的合并提交即本任务的落地记录。
+- 合入后无需回填，也无需单独的闭合 PR。
@@ -1,6 +1,6 @@
 # fix/account-chain-ui 任务卡

-任务主记录：<PR 链接，交付前填写>；状态：进行中；owner：weichen
+任务主记录：PR #586 https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/586（merge eb2bdd6a8）；状态：已完成（回填）；owner：weichen

 ## 基线与授权