weichen/Agent-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
752 Commits 10 Branches 15 Tags
0f2057765aee28fa3448e7198058515bc58aa4d5
Commit Graph
22 Commits
Author SHA1 Message Date
weichenandCursor 8384136989 feat(projectinstance): map document actions to duties 
Route run/edit/submit/review/approve to a single duty, drop full-doc
creator bypass, and keep view listing independent of stage narrowing.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-14 07:54:43 +00:00
weichenandCursor 66d2a1837f test(projectinstance): pin action-level duty checks 
Lock the full/none/pre-activation matrix so creator no longer implies
document-task privilege and unactivated runs stay WORKFLOW_NOT_ACTIVATED.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-14 07:54:43 +00:00
weichenandCursor e1ed561917 feat(web): add optional human-approval switch for configurable docs 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-14 07:02:11 +00:00
weichenandCursor a0904fdd69 test(web): cover per-document approval toggle 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-14 07:02:11 +00:00
weichenandCursor 708b735eea feat(projectinstance): apply duty mode to readiness access and snapshots 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-14 06:58:06 +00:00
weichenandCursor 1dd1cc039e test(projectinstance): unify gate access and preview for duty modes 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-14 06:58:06 +00:00
weichenandCursor ea97a658c6 feat(projectinstance): classify optional duties without lowering required gates 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-14 06:53:21 +00:00
weichenandCursor de66558736 test(projectinstance): pin duty mode and activation governance 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-14 06:53:21 +00:00
weichenandCursor 5096581651 fix(projectinstance): resolve pre-activation task scope via governing three-state 
Never-activated projects were allowed by access ABAC but rejected with
TASK_SCOPE_UNRESOLVED 409; use GetGoverningInstanceForAccess so nil maps to
ScopePreActivation, live to stage scope, and closed stays unresolved.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 12:59:10 +00:00
weichenandCursor f50692be25 fix(projectinstance): distinguish never-activated vs closed governing instances 
GetLiveInstance remains active-only; access ABAC now uses
GetGoverningInstanceForAccess so completed/terminated PG rows are not
treated as unrestricted legacy projects, while brand-new projects without
instances stay open for creators.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 12:25:22 +00:00
weichenandCursor 1abafa3176 fix(chat): add message scope columns and write-path resolution 
Persist workflow_instance_id, stage_instance_id, scope_kind on chat
messages and task runs; resolve scope from live instance for chat and
document tasks so refresh can apply consistent stage authorization.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 03:06:08 +00:00
weichen 77b8d07cd7 fix(governance): 统一文档访问判定与上下文快照排除计数 
补齐 DocumentAccessDecider HTTP 409、projectcontext 私有对话排除统计，并更新整改 gap matrix 与测试报告。
 2026-09-13 02:50:23 +00:00
weichenandCursor ad6e38d11a test(workflow): add governance regression and activation PG coverage 
Cover public auth config, catalog policy, official main workflow activation on Postgres, and conn-busy metadata writeback fixes.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor f07178fa73 feat(service): enforce three-workflow governance and instance lifecycle 
Wire catalog policy, v2 manifests, stage access, activation metadata fixes, and coordinator instance advance around frozen workflow snapshots.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor 90f77eac93 feat(authz): implement six-phase permissions, settings and workflow v2 
Close P0 auth gaps for lineage/runs, stage ABAC fail-closed, and
project:create; add IAM migrations 00021-23, me settings APIs, schema v2
manifests, orchestrator skeleton, and gate A regression coverage.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor b6035991d4 feat(notification): add 24h stage advance reminder and confirm on advance. 
Poll pending requests every 15 minutes, emit deduplicated escalation notifications, and close requests when creator confirms stage advance.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor d9f3d40423 feat(abac): enforce stage access on chat, search and SSE streams. 
Tag messages with stage_key metadata, block sends for unauthorized roles, and filter history/search/case results by allowed stages.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor 32b88beee0 feat(projectinstance): refresh stage readiness after document approval. 
Sync doc task status on approve and evaluate whether to emit stage advance readiness; chain docgov hooks.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor ec2ea02e8a feat(abac): restrict workflow document access by active stage duties. 
Resolve stage access from live instance assignments and filter document list/content for non-assigned roles.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor b402426257 test(db): add PG integration test for activation and stage advance. 
Verify migration 00017 and full plan→preview→activate→advance chain against dev Postgres.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor e0c39aa38c feat(service): add stage gate readiness and creator-confirmed advance. 
Evaluate required document approvals before stage transition, expose readiness/advance APIs, show StageAdvanceBanner in the UI, and keep legacy workflow switch for explicit initial_workflow_key projects.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor dc629fc4b8 feat(service): implement project workflow plan, preview, and activation flow. 
New projectinstance package validates three-duty separation, issues confirmation tokens, and activates immutable workflow instances; new projects start in planning mode.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00