Remove leftover OnOutbox assignment from NewFromRuntime so production
stays on the durable events/docnotify path. Wire DirDeliverable into
docquery ledger fixtures after G1 DeliverableStore cutover.
User authorized lifting CURRENT FAV whole-branch merge protection on
2026-09-23. Keep FAV_DEGRADED_READ/FAV_PUBLISHER_ENABLED default false.
Drop duplicate goose 00034 (local_dev already has 00036). Preserve
agentx workspace admin routes and pin-export wiring.
Bring pinative/agentx workspace registry and A-B harness onto current
local_dev; renumber goose agentx registry 00062→00066 to avoid clash
with chat-summary/provenance migrations. Keep CURRENT/MATRIX as ours
for later docs apply; union module-boundaries agentx import tree.
Path literals use workspace constants for arch-check.
Add a login-visible user directory API and admin/self profile update
paths so project duty selectors stop falling back to "用户 N", and so
users can persist display fields with an admin-edit tip.
Remove production *pgxpool.Pool from Server, centralize domain→HTTP
status mapping, and expose Runtime ports for task-store readiness,
duty heal, and artifact vault registry. Allow app→docduty for heal wiring.
Invert chat dependencies onto composition-root adapters, replace
AssembleRequest coordinator embeds with local DTOs, and drop the
chat→app/* allowlist edges so arch-check can enforce the boundary.
Invert chat dependencies on chatflow/intentflow/stageflow through
composition-root adapters; replace AssembleRequest coordinator embeds
with local DTOs and tighten the module-boundaries allowlist.
Track workspace size and age, expose an admin list and cleanup route, and refuse TTL or quota deletion until a frozen manifest matches verified receipts.
Use the record tables when migration 00059 is present, and hide statements from documents the caller cannot see.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add PATCH /doc-tasks/{taskKey}/duties that updates live snapshot,
assignments, and document_records while blocking when a squad run holds
the document lease. Planning PUT remains PLAN_FROZEN.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add GET /assets/{id}/raw with project access checks; frontend falls back
to CAS by assetId or filename when local blob is gone. Align upload accept
list with backend whitelist and register binaries into CAS on chat upload.
Co-authored-by: Cursor <cursoragent@cursor.com>
Ambiguous consult only redirects on low confidence, and the testing template greets the signed-in user instead of a hardcoded name. Session tokens no longer parse as user id 0. Live chat sessions now evict the oldest entry at a hard cap.
Co-authored-by: Cursor <cursoragent@cursor.com>
Health checks reuse a two-second snapshot and bound the schema query. Task SSE writes an error frame when an event cannot be encoded. ResolveDocTask errors when the frozen plan has no duty row, while explicit none-duties stay zero. Drop the unwired semantic-summary replace env, record the intentional dev versus release model split, document the test/main cutover path, and archive pre-goose SQL.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add nosniff, frame denial, referrer policy, and a self-origin CSP. Clamp human and squad lease TTLs and require author edit rights before a human lease. Include DryRun in replay digests so a dry-run approval cannot authorize apply. Stop Server.Start from swallowing a second Runtime.Start.
Co-authored-by: Cursor <cursoragent@cursor.com>
- H4: sliding-window rate limiter (10 attempts / 5min per IP+username)
on login and register; successful login resets the counter; pure
stdlib, no new dependency
- H8: docker-compose.test.yml DB/ADMIN passwords now :?required (align
with main); docker-compose.main.yml AUTH_REGISTRATION_ENABLED
defaults to false
- M8: fix FAV_PUBLISHER_ENABLE -> FAV_PUBLISHER_ENABLED typo so the
gate test actually guards the real flag
Co-authored-by: Cursor <cursoragent@cursor.com>
- getOrCreateSession now takes ctx; GetSessionOwnerID/
RestoreSessionContext/CompilePromptGuidance run under
context.WithTimeout(5s) instead of context.Background()
- SyncRecentDialogue's rolling summary uses a 30s timeout context
instead of Background, so client disconnect cancels the LLM call
Co-authored-by: Cursor <cursoragent@cursor.com>
- Session gains mu sync.RWMutex + SnapshotMessages/AppendMessage/
TouchLastAccessed/SetProjectID/Project accessors
- sendMessageInternal, hydrateVisibleHistory, getOrCreateSession,
cleanStaleSessionsLocked, handleChat, handleChatStream,
enrichSessionWorkflowStage, bindSessionDocumentSummaryReader all use
locked accessors instead of raw field access
- ProjectID mutation now goes through SetProjectID (only when changed),
closing the cross-project pollution window in handleChat/handleChatStream
Co-authored-by: Cursor <cursoragent@cursor.com>
Add POST /api/v1/docgov/proposal for ProposeModification, harden decide
status mapping, and replace App pendingProposal local mock with real API calls.
Co-authored-by: Cursor <cursoragent@cursor.com>
Serve precompressed .br/.gz with Cache-Control and Vary, and return 404
for missing /assets and /fonts instead of index.html.
Co-authored-by: Cursor <cursoragent@cursor.com>
- new internal/sysadmin package (overview/kb/features/settings) with small
port interfaces; business packages stay unaware of sysadmin
- new routes /api/v1/admin/system/{overview,kb,features,settings} guarded
by requireSystemAdmin
- goose 00049: system_settings table (key/jsonb value, updated_by/at)
- SettingSpec whitelist registry with DB > env > default precedence
- register sysadmin in module-boundaries.yaml (archtest rules)
Expose GET /api/v1/vault/status and only wire in-process Drain when
FAV_PUBLISHER_ENABLED is explicitly true; degraded read stays off by default.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace the U8 stop-gate with a PG+PI confirm/generate harness and add a
mixed-duty governance long chain covering cross-user approve and none
non-blocking advance.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register newTestServer cleanup and Shutdown WaitIdle so race detector
no longer hits RemoveAll on a live DataDir.
Co-authored-by: Cursor <cursoragent@cursor.com>
Principal comes from the session and query scope; body identifiers are ignored and admins cannot skip membership.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pending-action task runs now use stageflow request aliases and Server ports, so chat no longer reaches through the orchestration root.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move construction and document OnOutbox out of server, give HTTP/CLI a shared task use case, and block already-cleared import/event arch rules.
Co-authored-by: Cursor <cursoragent@cursor.com>
Ignore request user_id as identity, authorize from the session Principal, and hydrate restore/memory from the same visible set so HTTP, SSE, and prompt assembly cannot amplify hidden messages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Hash deliverables through Capability.ReadArtifact, resolve backends on the server, and refuse workspace removal until frozen members match FAV receipts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Approve/commit now write FAV staging in the domain transaction, recover-apply materializes scratch collections, and unpublished or GET paths cannot mutate the registry.
Co-authored-by: Cursor <cursoragent@cursor.com>
Authorize project members, reject direct project_shared creates, and
cover idempotent client_key plus revision-state after register.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expose governance APIs for workflow selection/termination and allow login pages to read registration policy without admin credentials.
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen