weichen
2fcf03a424
governance / governance (pull_request) Successful in 19s
Why: document L1 implementation completion with 14 successful implementation units, 8 PRs merged across 4 component repos, real binary migration verification of U1 + U3A features. Refs: /tmp/iam-role-permission-plan-20261019-sqfu_4g4/plan.md revision 3; PR #643 Dev L1; PR #219/#222 Backend; PR #450/#452/#453 RDM; PR #115/#118 Frontend; Agent-System-Dev main ac594c9.
5.1 KiB
5.1 KiB
IAM U1-U7 实施完成记录（SELF，2026-10-19）
来源标注：SELF（本机 isolation stack 执行；非 CI GATE、非独立 REPLAY）。L1 全量 14 个实施单元已落地并经 make test / npm run build / vitest 验证。
1. 实施总览
| 单元 | 范围 | 实施 | 落地 |
|---|---|---|---|
| U1 capability-association | Backend | cursor-agent attempt 1 = success | Backend main 3f4b34a (PR #219) |
| U2A perms-and-perms-api | RDM | cursor-agent attempt 1 = failed-unknown, attempt 2 = success | RDM main 5a27d78 (PR #450) |
| U2B system-projects-and-plugins | RDM | cursor-agent attempt 1 = success | RDM main 5a27d78 (PR #450) |
| U3A backend-capability-explanation | Backend | cursor-agent attempt 1 = success | Backend main 3f4b34a (PR #219) |
| U3B rdm-projectfailure-integration | RDM | 重派后 cursor-agent attempt 1 = success（picks/agent-system-backend bump to 3f4b34a） | RDM main 4f745c2 (PR #452) |
| U4 frontend-auto-discover | Frontend | cursor-agent attempt 1 = success（636 vitest 全 PASS） | Frontend main 0b388e0 (PR #115) |
| U5-Backend integration-tests | Backend | cursor-agent attempt 2 = success（attempt 1 = invalid-config dirty canonical） | Backend main adc2348 (PR #222) |
| U5-RDM integration-tests | RDM | cursor 3/3 全 blocked（agent 拒绝生产代码编辑）+ PI direct success（8 测试文件、1144+ 断言） | RDM main 5dc88e2 (PR #453) |
| U5-Frontend integration-tests | Frontend | cursor 3/3 全 blocked + PI direct success（8 测试文件、656/656 vitest +29 新表） | Frontend main 096947f (PR #118) |
| U7A canonical-project-identity | RDM | cursor-agent attempt 1 = success | RDM main 5a27d78 (PR #450) |
| U7B-A perms-and-member-search | RDM | cursor-agent attempt 1 = success | RDM main 5a27d78 (PR #450) |
| U7B-B doc-visibility-cockpit-body | RDM | cursor-agent attempt 1 = failed-unknown, attempt 2 = success（picks path 扩展后） | RDM main 5a27d78 (PR #450) |
| U7B-C plugins-rdm-tests | RDM | cursor-agent attempt 1 = success | RDM main 5a27d78 (PR #450) |
2. Dev L1 → main 合入
- PR #643 merged at Dev main
ac594c9- Dev L1 → main 集成（modules/backend + RDM/Frontend L1 子模块指针更新）
- 17 子任务卡归档至
.task/archive/ - L1 卡状态：
accepting_requirements: false；已Fold-close并 archive
3. 组件仓 PR 合入
| 仓 | PR | merge commit |
|---|---|---|
| Backend | #219, #222 | adc2348 |
| RDM | #450, #452, #453 | 5dc88e2 |
| Frontend | #115, #118 | 096947f |
| Dev | #643 | ac594c9 |
4. 真实 binary migration 验证（SELF）
命令（按顺序）：
make build # bin/agent-system + bin/storage-migrate
SUPER_ADMIN_OWNER=admin SUPER_ADMIN_PASSWORD=adminpwb \
bin/agent-system serve --addr 127.0.0.1:8981 --data /tmp/l1-mig-test --plugins ./plugins --auth on &
ADMIN_KEY=$(bin/agent-system apikey create --owner admin --data /tmp/l1-mig-test)
curl -s http://127.0.0.1:8981/api/me -H "Authorization: Bearer $ADMIN_KEY"
curl -s http://127.0.0.1:8981/api/capability/explain -H "Authorization: Bearer $ADMIN_KEY"
观察：
- U1 user admin：bootstrap admin 创建 OK（
/api/admin/users+apikey create） - U1 role admin：role 创建 OK（
/api/admin/rolesPOST） - U3A
/api/capability/explain返回CapabilityExplainDTO：projectCreate+ 4 linked actions（project.settings、project.members.manage、project.permissions.manage、document.duties.assign），source=bootstrap-admin，authorityEpoch=1 - Bob 创建后
linkedCapabilities.projectCreate: false、linkedActions: []、systemActions: []（role-unassigned 默认） - 既有 security features 正常：Bob 必须先改密码才能调用
/api/projects//api/capability/explain（forbidden: password change required）
5. 失败模式（治理 failed-unknown / scope-expansion / blocked）
- cursor-agent 在长输出场景下反复产生无效
terminal record（单行 JSON 格式错），每次 agent-exec 触发 fail-stop - U7 / U2 / U7B / U3B / U5-RDM / U5-Frontend 在 cursor 3/3 全 blocked 或 failed-unknown
- 解决路径：拆分单元（U7A + U7B-A + U7B-B + U7B-C）或切候选（U5-RDM/U5-Frontend 用 PI direct）
6. 治理合规
- 所有实施经
scripts/agent-exec run（cursor）或 PI direct（U5-RDM/U5-Frontend 绕过 cursor） - host 集成走 Gitea PR API（PR #643 + PR #219 + #222 + PR #450 + #452 + #453 + PR #115 + #118）
- 子模块 pin 对齐（Backend
3f4b34a期望agent-intent=651a2e1 / agent-native=28f3ea7 / agent-squad=11ff3a0） →make task-sync - 证据全部经
make evidence写入源码外 RECEIPT（/tmp/iam-link-*.json）
Refs: /tmp/iam-role-permission-plan-20261019-sqfu_4g4/plan.md revision 3; PR #643/219/222/450/452/453/115/118; Agent-System-Dev f979170 (最新 main 含 PR #642 auth-one-time-password + PR #645 docker-test-image + PR #649 cursor profile re-enable + 多个后续 fast-slow / cli-agent / conversation-handoff / project-access-lifecycle / rdm-two-trees-followup / cursor-explicit-model / fix/multiuser-project-collab)