Why: Legacy upload events and synced duty flows need the same private-data and current-state guarantees as new member work.
Evidence: Real legacy SSE leakage and independent duty replay findings; correction evidence remains in the canonical task record.
Impact: Describe trusted per-event sharing and durable duty versions without new mandatory downstream interfaces or runtime changes.
Refs: system-project-membership r1.1; Dev feature/project-member-access
Why: Joined members must see one globally named project and keep private conversations and source documents.\n\nEvidence: Proposal links the fixed implementation plan, explicit authorization and task evidence without claiming deployment or CI success.\n\nImpact: Define optional lifecycle extension, identity recovery, private reads and published knowledge for U2/U3/U5.\n\nRefs: Dev feature/project-member-access
Why: the retest changed the K4 SELF result, and the plan has to record that without opening write traffic.
Evidence: SELF drill backup-20261013-013354, K1-K7 true. Documents has no CI workflow.
Impact: proposal r2.3. Second-instance writes stay closed.
Refs: #92
Why: the 2026-10-12 drill left artifact recovery failed, and the retest changed that SELF result without changing the write-traffic gate.
Evidence: backup-20261013-013354 on Dev a83588dd and backend 46073d30; K1-K7 true, RPO 65s, RTO 3s, five artifacts matched and cross-user access returned 404. SELF.
Impact: proposal moves to r2.3. Second-instance writes stay closed until REPLAY or CI and the second host exist.
Refs: docs/records/2026-10-12-u7-ops-drill-report.md docs/proposals/2026-10-11-collaboration-storage-and-distribution.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Keep planning progress aligned with actual implemented corrections without duplicating CI and merge state.
Evidence: Reference UI155, Frontend210 and 19 local browser cases via Dev native receipts; final GATE remains separately tracked.
Impact: Planning metadata only; no deployment or model-routing claim.
Refs: work-companion-ui r0.2/r1, UI01-UI13
Why: Keep the approved design and implementation plan consistent with the current candidate.
Evidence: Reference actual SELF verification and pending independent Review and GATE, without copying command output.
Impact: Planning progress only; inherited live-model capabilities and deployment remain separate.
Refs: UI01-UI13, work-companion-ui U5
Why: preserve concurrent planning records before the Dev combination sync.
Evidence: fetched authoritative Documents main f76cce9e32.
Impact: planning record integration without rewriting history.
Refs: work-companion-ui U5.
Why: B6, C4, and C5 now have same-host results, and the plan still said the ops drills were not done and that replay was the next step.
Evidence: Dev results pgbench-20261012-131948, fault-20261012-142734, and backup-20261012-153441 (SELF). The user declined a capacity replay on 2026-10-12.
Impact: Second-instance writes stay closed. K4 remains a product defect. Replay and C3 are not started.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the recovery plan needs the D1-D3 remediation record before the Dev pin moves.
Evidence: repository has no .gitea workflow; combined status has zero checks. Diff is one recovery-plan section.
Impact: documents only.
Refs: #88
Why: implement a simple workbench for nontechnical users under continuous authorization.
Evidence: current source audit and the reviewed r0.1 prototype; runtime verification remains pending.
Impact: design and plan only; task execution state stays in the Dev task card.
Refs: UI01-UI13 and the existing fast-slow display design r1.1.
Why: keep r2/r3 proposal updates rebase-friendly before PR.
Evidence: origin/main at fetch time.
Impact: Documents feature tip includes latest main.
Refs: feature/svc-account-durability-plan
Why: Capacity ladder/60m/2h dual-instance windows finished; planning
progress must reflect SELF-pass vs remaining GATE/REPLAY/C3 gaps.
Evidence: SELF load results summarized in the new capacity report.
Impact: Preferred next becomes independent REPLAY or C3/C4/C5.
Refs: Dev feature/u7-capacity-wrap-measure; release-multi-instance.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Dev #451 cannot pin modules/documents while feature tip and main diverge.
Evidence: merge-tree reports submodule conflict 1048e7c vs 9e4ee27.
Impact: Documents #84 tip includes main@1048e7c plus r1.1/U1 plan.
Refs: Dev PR #451; Documents PR #84
Why: distinguish timed observations from current service ownership.
Evidence: SELF task-sync and read-only observations at 18:14 Beijing time.
Impact: planning metadata only; runtime and component deployment unchanged by this task.
Refs: account r2; recovery r3
Why: account help, dev credential writes and crash recovery need a current, reviewable contract.
Evidence: SELF source and sanitized runtime observations; seven document review lenses; business and fault validation NOT_RUN.
Impact: revise two planning documents only; preserve prior approvals and mark additions pending review.
Refs: Dev feature/svc-account-durability-plan; account r2; recovery r3
Why: User authorized stage-5 start; record plan status for executors.
Evidence: Chat authorization "开始"; no runtime tests.
Impact: Documents proposal status only.
Refs: 2026-10-12-fast-slow-channel-display-u1-plan.md
Why: Record approved stage-4 design with R03 splits and U1 exit
whitelist, plus stage-5 U1 implementation plan for review.
Evidence: Document edits only; no runtime verification.
Impact: Documents proposals INDEX; no business code.
Refs: feature/fast-slow-display-design
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Delivery requires writing planning progress back after U7
landed; the proposal still claimed U1+U2 start / NOT_RUN.
Evidence: SELF doc edit against archived U7 cards and release
checklist A1-A7/B1 facts.
Impact: Readers see code-done vs capacity-window-pending; adds
HTTP multi-instance vs Manager-test lesson.
Refs: Dev feature/u7-capacity-wrap-measure; release-multi-instance.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Capture nil-card panic and intent data-flatten field fixes found
during local prod acceptance without revising the final closure verdict.
Evidence: Backend#173 #174; prod action checklist
Impact: Field-fix log lists the two hotfixes and their PRs.
Refs: GenUI prod deploy; fix track
Why: Record that the known-boundary production deploy/acceptance ran
on the local prod svc instance with auth and PG.
Evidence: scripts/svc.sh prod list; acceptance API checklist
Impact: Usage guide boundary list no longer says deploy is pending.
Refs: GenUI prod deploy task
Why: user approved the proposal and U1/U4 specs and authorized push/PRs
plus U1/U4 implementation start.
Evidence: SELF conversation approval 2026-10-12; implementation still NOT_RUN.
Impact: planning status only.
Refs: docs/proposals/2026-10-12-svc-unified-deploy-and-login-key.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: capture the reviewed design for binary/source install, env prep,
and passwordless activation via one-time restricted sessions.
Evidence: SELF source review against Dev af9c2de; implementation NOT_RUN.
Impact: Documents planning index only; no runtime change.
Refs: docs/proposals/2026-10-12-svc-unified-deploy-and-login-key.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Record the independent U5-style review for the first two B-class
surface actions and update the usage guide allowlist note.
Evidence: proposal r1 status approved; usage doc API table updated.
Impact: Documents authority for backend whitelist implementation.
Refs: U5 action-scope r2; plan GenUI boundaries 2026-10-12
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The direction closes at U7 - the master record needs its
companion usage guide (enable/generate/revise/act/disable for owners)
and the combined evaluation record covering every landed increment
with its evidence chain and known boundaries.
Evidence: Live E2E on dev@b634a27 (real MiniMax-M3): progress page
presented autonomously, conversation surfaces=2, project aggregation
returns cross-conversation pages under the owner scope; receipts in
Dev task feature/generative-ui-u7-acceptance.
Impact: Documents-only (new guide + index closeout).
Refs: r2 master record; U5 scope r2; Dev task
feature/generative-ui-u7-acceptance
Why: between the review round and the approval decision another session completed and merged svc-autorecover (PR #396/#400/#401/#402), so the (a)-decision tracking must reflect the landed slice and the remaining U2 delta.
Evidence: SELF - merged main history c622372 and archived card .task/archive/feature-svc-autorecover.md (10/10 tests, 146/146 governance, CI green on e0b49d1).
Impact: review record, INDEX; proposal r2 body unchanged.
Refs: PR #396#401
Why: the human gate resolved on 2026-10-12 - r2 approved (five stages at once) and option (a) adopted; the review record, proposal index and status navigation must reflect it.
Evidence: SELF - user decision relayed in conversation; stage-review details in the Dev task card; proposal r2 body unchanged (SHA256 9cfda252...).
Impact: review record, INDEX entry; no plan content change.
Refs: Dev task card .task/feature-service-restart-recovery-plan.md
Why: the reviewer record must reflect that all r2 gap claims hold at the post-sync backend pin 25fbea85, and that the svc-autorecover ownership decision now has 373 lines of unregistered, partially failing in-flight work to weigh.
Evidence: SELF - drift-check receipt in the Dev task card (exit 0, all cited gaps hold); svc-autorecover suite observed 5 of 10 tests failing on 2026-10-11.
Impact: review record addendum only; proposal r2 (SHA256 9cfda252...) unchanged.
Refs: Dev task card .task/feature-service-restart-recovery-plan.md
Why: absorb the external source-review round - pin the shutdown budget change, close the U1 acceptance gap for program/cwd changes, gate U4 public states on a mapping table, and make the svc-autorecover coordination an explicit human decision.
Evidence: SELF - external review round 2 in the review record; r2 SHA256 9cfda2520b913e6966c68fb3f66fb7bc8382a8f7a2b69cb364122216dcdb72cd; all reviewed claims re-verified against the pinned baselines.
Impact: documents only; four targeted amendments (U1/U3/U4/section 9) plus version bump and INDEX update; requirements and metrics unchanged.
Refs: Dev task card .task/feature-service-restart-recovery-plan.md
Why: U5 landed via RDM PR #213 (merge 1dce69d); all five implementation units now complete.
Evidence: RDM PR #213 merged=True.
Impact: plan status + U5 progress + INDEX.
Refs: RDM PR #213
Why: U4 landed via Dev PR #368 (merge 7aa8fd9).
Evidence: Dev PR #368 merged; CI green.
Impact: status line + U4 progress + INDEX only.
Refs: Dev PR #368
Why: The U6 precondition (benefit evidence from U4/U5) resolves to the
owner actually using the landed U1-U5 capability - the human usability
comparison marked NOT_RUN since U1 finds its execution path here; the
user ruled 2026-10-11 to evaluate first and decide U6 after.
Evidence: Ruling collected via the session question panel on
2026-10-11; U1-U5 all merged (Dev #329/#336/#345/#351/#367).
Impact: Documents-only (master record U6 gate note + index status).
Refs: r2 U6 clause; Dev task feature/generative-ui-u6-gate-record
EOF
)
Why: The user ruled on the three questions (categories and ranges
approved as proposed; C-class limited to plugin KV plus task ledger;
confirm UX reuses the inline card); the proposal becomes the approved
scope and unblocks the U5 implementation task.
Evidence: Ruling collected via the session question panel on
2026-10-11; implementation task feature/generative-ui-u5 starts under
policy/delivery.md.
Impact: Documents-only (proposal r2 + index status).
Refs: r2 master record U5; Dev task feature/generative-ui-u5
EOF
)
Why: The r2 U5 clause requires a human review of the action scope
before implementation; this draft grounds the decision in the current
command inventory and existing safety machinery.
Evidence: Source facts cited inline (builtin command list with risk
levels, DangerHigh inline-confirm flow with pendingStore, audit
envelope) verified against backend main on 2026-10-11.
Impact: Documents-only (new proposal + index entry); no code changes.
Refs: 2026-10-10-generative-ui-plugin.md (r2 U5); Dev task
feature/generative-ui-u5-scope
Why: U3 landed via RDM PR #201 (merge dbc41b6); the master record must reflect actual progress.
Evidence: SELF U3 closeout doc check exit 0 (receipt in Dev closeout task card).
Impact: proposal status line, U3 progress paragraph, INDEX row only.
Refs: RDM PR #201; Dev feature/rdm-u3-closeout
Why: Dev PR #340 pinned this Documents branch tip while it was never merged into Documents main (cross-repo pin discipline); this reconciliation unifies both planning lineages.
Evidence: merge-base 2a5f658; INDEX conflict resolved as union (U1+U2 progress row + two new plan entries).
Impact: docs only.
Refs: Dev #340
Why: U2 landed via RDM PR #197 (merge fe8a75b); delivery policy requires the master record to reflect actual progress at task completion.
Evidence: SELF U2 closeout doc check exit 0 (receipt in the Dev closeout task card); RDM PR #197 merged=True via API.
Impact: proposal status line, U2 progress paragraph, and INDEX row only.
Refs: RDM PR #197; Dev feature/rdm-u2-closeout
Why: retain the newly merged RDM U1 progress alongside the final-target plan.
Evidence: resolved the single index conflict by keeping the updated U1 entry and both new plan links; diff check passed.
Impact: documentation merge only; business validation NOT_RUN.
Refs: docs/proposals/INDEX.md
Why: reconcile the confirmed project, privacy and duty rules with all approved product requirements.
Evidence: current RDM d8d7e743 source review, recorded source receipt, and exact 34 UR/68 SR/10 F matrix checks; business validation NOT_RUN.
Impact: reviewed planning documents only, covering all 69 template types and the existing XLSX asset; no runtime changes.
Refs: docs/proposals/2026-10-11-rdm-final-target-completion.md
Why: U1 landed via RDM PR #195 (merge 05b7d1a); delivery policy requires the master record to reflect actual progress at task completion.
Evidence: SELF closeout doc check exit 0 (receipt in the Dev closeout task card); RDM PR #195 merged=True via API.
Impact: proposal status line, U1 progress paragraph, and INDEX row only; no scope or requirement change.
Refs: RDM PR #195; Dev feature/rdm-u1-closeout
Why: preserve the user decision from the previous planning turn before expanding scope.
Evidence: r1.1 records the explicit user response; prior documentation-check receipt is in the Dev task card.
Impact: planning metadata only; no business changes.
Refs: docs/proposals/2026-10-11-rdm-template-dialog-generation.md
Why: U4 ships the managed migration entry; the runbook is the operator-facing contract for inventory/backup/migrate, migration identity and resume rules, verification semantics, and the authorized-window switch sequence.
Evidence: backend branch feature/collab-storage-u4-migrator - integration tests green against real PostgreSQL (idempotent rerun, resume, foreign-data refusal, wrong-snapshot refusal, unknown-owner block).
Impact: docs only.
Refs: proposals/2026-10-11-collaboration-storage-and-distribution.md U4 and section 6.
Why: connect the existing RDM assets and two-trees model to a reviewable document workflow.
Evidence: source inventory at RDM 0081628a; document structure and local link checks recorded as SELF in the Dev task card; business validation NOT_RUN.
Impact: planning and inventory documents only; no implementation or deployment.
Refs: docs/proposals/2026-10-11-rdm-template-dialog-generation.md
Why: U3 slice 2 ships admission budgets (runtime.* keys, lease semantics, yield/reacquire) and the host-side action matrix; the runbook is the single source for operators and records the versioned public-contract plan KTD13 requires.
Evidence: backend branch feature/collab-storage-u3-budget-authz (admission.go, action matrix in server.go) with admission/matrix tests green.
Impact: docs only.
Refs: proposals/2026-10-11-collaboration-storage-and-distribution.md KTD13/R8, section 5 U3.
Why: branch protection requires the head to contain the current base before merge.
Evidence: fetched origin/main=336a90f0ade0ffe049879ca5159a61f0a3948708.
Impact: integrate upstream changes without rewriting task history.
Refs: Documents PR #63
Why: The U1 controlled trial (three arms on synthetic materials,
MiniMax M3 + M2.7-highspeed, CNY 3 spent of the 200 cap) finished on
2026-10-11; its evidence changes the plan and must live in the master
record: goal-driven structure divergence holds (6/6), generation must
go through tool arguments (text-channel JSON discipline is the floor),
highspeed is rejected as the generator, and the first release keeps the
in-house renderer.
Evidence: Full data and failure taxonomy in Dev task
feature/generative-ui-u1 (.task/genui-u1/report.md, SELF; CI gate on
the Dev PR). Tool-channel and response_format probes recorded there.
Impact: Proposal r1 -> r2 (new results section, catalog/model/channel
revisions); INDEX entry updated. No code or contract changes.
Refs: Dev task feature/generative-ui-u1; Documents PR #60 (r1)
Why: the user reviewed and approved the plan (2026-10-11, five stages bundled) and chose a two-tier admin model for KTD4 instead of strict ledger separation.
Evidence: SELF user session rulings recorded in the Dev task card; document-check receipt follows in the task card evidence section.
Impact: proposal r1 and INDEX now record approval and the two-tier admin ruling; no code or deployment change.
Refs: Dev feature/rdm-two-trees-audit-plan
Why: assess existing two-tree and trace-network capabilities and define project-scoped inspection.
Evidence: SELF source receipt and document checks; business and runtime verification were not run.
Impact: pending-review proposal and index only; no product implementation or deployment.
Refs: Dev feature/rdm-two-trees-audit-plan
Why: the approved collaboration plan U1 requires a fixed deployment manifest, tier config contract, migration mapping, capacity contract, isolation test scheme and KTD14 copy-protection contract as the single source of truth for team-tier operations.
Evidence: contract keys match backend config.go tier/pool fields (U2, backend branch feature/collab-storage-pg-tier); local verification used svc.sh collabtest on 127.0.0.1:8897 and Redis on 6399.
Impact: docs only (new guide + usage.md cross-links); no code change.
Refs: proposals/2026-10-11-collaboration-storage-and-distribution.md sections 5 (U1/U2), KTD1/KTD8/KTD12/KTD14.
Why: The user ruled on 2026-10-11 the three open product choices (first
pilot = full analysis page inside the conversation; enable/disable via a
trusted compiled plugin; U1 trial on MiniMax M3 + M2.7-highspeed with
sanitized materials and a CNY 200 cap), so the proposal now publishes as
the direction's master record instead of a local draft.
Evidence: Doc self-check receipts live in the Dev task card
feature/generative-ui-research; the rulings are recorded in the doc's
"用户裁定记录" section and mirrored in INDEX.md.
Impact: Documents-only change (new proposal + index entry). No runtime,
contract, or code changes; U1 trial start and deployment stay separately
reviewed.
Refs: Dev task feature/generative-ui-research
Why: freeze the direction for 10-100 user multi-project collaboration storage (PostgreSQL team tier, migration, staged multi-instance) before U1+U2 implementation starts.
Evidence: static review record and SELF audit receipt included; user approval recorded in Dev task card 2026-10-11 (instruction to start the transformation per the plan).
Impact: docs only - new proposal, index entry, review record, audit receipt; no code or runtime change.
Refs: Dev .task/feature-collaboration-storage-plan.md; plan section 5 names U1+U2 as the first increment.
Why: The E1 quick-fix increment landed (delegate full text, MiniMax
reasoning split, sandbox deps layer, parallel tool execution with kernel
ordering) and the proposal is the master record, so its stage table and
the index row must reflect the actual progress with links.
Evidence: Agent-Native #42/#43/#44, Backend #127, Dev task
feature/agent-e1-parallel-fixes (live verification receipts: F2 zero
think-leak, F3 sandbox IMPORTS-OK, F5 concurrent overlap; eval
toolFailures 19->11, unverifiedFacts 7->12 recorded honestly).
Impact: Documents-only progress backfill; E2-E5/S0 remain unauthorized.
Why: The user asked for a researched design covering subagent use,
tiered model routing (Claude via dmxapi for complex work, MiniMax for
the rest), a millisecond/sub-second task sandbox (record-only), and a
verdict on why the agent still feels weaker than codex/claude-code/kimi.
Why: Four research threads (external frontier survey, subagent/routing
evidence, harness-vs-model attribution, local code audit and probes)
converge on role/stage routing instead of whole-task routing, and on
three corrections to the sandbox assumptions (overlay is not a snapshot;
snapshots defer conflicts to merge time; destroy must follow sealing).
Evidence: Local measurements are SELF receipts in the Dev task card
(bwrap namespace ~7ms, overlay same, docker ~142ms; MiniMax reasoning
split; dmxapi /v1/messages cache_read; EXT-16 sandbox missing the
python-docx layer). External claims carry per-item source URLs in the
proposal's section 8.
Impact: Documents-only addition: new proposal 2026-10-10 (E1-E5/S0
increments, D/R workstreams, sandbox tiers L0-L2) plus INDEX rows for it
and the previously unlisted G1 package. No product code changes; all
implementation increments stay unauthorized until approved.
Refs: proposals/2026-10-09-agent-quality-improvement-plan.md (P4/P5,
model A/B), 2026-10-09-ext-g1-b1-b3-exec-backend.md (EXT-16),
Dev task feature/agent-exec-routing-sandbox-plan.
Why: RDM G1/G2 are blocked on four base capabilities - the member agent
cannot see published project knowledge inside a run, plugin commands are
unreachable as tools, members cannot see or open conversations in shared
projects, and the isolated exec tier needs a backend seam.
Evidence: SELF - code citations verified at Dev main (runmgr.go:726-736
owner-only Retrieve; hostcaps.go:64-66 owner-only search; server.go:438-441
owner-only listProjects; store/projects.go:124-130 owner-scoped conversation
creation); bwrap availability tested on this host (2026-10-09).
Impact: Docs only. New proposal docs/proposals/2026-10-09-ext-g1-b1-b3-exec-backend.md
registering EXT-13..EXT-16 per the compat-policy template; no code change.
Refs: RDM plan V1.1 sections 3.3/3.4/5.3; owner Q1-Q8 (Q4=option A, Q2)
weichen
