A successful post-restart recordPass would overwrite the main 18-case ui-acceptance-results.json. Keep that historical name for main and write ui-acceptance-results-post-restart.json after restart, while still sharing phase-state and secrets.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the schema31 strict-mode failure, the banner/entry locator contract, and phase-split Playwright directories. Do not mark UI-15 passed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Page-wide project-name text hits both the top bar and the session rail after restart. Click the complementary exact title, then assert the banner exact name. Split Playwright output and HTML reports by UI_PHASE so post-restart cannot wipe main traces.
Co-authored-by: Cursor <cursoragent@cursor.com>
Note that HealProjectDocuments now shares pg_advisory_xact_lock(project_id) with member writes so an old reviewer cannot be written back.
Co-authored-by: Cursor <cursoragent@cursor.com>
Heal used to resolve and backfill on the pool without the member-write advisory lock, so a stale snapshot of reviewer A could overwrite a committed transfer to B. Lock, resolve, and document updates now share one transaction and the same lock key.
Co-authored-by: Cursor <cursoragent@cursor.com>
Document that lock, holder reads, member writes, and reviewer/approver slot clears share one transaction, with heal after commit.
Co-authored-by: Cursor <cursoragent@cursor.com>
Duty revoke must share the project advisory lock with reading old holders and writing members, so a post-commit service snapshot cannot miss a transfer. Heal still fills the new holder after commit, and sync failure stays ERR_DUTY_SYNC.
Co-authored-by: Cursor <cursoragent@cursor.com>
Sync short-term, checklist, and handoff with remaining 6145 risk and
the isolated PG verification path.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove now reconciles document slots and returns ERR_DUTY_SYNC on
failure. CreateOrGetDocument errors abort the task. The frontend
refreshes workflow docs after add, update, restore, and remove.
Co-authored-by: Cursor <cursoragent@cursor.com>
Empty assigned heal now clears only exited or non-member reviewer/approver
holders and never blanks author. Explicit reconcile uses the pre-update
duty plus a project advisory lock so viewer demotion and transfers are
not left to generic heal.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require TEST_DATABASE_URL and refuse agent_system_dev. Script creates a
throwaway database, runs packages serially, then drops it.
Co-authored-by: Cursor <cursoragent@cursor.com>
Post-create role changes were silently dropping reviewer/approver
because only project_role was persisted.
Co-authored-by: Cursor <cursoragent@cursor.com>
Omit project_role no longer defaults to member. Exclusive duty writes
take an advisory lock and retry conflicts so last-writer wins without
dual reviewers. Author write tests require err==nil.
Co-authored-by: Cursor <cursoragent@cursor.com>
Align document slots to project document_duty even when the wrong ID is
an active member, and fail generate/list instead of returning stale
placeholder duties. Owner author backfill now picks creator, else lowest ID.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep project_role as member/viewer, send document_duty=reviewer for USER_B, and clear the seed 李主管 reviewer so the assigned reviewer is the one that syncs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop inventing reviewer_id=2. Use project document_duty as the authority, heal missing or non-member placeholders, and keep write paths rejected for reviewer and outsiders.
Co-authored-by: Cursor <cursoragent@cursor.com>
Project access roles cannot carry reviewer. Persist a separate exclusive document_duty so later controlled docs can inherit the assigned reviewer.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-13a now proves USER_B is viewer despite UI-01 assigning reviewer; claim a new mutex and document the 6145 ledger gap.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-13a reviewer contract now has 6 unit cases; keep the short-term note aligned without rewriting the already-reviewed fix commit.
Co-authored-by: Cursor <cursoragent@cursor.com>
USER_B is assigned reviewer in UI-01. Accept only role=reviewer on
the duty control, and reject assignable or enabled selects.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-13a treated concatenated select options as the current role.
Assert the control value or badge role for that doc instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-13a stayed on private after upload, so the doc menu had no
doc_proj* entries. Always use the category trigger first, then exact id.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-11 can finish before the waiter sees pending. Treat success terminals
as done, keep upload/correspondence/error checks, and cover both timelines.
Co-authored-by: Cursor <cursoragent@cursor.com>
Promote root output.md only when the runner succeeded, protected parents
were untouched, and the local target is trusted. Restore errors abort
instead of being ignored.
Co-authored-by: Cursor <cursoragent@cursor.com>
Repair TASK.md told the model to edit ../../output.md, so the local
target never appeared and UI-03 stayed quality_failed. Snapshot parent
inputs locally, restore them on containment violations, and promote
only a trusted repair/output.md before revalidate.
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop test-only ETag helpers. App now calls saveControlledBlockEdit,
which PATCHes once on the bound editor docId or fail-closes. Resume
hydrate after a blocked first load, and refuse silent doc switches.
Co-authored-by: Cursor <cursoragent@cursor.com>
Background GET rebuilt markdown AST with Math.random ids and dropped
head_block_map, so save closed the modal without PATCH. Align hydrate
to the ledger map, gate in-flight responses, and fail-closed on stale ids.
Co-authored-by: Cursor <cursoragent@cursor.com>
runner.mjs imports ./settle-policy.mjs but the Dockerfile only copied
runner.mjs, which crashed shuimu-pi-agent-dev on import. COPY the
runtime module and assert every relative import is in the image set.
Co-authored-by: Cursor <cursoragent@cursor.com>
auto_retry_end success=true now drops providerTransient and lastErr so
a later agent_settled can succeed when the in-process retry landed a
real target. A new error after recovery still fails.
Co-authored-by: Cursor <cursoragent@cursor.com>
A this-invocation output.md is preserved and never retried over, but
Success=false stays a step failure so truncated writes cannot pass.
Prior-round residue without a trusted patch is also not success.
Co-authored-by: Cursor <cursoragent@cursor.com>
Fresh step invocation is limited to provider terminated/connection plus
a missing target, or an explicit runner failure. A deliverable already
on disk is accepted and never overwritten.
Co-authored-by: Cursor <cursoragent@cursor.com>
*.md was excluding templates/docs from Docker context, so COPY and
go:embed could not see prelim_design.md at /app. Un-ignore those trees
and assert the smoke image can cat the official file.
Co-authored-by: Cursor <cursoragent@cursor.com>
Separate MiniMax/SDK connection failures from the product gap that
reported process 0 and agent_settled as step success.
Co-authored-by: Cursor <cursoragent@cursor.com>
agent_settled after terminated or auto_retry_end success=false is not a
deliverable. Return retryable for provider transients and keep clean
missing targets permanent.
Co-authored-by: Cursor <cursoragent@cursor.com>
runOneStep re-executes the backend at most once when the first attempt
is a settled failure or missing target after provider errors, records
each attempt honestly, and fail-closes after the bound.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat process-0 plus terminated/Connection error/auto_retry_end as a
provider transient. Permanent missing deliverables stay fail-closed and
are never reconstructed from truncated write arguments.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the missing-output.md failure, embed/path-mapping tradeoffs, and CURRENT mutex without marking the task done.
Co-authored-by: Cursor <cursoragent@cursor.com>
agent_settled after exhausted retries is not success; missing or empty target files must return ok:false instead of an empty patch list.
Co-authored-by: Cursor <cursoragent@cursor.com>
Normalize absolute, ./, and duplicated step prefixes onto output.md, and fail closed when the runner reports ok without a non-empty deliverable.
Co-authored-by: Cursor <cursoragent@cursor.com>
App images have no templates/ checkout, so GetDocTemplate fell back to a two-section stub and prelim_design lost its real contract.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep the routing/lease task in_progress and document why the second-doc locator must use the registered doc id.
Co-authored-by: Cursor <cursoragent@cursor.com>
Card title is 系统初步设计方案, not 系统设计输入; select doc_proj*_prelim_design so the template slot cannot be mistaken for the generated document.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the tenth-round routing/lease failure, request-scoped release tradeoff, and CURRENT claim without marking the task done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Arm tasks/runs waiter before send and assert HTTP 202 so a sync DOC_BUSY completed turn cannot pass as a new document run.
Co-authored-by: Cursor <cursoragent@cursor.com>
Explicit aliases (including 系统设计输入) must win before keyword fallback so UI-11 does not route to intake.
Co-authored-by: Cursor <cursoragent@cursor.com>
Link the archived ninth-round mid-transition failure; do not mark
the task done before a real UI rerun.
Co-authored-by: Cursor <cursoragent@cursor.com>
Poll pane document-block computed styles until two frames match.
Pure requires transparent background and box-shadow none; manual/all
require a real overlay mark without hard-coded theme colors.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-07 reads every active-pane document-block after the real overlay
fetch. Pure must stay unmarked; manual/all may share amber on the
same human hunk. UI-10 waits for history to auto-close.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-06/13b click 保存修改 only inside 编辑受控块; UI-13a asserts
the dialog is absent instead of a page-wide /保存/ match.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expose role=dialog and a stable aria-label so save can be scoped
without changing the modal's visuals or save behavior.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-06 and UI-13b reuse the pane-scoped helper; stop clicking overlay
or native heading/paragraph tags that the renderer does not emit.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add data-testid=document-block plus block id on every wrapper so
pure-mode editors stay addressable without changing visuals.
Co-authored-by: Cursor <cursoragent@cursor.com>
Mark server summaries dutiesAuthoritative so id 0 stays fail-closed
viewer instead of matching names like a legacy local document.
Co-authored-by: Cursor <cursoragent@cursor.com>
Reject revision-state network/5xx and missing ledger on controlled
hydrate; never PATCH 0:0 unless the document is freeform.
Co-authored-by: Cursor <cursoragent@cursor.com>
Document the privilege-escalation and silent-overwrite hazards; keep
the reject-routing task in_progress pending real UI rerun.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require matching r/etag on both windows and keep A2's editor filled
before A1 saves so the conflict is a real race.
Co-authored-by: Cursor <cursoragent@cursor.com>
Retain ledger author/reviewer/approver, fail-closed unknown users to
viewer, and send the opened revision ETag instead of a fresh GET.
Co-authored-by: Cursor <cursoragent@cursor.com>
ListWorkflowDocumentsByProject now projects author/reviewer/approver
id+name so clients cannot invent the current user as author.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-05b has not reached reject yet, so pending-flow cannot be done; move it to pending-report-ui so reject-routing can keep document-revision-runtime-ui.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require 当前受控文档 deixis plus tasks/runs task_key/doc_id checks so reject stays on intake; compare inside 版本历史, hide the project from non-member C, and split UI-13 into reviewer-readonly plus dual-author conflict.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-04 must close via the dialog 关闭 button; UI-05a/05b must click 待确认报告 and assert panel actions so leftover first-round reports cannot hide the decision path.
Co-authored-by: Cursor <cursoragent@cursor.com>
Reject 待续 status-cell exemptions unless the same contiguous table has a header immediately followed by a valid separator and the data row width matches the header.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat structured 阶段/状态/进度 cells as workflow state, not hedging, while still failing body, lists, and non-status columns.
Co-authored-by: Cursor <cursoragent@cursor.com>
When the user refers to the current document, keep task_key/doc_id on the selected registered doc_proj instead of rerouting by domain keywords.
Co-authored-by: Cursor <cursoragent@cursor.com>
Return existing task run 202 for the same turn before scope/preflight so
SSE disconnect retries do not hit DOC_BUSY or duplicate chat. Extend
task-run events write deadlines with heartbeats without dropping global
HTTP WriteTimeout. Reconnect subscribeTaskRunEvents on EOF via after_seq.
Co-authored-by: Cursor <cursoragent@cursor.com>
