From 2fcf03a4244755be1b2d5cfc7620ffd1a190a810 Mon Sep 17 00:00:00 2001 From: weichen Date: Tue, 20 Oct 2026 07:20:13 +0000 Subject: [PATCH] Record IAM U1-U7 implementation completion with binary migration verification Why: document L1 implementation completion with 14 successful implementation units, 8 PRs merged across 4 component repos, real binary migration verification of U1 + U3A features. Refs: /tmp/iam-role-permission-plan-20261019-sqfu_4g4/plan.md revision 3; PR #643 Dev L1; PR #219/#222 Backend; PR #450/#452/#453 RDM; PR #115/#118 Frontend; Agent-System-Dev main ac594c9. --- ...6-10-19-iam-u1-u7-implementation-record.md | 71 +++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 docs/records/2026-10-19-iam-u1-u7-implementation-record.md diff --git a/docs/records/2026-10-19-iam-u1-u7-implementation-record.md b/docs/records/2026-10-19-iam-u1-u7-implementation-record.md new file mode 100644 index 0000000..5df9b16 --- /dev/null +++ b/docs/records/2026-10-19-iam-u1-u7-implementation-record.md @@ -0,0 +1,71 @@ +# IAM U1-U7 实施完成记录（SELF，2026-10-19） + +来源标注：**SELF**（本机 isolation stack 执行；非 CI GATE、非独立 REPLAY）。L1 全量 14 个实施单元已落地并经 `make test` / `npm run build` / vitest 验证。 + +## 1. 实施总览 + +| 单元 | 范围 | 实施 | 落地 | +|---|---|---|---| +| **U1** capability-association | Backend | cursor-agent attempt 1 = success | Backend main `3f4b34a` (PR #219) | +| **U2A** perms-and-perms-api | RDM | cursor-agent attempt 1 = failed-unknown, attempt 2 = success | RDM main `5a27d78` (PR #450) | +| **U2B** system-projects-and-plugins | RDM | cursor-agent attempt 1 = success | RDM main `5a27d78` (PR #450) | +| **U3A** backend-capability-explanation | Backend | cursor-agent attempt 1 = success | Backend main `3f4b34a` (PR #219) | +| **U3B** rdm-projectfailure-integration | RDM | 重派后 cursor-agent attempt 1 = success（picks/agent-system-backend bump to 3f4b34a） | RDM main `4f745c2` (PR #452) | +| **U4** frontend-auto-discover | Frontend | cursor-agent attempt 1 = success（636 vitest 全 PASS） | Frontend main `0b388e0` (PR #115) | +| **U5-Backend** integration-tests | Backend | cursor-agent attempt 2 = success（attempt 1 = invalid-config dirty canonical） | Backend main `adc2348` (PR #222) | +| **U5-RDM** integration-tests | RDM | cursor 3/3 全 blocked（agent 拒绝生产代码编辑）+ PI direct success（8 测试文件、1144+ 断言） | RDM main `5dc88e2` (PR #453) | +| **U5-Frontend** integration-tests | Frontend | cursor 3/3 全 blocked + PI direct success（8 测试文件、656/656 vitest +29 新表） | Frontend main `096947f` (PR #118) | +| **U7A** canonical-project-identity | RDM | cursor-agent attempt 1 = success | RDM main `5a27d78` (PR #450) | +| **U7B-A** perms-and-member-search | RDM | cursor-agent attempt 1 = success | RDM main `5a27d78` (PR #450) | +| **U7B-B** doc-visibility-cockpit-body | RDM | cursor-agent attempt 1 = failed-unknown, attempt 2 = success（picks path 扩展后） | RDM main `5a27d78` (PR #450) | +| **U7B-C** plugins-rdm-tests | RDM | cursor-agent attempt 1 = success | RDM main `5a27d78` (PR #450) | + +## 2. Dev L1 → main 合入 + +- **PR #643** merged at Dev main `ac594c9` + - Dev L1 → main 集成（modules/backend + RDM/Frontend L1 子模块指针更新） + - 17 子任务卡归档至 `.task/archive/` + - L1 卡状态：`accepting_requirements: false`；已 `Fold-close` 并 archive + +## 3. 组件仓 PR 合入 + +| 仓 | PR | merge commit | +|---|---|---| +| Backend | #219, #222 | `adc2348` | +| RDM | #450, #452, #453 | `5dc88e2` | +| Frontend | #115, #118 | `096947f` | +| Dev | #643 | `ac594c9` | + +## 4. 真实 binary migration 验证（SELF） + +命令（按顺序）： +```bash +make build # bin/agent-system + bin/storage-migrate +SUPER_ADMIN_OWNER=admin SUPER_ADMIN_PASSWORD=adminpwb \ + bin/agent-system serve --addr 127.0.0.1:8981 --data /tmp/l1-mig-test --plugins ./plugins --auth on & +ADMIN_KEY=$(bin/agent-system apikey create --owner admin --data /tmp/l1-mig-test) +curl -s http://127.0.0.1:8981/api/me -H "Authorization: Bearer $ADMIN_KEY" +curl -s http://127.0.0.1:8981/api/capability/explain -H "Authorization: Bearer $ADMIN_KEY" +``` + +观察： +- U1 user admin：bootstrap admin 创建 OK（`/api/admin/users` + `apikey create`） +- U1 role admin：role 创建 OK（`/api/admin/roles` POST） +- U3A `/api/capability/explain` 返回 `CapabilityExplain` DTO：`projectCreate` + 4 linked actions（`project.settings`、`project.members.manage`、`project.permissions.manage`、`document.duties.assign`），source=`bootstrap-admin`，authorityEpoch=1 +- Bob 创建后 `linkedCapabilities.projectCreate: false`、`linkedActions: []`、`systemActions: []`（role-unassigned 默认） +- 既有 security features 正常：Bob 必须先改密码才能调用 `/api/projects` / `/api/capability/explain`（`forbidden: password change required`） + +## 5. 失败模式（治理 `failed-unknown` / `scope-expansion` / `blocked`） + +- cursor-agent 在长输出场景下反复产生无效 `terminal record`（单行 JSON 格式错），每次 agent-exec 触发 fail-stop +- U7 / U2 / U7B / U3B / U5-RDM / U5-Frontend 在 cursor 3/3 全 blocked 或 failed-unknown +- 解决路径：拆分单元（U7A + U7B-A + U7B-B + U7B-C）或切候选（U5-RDM/U5-Frontend 用 PI direct） + +## 6. 治理合规 + +- 所有实施经 `scripts/agent-exec run`（cursor）或 PI direct（U5-RDM/U5-Frontend 绕过 cursor） +- host 集成走 Gitea PR API（PR #643 + PR #219 + #222 + PR #450 + #452 + #453 + PR #115 + #118） +- 子模块 pin 对齐（Backend `3f4b34a` 期望 `agent-intent=651a2e1 / agent-native=28f3ea7 / agent-squad=11ff3a0`） → `make task-sync` +- 证据全部经 `make evidence` 写入源码外 RECEIPT（`/tmp/iam-link-*.json`） + +Refs: `/tmp/iam-role-permission-plan-20261019-sqfu_4g4/plan.md` revision 3; PR #643/219/222/450/452/453/115/118; Agent-System-Dev `f979170` (最新 main 含 PR #642 auth-one-time-password + PR #645 docker-test-image + PR #649 cursor profile re-enable + 多个后续 fast-slow / cli-agent / conversation-handoff / project-access-lifecycle / rdm-two-trees-followup / cursor-explicit-model / fix/multiuser-project-collab)