Record IAM U1-U7 implementation completion with binary migration verification

Why: document L1 implementation completion with 14 successful implementation units, 8 PRs merged across 4 component repos, real binary migration verification of U1 + U3A features.

Refs: /tmp/iam-role-permission-plan-20261019-sqfu_4g4/plan.md revision 3; PR #643 Dev L1; PR #219/#222 Backend; PR #450/#452/#453 RDM; PR #115/#118 Frontend; Agent-System-Dev main ac594c9.

docs/records/2026-10-19-iam-u1-u7-implementation-record.md

@@ -0,0 +1,71 @@
+# IAM U1-U7 实施完成记录（SELF，2026-10-19）
+
+来源标注：**SELF**（本机 isolation stack 执行；非 CI GATE、非独立 REPLAY）。L1 全量 14 个实施单元已落地并经 `make test` / `npm run build` / vitest 验证。
+
+## 1. 实施总览
+
+| 单元 | 范围 | 实施 | 落地 |
+|---|---|---|---|
+| **U1** capability-association | Backend | cursor-agent attempt 1 = success | Backend main `3f4b34a` (PR #219) |
+| **U2A** perms-and-perms-api | RDM | cursor-agent attempt 1 = failed-unknown, attempt 2 = success | RDM main `5a27d78` (PR #450) |
+| **U2B** system-projects-and-plugins | RDM | cursor-agent attempt 1 = success | RDM main `5a27d78` (PR #450) |
+| **U3A** backend-capability-explanation | Backend | cursor-agent attempt 1 = success | Backend main `3f4b34a` (PR #219) |
+| **U3B** rdm-projectfailure-integration | RDM | 重派后 cursor-agent attempt 1 = success（picks/agent-system-backend bump to 3f4b34a） | RDM main `4f745c2` (PR #452) |
+| **U4** frontend-auto-discover | Frontend | cursor-agent attempt 1 = success（636 vitest 全 PASS） | Frontend main `0b388e0` (PR #115) |
+| **U5-Backend** integration-tests | Backend | cursor-agent attempt 2 = success（attempt 1 = invalid-config dirty canonical） | Backend main `adc2348` (PR #222) |
+| **U5-RDM** integration-tests | RDM | cursor 3/3 全 blocked（agent 拒绝生产代码编辑）+ PI direct success（8 测试文件、1144+ 断言） | RDM main `5dc88e2` (PR #453) |
+| **U5-Frontend** integration-tests | Frontend | cursor 3/3 全 blocked + PI direct success（8 测试文件、656/656 vitest +29 新表） | Frontend main `096947f` (PR #118) |
+| **U7A** canonical-project-identity | RDM | cursor-agent attempt 1 = success | RDM main `5a27d78` (PR #450) |
+| **U7B-A** perms-and-member-search | RDM | cursor-agent attempt 1 = success | RDM main `5a27d78` (PR #450) |
+| **U7B-B** doc-visibility-cockpit-body | RDM | cursor-agent attempt 1 = failed-unknown, attempt 2 = success（picks path 扩展后） | RDM main `5a27d78` (PR #450) |
+| **U7B-C** plugins-rdm-tests | RDM | cursor-agent attempt 1 = success | RDM main `5a27d78` (PR #450) |
+
+## 2. Dev L1 → main 合入
+
+- **PR #643** merged at Dev main `ac594c9`
+  - Dev L1 → main 集成（modules/backend + RDM/Frontend L1 子模块指针更新）
+  - 17 子任务卡归档至 `.task/archive/`
+  - L1 卡状态：`accepting_requirements: false`；已 `Fold-close` 并 archive
+
+## 3. 组件仓 PR 合入
+
+| 仓 | PR | merge commit |
+|---|---|---|
+| Backend | #219, #222 | `adc2348` |
+| RDM | #450, #452, #453 | `5dc88e2` |
+| Frontend | #115, #118 | `096947f` |
+| Dev | #643 | `ac594c9` |
+
+## 4. 真实 binary migration 验证（SELF）
+
+命令（按顺序）：
+```bash
+make build  # bin/agent-system + bin/storage-migrate
+SUPER_ADMIN_OWNER=admin SUPER_ADMIN_PASSWORD=adminpwb \
+  bin/agent-system serve --addr 127.0.0.1:8981 --data /tmp/l1-mig-test --plugins ./plugins --auth on &
+ADMIN_KEY=$(bin/agent-system apikey create --owner admin --data /tmp/l1-mig-test)
+curl -s http://127.0.0.1:8981/api/me -H "Authorization: Bearer $ADMIN_KEY"
+curl -s http://127.0.0.1:8981/api/capability/explain -H "Authorization: Bearer $ADMIN_KEY"
+```
+
+观察：
+- U1 user admin：bootstrap admin 创建 OK（`/api/admin/users` + `apikey create`）
+- U1 role admin：role 创建 OK（`/api/admin/roles` POST）
+- U3A `/api/capability/explain` 返回 `CapabilityExplain` DTO：`projectCreate` + 4 linked actions（`project.settings`、`project.members.manage`、`project.permissions.manage`、`document.duties.assign`），source=`bootstrap-admin`，authorityEpoch=1
+- Bob 创建后 `linkedCapabilities.projectCreate: false`、`linkedActions: []`、`systemActions: []`（role-unassigned 默认）
+- 既有 security features 正常：Bob 必须先改密码才能调用 `/api/projects` / `/api/capability/explain`（`forbidden: password change required`）
+
+## 5. 失败模式（治理 `failed-unknown` / `scope-expansion` / `blocked`）
+
+- cursor-agent 在长输出场景下反复产生无效 `terminal record`（单行 JSON 格式错），每次 agent-exec 触发 fail-stop
+- U7 / U2 / U7B / U3B / U5-RDM / U5-Frontend 在 cursor 3/3 全 blocked 或 failed-unknown
+- 解决路径：拆分单元（U7A + U7B-A + U7B-B + U7B-C）或切候选（U5-RDM/U5-Frontend 用 PI direct）
+
+## 6. 治理合规
+
+- 所有实施经 `scripts/agent-exec run`（cursor）或 PI direct（U5-RDM/U5-Frontend 绕过 cursor）
+- host 集成走 Gitea PR API（PR #643 + PR #219 + #222 + PR #450 + #452 + #453 + PR #115 + #118）
+- 子模块 pin 对齐（Backend `3f4b34a` 期望 `agent-intent=651a2e1 / agent-native=28f3ea7 / agent-squad=11ff3a0`） → `make task-sync`
+- 证据全部经 `make evidence` 写入源码外 RECEIPT（`/tmp/iam-link-*.json`）
+
+Refs: `/tmp/iam-role-permission-plan-20261019-sqfu_4g4/plan.md` revision 3; PR #643/219/222/450/452/453/115/118; Agent-System-Dev `f979170` (最新 main 含 PR #642 auth-one-time-password + PR #645 docker-test-image + PR #649 cursor profile re-enable + 多个后续 fast-slow / cli-agent / conversation-handoff / project-access-lifecycle / rdm-two-trees-followup / cursor-explicit-model / fix/multiuser-project-collab)