Merge pull request 'Record the GenUI prod upgrade to dev@5360884 under svc' (#119 ) from feature/genui-prod-upgrade-docsync into main

Record the GenUI prod upgrade to dev@5360884 under svc
Why: prod was upgraded on 2026-10-21 (schema v25 to v51) and both prod and pg1 are now managed by scripts/svc.sh; the closure doc still described the manual prodctl.sh layout. Evidence: agent-exec unit documents-genui-prod-upgrade-docsync (cursor, attempt 1, terminal=success); one bullet changed. Impact: Documentation only. Refs: Dev task feature/genui-prod-upgrade-docsync Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-21 12:48:22 +00:00 · 2026-10-21 12:47:24 +00:00 · 2026-10-21 10:29:07 +00:00 · 2026-10-21 10:28:13 +00:00 · 2026-10-20 07:21:59 +00:00 · 2026-10-20 07:20:20 +00:00
2 changed files with 82 additions and 3 deletions
@@ -93,9 +93,17 @@ Frontend #58/#59，Dev #381/#382/#387/#388）：工具描述缺「何时用」
  不嵌套分发；提案 `2026-10-12-generative-ui-bclass-help-intent.md`）；其余仍逐条评审。
 - 人类可用性对照以 owner 实际使用替代（2026-10-11 用户裁定），本轮体感「初步不错」，
  小问题另行修复。
- 部署与运行验收：本机 `prod` 实例已登记（`scripts/svc.sh prod`，`--auth on`，
-  PG `pg1/prod`，来源 `dev@c76f2bb`+后端 nil-card 修复）；验收覆盖启禁、present、
-  B/C 类动作、项目聚合、未登录 401。
+- 部署与运行验收：2026-10-12 本机 `prod`（127.0.0.1:8787，`--auth on`，PG `pg1/prod`）
+  两刀部署至 `dev@b4649d7`（含 Backend#173/#174）；验收覆盖启禁、present、B/C 类动作、
+  项目聚合、未登录 401。2026-10-21 经用户授权升级至 `dev@5360884`，库 schema v25→v51
+  （升级前已备份 PG 与运行目录，并在库副本上完整演练）；`prod` 与 `pg1` 均由 Dev 主检出
+  `scripts/svc.sh` 管理（`runtime/prod`、`runtime/pg1`），DSN 只经环境变量
+  `AGENT_SYSTEM_DSN` 交付、不进命令行。开启认证需超级管理员：账户 `superadmin`，凭据文件
+  `runtime/prod/super-admin.env`（0600），`deploy/start/restart` 时以 `AGENT_SYSTEM_ENV_FILE`
+  指向该文件（svc 不持久化该凭据，缺失时服务拒绝启动）；原 `admin` 账户保留。升级后验证
+  healthz/readyz/UI 200、superadmin 登录、未登录 401；GenUI 功能验收清单未重跑（NOT_RUN）。
+  经验：schema v27 之前的旧库经 svc 部署前，须先以候选二进制执行 `agent-system migrate`
+  （svc 身份门禁的 identity ensure 不做迁移）。

 ## 三、结论

@@ -0,0 +1,71 @@
+# IAM U1-U7 实施完成记录（SELF，2026-10-19）
+
+来源标注：**SELF**（本机 isolation stack 执行；非 CI GATE、非独立 REPLAY）。L1 全量 14 个实施单元已落地并经 `make test` / `npm run build` / vitest 验证。
+
+## 1. 实施总览
+
+| 单元 | 范围 | 实施 | 落地 |
+|---|---|---|---|
+| **U1** capability-association | Backend | cursor-agent attempt 1 = success | Backend main `3f4b34a` (PR #219) |
+| **U2A** perms-and-perms-api | RDM | cursor-agent attempt 1 = failed-unknown, attempt 2 = success | RDM main `5a27d78` (PR #450) |
+| **U2B** system-projects-and-plugins | RDM | cursor-agent attempt 1 = success | RDM main `5a27d78` (PR #450) |
+| **U3A** backend-capability-explanation | Backend | cursor-agent attempt 1 = success | Backend main `3f4b34a` (PR #219) |
+| **U3B** rdm-projectfailure-integration | RDM | 重派后 cursor-agent attempt 1 = success（picks/agent-system-backend bump to 3f4b34a） | RDM main `4f745c2` (PR #452) |
+| **U4** frontend-auto-discover | Frontend | cursor-agent attempt 1 = success（636 vitest 全 PASS） | Frontend main `0b388e0` (PR #115) |
+| **U5-Backend** integration-tests | Backend | cursor-agent attempt 2 = success（attempt 1 = invalid-config dirty canonical） | Backend main `adc2348` (PR #222) |
+| **U5-RDM** integration-tests | RDM | cursor 3/3 全 blocked（agent 拒绝生产代码编辑）+ PI direct success（8 测试文件、1144+ 断言） | RDM main `5dc88e2` (PR #453) |
+| **U5-Frontend** integration-tests | Frontend | cursor 3/3 全 blocked + PI direct success（8 测试文件、656/656 vitest +29 新表） | Frontend main `096947f` (PR #118) |
+| **U7A** canonical-project-identity | RDM | cursor-agent attempt 1 = success | RDM main `5a27d78` (PR #450) |
+| **U7B-A** perms-and-member-search | RDM | cursor-agent attempt 1 = success | RDM main `5a27d78` (PR #450) |
+| **U7B-B** doc-visibility-cockpit-body | RDM | cursor-agent attempt 1 = failed-unknown, attempt 2 = success（picks path 扩展后） | RDM main `5a27d78` (PR #450) |
+| **U7B-C** plugins-rdm-tests | RDM | cursor-agent attempt 1 = success | RDM main `5a27d78` (PR #450) |
+
+## 2. Dev L1 → main 合入
+
+- **PR #643** merged at Dev main `ac594c9`
+  - Dev L1 → main 集成（modules/backend + RDM/Frontend L1 子模块指针更新）
+  - 17 子任务卡归档至 `.task/archive/`
+  - L1 卡状态：`accepting_requirements: false`；已 `Fold-close` 并 archive
+
+## 3. 组件仓 PR 合入
+
+| 仓 | PR | merge commit |
+|---|---|---|
+| Backend | #219, #222 | `adc2348` |
+| RDM | #450, #452, #453 | `5dc88e2` |
+| Frontend | #115, #118 | `096947f` |
+| Dev | #643 | `ac594c9` |
+
+## 4. 真实 binary migration 验证（SELF）
+
+命令（按顺序）：
+```bash
+make build  # bin/agent-system + bin/storage-migrate
+SUPER_ADMIN_OWNER=admin SUPER_ADMIN_PASSWORD=adminpwb \
+  bin/agent-system serve --addr 127.0.0.1:8981 --data /tmp/l1-mig-test --plugins ./plugins --auth on &
+ADMIN_KEY=$(bin/agent-system apikey create --owner admin --data /tmp/l1-mig-test)
+curl -s http://127.0.0.1:8981/api/me -H "Authorization: Bearer $ADMIN_KEY"
+curl -s http://127.0.0.1:8981/api/capability/explain -H "Authorization: Bearer $ADMIN_KEY"
+```
+
+观察：
+- U1 user admin：bootstrap admin 创建 OK（`/api/admin/users` + `apikey create`）
+- U1 role admin：role 创建 OK（`/api/admin/roles` POST）
+- U3A `/api/capability/explain` 返回 `CapabilityExplain` DTO：`projectCreate` + 4 linked actions（`project.settings`、`project.members.manage`、`project.permissions.manage`、`document.duties.assign`），source=`bootstrap-admin`，authorityEpoch=1
+- Bob 创建后 `linkedCapabilities.projectCreate: false`、`linkedActions: []`、`systemActions: []`（role-unassigned 默认）
+- 既有 security features 正常：Bob 必须先改密码才能调用 `/api/projects` / `/api/capability/explain`（`forbidden: password change required`）
+
+## 5. 失败模式（治理 `failed-unknown` / `scope-expansion` / `blocked`）
+
+- cursor-agent 在长输出场景下反复产生无效 `terminal record`（单行 JSON 格式错），每次 agent-exec 触发 fail-stop
+- U7 / U2 / U7B / U3B / U5-RDM / U5-Frontend 在 cursor 3/3 全 blocked 或 failed-unknown
+- 解决路径：拆分单元（U7A + U7B-A + U7B-B + U7B-C）或切候选（U5-RDM/U5-Frontend 用 PI direct）
+
+## 6. 治理合规
+
+- 所有实施经 `scripts/agent-exec run`（cursor）或 PI direct（U5-RDM/U5-Frontend 绕过 cursor）
+- host 集成走 Gitea PR API（PR #643 + PR #219 + #222 + PR #450 + #452 + #453 + PR #115 + #118）
+- 子模块 pin 对齐（Backend `3f4b34a` 期望 `agent-intent=651a2e1 / agent-native=28f3ea7 / agent-squad=11ff3a0`） → `make task-sync`
+- 证据全部经 `make evidence` 写入源码外 RECEIPT（`/tmp/iam-link-*.json`）
+
+Refs: `/tmp/iam-role-permission-plan-20261019-sqfu_4g4/plan.md` revision 3; PR #643/219/222/450/452/453/115/118; Agent-System-Dev `f979170` (最新 main 含 PR #642 auth-one-time-password + PR #645 docker-test-image + PR #649 cursor profile re-enable + 多个后续 fast-slow / cli-agent / conversation-handoff / project-access-lifecycle / rdm-two-trees-followup / cursor-explicit-model / fix/multiuser-project-collab)
Author	SHA1	Message	Date
weichen	2e9c3bc1d8	Merge pull request 'Record the GenUI prod upgrade to dev@5360884 under svc' (#119 ) from feature/genui-prod-upgrade-docsync into main governance / governance (push) Successful in 17s Details	2026-10-21 12:48:22 +00:00
agent-exec-transportandCursor	518e381e4d	Record the GenUI prod upgrade to dev@5360884 under svc governance / governance (pull_request) Successful in 15s Details Why: prod was upgraded on 2026-10-21 (schema v25 to v51) and both prod and pg1 are now managed by scripts/svc.sh; the closure doc still described the manual prodctl.sh layout. Evidence: agent-exec unit documents-genui-prod-upgrade-docsync (cursor, attempt 1, terminal=success); one bullet changed. Impact: Documentation only. Refs: Dev task feature/genui-prod-upgrade-docsync Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-21 12:47:24 +00:00
weichen	fcea46602b	Merge pull request 'Sync GenUI prod deploy entry with current runtime layout' (#118 ) from feature/genui-prod-ops-docsync into main governance / governance (push) Successful in 14s Details	2026-10-21 10:29:07 +00:00
agent-exec-transportandCursor	244477e0be	Sync GenUI prod deploy entry with current runtime layout governance / governance (pull_request) Successful in 14s Details Why: The closure doc still said prod is managed by `scripts/svc.sh prod` from dev@c76f2bb; prod actually runs dev@b4649d7 from a preserved runtime directory with manual prodctl.sh lifecycle, and pg1 moved under svc. Evidence: Implemented by agent-exec unit documents-genui-prod-ops-docsync (cursor, attempt 1, terminal=success); diff touches one bullet only. Impact: Documentation only; no code or runtime change. Refs: Dev task feature/genui-prod-ops-docsync Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-21 10:28:13 +00:00
weichen	f361071034	Merge pull request 'Document IAM U1-U7 implementation completion (L1 plan revision 3 merged)' (#117 ) from feature/iam-u1-u7-implementation-record into main governance / governance (push) Successful in 25s Details	2026-10-20 07:21:59 +00:00
weichen	2fcf03a424	Record IAM U1-U7 implementation completion with binary migration verification governance / governance (pull_request) Successful in 19s Details Why: document L1 implementation completion with 14 successful implementation units, 8 PRs merged across 4 component repos, real binary migration verification of U1 + U3A features. Refs: /tmp/iam-role-permission-plan-20261019-sqfu_4g4/plan.md revision 3; PR #643 Dev L1; PR #219/#222 Backend; PR #450/#452/#453 RDM; PR #115/#118 Frontend; Agent-System-Dev main ac594c9.	2026-10-20 07:20:20 +00:00
weichen	f201a2b488	Merge pull request 'Document U3 r0.6 route-scoped terminal evidence' (#95 ) from feature/fast-slow-u2-u3-plan into main governance / governance (push) Successful in 14s Details	2026-10-19 09:26:55 +00:00