Live workflows still restrict document actions to duty holders, but
AllowedStageKeys now include active/completed stages so members can chat.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record E2E PASS for global unique names, member session visibility,
and asset raw preview; release integration slot and mark task done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Deny foreign user_id upsert without manage rights (403); unique project
names in ctxmgr PG fixture for global name index; add test-env data repair SQL.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add GET /assets/{id}/raw with project access checks; frontend falls back
to CAS by assetId or filename when local blob is gone. Align upload accept
list with backend whitelist and register binaries into CAS on chat upload.
Co-authored-by: Cursor <cursoragent@cursor.com>
Project managers can register sess-p{N}-u{uid} for other members; adding a
member also ensures their private session so the sidebar is never empty.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace per-creator name uniqueness with a global index among
non-retired projects, and reject cross-user duplicate creates with 409.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record rc-v1.0.0-beta.6 C-level evidence (pi-agent dialogue, intake docs,
12 regressions) and flip CURRENT to test schema 56 with idle integration slot.
Co-authored-by: Cursor <cursoragent@cursor.com>
Postgres and app reach ready in about a second. Vite cold cache is not the old ten-second stall, and the login form was not measured.
Co-authored-by: Cursor <cursoragent@cursor.com>
Software-plan N/A stayed closed and the proposal completed, but the planning review finished quality_failed at score 20. The poller now treats that status as terminal so it does not spin until timeout.
Co-authored-by: Cursor <cursoragent@cursor.com>
Session state stays in App. The shell, rights dialogs, and project modals now render from WorkbenchView, so App no longer mounts AppShell itself.
Co-authored-by: Cursor <cursoragent@cursor.com>
The workbench shell still owns session and modal state. Message stream, filters, and the composer now live in ChatColumn so App stops assembling that column inline.
Co-authored-by: Cursor <cursoragent@cursor.com>
The rebuilt bundle stays under the draft login budgets on this machine. Restart-to-health is under half a second, and the wider restart matrix is still open.
Co-authored-by: Cursor <cursoragent@cursor.com>
The revision toolbar, file preview, and governance bars stay with the document pane so the workbench shell no longer owns that column.
Co-authored-by: Cursor <cursoragent@cursor.com>
The rebuilt workbench issues one member request and one session list request. Slow-network samples improved, but twenty-run percentiles and the restart matrix are still open.
Co-authored-by: Cursor <cursoragent@cursor.com>
The in-memory authorizer treats any positive user id as a member, so the HTTP negative has to run against a real project row.
Co-authored-by: Cursor <cursoragent@cursor.com>
The checksum-immutable note inside 00001 contained a goose annotation and would fail a new database. Keep that warning out of files goose already applied.
Co-authored-by: Cursor <cursoragent@cursor.com>
The current workbench stays at one member fetch across 20 logins, while the deployed bundle still fans out. Slow-network samples stay diagnostic until the container is rebuilt.
Co-authored-by: Cursor <cursoragent@cursor.com>
Give the initial-load baseline a repeatable probe that strips query strings and can assert the login member fanout stays on the current project.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep private-library share, revoke, delete, and save-to-private off the workbench shell so those side effects stay testable without growing App.tsx.
Co-authored-by: Cursor <cursoragent@cursor.com>
Refresh the roster and workflow documents only after the member write succeeds, so a failed add does not invent a local session.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remember the new project id as soon as create succeeds so a later member failure retries members instead of creating a second project.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep plan confirmation, reject, undo, and approval on the same card so a revision conflict still reconciles before the card changes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Apply a controlled block only after the server patch succeeds, and keep insert, move, delete, and comments on the same document state.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep attachment registration, task dispatch, and the demo shortcuts on the same path so a failed upload still blocks before any local message is stored.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep claim, review, and approval on one server record so the open document and the sidebar stay in the same state.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep freeform append, workflow reconcile, and lease polling together so a failed list cannot wipe local docs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Project list, member roster, and session fetch ran as four effects inside the workbench component. They now share one hook so the entry file is not the only place that knows the login startup order.
Co-authored-by: Cursor <cursoragent@cursor.com>
Session, project, and deliverable caches were written from scattered effects, and the legacy message migration ran twice on mount. One hook keeps that write path in a single place.
Co-authored-by: Cursor <cursoragent@cursor.com>
The login entry no longer ships KaTeX. Chat bubbles and document text render formulas after a dynamic import, and rich-text copy does the same.
Co-authored-by: Cursor <cursoragent@cursor.com>
Published manifests now use bd_/pm_/tm_/sw_ prefixes so workflows cannot share a doc id. Frozen instances keep the old keys; lookup, templates, and duty checks treat the two names as the same task.
Co-authored-by: Cursor <cursoragent@cursor.com>
npm test and the production build passed on this branch. The entry bundle stays near 1 MB, and CURRENT still correctly says schema 52 until the containers are rebuilt.
Co-authored-by: Cursor <cursoragent@cursor.com>
Selecting the design-control workflow now repeats the server rule: business handover must finish with an approved CDO quote first. Other workflows stay quiet.
Co-authored-by: Cursor <cursoragent@cursor.com>
Later stages with more than four documents start collapsed, and one action can put the whole stage under human approval or take it back out. The workflow chip still names the design-control flow when the catalog has not loaded.
Co-authored-by: Cursor <cursoragent@cursor.com>
生成项目建议书 now resolves to rd_proposal. Longer titles win, so 系统设计方案 is not mistaken for the shorter business-stage phrase, and an explicit generate command is no longer swallowed by a progress question.
Co-authored-by: Cursor <cursoragent@cursor.com>
The project list is already limited to the current user, so other rosters wait until the member panel opens. Session reload no longer follows project updates, and a newer response cannot overwrite an older user.
Co-authored-by: Cursor <cursoragent@cursor.com>
Each rdev step now gets a role-filtered overlay so writing discipline stays out of the template. User needs, system requirements, review minutes, and upload indexes fail the quality gate when IDs, decisions, or attachment indexes are incomplete.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stage-specific squad steps now win over the kind default, including always-on regulatory and searcher roles. Each of the 60 tasks carries its writing hint and Chinese alias so lookup and the writer accept line use them.
Co-authored-by: Cursor <cursoragent@cursor.com>
Listed tasks still get a regulatory step when complexity is unset or high. Medium and low skip it, and the squad model now comes from SQUAD_MODEL_ID or MINIMAX_MODEL_ID instead of a fixed name.
Co-authored-by: Cursor <cursoragent@cursor.com>
/auth/me was authenticating again after the middleware had already done it, and the session lookup queried user status in a second round trip. Reuse the request principal and join status into the session read so a revoked token still fails on the next request.
Co-authored-by: Cursor <cursoragent@cursor.com>
The login shell was downloading the document engines with the workbench. Those modules now load on click or when a matching block appears, and a failed chunk can be retried without submitting an edit.
Co-authored-by: Cursor <cursoragent@cursor.com>
The branch frontend suite and production build passed. Cross-user document comments still need a Postgres negative because the in-memory authorizer is intentionally open.
Co-authored-by: Cursor <cursoragent@cursor.com>
The human ledger and the document body are different stores. Record the projection intent in the same transaction as the ledger, and clear it only when the body write succeeds so a retry cannot append a second revision.
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop window-cache payloads that lack a schema field. Prove a non-owner listing another user's sessions is forbidden. Correct the stale test schema note in CURRENT.
Co-authored-by: Cursor <cursoragent@cursor.com>
PostgreSQL claim now uses the same next-version rule as MemoryBus, and checkpoints only move forward. A later version cannot be leased while an earlier one is still missing.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep M7, M15, the frontend split, and the red-line features open so the next pass does not treat them as done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Ambiguous consult only redirects on low confidence, and the testing template greets the signed-in user instead of a hardcoded name. Session tokens no longer parse as user id 0. Live chat sessions now evict the oldest entry at a hard cap.
Co-authored-by: Cursor <cursoragent@cursor.com>
Health checks reuse a two-second snapshot and bound the schema query. Task SSE writes an error frame when an event cannot be encoded. ResolveDocTask errors when the frozen plan has no duty row, while explicit none-duties stay zero. Drop the unwired semantic-summary replace env, record the intentional dev versus release model split, document the test/main cutover path, and archive pre-goose SQL.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add nosniff, frame denial, referrer policy, and a self-origin CSP. Clamp human and squad lease TTLs and require author edit rights before a human lease. Include DryRun in replay digests so a dry-run approval cannot authorize apply. Stop Server.Start from swallowing a second Runtime.Start.
Co-authored-by: Cursor <cursoragent@cursor.com>
Capture the read-only check that planned capabilities are wired, while dev is not ready to merge into test until the container is rebuilt and the remaining gates run.
Co-authored-by: Cursor <cursoragent@cursor.com>
Critical/high fixes are already on dev. Record the frontend test report, restore the audit note, and move remaining medium/low items into long-term so they are not treated as release blockers.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Escape KaTeX fallback HTML and salt math/code placeholders per render
- Roll back optimistic unread marks when POST /chat/read fails
- Reset MessageStream scroll baseline when the session changes
- Preview only the first 1000 Excel rows and say so in the sheet header
Co-authored-by: Cursor <cursoragent@cursor.com>
Goose checksums forbid rewriting applied files. Document that 00001-00009
have no down migration and that 00012's unconditional DELETE is demo-only.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Wait for the chat SSE heartbeat goroutine to exit before the handler
returns, so it cannot write a recycled connection
- Extend /tasks/run write deadline to 75m so long sync runs are not cut
by the global 120s WriteTimeout before the response is written
- Reuse an existing task run on the SSE path when the idempotency key
already belongs to the same user/session/project
- Log stale fencing on event ack so unbounded replay is observable
Co-authored-by: Cursor <cursoragent@cursor.com>
- H4: sliding-window rate limiter (10 attempts / 5min per IP+username)
on login and register; successful login resets the counter; pure
stdlib, no new dependency
- H8: docker-compose.test.yml DB/ADMIN passwords now :?required (align
with main); docker-compose.main.yml AUTH_REGISTRATION_ENABLED
defaults to false
- M8: fix FAV_PUBLISHER_ENABLE -> FAV_PUBLISHER_ENABLED typo so the
gate test actually guards the real flag
Co-authored-by: Cursor <cursoragent@cursor.com>
- H1: log legacy test-principal fallback (path/method/remote_addr) via
slog.Warn so silent unauthenticated access is observable
- H2: AddComment/Claim now derive actor ID/Name/Role from the auth
principal and server-side doc duty resolution (resolveDocGovRole),
never from request body; GetDocument/ListComments/ListAuditLogs now
require project membership via requireDocGovDocAccess
- H3: handleGetChatTurn asserts session ownership; handleListChatSessions
and handleGetUserContext reject cross-user user_id (403) and stop
defaulting to user id=1
Co-authored-by: Cursor <cursoragent@cursor.com>
- getOrCreateSession now takes ctx; GetSessionOwnerID/
RestoreSessionContext/CompilePromptGuidance run under
context.WithTimeout(5s) instead of context.Background()
- SyncRecentDialogue's rolling summary uses a 30s timeout context
instead of Background, so client disconnect cancels the LLM call
Co-authored-by: Cursor <cursoragent@cursor.com>
- Add Store.SavePlanWithRevision: single-transaction planning upsert +
revision bump (bump first with optimistic lock, conflict rolls back
before any plan write), closing the SaveWorkflowPlan split-transaction
race where plan content and revision could diverge
- AdvanceStage now takes operatorID and writes completed_by explicitly
instead of SELECT activated_by, so the completing operator is the
actual advancing user, not the original activator
- Service.SaveWorkflowPlan/AdvanceStage pass userID through; memStore
implements SavePlanWithRevision under its single mutex
Co-authored-by: Cursor <cursoragent@cursor.com>
- Session gains mu sync.RWMutex + SnapshotMessages/AppendMessage/
TouchLastAccessed/SetProjectID/Project accessors
- sendMessageInternal, hydrateVisibleHistory, getOrCreateSession,
cleanStaleSessionsLocked, handleChat, handleChatStream,
enrichSessionWorkflowStage, bindSessionDocumentSummaryReader all use
locked accessors instead of raw field access
- ProjectID mutation now goes through SetProjectID (only when changed),
closing the cross-project pollution window in handleChat/handleChatStream
Co-authored-by: Cursor <cursoragent@cursor.com>
- persistLeaseLocked now returns error; AcquireLease rolls back in-memory
lease on DB failure so memory and PG stay consistent
- appendAuditLocked uses request ctx and logs audit INSERT failures
instead of swallowing them with context.Background()
- loadDocumentFromDBLocked now SELECTs lease_fencing_token so fencing
survives process restart
- SaveDocumentContent/RecordDocumentViewed/RecordDocumentEdited/
DecideModificationProposal/SetDocumentWorkDir log persist failures
via slog.Error instead of silent _, _
Co-authored-by: Cursor <cursoragent@cursor.com>
The untracked node_modules tree and the local feature branch are gone.
The remote branch was left in place.
Co-authored-by: Cursor <cursoragent@cursor.com>
Progress tracking now lives in a separate project. Drop the server,
docs, and module-boundary entries without restoring engineering-dashboard.
Co-authored-by: Cursor <cursoragent@cursor.com>
