Why: a lost write response was keeping the old duty version, so the next save replayed it, and a busy save could stay locked if another request advanced the sequence.
Evidence: SELF vitest duty-draft 6 passed, tsc passed, knip 43, Playwright duty flows 3 passed.
Impact: an unknown save reloads server roles, confirmation resets, and busy clears even if a later read is discarded.
Refs: docs/proposals/2026-10-15-rdm-duty-matrix-rework.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the real catalog leads with protected system actions whose checkboxes are disabled; the live flow must advance permission groups to reach an editable action.
Evidence: deterministic 16/16 unchanged.
Impact: live test navigation only.
Refs: feature/iam-u4-role-permission-ui
Why: project settings must keep the shared duty draft and must not regain template document creation from main.
Evidence: SELF vitest 292 passed, tsc --noEmit passed, knip unused exports 43.
Impact: the duties tab stays assignment-only while conversation ordering from main is included.
Refs: docs/proposals/2026-10-15-rdm-duty-matrix-rework.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Wait for the unrelated foreground reply before measuring duplicate replies.
Evidence: All 24 scenarios passed against deployed 8788; independent replay passed the targeted scenario.
Impact: Test synchronization only; the duplicate-reply assertion is unchanged.
Refs: Agent-System-Frontend #89; Agent-System-Dev #565
Why: the live composition starts with zero roles; the real permission catalog table renders only after a role is selected, so the catalog assertion must follow role creation.
Evidence: deterministic 16/16 unchanged; live layer reruns via iam-u4-role-acceptance.sh.
Impact: live test order only; no behavior change.
Refs: feature/iam-u4-role-permission-ui
Why: Completion or progress from an earlier task could appear in the process of an unrelated newer answer.
Evidence: The new ownership regression fails before the guard and passes afterward; the frontend suite, TypeScript and unchanged export gate pass.
Impact: Project child progress only into its originating live turn while still reconciling background results.
Refs: feature/workbench-flow-completion chronological display requirement
Why: Full execution history must retain outputs after the 500-event API page boundary.
Evidence: Ordered 502-event replay and nonadvancing-cursor rejection tests pass.
Impact: Add regression coverage only; production source is unchanged.
Refs: feature/workbench-flow-completion review testing gap
Why: stage 7 (DR6-DR10) requires repeatable browser evidence; the reviewed flows lacked a disable confirmation, role-scoped draft lifetime with an explicit leave decision, and status announcements.
Evidence: 16/16 deterministic Playwright scenarios pass on an isolated preview (route-driven, no live services); 283 unit tests and build/knip stay green; live-layer cases ride the same file under IAM_E2E_LIVE.
Impact: RolePermissionsPanel keeps per-roleId drafts, guards zone leave/refresh, adds a disable confirm strip (name + binding count + impact + cancel) and restores save focus; AdminZone consults the leave guard; AccountUsersPanel notice becomes role=status; new e2e/iam-role-authority.playwright.ts.
Refs: feature/iam-u4-role-permission-ui
Why: the settings page only needs the draft operations the views call. Extra aliases and unused helpers pushed the unused-export count over the baseline.
Evidence: SELF node scripts/check-knip.mjs reported 43 <= 43, and duty-draft vitest passed.
Impact: chapter-review command aliases are gone from the settings gate. The draft behavior is unchanged.
Refs: modules/frontend/knip-baseline.json
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A rejected result-reference request could discard the user text or uploads after the composer cleared.
Evidence: 286 frontend tests, TypeScript and the unchanged unused-export gate pass; mixed-input browser regression preserves the draft.
Impact: Validate incompatible inputs before clearing, retain failed pending input with its request identity, and require explicit retry while other messages can continue.
Refs: feature/workbench-flow-completion review frontend-races finding
Why: the three views, the blocked empty-reviewer save, and the narrow-screen matrix need a browser check that does not depend on a live account.
Evidence: SELF playwright e2e/rdm-duties.playwright.ts, 3 passed against the local Vite server.
Impact: the duties end-to-end file now drives assignment, stale responses, and the narrow-screen guidance.
Refs: feature/rdm-duty-matrix
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the settings page was mixing duty assignment with whole-document review and chapter objects. The three views need one draft and one save check.
Evidence: SELF vitest run of the frontend suite, 278 tests passed, including duty-draft and design-guard.
Impact: the duties tab assigns existing documents only. Submit, approve, reject, and final stay out of this page. Commands that are not ready keep the tab hidden.
Refs: feature/rdm-duty-matrix
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The frontend unused-export gate rejected a helper used only within its module.
Evidence: The unchanged knip baseline and TypeScript checks pass.
Impact: Remove an unnecessary export without changing replay behavior.
Refs: feature/workbench-flow-completion
Why: Keep persisted task decisions aligned across Go and TypeScript.
Evidence: make contracts generated both consumers from Core 1a5ef6b.
Impact: Include the reserved run identity and typed dispatching state.
Refs: feature/workbench-flow-completion
Why: Repeated progress and coupled scrolling obscured chat, and task choices lacked a reliable independent interaction path.
Evidence: 285 frontend unit tests and 23 browser scenarios pass locally before the shared event-loader extraction; final combination checks follow in Dev.
Impact: Coalesce cumulative progress, retain execution records, show timestamps and quiet notifications, support versioned work actions and explicit result references without automatic chat backfill.
Refs: feature/workbench-flow-completion
Why: Retired edges and compliance edges awaiting review both fell back to a generic lifecycle label.
Evidence: Presentation tests, production build, knip, and diff checks pass.
Impact: The trace network now shows 已停用 and 待复核 as distinct human-readable states.
Refs: readable trace network
Why: Consume the Core work result and optional decision snapshot.
Evidence: Generated with make contracts from Core 00f1826.
Impact: Add optional types without changing existing cards.
Refs: feature/workbench-flow-completion
Why: Work-source decomposition, detected risks, human answers, and structure decisions were recorded but absent from the audit timeline.
Evidence: Focused presentation/tree tests, production build, and knip baseline pass.
Impact: Audit filters and rows now include the complete business-operation feed without raw payloads.
Refs: TT-N03 TT-R01 W4b
Why: the duties tab only listed existing documents — rdm.docs.instantiate
had no UI entry, so a fresh project showed an empty duties tab with no
setup path (owner trial feedback 2026-10-15).
Evidence: new docs-instantiate-params tests green; full vitest run shows
only the 12 pre-existing conversation-work failures also present at clean
HEAD; design-guard green.
Impact: duties tab gains a template picker + title input wired to
rdm.docs.instantiate (backend command rdm.docs.templates lists published
identities); instantiation refreshes the catalog and selects the new doc.
Refs: Agent-System-RDM docs/records/dhf/u4-header-footer-slots.md
Why: Fine-grained viewers and managers need independent data loading, safe conflict recovery, and complete paged role access.
Evidence: Frontend 281 tests, production build, and knip baseline passed; independent final review found no remaining findings.
Impact: Adds action-specific controls, server-side role filters and paging, matrix cap editing, and sequence-safe draft rebasing.
Refs: feature/iam-u4-role-authority
Why: The Backend-authoritative role and account views replace the legacy local role and user panels.
Evidence: npm test; npm run build; node scripts/check-knip.mjs; UI npm test.
Impact: Keeps one role administration surface and restores the unused-export baseline.
Refs: feature/iam-u4-role-authority
Why: Object details render the same relationship row and must identify the endpoint relative to that object.
Evidence: Type checking identified the missing selected-object context after the endpoint fix.
Impact: Relationship rendering is consistent in the trace view and object details.
Refs: rdm-two-trees-latest-templates
Why: The trace view selected an endpoint by lexical ID order and could present the current section as its own source.
Evidence: Focused presentation tests cover both selected directions of a source-to-section relationship.
Impact: Source and impact columns now identify the object opposite the selected node.
Refs: rdm-two-trees-latest-templates
Why: Recursive template nodes without titles were rendered as repeated generic project objects in the audit tree.
Evidence: Focused presentation tests pass, including a regression for stable readable fallback names.
Impact: Template-derived paragraphs, tables, rows, cells, fields, and attachments remain distinguishable in the document tree.
Refs: rdm-two-trees-latest-templates
Why: Administrators and delegated system managers need focused role, user, and permission controls with search, filters, single-role editing, and a matrix view.
Evidence: Frontend 280 tests, production build, paired UI 163 tests, and design guards passed.
Impact: Replaces the RDM role panel with Backend role authority and adds optional user profiles, unique role assignment, and explicit system-grant editing.
Refs: Focused role and permission system task 7
Why: Single-role and matrix views need one typed Backend contract and one draft model so filtering cannot mutate authorization scope.
Evidence: Focused draft-model tests passed and the Frontend production build completed.
Impact: Adds role, binding, catalog, and system-grant APIs without changing visible UI yet.
Refs: Focused role and permission system task 6
Why: Project document and knowledge structures can contain nested nodes whose children must remain navigable beyond the first section level.
Evidence: A RED test first showed child-bearing sections were not expandable; presentation and design-guard tests, knip baseline 43, and npm run build now pass.
Impact: Recursively render any node marked with children while preserving current document fallback and readable node states.
Refs: TT-N01, TT-N02, TT-D01, TT-U01; two trees one graph vertical slice
Why: Project members need to understand who changed what, why, and with what impact without reading operation codes or raw audit payloads.
Evidence: A RED presentation test first failed on the missing humanization layer; 276 frontend tests passed, design guard 10 checks passed, knip stayed at baseline 43, and npm run build passed.
Impact: Humanize tree, relation, state, and operation vocabulary; render structured reason, impact, source, and outcome fields; raw event detail is no longer shown in the audit timeline.
Refs: TT-U01, TT-U02, TT-U03, TT-U04; two trees one graph stage-five plan
Why: Independent review found component-local color derivation, a private transition, and missing dark/molv coverage in the visual candidate.
Evidence: Frontend design guard passes and 19 Playwright scenarios cover light, dark, molv, and 320-1920px layouts.
Impact: Keeps the approved visual direction while moving color ownership to @ui tokens and removing private motion.
Refs: Agent-System-Dev feature/workbench-visual-redesign
Why: The inherited light-theme divider and hover treatment disappeared inside the new inverse create button.
Evidence: Focused browser layout test and production build pass locally.
Impact: Changes only the create action divider and hover surface.
Refs: Agent-System-Dev feature/workbench-visual-redesign
Why: Spacing-only refinements still looked like the original flat gray workspace and did not satisfy the approved visual redesign.
Evidence: 272 unit tests, 16 browser scenarios across 320-1920px, and the production build pass locally.
Impact: Gives navigation, authored messages, assistant results, and work details clearly different visual surfaces while preserving behavior.
Refs: Agent-System-Dev feature/workbench-visual-redesign
Why: The three-column workspace read as flat and visually scattered, making conversation, current work, and navigation difficult to distinguish.
Evidence: 272 unit tests, 16 focused browser scenarios across 320-1920px, and the production build pass locally.
Impact: Refines the existing workbench presentation without changing its data flow or fast/slow task behavior.
Refs: Agent-System-Dev feature/workbench-visual-redesign
Why: An early filesystem failure could exit before the UI deploy key cleanup trap existed.
Evidence: Parsed workflow confirms the EXIT trap precedes the first secret write.
Impact: Normal checkout failures remove both transient credential files from the runner.
Refs: IAM U3 Frontend PR #86
Why: The CI runner executed a mirror-downloaded toolchain without authenticating its contents.
Evidence: The pinned SHA256 matches the signed Node.js v22.23.3 release manifest and the current mirror archive.
Impact: CI fails before extraction if the Node archive differs from the reviewed release artifact.
Refs: IAM U3 Frontend PR #86
Why: The Gitea job token cannot read the private UI repository and this server lacks HTTPS deploy-token API support.
Evidence: Repository-scoped UI deploy key read was verified; Frontend Actions secret UI_DEPLOY_KEY is listed; prior CI run 3214 confirmed the missing credential gate.
Impact: Exact-pin CI uses a read-only SSH key and pinned host identity, deleting the transient key after checkout.
Refs: IAM U3 Frontend PR #86
Why: Gitea job token can fetch Frontend but receives repository-not-found for private UI.
Evidence: PR CI run 3213 checkout log shows Frontend fetch succeeded and UI fetch failed; Frontend secret listing lacks SUBMODULE_TOKEN.
Impact: CI now requests the dedicated UI read credential and fails clearly until it is provisioned.
Refs: IAM U3 Frontend PR #86
Why: The runner may inject an internal Gitea URL rather than the public browser URL.
Evidence: PR CI run 3212 exited at checkout preflight before any fetch; updated YAML parses locally.
Impact: Checkout validates the injected URL shape and logs nonsecret event context.
Refs: IAM U3 Frontend PR #86
Why: The Frontend repository lacked an exact-HEAD CI gate for U3 delivery.
Evidence: Workflow syntax parsed locally; Frontend and pinned UI tests and build passed locally; platform run pending.
Impact: PR and main checks now fetch fixed Frontend/UI commits and run install, tests, and production build.
Refs: IAM U3 delivery gate
Why: A confirmed proposal should not instruct the owner to confirm it again.
Evidence: Frontend tests and production build passed at the changed source.
Impact: Confirmation notice describes the existing state and keeps credential authority with the owner.
Refs: IAM U3 account recovery
Why: A lost proposal response followed by revocation could leave admins with an ambiguous result, and a late response could overwrite a newly selected account.
Evidence: Frontend 272 tests and production build passed; isolated browser replay covered lost response, terminal retry, and account switch.
Impact: Recovery notices reflect current proposal state, and stale account requests cannot update the selected detail.
Refs: IAM U3 account directory and recovery
Why: A successful mutation from a later search page reused an invalid signed cursor and falsely reported a write conflict; a lost recovery-proposal response left a committed proposal hidden and retried with a fresh key.
Evidence: Isolated browser red runs reproduced the stale-page duplicate warning and unknown proposal status; after the fix the combined page-two and lost-response flow passed, as did 272 Frontend tests and a production build.
Impact: Successful writes restart pagination and keep their success status, while uncertain proposal outcomes re-read metadata and reuse the same idempotency key for explicit retry.
Refs: IAM U3 Stage 7; Frontend PR #86
weichen
