Root causes of the remaining 5 CI PG failures (and the hidden flaky set):
1. All PG-integration packages shared ONE database under parallel package
execution - migrations/seeds/truncates raced (nondeterministic failure
sets, locally and in CI).
Fix: RequireTestDatabaseURL/SkipIfNoTestDatabaseURL now derive a
per-package database (<base>_<pkgHash>, advisory-lock-guarded
CREATE); 9 raw-env straggler tests funnelled through the helpers;
db-package tests call it unqualified (no import cycle).
2. Approval-chain fixtures were not production-shaped: freezeReviewSnapshot
only honors head_snapshot_id, fake content hashes never froze a
snapshot, so ApproverApprove rejected with 'approved requires frozen
review_snapshot_id'. Errors were swallowed (_, _ =) hiding this.
Fix (ownership-respecting, arch-enforced):
- docrevision.SeedContentSnapshotForTest seeds the ledger tables it owns
- docgov GovernanceEngine.FreezeHeadSnapshotForTest freezes head/review
pointers on document_records (docgov-owned) and clears engine cache
- all four integration fixtures use the pair; swallowed errors checked
3. Fixed-name fixtures collide once a package shares one DB (projects
uq_projects_name_global): uniquified in projectinstance + server tests.
4. CAS/ctxmgr tests never bootstrapped migrations (relied on other packages
having migrated the shared DB): explicit RunMigrationsOnceForTest.
Verified: full parallel short suite = 75 packages, 0 failures against an
isolated throwaway PG. CI skip list removed - short tests fully required.
Open member free-lane for chat initiation; auto-claim on author view;
harden lease persist/ownership with readable DOC_BUSY; add notification
inbox and supplement-impact HTTP decision APIs wired to composition root.
Keep registry key validation local to workflowdef with composition-root
injection, adapt FlatCatalog for projectworkflow, and drive the
orchestrator through LiveInstancePort views instead of projectinstance.
enforceChatProjectAccess before allowAnyStageAccess on GET /context/project
so activated projects are no longer readable by arbitrary authenticated users.
Align failing gate fixtures with official workflow keys, isolated TEST_DATABASE_URL,
unique project names (00057), duty membership, and in-memory bizdev-cli envs.
Co-authored-by: Cursor <cursoragent@cursor.com>
New workflow instances store bd_* task keys, but chat still sends the old keys. Scope and document access now treat those aliases as the same task so a live instance no longer fails closed on an exact string miss.
Co-authored-by: Cursor <cursoragent@cursor.com>
Selected documents return to drafting, and advance asks the creator to acknowledge an open recheck mark.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add PATCH /doc-tasks/{taskKey}/duties that updates live snapshot,
assignments, and document_records while blocking when a squad run holds
the document lease. Planning PUT remains PLAN_FROZEN.
Co-authored-by: Cursor <cursoragent@cursor.com>
Live workflows still restrict document actions to duty holders, but
AllowedStageKeys now include active/completed stages so members can chat.
Co-authored-by: Cursor <cursoragent@cursor.com>
Published manifests now use bd_/pm_/tm_/sw_ prefixes so workflows cannot share a doc id. Frozen instances keep the old keys; lookup, templates, and duty checks treat the two names as the same task.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Add Store.SavePlanWithRevision: single-transaction planning upsert +
revision bump (bump first with optimistic lock, conflict rolls back
before any plan write), closing the SaveWorkflowPlan split-transaction
race where plan content and revision could diverge
- AdvanceStage now takes operatorID and writes completed_by explicitly
instead of SELECT activated_by, so the completing operator is the
actual advancing user, not the original activator
- Service.SaveWorkflowPlan/AdvanceStage pass userID through; memStore
implements SavePlanWithRevision under its single mutex
Co-authored-by: Cursor <cursoragent@cursor.com>
Avoid unique (project_id, instance_no) collisions when saving a new
workflow plan after a completed main instance.
Co-authored-by: Cursor <cursoragent@cursor.com>
Close out document author_only U1–U6 into dev (default policy off).
Resolved CURRENT claim table and bizdev service conflicts with rdev prior-doc injection.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prove A can run the full action chain and outsiders stay denied; assert
audit Details carry duty_policy on all five transitions.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use ResolveDocTaskDuty so normalized author-only plans (author ID only)
are treated as full A/A/A for access, stage visibility, and readiness.
Co-authored-by: Cursor <cursoragent@cursor.com>
Seed rdev.v2.json, rd_ templates, catalog policy (order 40), squad
kind orchestration, and hard precheck requiring completed main (CDO).
Includes StageKey dynamicization from P0 and docs for P2–P4 skeleton.
Co-authored-by: Cursor <cursoragent@cursor.com>
Verify resolve/normalize/hash stability, policy gating, stale token
rejection, and HTTP error mapping for the new duty policy path.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add ResolveDocTaskDuty, require the system policy on save/preview,
lock the policy row during activation, and derive A/A/A assignments.
Co-authored-by: Cursor <cursoragent@cursor.com>
Route run/edit/submit/review/approve to a single duty, drop full-doc
creator bypass, and keep view listing independent of stage narrowing.
Co-authored-by: Cursor <cursoragent@cursor.com>
Lock the full/none/pre-activation matrix so creator no longer implies
document-task privilege and unactivated runs stay WORKFLOW_NOT_ACTIVATED.
Co-authored-by: Cursor <cursoragent@cursor.com>
Never-activated projects were allowed by access ABAC but rejected with
TASK_SCOPE_UNRESOLVED 409; use GetGoverningInstanceForAccess so nil maps to
ScopePreActivation, live to stage scope, and closed stays unresolved.
Co-authored-by: Cursor <cursoragent@cursor.com>
GetLiveInstance remains active-only; access ABAC now uses
GetGoverningInstanceForAccess so completed/terminated PG rows are not
treated as unrestricted legacy projects, while brand-new projects without
instances stay open for creators.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist workflow_instance_id, stage_instance_id, scope_kind on chat
messages and task runs; resolve scope from live instance for chat and
document tasks so refresh can apply consistent stage authorization.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cover public auth config, catalog policy, official main workflow activation on Postgres, and conn-busy metadata writeback fixes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Close P0 auth gaps for lineage/runs, stage ABAC fail-closed, and
project:create; add IAM migrations 00021-23, me settings APIs, schema v2
manifests, orchestrator skeleton, and gate A regression coverage.
Co-authored-by: Cursor <cursoragent@cursor.com>
Tag messages with stage_key metadata, block sends for unauthorized roles, and filter history/search/case results by allowed stages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Sync doc task status on approve and evaluate whether to emit stage advance readiness; chain docgov hooks.
Co-authored-by: Cursor <cursoragent@cursor.com>
Resolve stage access from live instance assignments and filter document list/content for non-assigned roles.
Co-authored-by: Cursor <cursoragent@cursor.com>
Evaluate required document approvals before stage transition, expose readiness/advance APIs, show StageAdvanceBanner in the UI, and keep legacy workflow switch for explicit initial_workflow_key projects.
Co-authored-by: Cursor <cursoragent@cursor.com>
agent-bot
weichen