feat(projectinstance): apply duty mode to readiness access and snapshots

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/projectinstance/document_access.go

@@ -15,6 +15,7 @@ const (
 	AccessCodeDocTaskDisabled = "DOC_TASK_DISABLED"
 	AccessCodeNotCurrentStage = "DOC_TASK_NOT_IN_ACTIVE_STAGE"
 	AccessCodeForbiddenDuty   = "DOC_DUTY_FORBIDDEN"
+	AccessCodeDutyNotManaged  = "DOC_DUTY_NOT_MANAGED"
 	AccessCodeInstanceClosed  = "WORKFLOW_INSTANCE_CLOSED"
 )
 
@@ -112,6 +113,26 @@ func (s *Service) CheckDocTaskAccess(
 		}
 	}
 
+	if classifyDocDuty(planTask.Duties) == DutyModeNone {
+		switch action {
+		case DocAccessActionRun, DocAccessActionEdit:
+			if isCreator {
+				return allow
+			}
+			return DocAccessDecision{
+				Allowed: false,
+				Code:    AccessCodeForbiddenDuty,
+				Message: "未纳入人工审批的文档仅创建者可编辑或执行",
+			}
+		case DocAccessActionReview, DocAccessActionApprove, DocAccessActionSubmit:
+			return DocAccessDecision{
+				Allowed: false,
+				Code:    AccessCodeDutyNotManaged,
+				Message: "该文档未纳入人工审批，不能审核、批准或提交审批",
+			}
+		}
+	}
+
 	if isCreator {
 		return allow
 	}

internal/projectinstance/duty_mode.go

@@ -20,6 +20,11 @@ const (
 	issueSeparationOfDutyViolation = "SEPARATION_OF_DUTY_VIOLATION"
 )
 
+// ClassifyDocDuty 供运行时/门禁复用，禁止平行再写一套三职判定。
+func ClassifyDocDuty(d DocDuty) DutyMode {
+	return classifyDocDuty(d)
+}
+
 func classifyDocDuty(d DocDuty) DutyMode {
 	ids := []int64{d.AuthorUserID, d.ReviewerUserID, d.ApproverUserID}
 	assigned := 0

internal/projectinstance/gate.go

@@ -25,18 +25,20 @@ func evaluateStageReadiness(
 			continue
 		}
 		td, hasDef := taskDefMap[dt.TaskKey]
-		required := !hasDef || td.BlocksWhenEnabled()
+		approvalManaged := classifyDocDuty(dt.Duties) != DutyModeNone
+		required := approvalManaged && (!hasDef || td.BlocksWhenEnabled())
 		state := docStates[dt.TaskKey]
 		if state == "" {
 			state = "missing"
 		}
 		approved := state == "approved"
 		item := DocTaskReadiness{
-			TaskKey:  dt.TaskKey,
+			TaskKey:         dt.TaskKey,
-			Required: required,
+			Required:        required,
-			Enabled:  true,
+			Enabled:         true,
-			DocState: state,
+			ApprovalManaged: approvalManaged,
-			Approved: approved,
+			DocState:        state,
+			Approved:        approved,
 		}
 		readiness = append(readiness, item)
 		if required && !approved {

internal/projectinstance/stage_access.go

@@ -59,12 +59,13 @@ func (s *Service) ResolveStageAccess(ctx context.Context, projectID int64, userI
 		}
 		status := stageStatus[stPlan.StageKey]
 		hasDuty := stageDutyForUser(stPlan, userID)
+		hasUnmanaged := stageHasUnmanagedDoc(stPlan)
 		allow := false
 		switch status {
 		case StageActive:
-			allow = isCreator || hasDuty
+			allow = isCreator || hasDuty || hasUnmanaged
 		case StageCompleted:
-			allow = hasDuty || isCreator
+			allow = hasDuty || isCreator || hasUnmanaged
 		default:
 			allow = false
 		}
@@ -76,7 +77,7 @@ func (s *Service) ResolveStageAccess(ctx context.Context, projectID int64, userI
 			if !dt.Enabled {
 				continue
 			}
-			if isCreator || docTaskDutyForUser(dt, userID) {
+			if isCreator || docTaskDutyForUser(dt, userID) || classifyDocDuty(dt.Duties) == DutyModeNone {
 				out.AllowedTaskKeys[dt.TaskKey] = true
 			}
 		}
@@ -94,11 +95,23 @@ func stageDutyForUser(st StagePlan, userID int64) bool {
 }
 
 func docTaskDutyForUser(dt DocTaskPlan, userID int64) bool {
+	if classifyDocDuty(dt.Duties) != DutyModeFull {
+		return false
+	}
 	return dt.Duties.AuthorUserID == userID ||
 		dt.Duties.ReviewerUserID == userID ||
 		dt.Duties.ApproverUserID == userID
 }
 
+func stageHasUnmanagedDoc(st StagePlan) bool {
+	for _, dt := range st.DocTasks {
+		if dt.Enabled && classifyDocDuty(dt.Duties) == DutyModeNone {
+			return true
+		}
+	}
+	return false
+}
+
 // TaskKeyAllowed 判断 task_key 是否在允许范围内。
 func (a *StageAccess) TaskKeyAllowed(taskKey string) bool {
 	if a == nil || !a.Restricted {

internal/projectinstance/store.go

@@ -296,7 +296,7 @@ func (s *pgStore) replaceInstanceChildren(ctx context.Context, tx pgx.Tx, inst *
 			if err != nil {
 				return err
 			}
-			if !dt.Enabled {
+			if !dt.Enabled || classifyDocDuty(dt.Duties) == DutyModeNone {
 				continue
 			}
 			for role, uid := range map[string]int64{
@@ -960,9 +960,9 @@ func (m *memStore) TerminateInstance(_ context.Context, instanceID int64, projec
 		return nil, ErrInstanceNotFound
 	}
 	now := time.Now()
-	inst.Status = "terminated"
+	inst.Status = InstanceTerminated
 	copyInst := *inst
-	delete(m.live, projectID)
+	m.live[projectID] = &copyInst
 	pm := m.ensureMeta(projectID)
 	pm.lifecycle = LifecyclePlanning
 	pm.activeKey = ""

internal/projectinstance/types.go

@@ -110,15 +110,24 @@ type ActivationPreview struct {
 	ExpiresAt              time.Time                    `json:"expires_at"`
 }
 
+// PreviewDocRef 预览中列出的例外文档。
+type PreviewDocRef struct {
+	TaskKey string `json:"task_key"`
+	Title   string `json:"title"`
+}
+
 // PreviewSummary 激活影响摘要。
 type PreviewSummary struct {
-	WorkflowName    string `json:"workflow_name"`
+	WorkflowName         string          `json:"workflow_name"`
-	WorkflowVersion int    `json:"workflow_version"`
+	WorkflowVersion      int             `json:"workflow_version"`
-	EnabledStages   int    `json:"enabled_stages"`
+	EnabledStages        int             `json:"enabled_stages"`
-	EnabledDocTasks int    `json:"enabled_doc_tasks"`
+	EnabledDocTasks      int             `json:"enabled_doc_tasks"`
-	AssignedDuties  int    `json:"assigned_duties"`
+	GovernedDocTasks     int             `json:"governed_doc_tasks"`
-	FirstStageKey   string `json:"first_stage_key,omitempty"`
+	UnmanagedDocTasks    int             `json:"unmanaged_doc_tasks"`
-	FirstStageName  string `json:"first_stage_name,omitempty"`
+	AssignedDuties       int             `json:"assigned_duties"`
+	UnmanagedDocuments   []PreviewDocRef `json:"unmanaged_documents,omitempty"`
+	FirstStageKey        string          `json:"first_stage_key,omitempty"`
+	FirstStageName       string          `json:"first_stage_name,omitempty"`
 }
 
 // ActivateInput 二次确认激活。
@@ -199,11 +208,12 @@ type GateIssue struct {
 
 // DocTaskReadiness 文档任务就绪状态。
 type DocTaskReadiness struct {
-	TaskKey  string `json:"task_key"`
+	TaskKey          string `json:"task_key"`
-	Required bool   `json:"required"`
+	Required         bool   `json:"required"`
-	Enabled  bool   `json:"enabled"`
+	Enabled          bool   `json:"enabled"`
-	DocState string `json:"doc_state"`
+	ApprovalManaged  bool   `json:"approval_managed"`
-	Approved bool   `json:"approved"`
+	DocState         string `json:"doc_state"`
+	Approved         bool   `json:"approved"`
 }
 
 // StageReadiness 阶段推进就绪评估。

internal/projectinstance/validator.go

@@ -237,14 +237,24 @@ func previewSummary(plan WorkflowPlan, version *workflowdef.Version) PreviewSumm
 				continue
 			}
 			sum.EnabledDocTasks++
-			if dt.Duties.AuthorUserID > 0 {
+			switch classifyDocDuty(dt.Duties) {
-				sum.AssignedDuties++
+			case DutyModeFull:
-			}
+				sum.GovernedDocTasks++
-			if dt.Duties.ReviewerUserID > 0 {
+				if dt.Duties.AuthorUserID > 0 {
-				sum.AssignedDuties++
+					sum.AssignedDuties++
-			}
+				}
-			if dt.Duties.ApproverUserID > 0 {
+				if dt.Duties.ReviewerUserID > 0 {
-				sum.AssignedDuties++
+					sum.AssignedDuties++
+				}
+				if dt.Duties.ApproverUserID > 0 {
+					sum.AssignedDuties++
+				}
+			case DutyModeNone:
+				sum.UnmanagedDocTasks++
+				sum.UnmanagedDocuments = append(sum.UnmanagedDocuments, PreviewDocRef{
+					TaskKey: dt.TaskKey,
+					Title:   dutyTaskLabel(dt),
+				})
 			}
 		}
 	}

web/src/components/project/ProjectSettingsModal.tsx

@@ -538,7 +538,15 @@ export const ProjectSettingsModal: React.FC<ProjectSettingsModalProps> = ({
                 </div>
                 <div>工作流：{preview.summary.workflow_name} v{preview.summary.workflow_version}</div>
                 <div>启用阶段：{preview.summary.enabled_stages} · 文档任务：{preview.summary.enabled_doc_tasks}</div>
+                <div>
+                  纳入人工审批：{preview.summary.governed_doc_tasks ?? preview.summary.enabled_doc_tasks} · 不纳入：{preview.summary.unmanaged_doc_tasks ?? 0}
+                </div>
                 <div>职责指派：{preview.summary.assigned_duties} 项</div>
+                {(preview.summary.unmanaged_documents || []).length > 0 && (
+                  <div>
+                    例外文档：{(preview.summary.unmanaged_documents || []).map((doc) => doc.title || doc.task_key).join('、')}
+                  </div>
+                )}
                 {preview.summary.first_stage_name && (
                   <div>首阶段：{preview.summary.first_stage_name}</div>
                 )}

web/src/types/projectSettings.ts

@@ -81,7 +81,10 @@ export interface ActivationPreview {
     workflow_version: number;
     enabled_stages: number;
     enabled_doc_tasks: number;
+    governed_doc_tasks?: number;
+    unmanaged_doc_tasks?: number;
     assigned_duties: number;
+    unmanaged_documents?: Array<{ task_key: string; title: string }>;
     first_stage_key?: string;
     first_stage_name?: string;
   };
@@ -124,6 +127,7 @@ export interface StageReadiness {
     task_key: string;
     required: boolean;
     enabled: boolean;
+    approval_managed?: boolean;
     doc_state: string;
     approved: boolean;
   }>;