Introduce internal/contracts/vocabulary for state/role/error sentinels,
alias through docgov, and retarget hot production consumers so
coordinator no longer imports docgov for vocabulary-only use.
Keep registry key validation local to workflowdef with composition-root
injection, adapt FlatCatalog for projectworkflow, and drive the
orchestrator through LiveInstancePort views instead of projectinstance.
Replace FakeActionOwner with QueryOwner+QueryGuard at the composition
root; DispatchEligible reuses claim/execute/recover so confirm stays
zero-write before dispatch and default tier remains legacy.
Remove production *pgxpool.Pool from Server, centralize domain→HTTP
status mapping, and expose Runtime ports for task-store readiness,
duty heal, and artifact vault registry. Allow app→docduty for heal wiring.
Move document_records duty-slot writes into docgov, project ledger
heads through docgov/freedoc ports, and workspace deliverable I/O
through DeliverableStore so arch-check baseline drops to sql_write:1
path:13.
Invert chat dependencies onto composition-root adapters, replace
AssembleRequest coordinator embeds with local DTOs, and drop the
chat→app/* allowlist edges so arch-check can enforce the boundary.
Invert chat dependencies on chatflow/intentflow/stageflow through
composition-root adapters; replace AssembleRequest coordinator embeds
with local DTOs and tighten the module-boundaries allowlist.
Close T20-B2/B6/B8/B9/B10 low-risk leaks: map-backed cancel reclaim, idempotency lock TTL in cleanupLoop, sync.Once information_schema probe, InvalidateLayer after chat memory upsert, and Subscribe before SSE headers.
go test under internal/server previously preferred package-local
data/test, so materials never reached the pi-agent bind mount and
intake quality gates failed closed on empty sandboxes.
Official main.v2 uses bd_intake (not intake); stage gates stayed closed when
fixtures approved the wrong task key. Task-run finalizers also require a real
project_id for outbox event scope—seed scoped projects in PG fixtures.
Co-authored-by: Cursor <cursoragent@cursor.com>
enforceChatProjectAccess before allowAnyStageAccess on GET /context/project
so activated projects are no longer readable by arbitrary authenticated users.
Align failing gate fixtures with official workflow keys, isolated TEST_DATABASE_URL,
unique project names (00057), duty membership, and in-memory bizdev-cli envs.
Co-authored-by: Cursor <cursoragent@cursor.com>
arch-check --mode block failed on frozen dev (23 NEW import findings):
modules materialindex/mineru/workflowscope and edges shipped via their
own accepted tasks were never registered in module-boundaries.yaml.
Register the intentional allowlist edges (precedent 97b868a9); no new
exceptions are added.
7 PG tests fell back to a hardcoded dev DB (127.0.0.1:5433) when
TEST_DATABASE_URL/CONTEXT_DB_DSN were unset, contradicting the isolated
test-DB contract (BUG-08) and polluting dev on a bare 'go test -short'.
Change the fallback to skip when no isolated DB env is provided.
Co-authored-by: Cursor <cursoragent@cursor.com>
A missing ledger body was reported as not found, so an in-scope view of a template document never reached the template reply.
Co-authored-by: Cursor <cursoragent@cursor.com>
The document list now reports WORKFLOW_SCOPE_MODE, and weighted mode only blocks a cross-workflow write when that title outscores the active workflow.
Co-authored-by: Cursor <cursoragent@cursor.com>
Exact out-of-workflow documents can be summarized when WORKFLOW_SCOPE_MODE=weighted and the caller can still view the active instance; writes stay blocked.
Co-authored-by: Cursor <cursoragent@cursor.com>
Async-trigger MinerU after CAS store and surface parse status in
assets API plus a lightweight preview badge.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Document list returns workflow_key per item and active_workflow_key
- DeliverableItem keeps workflowKey through server sync
- resolveTaskTemplateForMessage filters the match pool and blocks
cross-workflow mentions with switch guidance
Co-authored-by: Cursor <cursoragent@cursor.com>
Interrupted runs often have no done event, so a refresh replay would otherwise hold the SSE connection open.
Co-authored-by: Cursor <cursoragent@cursor.com>
A new recheck mark is posted into the actor's existing project session, and a downstream-impact event does the same. Asking about what a change affects still resolves to impact analysis.
Co-authored-by: Cursor <cursoragent@cursor.com>
A 409 used to return before any message was written, so a refresh showed an empty conversation. Record the user turn and a failed assistant reply before rejecting the run.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use the record tables when migration 00059 is present, and hide statements from documents the caller cannot see.
Co-authored-by: Cursor <cursoragent@cursor.com>
Bind preference writes and session-scoped project reads to the authenticated principal, and require an owned session_id for recategorize so empty ids cannot touch all messages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Absorb stalled capability fixes and avoid goose out-of-order on schema 57 DBs by shipping chat_summaries as 00058.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add PATCH /doc-tasks/{taskKey}/duties that updates live snapshot,
assignments, and document_records while blocking when a squad run holds
the document lease. Planning PUT remains PLAN_FROZEN.
Co-authored-by: Cursor <cursoragent@cursor.com>
Deny foreign user_id upsert without manage rights (403); unique project
names in ctxmgr PG fixture for global name index; add test-env data repair SQL.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add GET /assets/{id}/raw with project access checks; frontend falls back
to CAS by assetId or filename when local blob is gone. Align upload accept
list with backend whitelist and register binaries into CAS on chat upload.
Co-authored-by: Cursor <cursoragent@cursor.com>
Project managers can register sess-p{N}-u{uid} for other members; adding a
member also ensures their private session so the sidebar is never empty.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace per-creator name uniqueness with a global index among
non-retired projects, and reject cross-user duplicate creates with 409.
Co-authored-by: Cursor <cursoragent@cursor.com>
The in-memory authorizer treats any positive user id as a member, so the HTTP negative has to run against a real project row.
Co-authored-by: Cursor <cursoragent@cursor.com>
WeiCHEN