Why: The base gate (cmdbus.RequiresProjectWorkDecision) refuses rdm.review.doc.approve/reject/final unless the request carries a committed conversation source as top-level conversationId and anchorMessageId. The workspace sent bare params, so the decision buttons were refused in the real product.
Evidence: vitest 39 files / 441 tests passed (22 new in test/document-decision.test.ts); npx tsc --noEmit clean; npm run build ok; check-knip unused exports 51 <= 51; e2e/document-renderer.playwright.ts type-checks and lists 13 tests. Request shape from pins/agent-system-backend: internal/server/server.go:1276-1304 (body decode), internal/cmdbus/cmdbus.go:109-134 and 385, internal/app/app.go:646-665 (preflight), server.go:1010-1150 (message POST returns the committed message).
Impact: approve/reject/final first post a Chinese decision message to the host project's 文档审签记录 conversation (reused, or created), then dispatch with its id as the anchor (entrance button). Identity is never sent. Any failing step shows a readable refusal and nothing is dispatched. Double-click is ignored while an action is in flight, and retries reuse the operation id so the server returns the same source message. rdmCommand takes an optional source; rdm.render.* is unchanged. The e2e spec drives §11-5c through the workspace only and asserts the anchored, committed receipt. Not run against a live backend or browser here.
Refs: unified renderer plan Task 11; RDM cmdbus gate (pins/agent-system-backend internal/cmdbus/cmdbus.go:109-134); live-verify sequence /tmp/live-verify/run.sh lines 56-70 and 140-146.
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The renderer browser acceptance still recorded GAP markers for approve, final, rule binding and the full package, which the workspace now provides; the spec must exercise those entries through the UI first, falling back to the API only when an entry is absent.
Evidence: tsc --noEmit on e2e/document-renderer.playwright.ts exits 0; playwright test --list loads 13 tests (adds §11-2b and §11-3b); the spec still skips without PLAYWRIGHT_BASE_URL and RBA_OUT, so no browser run was possible here; leak scan in §11-8 is untouched.
Impact: approve and final are attempted from the workspace and asserted by success text or a readable failure; the package download asserts a ZIP header; binding asserts the refresh and the controlled-document refusal copy. Not run against a real product in this session.
Refs: unified renderer acceptance §11 items 2, 3, 5 and 6; RDM 7169944 (review decision contract), 4b7ac2a (profile bind), 75ba50c (package).
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Task 11 requires the document render workspace to offer approve, reject and final decisions, rule bind/unbind for document, document type and project default, and the full delivery package, so reviewers and settings holders no longer need other screens.
Evidence: vitest 38 files / 419 tests passed (new test/document-render-actions.test.ts covers decision entries from frozen duties, decision payloads without identity fields, package availability, refusal codes, binding candidates and payloads, perm gating and SSR visibility); tsc --noEmit clean; knip unused exports 51 <= baseline 51.
Impact: decision entries show only when the command is enabled and the frozen submission lists the session user; binding needs rdm.perm.check project.settings allowed=true; package appears only for ready deliveries; organization-default binding is not offered from the workspace (domain admin only).
Refs: unified renderer plan Task 11, 05 section 9, 06 section 6, 07 sections 1 and 5; RDM plugins/rdm/plugin.go review.doc.* and render.profile.* schemas (7169944, 4b7ac2a, 75ba50c).
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: origin/main carries the cockpit, account and duty-settings work; the render workspace branch needs its rdmRender capability state kept beside the new rdmCockpitAvailable flag.
Evidence: store.ts conflicts resolved by keeping both sides in the identity reset and capability refresh paths; tsc --noEmit clean; vitest run 37 files / 394 tests passed; npm run build passed; knip unused exports 51 <= baseline 51.
Impact: refresh failure and identity reset now clear rdmCockpitAvailable and rdmRender together; no behavior removed from either side.
Refs: unified renderer plan Task 11 (09-implementation-plan.md); Dev precheck verdict SHARED_WORKSPACE_BUSY recorded in the task report.
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: after login the store's identity epoch and the capability probe each
settle once more; the app closes open workspaces on identity change, so
clicking the sidebar entry too early raced the overlay close (intermittent
加载中 hang, caught across I4 e2e runs).
Evidence: instrumented probe (rows=2 parsed then overlay closed on identity
bump); settled-login rerun follows on the Dev I4 card.
Impact: spec stability only.
Refs: rollout I4
Why: rdm.project.list returns { projects: [...] }; the cockpit component
assumed a bare array and always rendered 暂无可见研发项目, caught by I4 e2e
scenario 1.
Evidence: tsc/vitest/build green (SELF); browser e2e rerun recorded on the
Dev I4 card.
Impact: cockpit entry only.
Refs: rollout I4
Why: TaskSidebar builds its own workspace entry list without the cockpit
flag, so the 文档驾驶舱 entry never appeared in the sidebar even when the
command probe passed (caught by I4 e2e scenario 1).
Evidence: tsc/vitest/vite build green (SELF); cockpit e2e suite re-run via
Dev scripts/e2e.sh follows on the Dev I4 card.
Impact: sidebar entry visibility only; no behavior change elsewhere.
Refs: rollout I4
Why: implement the reviewed I4 browser acceptance - seven scenarios over the
cockpit: first-entry stats/tree/panorama, tree-section reader positioning on
the shared selection, four evidence tabs with counts and honest empty/
restricted states, pending-probe adoption via in-session API then refresh
(snapshot and version block advance together, DV-R05), route-abort outage
keeping the previous snapshot with a retry entry (DV-R08), non-member
account sees no projects (DV-R06 negative), and 390px/18px/keyboard/reduced-
motion usability (DV-R07).
Evidence: tsc green; suite driven by Dev scripts/e2e.sh (seed: cockpit-e2e
structure YAML via the structure-content loader, pending probe proposal,
non-member account); GATE is the Dev-side e2e.sh run recorded on the Dev I4
card.
Impact: e2e spec only; no product source change.
Refs: rollout I4
Why: I3 adds the reader/evidence-panel module whose contract types
(documentCockpit.ts) are consumed by tests and the I4 combination work; the
repo's knip ratchet exists for exactly this deliberate, documented raise.
Code paths themselves reduced first (attempted de-export churned unrelated
surface, reverted in favor of the baseline bump).
Evidence: knip 51 <= 51 via scripts/check-knip.mjs; vitest 324/324; tsc and
vite build green.
Impact: baseline file only.
Refs: rollout I3
Why: implement the reviewed I3 increment - continuous body reading with
per-section status lines, version summary with collapsed line-diff (backend
versions projection from RDM PR #420), right evidence panel with
sources/history/impacts/conflicts tabs, panorama-reader positioning on the
shared selection, per user+project view preferences (panorama/reader,
density, panel tab), strict-seq history merging and honest restricted states.
Evidence: 10 new pure-logic tests (prefs validation, version summary and
diff marks, strict history merge drops, reader assembly three-state); vitest
324/324 green; tsc and vite build green; tokens-only styles.
Impact: cockpit-only; no fourth column, no standalone graph (relations stay
in the right panel); reader entry is explicit (panorama button / view toggle).
Refs: rollout I3
Why: the 400 (unknown field name) outage shipped because no automated
check drove the UsersPanel create path against the strict backend
contract; this scenario pins the request body, the pending notice, the
table row state and the CLI handoff hint into the composition suite.
Evidence: passing run against the deployed shared dev (SELF, task card).
Impact: e2e/ only; no production code.
Refs: backend 8dfc223, frontend #94
Why: implement the reviewed I2 increment - statistics band, structure tree
with lazy section pages, panorama center (project overview + node summary),
shared selection/filter, snapshot-consistency banner and honest states, per
the frozen contract (Dev docs/superpowers 2026-10-16, rollout section 7).
Evidence: vitest 314/314 green (14 new pure-logic tests covering capability
gate, true-zero vs unavailable stats, filter toggle, snapshot equality and
update notice, context key, selection survival, honest badges); tsc -b and
vite production build green.
Impact: new workspace entry (rdm-cockpit, gated on the seven cockpit
commands); no changes to existing surfaces; reader view and right panel
land in I3.
Refs: rollout I2
Why: the forced password gate still submitted an empty current password
after the backend began requiring it (current_required), locking every
account seeded with an initial password out of the workbench, and the
admin user panel had no client for the owner-confirmed recovery
proposal contract that replaced one-time key issuing (HTTP 410).
Evidence: npm test 300 passed; tsc -b && vite build ok; knip issues
54 <= baseline 55 (SELF).
Impact: mode-aware ChangePasswordGate with current-password input,
admin recovery proposal panel, owner-side account settings section,
recovery proposal client methods; no backend changes.
Refs: backend 8dfc223, b9c0a34; frontend #94
Why: independent review flagged the issue client still targeting the 410
endpoint and a hint sentence ending with a period.
Evidence: npm run build + npm test re-run on the fix (SELF).
Impact: api client surface only.
Refs: review brief /tmp/review-brief-admin-user-contract.md
Why: Probes sent with page.request do not raise page response events, so
the §11-8 leak scan only covered passive page responses.
Evidence: Final run 20261016T065123Z item8-scan.json counted 18 responses,
all passive; probe bodies were checked only for rejection and payload.
Impact: Every probe and host API body is scanned for project A names, the
controlled and uncontrolled document titles and review markers.
Refs: unified renderer plan Task 13 §11
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The Task 11 spec was never run and assumed a seed, login gate and
navigation the real product does not have. §11 acceptance needs all nine
items covered with three duties, two projects, auth on, screenshots,
network logs and leak scanning for the user without permission.
Evidence: Driven by /tmp/renderer-browser-acceptance/browser-acceptance.sh
against RDM d63f1db; per-test results, screenshots, downloads and network
logs under $RBA_OUT/evidence; receipt composed into browser-receipt.json.
Impact: Product capability gaps are recorded as soft GAP/BLOCKER failures
naming the owning repository instead of being skipped; steps only reachable
by direct commands in the user's own session are tagged API_ASSISTED.
Refs: unified renderer plan Task 13 §11
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Running §11 against RDM d63f1db showed three Frontend defects. A
validated template rule with a server blockedReason was disabled for
preview, although the server only restricts formal delivery. A reviewer
opening the document in another session could not find the author's
submission until an export existed. Template-instance blocks without a
title (cover, sign-off table, fields) rendered as blank canvas nodes and
reader headings.
Evidence: npx vitest run (35 files, 363 tests passed); npm run build ok;
node scripts/check-knip.mjs (43 <= 43); browser run under
/tmp/renderer-browser-acceptance/20261016T064052Z (item1 172 nodes,
preview generated with the validated template rule).
Impact: Preview is offered for validated/draft rules while formal submit
stays blocked; the current submission comes from rdm.review.doc.status;
untitled nodes show "<kind>（<templateBlockId>）".
Refs: unified renderer plan Task 13 §11
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: backend 8dfc223 replaced POST /api/admin/users with strict
{owner, profile} decoding and returned 410 for login-key issuing, so the
UI create form failed with 400 unknown field name. Creation now sends
{owner, profile:{name}} only; password input, admin checkbox and the
login-key issue entry are removed; notice points to the local CLI
initialize-account flow. passwords.ts lost its only consumer.
Evidence: npm run build + npm test (34 files/293 passed) + knip identical
to baseline on the task worktree (SELF).
Impact: UsersPanel and api client only; no style/token changes.
Refs: backend 8dfc223, b9c0a34
Why: S9 acceptance finding 3 — the project settings modal exposed the
host override settings (including the model/key group, masked) to plain
project members; the duties data plane was already permission-enforced,
but the host settings surface had no gate.
Evidence: vitest 34 files / 293 tests pass with the change; tsc reports
no errors in the modified file. Ruling per the acceptance plan P1-B:
the modal entry stays (granted duty managers need the RDM tabs), while
the host override settings group renders only for the project owner or
a system admin; RDM tabs keep their own fail-closed gating.
Impact: ProjectSettingsModal project tab renders an explanatory empty
state for non-privileged viewers; members/duties/matrix tabs unchanged.
Refs: S9 acceptance report P1-B
Why: Independent review of a81e94a..85428b4 found five contract mismatches
against the RDM server: profile sources document-type/project-default were
dropped, the refusal object {code,message} was ignored, submit receipts were
read as `id` instead of `submissionId`, diagnostics were expected inside
preview/export receipts (they live in a separate diagnostics delivery blob),
and rdm.inspect.tree was treated as recursive although it returns one level.
Evidence: New tests use the server JSON shapes (RenderProfileOptions,
RenderDeliveryReceipt, DocSubmissionRec, rdmRenderDownload, InspectTree); 26
of them fail against the previous implementation. npx vitest run: 35 files,
359 tests passed; npm run build: ok; scripts/check-knip.mjs: unused exports
43 <= 43; git diff --cached --check: clean.
Impact: Rules panel lists all five sources with Chinese labels and keeps the
server's selected default; refusals render readably; a new submission is
auto-selected; diagnostics are fetched via rdm.render.download kind=diagnostics
under a sequence/epoch guard with readable failures and a Chinese receipt
state label; the document tree is walked breadth-first (depth 12, 2000 nodes,
concurrency 4) with a truncation notice. Playwright spec asserts per-node
diagnostic anchors after preview (authored, not run).
Refs: unified renderer plan Task 11 review findings
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: unified renderer Task 11 needs a reader/delivery UI over the RDM
document tree: four-level rule selection with controlled-document
no-fallback explanation, preview with node-linked diagnostics, a
structure canvas and a linear reader sharing one selection and filter,
review annotations/revisions, and per-delivery downloads.
Evidence: npx vitest run -> 35 files, 338 tests passed (45 new in
test/document-render-workspace.test.ts, design-guard green);
npm run build -> tsc -b + vite build ok; npx knip -> findings identical
to the pre-existing baseline (check-knip 43 <= 43); git diff --check
clean. e2e/document-renderer.playwright.ts authored, not executed.
Impact: new src/documentRenderPresentation.ts (pure helpers) and
src/components/DocumentRenderWorkspace.tsx, opened from a per-document
"阅读与交付" action in the audit materials tree; store gains an
rdmRender capability probe (fail-closed); audit export reuses the shared
base64 file saver; token-only styles appended to styles.css. Async
state is owned per hook with request guards plus identity epoch, and
the workspace remounts per identity/project/document scope.
Refs: unified renderer plan Task 11
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Approving an extra package, rebuilding the base layer, reclaiming unused layers, and uploading a wheel need an admin surface that uses the existing admin controls.
Evidence: SELF tsc of the new panel reported no errors in frontend sources. UI package type errors come from missing node_modules in this worktree, not from this panel.
Impact: Administrators get a Python 环境 section. Other admin sections are unchanged.
Refs: .task/feature-layered-python-env.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: a lost write response was keeping the old duty version, so the next save replayed it, and a busy save could stay locked if another request advanced the sequence.
Evidence: SELF vitest duty-draft 6 passed, tsc passed, knip 43, Playwright duty flows 3 passed.
Impact: an unknown save reloads server roles, confirmation resets, and busy clears even if a later read is discarded.
Refs: docs/proposals/2026-10-15-rdm-duty-matrix-rework.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: project settings must keep the shared duty draft and must not regain template document creation from main.
Evidence: SELF vitest 292 passed, tsc --noEmit passed, knip unused exports 43.
Impact: the duties tab stays assignment-only while conversation ordering from main is included.
Refs: docs/proposals/2026-10-15-rdm-duty-matrix-rework.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Wait for the unrelated foreground reply before measuring duplicate replies.
Evidence: All 24 scenarios passed against deployed 8788; independent replay passed the targeted scenario.
Impact: Test synchronization only; the duplicate-reply assertion is unchanged.
Refs: Agent-System-Frontend #89; Agent-System-Dev #565
Why: Completion or progress from an earlier task could appear in the process of an unrelated newer answer.
Evidence: The new ownership regression fails before the guard and passes afterward; the frontend suite, TypeScript and unchanged export gate pass.
Impact: Project child progress only into its originating live turn while still reconciling background results.
Refs: feature/workbench-flow-completion chronological display requirement
Why: Full execution history must retain outputs after the 500-event API page boundary.
Evidence: Ordered 502-event replay and nonadvancing-cursor rejection tests pass.
Impact: Add regression coverage only; production source is unchanged.
Refs: feature/workbench-flow-completion review testing gap
Why: the settings page only needs the draft operations the views call. Extra aliases and unused helpers pushed the unused-export count over the baseline.
Evidence: SELF node scripts/check-knip.mjs reported 43 <= 43, and duty-draft vitest passed.
Impact: chapter-review command aliases are gone from the settings gate. The draft behavior is unchanged.
Refs: modules/frontend/knip-baseline.json
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A rejected result-reference request could discard the user text or uploads after the composer cleared.
Evidence: 286 frontend tests, TypeScript and the unchanged unused-export gate pass; mixed-input browser regression preserves the draft.
Impact: Validate incompatible inputs before clearing, retain failed pending input with its request identity, and require explicit retry while other messages can continue.
Refs: feature/workbench-flow-completion review frontend-races finding
Why: the three views, the blocked empty-reviewer save, and the narrow-screen matrix need a browser check that does not depend on a live account.
Evidence: SELF playwright e2e/rdm-duties.playwright.ts, 3 passed against the local Vite server.
Impact: the duties end-to-end file now drives assignment, stale responses, and the narrow-screen guidance.
Refs: feature/rdm-duty-matrix
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the settings page was mixing duty assignment with whole-document review and chapter objects. The three views need one draft and one save check.
Evidence: SELF vitest run of the frontend suite, 278 tests passed, including duty-draft and design-guard.
Impact: the duties tab assigns existing documents only. Submit, approve, reject, and final stay out of this page. Commands that are not ready keep the tab hidden.
Refs: feature/rdm-duty-matrix
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The frontend unused-export gate rejected a helper used only within its module.
Evidence: The unchanged knip baseline and TypeScript checks pass.
Impact: Remove an unnecessary export without changing replay behavior.
Refs: feature/workbench-flow-completion
weichen