Authorize first, then return immutable ledger markdown with typed consistency so a missing or drifted projection is no longer a 404/409. GET stays read-only and FAV degraded read stays off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Lock the document row and re-authorize duty before edit, agent commit, approve, or reject share a single transaction. Characterization tests pin ETag races, one legal approve/reject terminal, and same-key digest conflicts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Creating with initial_workflow_key must stay in planning with an empty
active key while the catalog still mounts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep 202 for unactivated document runs, persist blocked_pending_governance,
and refuse submit/review/approve/edit until a live workflow exists.
Co-authored-by: Cursor <cursoragent@cursor.com>
migration_repair is not a human revision. HashUpdater now loads from DB
and retries still sync. Content reads return a structured drift conflict
instead of the destructive old head.
Co-authored-by: Cursor <cursoragent@cursor.com>
Duty revoke must share the project advisory lock with reading old holders and writing members, so a post-commit service snapshot cannot miss a transfer. Heal still fills the new holder after commit, and sync failure stays ERR_DUTY_SYNC.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove now reconciles document slots and returns ERR_DUTY_SYNC on
failure. CreateOrGetDocument errors abort the task. The frontend
refreshes workflow docs after add, update, restore, and remove.
Co-authored-by: Cursor <cursoragent@cursor.com>
Omit project_role no longer defaults to member. Exclusive duty writes
take an advisory lock and retry conflicts so last-writer wins without
dual reviewers. Author write tests require err==nil.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop inventing reviewer_id=2. Use project document_duty as the authority, heal missing or non-member placeholders, and keep write paths rejected for reviewer and outsiders.
Co-authored-by: Cursor <cursoragent@cursor.com>
Return existing task run 202 for the same turn before scope/preflight so
SSE disconnect retries do not hit DOC_BUSY or duplicate chat. Extend
task-run events write deadlines with heartbeats without dropping global
HTTP WriteTimeout. Reconnect subscribeTaskRunEvents on EOF via after_seq.
Co-authored-by: Cursor <cursoragent@cursor.com>
Never-activated projects were allowed by access ABAC but rejected with
TASK_SCOPE_UNRESOLVED 409; use GetGoverningInstanceForAccess so nil maps to
ScopePreActivation, live to stage scope, and closed stays unresolved.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unrestricted stage access on projects without a live workflow must not
let arbitrary authenticated users join by project_id. Enforce member or
creator (admin per existing policy) before stage ABAC, and reject chat
streams with JSON 403 before SSE headers/flush.
Co-authored-by: Cursor <cursoragent@cursor.com>
Return the UpdateUserRole error instead of silently continuing when an
admin approves a user with an explicit role_id.
Co-authored-by: Cursor <cursoragent@cursor.com>
Authorize project members, reject direct project_shared creates, and
cover idempotent client_key plus revision-state after register.
Co-authored-by: Cursor <cursoragent@cursor.com>
Do not expose a production path that mutates only the in-memory proposal
index. Cover decision idempotency via ProposeModification+Decide and the
existing package MarkProposalApplied tests instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
Surface a same-decision retry hint and cover commit-then-MarkProposalApplied
compensation via PutChangeProposal when the proposal index was missing.
Co-authored-by: Cursor <cursoragent@cursor.com>
Sync coordinator and async CompletionSummary use pending_author_confirmation
with artifact metadata for document entry; completed only after commit.
Co-authored-by: Cursor <cursoragent@cursor.com>
Materialize needs_confirmation restores ledger head to output.md and
document_records hash; only committed heads update DocGov. Decision
handler projects after commit or reject. Stage gates DocGov proposals
via PendingProposal, not bare RequiresAuthorApproval.
Co-authored-by: Cursor <cursoragent@cursor.com>
Surface pending_candidate_id, report id, and risk so NeedsConfirmation
candidates are discoverable before they enter the version list.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unauthorized actors no longer grab leases; controlled PATCH projects through
DocGov so author_last_edited and audit survive, with idempotent retry on failure.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stage generation without a real document must not panic or enter the ledger.
Unknown orphan IDs are denied, write paths check author/lease/lifecycle, PATCH
no longer returns a fake 200, and overlay matching survives client/server block id drift.
Co-authored-by: Cursor <cursoragent@cursor.com>
Resolve controlled/freeform/orphan docs, bootstrap on GET, write output.md or freeform content on PATCH, and wire lineage impacts for agent candidates.
Co-authored-by: Cursor <cursoragent@cursor.com>
Rebuild dev backend so message visibility uses scope-aware filtering instead of dropping messages without stage_key. Map HTTP 401/403 on chat stream to actionable auth errors instead of generic NETWORK_ERROR.
Co-authored-by: Cursor <cursoragent@cursor.com>
Apply session ownership plus scope_kind visibility across window, day,
search, dates, categories, unread, and digest endpoints; add PG refresh
regression test for pre-activation and task-scoped messages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cover public auth config, catalog policy, official main workflow activation on Postgres, and conn-busy metadata writeback fixes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expose governance APIs for workflow selection/termination and allow login pages to read registration policy without admin credentials.
Co-authored-by: Cursor <cursoragent@cursor.com>
Close P0 auth gaps for lineage/runs, stage ABAC fail-closed, and
project:create; add IAM migrations 00021-23, me settings APIs, schema v2
manifests, orchestrator skeleton, and gate A regression coverage.
Co-authored-by: Cursor <cursoragent@cursor.com>
V0.1 workflow steps exceeded the default 30m pi-agent /v1/run deadline; align test config with production AGENT_TIMEOUT and runner env vars.
Co-authored-by: Cursor <cursoragent@cursor.com>
