- Document list returns workflow_key per item and active_workflow_key
- DeliverableItem keeps workflowKey through server sync
- resolveTaskTemplateForMessage filters the match pool and blocks
cross-workflow mentions with switch guidance
Co-authored-by: Cursor <cursoragent@cursor.com>
- ContextSnapshot gains ActiveWorkflowKey; ToSnapshot passes it downstream
- manifest-backed doc-title -> workflow index (main/pm/tm/rdev/sw)
- TRIGGER_TASK and DOCGOV write actions blocked with switch guidance when
the named document belongs to another active workflow
- legacy projects without an active workflow key keep the old behavior
Co-authored-by: Cursor <cursoragent@cursor.com>
Interrupted runs often have no done event, so a refresh replay would otherwise hold the SSE connection open.
Co-authored-by: Cursor <cursoragent@cursor.com>
Activation and list healing need a server-side document row per enabled task, without overwriting documents that already have content.
Co-authored-by: Cursor <cursoragent@cursor.com>
A new recheck mark is posted into the actor's existing project session, and a downstream-impact event does the same. Asking about what a change affects still resolves to impact analysis.
Co-authored-by: Cursor <cursoragent@cursor.com>
A 409 used to return before any message was written, so a refresh showed an empty conversation. Record the user turn and a failed assistant reply before rejecting the run.
Co-authored-by: Cursor <cursoragent@cursor.com>
New workflow instances store bd_* task keys, but chat still sends the old keys. Scope and document access now treat those aliases as the same task so a live instance no longer fails closed on an exact string miss.
Co-authored-by: Cursor <cursoragent@cursor.com>
The task run API was emitting PascalCase fields, so the client never saw status or error_message and treated every disconnect as a network error.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use the record tables when migration 00059 is present, and hide statements from documents the caller cannot see.
Co-authored-by: Cursor <cursoragent@cursor.com>
Selected documents return to drafting, and advance asks the creator to acknowledge an open recheck mark.
Co-authored-by: Cursor <cursoragent@cursor.com>
Bind preference writes and session-scoped project reads to the authenticated principal, and require an owned session_id for recategorize so empty ids cannot touch all messages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Absorb stalled capability fixes and avoid goose out-of-order on schema 57 DBs by shipping chat_summaries as 00058.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add PATCH /doc-tasks/{taskKey}/duties that updates live snapshot,
assignments, and document_records while blocking when a squad run holds
the document lease. Planning PUT remains PLAN_FROZEN.
Co-authored-by: Cursor <cursoragent@cursor.com>
Live workflows still restrict document actions to duty holders, but
AllowedStageKeys now include active/completed stages so members can chat.
Co-authored-by: Cursor <cursoragent@cursor.com>
Deny foreign user_id upsert without manage rights (403); unique project
names in ctxmgr PG fixture for global name index; add test-env data repair SQL.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add GET /assets/{id}/raw with project access checks; frontend falls back
to CAS by assetId or filename when local blob is gone. Align upload accept
list with backend whitelist and register binaries into CAS on chat upload.
Co-authored-by: Cursor <cursoragent@cursor.com>
Project managers can register sess-p{N}-u{uid} for other members; adding a
member also ensures their private session so the sidebar is never empty.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace per-creator name uniqueness with a global index among
non-retired projects, and reject cross-user duplicate creates with 409.
Co-authored-by: Cursor <cursoragent@cursor.com>
A candidate used the same report later attached to the version, so a preview could be treated as the formal result. Proposed reports now close on replace or reject, and only the commit writes an authoritative successor.
The narrator only received counts, so it could not describe the actual change. Caps keep the full document out and leave the input digest unchanged; the flag stays off.
Co-authored-by: Cursor <cursoragent@cursor.com>
The in-memory authorizer treats any positive user id as a member, so the HTTP negative has to run against a real project row.
Co-authored-by: Cursor <cursoragent@cursor.com>
Published manifests now use bd_/pm_/tm_/sw_ prefixes so workflows cannot share a doc id. Frozen instances keep the old keys; lookup, templates, and duty checks treat the two names as the same task.
Co-authored-by: Cursor <cursoragent@cursor.com>
生成项目建议书 now resolves to rd_proposal. Longer titles win, so 系统设计方案 is not mistaken for the shorter business-stage phrase, and an explicit generate command is no longer swallowed by a progress question.
Co-authored-by: Cursor <cursoragent@cursor.com>
Each rdev step now gets a role-filtered overlay so writing discipline stays out of the template. User needs, system requirements, review minutes, and upload indexes fail the quality gate when IDs, decisions, or attachment indexes are incomplete.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stage-specific squad steps now win over the kind default, including always-on regulatory and searcher roles. Each of the 60 tasks carries its writing hint and Chinese alias so lookup and the writer accept line use them.
Co-authored-by: Cursor <cursoragent@cursor.com>
Listed tasks still get a regulatory step when complexity is unset or high. Medium and low skip it, and the squad model now comes from SQUAD_MODEL_ID or MINIMAX_MODEL_ID instead of a fixed name.
Co-authored-by: Cursor <cursoragent@cursor.com>
/auth/me was authenticating again after the middleware had already done it, and the session lookup queried user status in a second round trip. Reuse the request principal and join status into the session read so a revoked token still fails on the next request.
Co-authored-by: Cursor <cursoragent@cursor.com>
The human ledger and the document body are different stores. Record the projection intent in the same transaction as the ledger, and clear it only when the body write succeeds so a retry cannot append a second revision.
Co-authored-by: Cursor <cursoragent@cursor.com>
