fix(chat): bind project ID through CLI chat + stage dispatch (issue #2)

Root cause: the 2026-09-28 controlled-projection hardening added the
ErrUnboundControlledProject guard, and the server path got session project
binding backfilled - but two paths missed:
- CLI chat mode never called session.SetProjectID (only -project name)
- coordinator handleAdvanceStage built StageRunRequest without
  ProjectID/UserID, so every stage-advance squad task was rejected

Fixes:
- handleChatMode gains projectID param (wired from -project-id flag);
  session binding follows the server convention
- handleAdvanceStage passes parseDecimalID(UserCtx.Project/User.ID)
- CLI chat tests get hermetic env (unreachable DB + ALLOW_IN_MEMORY) so
  local runs stop accidentally hitting the real dev DB on :5433
- stale test TestBindSessionProjectContext_KeepsExistingProjectID asserted
  the pre-fix 'switch does not propagate' bug; updated to assert switch
  propagation + bind no-overwrite

Result: go test -short ./... = 75 packages, 0 failures (first time).
Short tests promoted from report-only back into the required CI gate.

.github/workflows/ci.yml

@@ -42,38 +42,16 @@ jobs:
       - name: arch-check (block cleared kinds)
         run: ./scripts/arch-check.sh --mode block
 
+      - name: go test (short, required since 2026-09-29)
+        env:
+          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci?sslmode=disable
+        run: go test -short -timeout 20m ./...
+
       - name: secrets scan (tracked files)
         run: |
           bad=$(git ls-files | grep -Ei '(^|/)(\.env|.*\.(pem|key|p12|sqlite|sqlite3))$' || true)
           if [ -n "$bad" ]; then echo "tracked secret-like files:"; echo "$bad"; exit 1; fi
 
-  short-tests-report:
-    # 存量已知失败（会话项目绑定等环境依赖用例）在 CI 从未通过；先报告不阻断，
-    # 跟踪 issue #2，修绿后并入 go-vet 必需门禁。
-    continue-on-error: true
-    runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: pgvector/pgvector:pg16
-        env:
-          POSTGRES_USER: app
-          POSTGRES_PASSWORD: ci_secret_db_pass
-          POSTGRES_DB: agent_system_ci
-        options: >-
-          --health-cmd "pg_isready -U app -d agent_system_ci"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 20
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: "1.27.1"
-          cache-dependency-path: go.sum
-      - name: go test (short, report-only)
-        env:
-          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci?sslmode=disable
-        run: go test -short -timeout 20m ./...
 
   backup-restore-drill:
     runs-on: ubuntu-latest

cmd/bizdev-cli/main.go

@@ -130,6 +130,7 @@ func main() {
 			*chatQuery,
 			*workDirFlag,
 			*project,
+			*projectIDFlag,
 			*customer,
 			*device,
 			*use,
@@ -590,6 +591,7 @@ func handleChatMode(
 	chatQuery string,
 	workDir string,
 	project string,
+	projectID int64,
 	customer string,
 	device string,
 	use string,
@@ -665,6 +667,11 @@ func handleChatMode(
 	engine := coordinator.NewCoordinatorEngine(stageflow.New(svc))
 	session := chat.NewSession("cli_chat_sess", userCtx, rec, engine)
 	session.CtxMgr = bizdev.Snapshot(svc).Ctx
+	// 回填会话项目绑定（与服务端 handlers 一致）：受控交付物任务按数字项目 ID
+	// 入账，仅传名称会让 ADVANCE_STAGE 派发被 ErrUnboundControlledProject 拒绝。
+	if projectID > 0 {
+		session.SetProjectID(projectID)
+	}
 
 	// 单次提问模式 (支持脚本与自动化测试)
 	if chatQuery != "" {

cmd/bizdev-cli/main_test.go

@@ -31,7 +31,7 @@ func TestBizdevCLIHelpAndRun(t *testing.T) {
 
 func TestBizdevCLIListTasks(t *testing.T) {
 	tmpDir := t.TempDir()
-	envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\n"
+	envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\nCONTEXT_DB_HOST=127.0.0.1\nCONTEXT_DB_PORT=1\n"
 	envPath := filepath.Join(tmpDir, ".env")
 	if err := os.WriteFile(envPath, []byte(envContent), 0o644); err != nil {
 		t.Fatal(err)
@@ -49,7 +49,7 @@ func TestBizdevCLIListTasks(t *testing.T) {
 
 func TestBizdevCLIExecuteAndInspect(t *testing.T) {
 	tmpDir := t.TempDir()
-	envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\n"
+	envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\nCONTEXT_DB_HOST=127.0.0.1\nCONTEXT_DB_PORT=1\n"
 	envPath := filepath.Join(tmpDir, ".env")
 	_ = os.WriteFile(envPath, []byte(envContent), 0o644)
 
@@ -114,7 +114,7 @@ func TestBizdevCLIExecuteAndInspect(t *testing.T) {
 
 func TestBizdevCLIStageExecution(t *testing.T) {
 	tmpDir := t.TempDir()
-	envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\n"
+	envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\nCONTEXT_DB_HOST=127.0.0.1\nCONTEXT_DB_PORT=1\n"
 	envPath := filepath.Join(tmpDir, ".env")
 	_ = os.WriteFile(envPath, []byte(envContent), 0o644)
 
@@ -158,7 +158,7 @@ func TestBizdevCLIStageExecution(t *testing.T) {
 
 func TestBizdevCLIChatQueries(t *testing.T) {
 	tmpDir := t.TempDir()
-	envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\n"
+	envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\nCONTEXT_DB_HOST=127.0.0.1\nCONTEXT_DB_PORT=1\n"
 	envPath := filepath.Join(tmpDir, ".env")
 	_ = os.WriteFile(envPath, []byte(envContent), 0o644)
 
@@ -244,7 +244,7 @@ func TestBizdevCLIChatQueries(t *testing.T) {
 
 func TestBizdevCLIThreeBranchQueries(t *testing.T) {
 	tmpDir := t.TempDir()
-	envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\n"
+	envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\nCONTEXT_DB_HOST=127.0.0.1\nCONTEXT_DB_PORT=1\n"
 	envPath := filepath.Join(tmpDir, ".env")
 	_ = os.WriteFile(envPath, []byte(envContent), 0o644)
 
@@ -345,7 +345,7 @@ func TestBizdevCLIThreeBranchQueries(t *testing.T) {
 
 func TestBizdevCLIExecuteAdhocTask(t *testing.T) {
 	tmpDir := t.TempDir()
-	envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\n"
+	envContent := "ENV=test\nDATA_DIR=" + tmpDir + "\nAGENT_BACKEND=stub\nALLOW_IN_MEMORY=true\nCONTEXT_DB_HOST=127.0.0.1\nCONTEXT_DB_PORT=1\n"
 	envPath := filepath.Join(tmpDir, ".env")
 	_ = os.WriteFile(envPath, []byte(envContent), 0o644)
 

internal/coordinator/engine_stage.go

@@ -291,6 +291,8 @@ func (e *CoordinatorEngine) handleAdvanceStage(ctx context.Context, cand *intent
 	}
 
 	// 3. 调用底层 L3 调度器执行阶段跃迁
+	// 回填数字项目/用户 ID：受控交付物任务按 ProjectID 入账（缺失会被
+	// ErrUnboundControlledProject 拒绝）；与 handleTask 派发口径一致。
 	stageRes, err := e.tasks().ExecuteStage(ctx, stageflow.StageRunRequest{
 		Stage:        targetStage,
 		ProjectName:  userCtx.Project.Name,
@@ -300,6 +302,8 @@ func (e *CoordinatorEngine) handleAdvanceStage(ctx context.Context, cand *intent
 		TargetMarket: userCtx.Project.TargetMarket,
 		Fields:       userCtx.BlackboardFacts,
 		WorkDir:      userCtx.WorkDir,
+		ProjectID:    parseDecimalID(userCtx.Project.ID),
+		UserID:       parseDecimalID(userCtx.User.ID),
 	})
 	if err != nil {
 		return &CoordinationResult{

internal/server/project_binding_test.go

@@ -18,14 +18,19 @@ func TestBindSessionProjectContext_FillsEmptyProjectID(t *testing.T) {
 	}
 }
 
-func TestBindSessionProjectContext_KeepsExistingProjectID(t *testing.T) {
+// 2026-09-28 回填会话项目绑定后，SetProjectID 会同步协调器上下文：
+// 切换项目必须传导（旧断言"保留 9"固化的是切换不生效的缺陷）。
+func TestBindSessionProjectContext_SwitchPropagates(t *testing.T) {
 	sess := chat.NewSession("sess-keep", &coordinator.UserProjectContext{
 		Project: coordinator.ProjectInfo{ID: "9", Name: "已绑定"},
 	}, nil, nil)
 	sess.SetProjectID(6024)
+	if sess.UserCtx.Project.ID != "6024" {
+		t.Fatalf("project switch must propagate, got %q", sess.UserCtx.Project.ID)
+	}
 	bindSessionProjectContext(sess)
-	if sess.UserCtx.Project.ID != "9" {
+	if sess.UserCtx.Project.ID != "6024" {
-		t.Fatalf("project id=%q", sess.UserCtx.Project.ID)
+		t.Fatalf("bind must not overwrite explicit binding, got %q", sess.UserCtx.Project.ID)
 	}
 }