Treat process-0 plus terminated/Connection error/auto_retry_end as a
provider transient. Permanent missing deliverables stay fail-closed and
are never reconstructed from truncated write arguments.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the missing-output.md failure, embed/path-mapping tradeoffs, and CURRENT mutex without marking the task done.
Co-authored-by: Cursor <cursoragent@cursor.com>
agent_settled after exhausted retries is not success; missing or empty target files must return ok:false instead of an empty patch list.
Co-authored-by: Cursor <cursoragent@cursor.com>
Normalize absolute, ./, and duplicated step prefixes onto output.md, and fail closed when the runner reports ok without a non-empty deliverable.
Co-authored-by: Cursor <cursoragent@cursor.com>
App images have no templates/ checkout, so GetDocTemplate fell back to a two-section stub and prelim_design lost its real contract.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep the routing/lease task in_progress and document why the second-doc locator must use the registered doc id.
Co-authored-by: Cursor <cursoragent@cursor.com>
Card title is 系统初步设计方案, not 系统设计输入; select doc_proj*_prelim_design so the template slot cannot be mistaken for the generated document.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the tenth-round routing/lease failure, request-scoped release tradeoff, and CURRENT claim without marking the task done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Arm tasks/runs waiter before send and assert HTTP 202 so a sync DOC_BUSY completed turn cannot pass as a new document run.
Co-authored-by: Cursor <cursoragent@cursor.com>
Explicit aliases (including 系统设计输入) must win before keyword fallback so UI-11 does not route to intake.
Co-authored-by: Cursor <cursoragent@cursor.com>
Link the archived ninth-round mid-transition failure; do not mark
the task done before a real UI rerun.
Co-authored-by: Cursor <cursoragent@cursor.com>
Poll pane document-block computed styles until two frames match.
Pure requires transparent background and box-shadow none; manual/all
require a real overlay mark without hard-coded theme colors.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-07 reads every active-pane document-block after the real overlay
fetch. Pure must stay unmarked; manual/all may share amber on the
same human hunk. UI-10 waits for history to auto-close.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-06/13b click 保存修改 only inside 编辑受控块; UI-13a asserts
the dialog is absent instead of a page-wide /保存/ match.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expose role=dialog and a stable aria-label so save can be scoped
without changing the modal's visuals or save behavior.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-06 and UI-13b reuse the pane-scoped helper; stop clicking overlay
or native heading/paragraph tags that the renderer does not emit.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add data-testid=document-block plus block id on every wrapper so
pure-mode editors stay addressable without changing visuals.
Co-authored-by: Cursor <cursoragent@cursor.com>
Mark server summaries dutiesAuthoritative so id 0 stays fail-closed
viewer instead of matching names like a legacy local document.
Co-authored-by: Cursor <cursoragent@cursor.com>
Reject revision-state network/5xx and missing ledger on controlled
hydrate; never PATCH 0:0 unless the document is freeform.
Co-authored-by: Cursor <cursoragent@cursor.com>
Document the privilege-escalation and silent-overwrite hazards; keep
the reject-routing task in_progress pending real UI rerun.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require matching r/etag on both windows and keep A2's editor filled
before A1 saves so the conflict is a real race.
Co-authored-by: Cursor <cursoragent@cursor.com>
Retain ledger author/reviewer/approver, fail-closed unknown users to
viewer, and send the opened revision ETag instead of a fresh GET.
Co-authored-by: Cursor <cursoragent@cursor.com>
ListWorkflowDocumentsByProject now projects author/reviewer/approver
id+name so clients cannot invent the current user as author.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-05b has not reached reject yet, so pending-flow cannot be done; move it to pending-report-ui so reject-routing can keep document-revision-runtime-ui.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require 当前受控文档 deixis plus tasks/runs task_key/doc_id checks so reject stays on intake; compare inside 版本历史, hide the project from non-member C, and split UI-13 into reviewer-readonly plus dual-author conflict.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-04 must close via the dialog 关闭 button; UI-05a/05b must click 待确认报告 and assert panel actions so leftover first-round reports cannot hide the decision path.
Co-authored-by: Cursor <cursoragent@cursor.com>
Reject 待续 status-cell exemptions unless the same contiguous table has a header immediately followed by a valid separator and the data row width matches the header.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat structured 阶段/状态/进度 cells as workflow state, not hedging, while still failing body, lists, and non-status columns.
Co-authored-by: Cursor <cursoragent@cursor.com>
When the user refers to the current document, keep task_key/doc_id on the selected registered doc_proj instead of rerouting by domain keywords.
Co-authored-by: Cursor <cursoragent@cursor.com>
Return existing task run 202 for the same turn before scope/preflight so
SSE disconnect retries do not hit DOC_BUSY or duplicate chat. Extend
task-run events write deadlines with heartbeats without dropping global
HTTP WriteTimeout. Reconnect subscribeTaskRunEvents on EOF via after_seq.
Co-authored-by: Cursor <cursoragent@cursor.com>
Chip assert after setInputFiles, wait POST /freeform-documents 2xx on
send, then pin doc-free pane id and drain this-turn assistant before
leaving UI-11.
Co-authored-by: Cursor <cursoragent@cursor.com>
Only completed/pending_author_confirmation pass waitForSquadCompletion;
category trigger/data-category for private open; UI-11/16 pin exact
doc-free id without global attachment text clicks.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add doc-selector-trigger / active-document-pane data attrs; resolve
assistant via virtualizer data-index siblings; UI-02/03 and open-by-id
helpers stop relying on global text or first dropdown-trigger.
Co-authored-by: Cursor <cursoragent@cursor.com>
Never-activated projects were allowed by access ABAC but rejected with
TASK_SCOPE_UNRESOLVED 409; use GetGoverningInstanceForAccess so nil maps to
ScopePreActivation, live to stage scope, and closed stays unresolved.
Co-authored-by: Cursor <cursoragent@cursor.com>
React state bootstrapId could be read as null by two concurrent confirms;
use a sync in-flight ref plus submitting UI so create runs once and member
retry stays serial/idempotent.
Co-authored-by: Cursor <cursoragent@cursor.com>
Create Project no longer treats local member lists as success: non-creator
initialMembers are upserted via the authorized members API, with bootstrap
project id retained for idempotent retry when persistence partially fails.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unrestricted stage access on projects without a live workflow must not
let arbitrary authenticated users join by project_id. Enforce member or
creator (admin per existing policy) before stage ABAC, and reject chat
streams with JSON 403 before SSE headers/flush.
Co-authored-by: Cursor <cursoragent@cursor.com>
GetLiveInstance remains active-only; access ABAC now uses
GetGoverningInstanceForAccess so completed/terminated PG rows are not
treated as unrestricted legacy projects, while brand-new projects without
instances stay open for creators.
Co-authored-by: Cursor <cursoragent@cursor.com>
AdminSettingsModal previously left onRefreshUsers as a dead prop, so newly
created users never reached App allUsers/localStorage and Create Project
member candidates stayed stale (UI-01). Wire syncAdminUserDirectories,
surface refresh errors, and document the residual cross-device directory gap.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add audit note and cross-link short-term/checklist/CURRENT for the
admin entry regression found in real browser acceptance.
Co-authored-by: Cursor <cursoragent@cursor.com>
Return the UpdateUserRole error instead of silently continuing when an
admin approves a user with an explicit role_id.
Co-authored-by: Cursor <cursoragent@cursor.com>
Do not ignore role promotion errors when ensuring the configured admin
account holds role-admin; cover success and failure with unit tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
Normalize role_id/employee_id/must_change_password/created_at into
camelCase for login, me, and admin user mutations so admin UI gates work.
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop the hardcoded admin password fallback so secrets never ship in the
spec; missing ADMIN_USERNAME/ADMIN_PASSWORD fails the suite explicitly.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record client_key create path and no-orphan send contract on the
document-revision-runtime short-term task.
Co-authored-by: Cursor <cursoragent@cursor.com>
Match only hyphenated doc-p template paths, reset logs after login, and
expect registered uploads to use server doc-free ledgers.
Co-authored-by: Cursor <cursoragent@cursor.com>
Make InputArea/onSendMessage async; fail closed with an explicit UI error
when createFreeformDoc fails, and persist fileStore under server doc-free IDs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Authorize project members, reject direct project_shared creates, and
cover idempotent client_key plus revision-state after register.
Co-authored-by: Cursor <cursoragent@cursor.com>
Support direct freeform create for upload fact-source registration while
keeping source_content_sha256 as a content fingerprint only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist owner-scoped client_key on freeform_documents so upload create
can retry safely without inventing local doc-upload orphans.
Co-authored-by: Cursor <cursoragent@cursor.com>
Skip revision-state for template-only and legacy local mocks; show a
non-error preview hint instead of 「账本未就绪」. Keep generated controlled
and server freeform on the toolbar; leave IndexedDB upload orphans unmounted.
Co-authored-by: Cursor <cursoragent@cursor.com>
