Capture trigger_user HITL expectations from dialogue adjudication (previously
dropped at the bizdev call site), project them as chat confirmation cards via
taskrun OnTerminal (exactly-once), arm the session PendingExpectation, and
handle confirm_context_fact hits through the supplement-info blackboard path.
Decline (纠正) guides the user to state the correct fact.
- Server no longer mirrors app.Runtime services (gov/svc/pwSvc/...): 574 call sites now use accessors in runtime_accessors.go
- backgroundLoop (mutex+sync.Once) stops sweeper/publisher/reminder/wsGC goroutines race-free (baseline 44161d2a reproduced DATA RACE; now green under -race)
- goose 00071 duplicate (dialogue merge 1da17a28 brought two 00071): context-conflict-adjudications renumbered to 00072; dev DB applied only through 00070 so zero data migration
- task_finalize tests build minimal app.Runtime; test injection via serverTestOverrides + setOverride* (explicit-nil markers for fail-closed cases)
Open member free-lane for chat initiation; auto-claim on author view;
harden lease persist/ownership with readable DOC_BUSY; add notification
inbox and supplement-impact HTTP decision APIs wired to composition root.
User authorized lifting CURRENT FAV whole-branch merge protection on
2026-09-23. Keep FAV_DEGRADED_READ/FAV_PUBLISHER_ENABLED default false.
Drop duplicate goose 00034 (local_dev already has 00036). Preserve
agentx workspace admin routes and pin-export wiring.
Return assistant_msg_id from createTaskRun so live bubbles merge with history,
hide continue on terminal failed runs, and restart via a fresh turn/bubble.
Introduce internal/contracts/vocabulary for state/role/error sentinels,
alias through docgov, and retarget hot production consumers so
coordinator no longer imports docgov for vocabulary-only use.
Remove production *pgxpool.Pool from Server, centralize domain→HTTP
status mapping, and expose Runtime ports for task-store readiness,
duty heal, and artifact vault registry. Allow app→docduty for heal wiring.
Close T20-B2/B6/B8/B9/B10 low-risk leaks: map-backed cancel reclaim, idempotency lock TTL in cleanupLoop, sync.Once information_schema probe, InvalidateLayer after chat memory upsert, and Subscribe before SSE headers.
Interrupted runs often have no done event, so a refresh replay would otherwise hold the SSE connection open.
Co-authored-by: Cursor <cursoragent@cursor.com>
A 409 used to return before any message was written, so a refresh showed an empty conversation. Record the user turn and a failed assistant reply before rejecting the run.
Co-authored-by: Cursor <cursoragent@cursor.com>
Health checks reuse a two-second snapshot and bound the schema query. Task SSE writes an error frame when an event cannot be encoded. ResolveDocTask errors when the frozen plan has no duty row, while explicit none-duties stay zero. Drop the unwired semantic-summary replace env, record the intentional dev versus release model split, document the test/main cutover path, and archive pre-goose SQL.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require ResolveBackendInEnv to deny stub (and empty stub fallback) when
env is main/prod so production cannot request simulated agent output.
Co-authored-by: Cursor <cursoragent@cursor.com>
Public errors now emit code, safe message, and request_id while keeping the legacy error field. Raw SQL, paths, tokens, and XSS payloads are stripped; the frontend branches on code instead of substring matching.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move construction and document OnOutbox out of server, give HTTP/CLI a shared task use case, and block already-cleared import/event arch rules.
Co-authored-by: Cursor <cursoragent@cursor.com>
Hash deliverables through Capability.ReadArtifact, resolve backends on the server, and refuse workspace removal until frozen members match FAV receipts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep 202 for unactivated document runs, persist blocked_pending_governance,
and refuse submit/review/approve/edit until a live workflow exists.
Co-authored-by: Cursor <cursoragent@cursor.com>
Return existing task run 202 for the same turn before scope/preflight so
SSE disconnect retries do not hit DOC_BUSY or duplicate chat. Extend
task-run events write deadlines with heartbeats without dropping global
HTTP WriteTimeout. Reconnect subscribeTaskRunEvents on EOF via after_seq.
Co-authored-by: Cursor <cursoragent@cursor.com>
Apply session ownership plus scope_kind visibility across window, day,
search, dates, categories, unread, and digest endpoints; add PG refresh
regression test for pre-activation and task-scoped messages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Close P0 auth gaps for lineage/runs, stage ABAC fail-closed, and
project:create; add IAM migrations 00021-23, me settings APIs, schema v2
manifests, orchestrator skeleton, and gate A regression coverage.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add confirm-gated resume API with resumable flag, Phase 5 finalize fault
and rolling-restart replay tests, Mermaid strict mode, request body limits,
and optional Runner Bearer auth between app and pi-agent.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.
Extend taskrun executors to return full TaskRunResult, finalize assistant
placeholder content with artifact metadata, and map quality_failed terminal
state instead of metadata-only updates.
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen