go test under internal/server previously preferred package-local
data/test, so materials never reached the pi-agent bind mount and
intake quality gates failed closed on empty sandboxes.
Close project-context membership gap, register arch SSOT edges, and repair
CI PG fixtures so release short/vet/arch gates pass on schema 61.
Co-authored-by: Cursor <cursoragent@cursor.com>
Parallel NewServer bootstrap raced with goose fixed-id user rows and
sequence drift, panicking the server package on wangzong insert. Treat
unique violations as success when the demo username exists (or retry once).
Co-authored-by: Cursor <cursoragent@cursor.com>
Official main.v2 uses bd_intake (not intake); stage gates stayed closed when
fixtures approved the wrong task key. Task-run finalizers also require a real
project_id for outbox event scope—seed scoped projects in PG fixtures.
Co-authored-by: Cursor <cursoragent@cursor.com>
enforceChatProjectAccess before allowAnyStageAccess on GET /context/project
so activated projects are no longer readable by arbitrary authenticated users.
Align failing gate fixtures with official workflow keys, isolated TEST_DATABASE_URL,
unique project names (00057), duty membership, and in-memory bizdev-cli envs.
Co-authored-by: Cursor <cursoragent@cursor.com>
arch-check --mode block failed on frozen dev (23 NEW import findings):
modules materialindex/mineru/workflowscope and edges shipped via their
own accepted tasks were never registered in module-boundaries.yaml.
Register the intentional allowlist edges (precedent 97b868a9); no new
exceptions are added.
7 PG tests fell back to a hardcoded dev DB (127.0.0.1:5433) when
TEST_DATABASE_URL/CONTEXT_DB_DSN were unset, contradicting the isolated
test-DB contract (BUG-08) and polluting dev on a bare 'go test -short'.
Change the fallback to skip when no isolated DB env is provided.
Co-authored-by: Cursor <cursoragent@cursor.com>
macOS host exception recorded in task doc: agentctl lease path is
Linux-only (/proc); commits under this task use --no-verify with the
manual equivalent gates listed in the exception section.
Co-authored-by: Cursor <cursoragent@cursor.com>
Align prepared clients with role budgets and automatic approvals. Keep uncertain delivery from triggering duplicate work and preserve task worktree gates.
Consolidate approved policies and add local lease, document CAS, commit, candidate and environment gates. Preserve conservative recovery and cleanup limits.
Record the dev data-mount drift (worktree env-service violation) and the
Agent API 20-page limit as the two combined root causes, with the
chunked real-28-page-PDF workspace evidence. Retract the first-round
acceptance verdict.
Co-authored-by: Cursor <cursoragent@cursor.com>
The free Agent lightweight API rejects files over 20 pages (-30003)
and the precision token is expired, so a real 28-page PDF could not
parse at all. On -30003, parse in 20-page windows and renumber chunk
anchors to global pages; report engine mode agent_chunked.
Also log skipped assets in ResolveMaterials and return a bool from
EnqueueAsync so parse_state is only set when a job is enqueued.
Co-authored-by: Cursor <cursoragent@cursor.com>
A missing ledger body was reported as not found, so an in-scope view of a template document never reached the template reply.
Co-authored-by: Cursor <cursoragent@cursor.com>
The flag reaches all three compose app services and the sysadmin catalog, and unknown values stay on the existing hard block.
Co-authored-by: Cursor <cursoragent@cursor.com>
The document list now reports WORKFLOW_SCOPE_MODE, and weighted mode only blocks a cross-workflow write when that title outscores the active workflow.
Co-authored-by: Cursor <cursoragent@cursor.com>
Weighted mode keeps an in-scope document when a cross-workflow name is only mentioned beside it, while exact cross-workflow writes stay blocked and exact reads record the owning workflow.
Co-authored-by: Cursor <cursoragent@cursor.com>
Exact out-of-workflow documents can be summarized when WORKFLOW_SCOPE_MODE=weighted and the caller can still view the active instance; writes stay blocked.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep WORKFLOW_SCOPE_MODE=strict as the default so cross-workflow mentions stay blocked until weighted mode is turned on.
Co-authored-by: Cursor <cursoragent@cursor.com>
When precision API key is missing or expired (A0202/A0211), parse
via the no-token Agent API so document understanding still works.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive the short-term task, mark CURRENT done, and attach rebuild
evidence from the correct dev tree no-cache image.
Co-authored-by: Cursor <cursoragent@cursor.com>
Claim CURRENT mutex, archive short-term task, and document unit PASS
plus live A0211 token-expired blocker.
Co-authored-by: Cursor <cursoragent@cursor.com>
Async-trigger MinerU after CAS store and surface parse status in
assets API plus a lightweight preview badge.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prefer MinerU markdown, inject fulltext or toc+rag for large docs,
and wire kb.Embedder into CAS instead of nil.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cache MinerU parse results by blob hash and store project-scoped
chunk embeddings for large uploaded materials.
Co-authored-by: Cursor <cursoragent@cursor.com>
Update short-term/CURRENT claim for the extension branch and archive
unit/web evidence pending live rebuild after merge.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep weak write verbs off the task shortcut path, and once-only fall back
to chat when TASK_SCOPE_UNRESOLVED or DOC_TASK_NOT_IN_ACTIVE_STAGE.
Co-authored-by: Cursor <cursoragent@cursor.com>
Ask via PendingExpectation for weak-write verbs, mid confidence, or
stage-mismatched doc tasks instead of running blindly.
Co-authored-by: Cursor <cursoragent@cursor.com>
Map early-stage "整理一下需求" style phrases to intake with needs_confirmation,
and stop RDev "用户需求" from hijacking main-flow "编写用户需求表".
Co-authored-by: Cursor <cursoragent@cursor.com>
Scope intent slot filling and document matching to the active workflow;
cross-workflow mentions are blocked with switch guidance.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Document list returns workflow_key per item and active_workflow_key
- DeliverableItem keeps workflowKey through server sync
- resolveTaskTemplateForMessage filters the match pool and blocks
cross-workflow mentions with switch guidance
Co-authored-by: Cursor <cursoragent@cursor.com>
Adopt the approved workflow with explicit dev baselines, serialized candidate integration, scoped validation and safe cleanup. Keep automation work tracked separately from the active policy.
- ContextSnapshot gains ActiveWorkflowKey; ToSnapshot passes it downstream
- manifest-backed doc-title -> workflow index (main/pm/tm/rdev/sw)
- TRIGGER_TASK and DOCGOV write actions blocked with switch guidance when
the named document belongs to another active workflow
- legacy projects without an active workflow key keep the old behavior
Co-authored-by: Cursor <cursoragent@cursor.com>
The dev container was rebuilt and the health check, task-run errors, and new UI strings are filed with the report.
Co-authored-by: Cursor <cursoragent@cursor.com>
The chat window hook only exposed refresh helpers, so the continue path did not type-check after it started reading history bubbles.
Co-authored-by: Cursor <cursoragent@cursor.com>
Template bodies were read-only, but the status chip said 编制中 and the lock banner said the document was already controlled.
Co-authored-by: Cursor <cursoragent@cursor.com>
Continue looked up only the in-memory message list, so a refreshed card did nothing, and the stream path also dropped the stored workspace.
Co-authored-by: Cursor <cursoragent@cursor.com>
Progress lived only in the open SSE stream, and interrupted history was shown as completed so the card could not be continued.
Co-authored-by: Cursor <cursoragent@cursor.com>
Interrupted runs often have no done event, so a refresh replay would otherwise hold the SSE connection open.
Co-authored-by: Cursor <cursoragent@cursor.com>
「初始用户需求表」contains「用户需求表」, so title matching sent V0.1 wording to the V0.5 task and the stage gate rejected it.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the intent-routing, task-card resume, and template-badge work before code changes so the mutex is visible.
Co-authored-by: Cursor <cursoragent@cursor.com>
The report keeps the 6579 document backfill, the live-edit switch rejection, and the rebuilt dev health check.
Co-authored-by: Cursor <cursoragent@cursor.com>
The scope error now has its own copy, so the 4xx case should assert that text instead of the generic request-failed fallback.
Co-authored-by: Cursor <cursoragent@cursor.com>
Message routing follows the project's real task key, account switches clear local workbench state, and the duty matrix writes the reassignment API instead of a local drill.
Co-authored-by: Cursor <cursoragent@cursor.com>
Activation and list healing need a server-side document row per enabled task, without overwriting documents that already have content.
Co-authored-by: Cursor <cursoragent@cursor.com>
The requirements and impact summary no longer occupies the chat column. Open recheck marks arrive as an assistant card with a no-change action.
Co-authored-by: Cursor <cursoragent@cursor.com>
A new recheck mark is posted into the actor's existing project session, and a downstream-impact event does the same. Asking about what a change affects still resolves to impact analysis.
Co-authored-by: Cursor <cursoragent@cursor.com>
Chen Wei's intake request against a bd_intake snapshot now creates a run, and the chat window still returns the turn after refresh.
Co-authored-by: Cursor <cursoragent@cursor.com>
A 409 used to return before any message was written, so a refresh showed an empty conversation. Record the user turn and a failed assistant reply before rejecting the run.
Co-authored-by: Cursor <cursoragent@cursor.com>
New workflow instances store bd_* task keys, but chat still sends the old keys. Scope and document access now treat those aliases as the same task so a live instance no longer fails closed on an exact string miss.
Co-authored-by: Cursor <cursoragent@cursor.com>
Dev rebuild serves snake_case task run JSON and the real pi-agent backend, so failed runs are no longer labeled as network errors.
Co-authored-by: Cursor <cursoragent@cursor.com>
Show error_message for failed runs, a distinct cancelled state, and business 4xx codes instead of a generic network message.
Co-authored-by: Cursor <cursoragent@cursor.com>
The task run API was emitting PascalCase fields, so the client never saw status or error_message and treated every disconnect as a network error.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the NETWORK_ERROR misreport and defer HTTP access logs so the failure reason is no longer hidden behind a network fallback.
Co-authored-by: Cursor <cursoragent@cursor.com>
The slices share feature/stage-backtrack-impl. Migration 00059 is not applied to the running environments yet.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use the record tables when migration 00059 is present, and hide statements from documents the caller cannot see.
Co-authored-by: Cursor <cursoragent@cursor.com>
Selected documents return to drafting, and advance asks the creator to acknowledge an open recheck mark.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record how later materials can affect earlier stages without hard gates, and split the implementation into planned slices.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record that go vet passed and the two short-test failures are docker registry EOF, not this documentation change.
Co-authored-by: Cursor <cursoragent@cursor.com>
Give implementers one entry for narrow ports, the event bus, and the rule that a fault stays inside its module.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep the modular-monolith baseline and name the seven places where a fault still crosses a module boundary.
Co-authored-by: Cursor <cursoragent@cursor.com>
Load backup credentials from env/secrets files and push via a temporary credential helper so tokens never appear in process listings.
Co-authored-by: Cursor <cursoragent@cursor.com>
Bind preference writes and session-scoped project reads to the authenticated principal, and require an owned session_id for recategorize so empty ids cannot touch all messages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Absorb stalled capability fixes and avoid goose out-of-order on schema 57 DBs by shipping chat_summaries as 00058.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record test-env evidence for chenwei stage chat and post-activation
PATCH duty reassignment after merge and rebuild.
Co-authored-by: Cursor <cursoragent@cursor.com>
Show editable duty selects after activation when the user has
project:assign_lead, calling the new PATCH API instead of workflow-plan PUT.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add PATCH /doc-tasks/{taskKey}/duties that updates live snapshot,
assignments, and document_records while blocking when a squad run holds
the document lease. Planning PUT remains PLAN_FROZEN.
Co-authored-by: Cursor <cursoragent@cursor.com>
Live workflows still restrict document actions to duty holders, but
AllowedStageKeys now include active/completed stages so members can chat.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record E2E PASS for global unique names, member session visibility,
and asset raw preview; release integration slot and mark task done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Deny foreign user_id upsert without manage rights (403); unique project
names in ctxmgr PG fixture for global name index; add test-env data repair SQL.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add GET /assets/{id}/raw with project access checks; frontend falls back
to CAS by assetId or filename when local blob is gone. Align upload accept
list with backend whitelist and register binaries into CAS on chat upload.
Co-authored-by: Cursor <cursoragent@cursor.com>
Project managers can register sess-p{N}-u{uid} for other members; adding a
member also ensures their private session so the sidebar is never empty.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace per-creator name uniqueness with a global index among
non-retired projects, and reject cross-user duplicate creates with 409.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record rc-v1.0.0-beta.6 C-level evidence (pi-agent dialogue, intake docs,
12 regressions) and flip CURRENT to test schema 56 with idle integration slot.
Co-authored-by: Cursor <cursoragent@cursor.com>
A candidate used the same report later attached to the version, so a preview could be treated as the formal result. Proposed reports now close on replace or reject, and only the commit writes an authoritative successor.
The narrator only received counts, so it could not describe the actual change. Caps keep the full document out and leave the input digest unchanged; the flag stays off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Postgres and app reach ready in about a second. Vite cold cache is not the old ten-second stall, and the login form was not measured.
Co-authored-by: Cursor <cursoragent@cursor.com>
Software-plan N/A stayed closed and the proposal completed, but the planning review finished quality_failed at score 20. The poller now treats that status as terminal so it does not spin until timeout.
Co-authored-by: Cursor <cursoragent@cursor.com>
Session state stays in App. The shell, rights dialogs, and project modals now render from WorkbenchView, so App no longer mounts AppShell itself.
Co-authored-by: Cursor <cursoragent@cursor.com>
The workbench shell still owns session and modal state. Message stream, filters, and the composer now live in ChatColumn so App stops assembling that column inline.
Co-authored-by: Cursor <cursoragent@cursor.com>
The rebuilt bundle stays under the draft login budgets on this machine. Restart-to-health is under half a second, and the wider restart matrix is still open.
Co-authored-by: Cursor <cursoragent@cursor.com>
The revision toolbar, file preview, and governance bars stay with the document pane so the workbench shell no longer owns that column.
Co-authored-by: Cursor <cursoragent@cursor.com>
The rebuilt workbench issues one member request and one session list request. Slow-network samples improved, but twenty-run percentiles and the restart matrix are still open.
Co-authored-by: Cursor <cursoragent@cursor.com>
The in-memory authorizer treats any positive user id as a member, so the HTTP negative has to run against a real project row.
Co-authored-by: Cursor <cursoragent@cursor.com>
The checksum-immutable note inside 00001 contained a goose annotation and would fail a new database. Keep that warning out of files goose already applied.
Co-authored-by: Cursor <cursoragent@cursor.com>
The current workbench stays at one member fetch across 20 logins, while the deployed bundle still fans out. Slow-network samples stay diagnostic until the container is rebuilt.
Co-authored-by: Cursor <cursoragent@cursor.com>
Give the initial-load baseline a repeatable probe that strips query strings and can assert the login member fanout stays on the current project.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep private-library share, revoke, delete, and save-to-private off the workbench shell so those side effects stay testable without growing App.tsx.
Co-authored-by: Cursor <cursoragent@cursor.com>
Refresh the roster and workflow documents only after the member write succeeds, so a failed add does not invent a local session.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remember the new project id as soon as create succeeds so a later member failure retries members instead of creating a second project.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep plan confirmation, reject, undo, and approval on the same card so a revision conflict still reconciles before the card changes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Apply a controlled block only after the server patch succeeds, and keep insert, move, delete, and comments on the same document state.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep attachment registration, task dispatch, and the demo shortcuts on the same path so a failed upload still blocks before any local message is stored.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep claim, review, and approval on one server record so the open document and the sidebar stay in the same state.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep freeform append, workflow reconcile, and lease polling together so a failed list cannot wipe local docs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Project list, member roster, and session fetch ran as four effects inside the workbench component. They now share one hook so the entry file is not the only place that knows the login startup order.
Co-authored-by: Cursor <cursoragent@cursor.com>
Session, project, and deliverable caches were written from scattered effects, and the legacy message migration ran twice on mount. One hook keeps that write path in a single place.
Co-authored-by: Cursor <cursoragent@cursor.com>
The login entry no longer ships KaTeX. Chat bubbles and document text render formulas after a dynamic import, and rich-text copy does the same.
Co-authored-by: Cursor <cursoragent@cursor.com>
Published manifests now use bd_/pm_/tm_/sw_ prefixes so workflows cannot share a doc id. Frozen instances keep the old keys; lookup, templates, and duty checks treat the two names as the same task.
Co-authored-by: Cursor <cursoragent@cursor.com>
npm test and the production build passed on this branch. The entry bundle stays near 1 MB, and CURRENT still correctly says schema 52 until the containers are rebuilt.
Co-authored-by: Cursor <cursoragent@cursor.com>
Selecting the design-control workflow now repeats the server rule: business handover must finish with an approved CDO quote first. Other workflows stay quiet.
Co-authored-by: Cursor <cursoragent@cursor.com>
Later stages with more than four documents start collapsed, and one action can put the whole stage under human approval or take it back out. The workflow chip still names the design-control flow when the catalog has not loaded.
Co-authored-by: Cursor <cursoragent@cursor.com>
生成项目建议书 now resolves to rd_proposal. Longer titles win, so 系统设计方案 is not mistaken for the shorter business-stage phrase, and an explicit generate command is no longer swallowed by a progress question.
Co-authored-by: Cursor <cursoragent@cursor.com>
The project list is already limited to the current user, so other rosters wait until the member panel opens. Session reload no longer follows project updates, and a newer response cannot overwrite an older user.
Co-authored-by: Cursor <cursoragent@cursor.com>
Each rdev step now gets a role-filtered overlay so writing discipline stays out of the template. User needs, system requirements, review minutes, and upload indexes fail the quality gate when IDs, decisions, or attachment indexes are incomplete.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stage-specific squad steps now win over the kind default, including always-on regulatory and searcher roles. Each of the 60 tasks carries its writing hint and Chinese alias so lookup and the writer accept line use them.
Co-authored-by: Cursor <cursoragent@cursor.com>
Listed tasks still get a regulatory step when complexity is unset or high. Medium and low skip it, and the squad model now comes from SQUAD_MODEL_ID or MINIMAX_MODEL_ID instead of a fixed name.
Co-authored-by: Cursor <cursoragent@cursor.com>
/auth/me was authenticating again after the middleware had already done it, and the session lookup queried user status in a second round trip. Reuse the request principal and join status into the session read so a revoked token still fails on the next request.
Co-authored-by: Cursor <cursoragent@cursor.com>
The login shell was downloading the document engines with the workbench. Those modules now load on click or when a matching block appears, and a failed chunk can be retried without submitting an edit.
Co-authored-by: Cursor <cursoragent@cursor.com>
The branch frontend suite and production build passed. Cross-user document comments still need a Postgres negative because the in-memory authorizer is intentionally open.
Co-authored-by: Cursor <cursoragent@cursor.com>
The human ledger and the document body are different stores. Record the projection intent in the same transaction as the ledger, and clear it only when the body write succeeds so a retry cannot append a second revision.
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop window-cache payloads that lack a schema field. Prove a non-owner listing another user's sessions is forbidden. Correct the stale test schema note in CURRENT.
Co-authored-by: Cursor <cursoragent@cursor.com>
PostgreSQL claim now uses the same next-version rule as MemoryBus, and checkpoints only move forward. A later version cannot be leased while an earlier one is still missing.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep M7, M15, the frontend split, and the red-line features open so the next pass does not treat them as done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Ambiguous consult only redirects on low confidence, and the testing template greets the signed-in user instead of a hardcoded name. Session tokens no longer parse as user id 0. Live chat sessions now evict the oldest entry at a hard cap.
Co-authored-by: Cursor <cursoragent@cursor.com>
Health checks reuse a two-second snapshot and bound the schema query. Task SSE writes an error frame when an event cannot be encoded. ResolveDocTask errors when the frozen plan has no duty row, while explicit none-duties stay zero. Drop the unwired semantic-summary replace env, record the intentional dev versus release model split, document the test/main cutover path, and archive pre-goose SQL.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add nosniff, frame denial, referrer policy, and a self-origin CSP. Clamp human and squad lease TTLs and require author edit rights before a human lease. Include DryRun in replay digests so a dry-run approval cannot authorize apply. Stop Server.Start from swallowing a second Runtime.Start.
Co-authored-by: Cursor <cursoragent@cursor.com>
Capture the read-only check that planned capabilities are wired, while dev is not ready to merge into test until the container is rebuilt and the remaining gates run.
Co-authored-by: Cursor <cursoragent@cursor.com>
Critical/high fixes are already on dev. Record the frontend test report, restore the audit note, and move remaining medium/low items into long-term so they are not treated as release blockers.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Escape KaTeX fallback HTML and salt math/code placeholders per render
- Roll back optimistic unread marks when POST /chat/read fails
- Reset MessageStream scroll baseline when the session changes
- Preview only the first 1000 Excel rows and say so in the sheet header
Co-authored-by: Cursor <cursoragent@cursor.com>
Goose checksums forbid rewriting applied files. Document that 00001-00009
have no down migration and that 00012's unconditional DELETE is demo-only.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Wait for the chat SSE heartbeat goroutine to exit before the handler
returns, so it cannot write a recycled connection
- Extend /tasks/run write deadline to 75m so long sync runs are not cut
by the global 120s WriteTimeout before the response is written
- Reuse an existing task run on the SSE path when the idempotency key
already belongs to the same user/session/project
- Log stale fencing on event ack so unbounded replay is observable
Co-authored-by: Cursor <cursoragent@cursor.com>
- H4: sliding-window rate limiter (10 attempts / 5min per IP+username)
on login and register; successful login resets the counter; pure
stdlib, no new dependency
- H8: docker-compose.test.yml DB/ADMIN passwords now :?required (align
with main); docker-compose.main.yml AUTH_REGISTRATION_ENABLED
defaults to false
- M8: fix FAV_PUBLISHER_ENABLE -> FAV_PUBLISHER_ENABLED typo so the
gate test actually guards the real flag
Co-authored-by: Cursor <cursoragent@cursor.com>
- H1: log legacy test-principal fallback (path/method/remote_addr) via
slog.Warn so silent unauthenticated access is observable
- H2: AddComment/Claim now derive actor ID/Name/Role from the auth
principal and server-side doc duty resolution (resolveDocGovRole),
never from request body; GetDocument/ListComments/ListAuditLogs now
require project membership via requireDocGovDocAccess
- H3: handleGetChatTurn asserts session ownership; handleListChatSessions
and handleGetUserContext reject cross-user user_id (403) and stop
defaulting to user id=1
Co-authored-by: Cursor <cursoragent@cursor.com>
- getOrCreateSession now takes ctx; GetSessionOwnerID/
RestoreSessionContext/CompilePromptGuidance run under
context.WithTimeout(5s) instead of context.Background()
- SyncRecentDialogue's rolling summary uses a 30s timeout context
instead of Background, so client disconnect cancels the LLM call
Co-authored-by: Cursor <cursoragent@cursor.com>
- Add Store.SavePlanWithRevision: single-transaction planning upsert +
revision bump (bump first with optimistic lock, conflict rolls back
before any plan write), closing the SaveWorkflowPlan split-transaction
race where plan content and revision could diverge
- AdvanceStage now takes operatorID and writes completed_by explicitly
instead of SELECT activated_by, so the completing operator is the
actual advancing user, not the original activator
- Service.SaveWorkflowPlan/AdvanceStage pass userID through; memStore
implements SavePlanWithRevision under its single mutex
Co-authored-by: Cursor <cursoragent@cursor.com>
- Session gains mu sync.RWMutex + SnapshotMessages/AppendMessage/
TouchLastAccessed/SetProjectID/Project accessors
- sendMessageInternal, hydrateVisibleHistory, getOrCreateSession,
cleanStaleSessionsLocked, handleChat, handleChatStream,
enrichSessionWorkflowStage, bindSessionDocumentSummaryReader all use
locked accessors instead of raw field access
- ProjectID mutation now goes through SetProjectID (only when changed),
closing the cross-project pollution window in handleChat/handleChatStream
Co-authored-by: Cursor <cursoragent@cursor.com>
- persistLeaseLocked now returns error; AcquireLease rolls back in-memory
lease on DB failure so memory and PG stay consistent
- appendAuditLocked uses request ctx and logs audit INSERT failures
instead of swallowing them with context.Background()
- loadDocumentFromDBLocked now SELECTs lease_fencing_token so fencing
survives process restart
- SaveDocumentContent/RecordDocumentViewed/RecordDocumentEdited/
DecideModificationProposal/SetDocumentWorkDir log persist failures
via slog.Error instead of silent _, _
Co-authored-by: Cursor <cursoragent@cursor.com>
The untracked node_modules tree and the local feature branch are gone.
The remote branch was left in place.
Co-authored-by: Cursor <cursoragent@cursor.com>
Progress tracking now lives in a separate project. Drop the server,
docs, and module-boundary entries without restoring engineering-dashboard.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the unit, live LLM, and SPA walkthrough evidence, and mark the
control-center row done now that engineering-dashboard is superseded.
Co-authored-by: Cursor <cursoragent@cursor.com>
The compose file published 5440 on all interfaces. Match the other
environment databases and listen only on 127.0.0.1.
Co-authored-by: Cursor <cursoragent@cursor.com>
Real highspeed responses wrap reasoning in think tags that contain
brackets, which made the JSON span extractor fail before the array.
Co-authored-by: Cursor <cursoragent@cursor.com>
Gate the merge on unit coverage for the three packages that previously
had none: env precedence, migrate/query, and claim/heartbeat/reap.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep Control Center and drop engineering-dashboard. Resolve CURRENT
claim rows and module-boundaries by removing the superseded dashboard
entry.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prefer error_code when present and route projectMembers/freeformDoc/
taskRuns/chatSessions failures through the shared structured parser.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove the skipped client work_dir resume coverage that targeted a deleted
entry point, and document why the real-PI stop-gate stays redirected to
internal/server to avoid an import cycle.
Co-authored-by: Cursor <cursoragent@cursor.com>
Carry the done checklist and test-report link that lagged the Wave 2
merge tip so Wave 3 starts from a consistent ops state.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pin E-3/E-4/E-6 compose declarations so dead runner config and missing
flag wiring cannot silently regress.
Co-authored-by: Cursor <cursoragent@cursor.com>
Placeholder cursor-agent service is gone; keep CURSOR_API_KEY/MODEL/BIN
for the local cursor-cli subprocess backend.
Co-authored-by: Cursor <cursoragent@cursor.com>
Also declare SEMANTIC_SUMMARY_SHADOW and PI_CHANGE_REPORT_NARRATIVE on
test/main, remove dead CURSOR_RUNNER_URL/cursor-agent, and set main
SEED_DEMO_USERS=false. Defaults stay legacy/false (no behavior change).
Co-authored-by: Cursor <cursoragent@cursor.com>
Close short-term task, mark remediation Wave 1 done, release integration
slot, and record main env=main / schema 52 / modes-off smoke evidence.
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop Env==\"\" as a dev alias; pin compose app/events ENV alignment and
main depends_on events with unit tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
Set app ENV=main (was prod) and require events service_healthy before
app starts so goose migrations finish before app queries new columns.
Co-authored-by: Cursor <cursoragent@cursor.com>
Close short-term task, mark remediation Wave 0 done, release integration
slot, and attach real pi-agent SSE heartbeat log plus suite results.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pass userId on every saveSessionWindowCache write, LRU-evict full cache
keys, and applyRestoredFileRaw so mount restore cannot drop newer deliverables.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive the 2026-09-17 health-check audit/remediation and short-term Wave 0
task so P0 SSE/cache fixes can proceed under mutex chat+web.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record real-PI samples for review and verification templates, mark S1 continued done across writing-spec/backlog/FEATURE-MATRIX/CURRENT.
Co-authored-by: Cursor <cursoragent@cursor.com>
Avoid unique (project_id, instance_no) collisions when saving a new
workflow plan after a completed main instance.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive CAS evidence for workflow.allow_author_only_approval on dev,
mark proposal HTTP audit resolved, and claim the feature branch in CURRENT.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add POST /api/v1/docgov/proposal for ProposeModification, harden decide
status mapping, and replace App pendingProposal local mock with real API calls.
Co-authored-by: Cursor <cursoragent@cursor.com>
- delete cmd/engineering-dashboard, internal/engineeringdashboard, scripts/engineering-dashboard.sh
- archive old design doc to .doc/archive/design/ with deprecation banner
- FEATURE-MATRIX: mark old row removed, add removed to status contract
- system-design README: section 8 now points to Control Center SSOT
Close out document author_only U1–U6 into dev (default policy off).
Resolved CURRENT claim table and bizdev service conflicts with rdev prior-doc injection.
Co-authored-by: Cursor <cursoragent@cursor.com>
Show a single author picker when兼任 is enabled, respect the system
capability flag, and surface author_only docs in activation preview.
Co-authored-by: Cursor <cursoragent@cursor.com>
Align TypeScript types and projectSettingsDuties with backend
ResolveDocTaskDuty so author_only no longer fails as partial.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prove A can run the full action chain and outsiders stay denied; assert
audit Details carry duty_policy on all five transitions.
Co-authored-by: Cursor <cursoragent@cursor.com>
Surface the document duty mode on submit/review/approve transitions for
consistent logs under author_only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use ResolveDocTaskDuty so normalized author-only plans (author ID only)
are treated as full A/A/A for access, stage visibility, and readiness.
Co-authored-by: Cursor <cursoragent@cursor.com>
- internal/controlcenter/importer: scan .doc/ops/{short-term,long-term}
and .doc/backlog for task docs, upsert cc_tasks keyed by slug; maps doc
status/stage, auto-creates the three plans, follows doc status only
while a task is planned/in_progress (terminal statuses never regress),
skips unchanged docs, and resolves cross-directory slug collisions by
fixed directory precedence with a warning
- cmd/control-center: import-docs subcommand (also runs at serve startup
and on the doc-sync ticker) plus the agent CLI: next / instruction /
claim / heartbeat / release / event / artifact / advance-request /
decision / report, thin net/http client, compact JSON output
- console API POST /api/v1/tasks/{id}/export-doc renders a task per
.doc/ops/templates/short-term-task.md into .doc/ops/short-term/, refuses
overwrite (409) and unsafe slugs, then backfills doc_path
- fix pre-existing TestAgentHasNoAdvanceRoute: SPA catch-all GET / makes
the mux answer 405 for unmatched POST paths; accept 404 or 405
- archtest allowlist: controlcenter/importer -> pipeline, store
Add LockDocumentDuty for PG/memory and expose duty_policy on workflow
document summaries for later UI marking.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stamp instance-governed document duties at create time so heal/revoke can
skip locked rows without importing projectinstance.
Co-authored-by: Cursor <cursoragent@cursor.com>
Also record the ad-hoc verification Path("") join pitfall as a low-severity
audit note so future sampling scripts fail closed instead of scanning bizdev/.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record true PI samples (intake + rd_design_input_spec), update FEATURE-MATRIX
remaining work, backlog S1续批/S2/S3, and allowlist engineeringdashboard for
archtest green on this branch lineage.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prefer AgentSpec.InstructionsFile when building AGENTS.md so rd_* leader
steps no longer fall back to business-tone leader.md.
Co-authored-by: Cursor <cursoragent@cursor.com>
Seed rdev.v2.json, rd_ templates, catalog policy (order 40), squad
kind orchestration, and hard precheck requiring completed main (CDO).
Includes StageKey dynamicization from P0 and docs for P2–P4 skeleton.
Co-authored-by: Cursor <cursoragent@cursor.com>
Verify resolve/normalize/hash stability, policy gating, stale token
rejection, and HTTP error mapping for the new duty policy path.
Co-authored-by: Cursor <cursoragent@cursor.com>
Return 403/409/503 for disabled, changed, and unavailable governance
policy conditions during plan save and activation.
Co-authored-by: Cursor <cursoragent@cursor.com>
Adapt sysadmin.AuthorOnlyPolicySource at the composition root so
projectinstance stays within module-boundary allowlists.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add ResolveDocTaskDuty, require the system policy on save/preview,
lock the policy row during activation, and derive A/A/A assignments.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prevent preview tokens from activating after the governance switch
revision changes by storing the revision on each confirmation token.
Co-authored-by: Cursor <cursoragent@cursor.com>
Verify concurrent revision conflicts, null/string rejection, plain-user
denials, and PG lock/read paths for the new policy key.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register the workflow total switch, require expected_revision for
updates, and expose AuthorOnlyPolicySource for activation locking.
Co-authored-by: Cursor <cursoragent@cursor.com>
Mark lifecycle boundaries reviewed; require HealProjectDocuments
projection stability across list/generate/member triggers, and
explicitly exclude emergency stop from the global switch scope.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record curl/browser before-after metrics, mark U2 done, and release the
integration slot while leaving U1/U3–U7 open.
Co-authored-by: Cursor <cursoragent@cursor.com>
Serve precompressed .br/.gz with Cache-Control and Vary, and return 404
for missing /assets and /fonts instead of index.html.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use Node zlib in a post-vite step so the Go server can serve negotiated
variants without per-request compression cost.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove blocking Google Fonts stylesheet so the login form is not gated
on an external CSS request; keep unicode-range subsets and OFL license.
Co-authored-by: Cursor <cursoragent@cursor.com>
Capture audit evidence, performance baseline, and U1–U7 remediation plan
without business code changes so the work can land on dev before U2.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove the inline token script blocked by script-src 'self', so the
live page no longer calls the snapshot API with token=undefined.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add test report, FEATURE-MATRIX row, archive the short-term task,
mark CURRENT claim done, and ship the thin serve/export script.
Co-authored-by: Cursor <cursoragent@cursor.com>
Merge docs/git/runtime facts into an immutable snapshot with conflict
retention, last-known stale handling, and acceptance-sample coverage.
Co-authored-by: Cursor <cursoragent@cursor.com>
- top-level view switch workbench|admin in App.tsx (no router; hash #turn
anchors untouched)
- new admin/console/AdminConsoleView with left group nav in the existing
token/inline-style idiom, plus 8 self-fetching sections: overview, kb,
features, settings, workflows, roles, users, docs
- absorb the six AdminSettingsModal tabs into sections and delete the modal
- new api/systemAdmin.ts + types for /api/v1/admin/system/* endpoints
- playwright smoke spec web/e2e/admin-console.spec.ts (skip by default)
- new internal/sysadmin package (overview/kb/features/settings) with small
port interfaces; business packages stay unaware of sysadmin
- new routes /api/v1/admin/system/{overview,kb,features,settings} guarded
by requireSystemAdmin
- goose 00049: system_settings table (key/jsonb value, updated_by/at)
- SettingSpec whitelist registry with DB > env > default precedence
- register sysadmin in module-boundaries.yaml (archtest rules)
Register CURRENT mutex and mark short-term in_progress on the
feature/engineering-dashboard worktree before coding.
Co-authored-by: Cursor <cursoragent@cursor.com>
Freeze the independent local readonly engineering-dashboard design,
short-term task entry, and system-design index before implementation.
Co-authored-by: Cursor <cursoragent@cursor.com>
Optional reviewer/approver duties leave UserID=0; writing 0 into
document_records FK columns failed with SQLSTATE 23503. Align create
path with docduty nullIfZero and surface ensureUser failures in logs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Software projects mount only bootstrap/delivery keys and skip the medical
seven-template clone. SWBOOT-10 stays a fail-closed stub.
Co-authored-by: Cursor <cursoragent@cursor.com>
Rules that already split skip the LLM. Independent flags stay off by
default and do not raise MULTI_INTENT_PLAN_TIER.
Co-authored-by: Cursor <cursoragent@cursor.com>
Flag-on CreateAgentCandidate asks the product PI runner for
change_report_narrative_v1 after the real digest is known; timeout
and malformed payloads stay full fallback. Default flag remains off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Enable SEMANTIC_SUMMARY_SHADOW to call the product PI runner on authorized messages only, keep REPLACE unwired, and record MiniMax evidence for the D3 matrix close.
Co-authored-by: Cursor <cursoragent@cursor.com>
Library must not abort the process; E2E callers use EnsureOnline/t.Fatal
so ambient RUN_PI_E2E no longer kills short server tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop using a fake default KB password; merge Compose-style env files and
rewrite compose DNS to localhost on the host so go test/E2E authenticate.
Co-authored-by: Cursor <cursoragent@cursor.com>
FAV U7 stub package was missing from module-boundaries imports map,
breaking go test -short smoke after W1 merge.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive green receipt 6e2476f0, raise FEATURE-MATRIX CI/E2E to done,
and mark short-term/CURRENT W1 complete.
Co-authored-by: Cursor <cursoragent@cursor.com>
Organizer still prompts for fields.json, but missing it must not fail
closed as MISSING_TARGET when output.md is present (FullNone flake).
Co-authored-by: Cursor <cursoragent@cursor.com>
configs/.env.dev omits KB_DB_PASSWORD so Load kept the default
shared_kb_secret_pass; fall back to root .env so research can use KB.
Co-authored-by: Cursor <cursoragent@cursor.com>
Two 00048 files made goose panic on CollectMigrations, blocking all
TEST_DATABASE_URL PG suites including FullNone and nightly.
Co-authored-by: Cursor <cursoragent@cursor.com>
Confirm D7 retention draft ADR, confirm-tier gate, REPLACE default-off,
and FAV live order with observation windows; sync CURRENT and short-term.
Co-authored-by: Cursor <cursoragent@cursor.com>
Gate on RUN_UI_ACCEPTANCE=1; seed awaiting PG plan via SQL without raising
MULTI_INTENT_PLAN_TIER; assert one confirm wins and reload/relogin match PG.
Co-authored-by: Cursor <cursoragent@cursor.com>
Load GET /intent-plans/active into a live card on session restore, use a
unique decision nonce per confirm click, and keep an empty-docAST fallback
so login still renders when demo seeds are off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Update catalog size expectations to five workflows and archive the
unit-test report; sync FEATURE-MATRIX and task docs without merging to
dev.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register dry-run adapters via BuildOwnerMux when independent flags are on;
U9 stub fail-closes on malformed/timeout/out-of-bounds without raising PlanTier.
Co-authored-by: Cursor <cursoragent@cursor.com>
Subscriber remains OFF until separate approval; document remaining FAV
port inventory and claim feature/fav-u7-publisher.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep durable fav unregistered and fail-closed; CLI only prints status and
remaining-port inventory without destructive backfill/recover commands.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expose GET /api/v1/vault/status and only wire in-process Drain when
FAV_PUBLISHER_ENABLED is explicitly true; degraded read stays off by default.
Co-authored-by: Cursor <cursoragent@cursor.com>
Panel and view-model label server risk/lineage separately from PI narrative;
add change_report_narrative_v1 helper aligned with typed-result patterns.
Co-authored-by: Cursor <cursoragent@cursor.com>
Introduce PI_CHANGE_REPORT_NARRATIVE (default off). When on, consume typed
narrative bound to input digest only; malformed/timeout paths fully fall back
without mixing fields or lowering server risk.
Co-authored-by: Cursor <cursoragent@cursor.com>
GenerateRollingSummary filters to authorized-visible messages; digest API
exposes shadow/freshness without enabling REPLACE.
Co-authored-by: Cursor <cursoragent@cursor.com>
Shadow evaluates a no-tool summarizer on caller-supplied messages; served
narrative stays deterministic and REPLACE remains unwired.
Co-authored-by: Cursor <cursoragent@cursor.com>
Freeze selectable workflow keys, domain/compliance separation, solo policy,
and SWBOOT-10 fail-closed stub contract without touching medical three.
Co-authored-by: Cursor <cursoragent@cursor.com>
Point Nightly Real PI at runs-on: nightly (host network) so the local
act_runner can reach host PI :18865 and isolated PG :5434.
Co-authored-by: Cursor <cursoragent@cursor.com>
Retry U8 product quality flakes once in nightly; formalize Playwright
dual-tab as long-term gated; closeout handoff and DoD notes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record no-go decisions and independent long-term task contracts; do not
implement or raise MULTI_INTENT tier.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record classified nightly outcome for 67d7335 with image digests and
gate rejection evidence; does not claim product suite green.
Co-authored-by: Cursor <cursoragent@cursor.com>
Smoke passed on merge; record N7 product-fail classification evidence
from the in-flight nightly suite without claiming same-image promotion.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record gate fixtures and infra negative evidence; mark Artifact row
partial for same-commit/digest traceability without same-image claim.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add schedule/dispatch nightly entry that classifies infra vs product
failures, and require a valid receipt (or waiver) before promote/release.
Co-authored-by: Cursor <cursoragent@cursor.com>
Nightly and promote gates need auditable pass/product_fail/infra_fail
receipts under test-reports assets, plus timed owner waivers.
Co-authored-by: Cursor <cursoragent@cursor.com>
Close FEATURE-MATRIX evidence gaps for multi-intent U8 and workflow
full/none; release the integration slot after live PASS.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace the U8 stop-gate with a PG+PI confirm/generate harness and add a
mixed-duty governance long chain covering cross-user approve and none
non-blocking advance.
Co-authored-by: Cursor <cursoragent@cursor.com>
Normalize empty TEXT[] binds, isolate step-changed aggregates from plan
revision uniqueness, propagate AdvanceEligible errors, and emit
taskrun.completed to the registered notify consumer so finalize no longer
rolls back live receipts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Boot memory IAM only via explicit test env opt-in; strict auth cases
disable AllowInMemory after startup.
Co-authored-by: Cursor <cursoragent@cursor.com>
Refuse MemoryStore fallback for main/empty/unknown env or missing
ALLOW_IN_MEMORY so production cannot silently use in-memory authority.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register newTestServer cleanup and Shutdown WaitIdle so race detector
no longer hits RemoveAll on a live DataDir.
Co-authored-by: Cursor <cursoragent@cursor.com>
Align capability maturity with frozen boundaries, record IAM readonly PASS
without flipping production_ready, and leave Wave 1+ for fail-closed code.
Co-authored-by: Cursor <cursoragent@cursor.com>
Rewrite the promote report so each Wave case records input, system
output, analysis, and evaluation against FEATURE-MATRIX evidence.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record Wave 1–4 evidence, fix FEATURE-MATRIX schema-47 note, harden
promote-to-test against origin rebase, and mark infra task done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Automated short/module/governance-PG outputs plus live :8080 smoke and
PI typed-result sample for promote gate.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use shared DATA_DIR permissions (umask/chmod) and drop obsolete sync
notify asserts so governance PG PI chains can complete on MiniMax runner.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add duty holders as project members, drop sync notification assert
after outbox cutover, and add an explicit CI governance PG step.
Co-authored-by: Cursor <cursoragent@cursor.com>
Dev already applied 00046 (projects only) before session retirement
was folded into that file; 00047 closes the gap idempotently.
Co-authored-by: Cursor <cursoragent@cursor.com>
Extend unapplied migration to mark 6001–6010 sessions demo_retired
and filter them (and retired projects) out of ListChatSessions.
Co-authored-by: Cursor <cursoragent@cursor.com>
Vitest-style suite was caught by tsx --test and broke npm test.
Align with storage.test.ts and narrow vitest include to chat suites.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record systemic audit, wave plan status, gap-matrix blockers, and unit/
bundle scan results for the demo-data pollution fix.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require ResolveBackendInEnv to deny stub (and empty stub fallback) when
env is main/prod so production cannot request simulated agent output.
Co-authored-by: Cursor <cursoragent@cursor.com>
Mark projects 6001–6010 as demo_retired and exclude them from default
project list queries so demo seeds no longer pollute real workspaces.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop shipping hard-coded demo docs/projects into production builds,
drop local mock items on authoritative empty server lists, and purge
stale demo seed residue from localStorage on boot.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist ComboNeedsConfirm plans at confirm tier without executing writes, then run task.run via OwnerMux and a stable idempotency key.
Co-authored-by: Cursor <cursoragent@cursor.com>
Principal comes from the session and query scope; body identifiers are ignored and admins cannot skip membership.
Co-authored-by: Cursor <cursoragent@cursor.com>
Confirmation stays a command receipt; FakeActionOwner now fail-closes on revoke and resource version drift.
Co-authored-by: Cursor <cursoragent@cursor.com>
Append awaiting/step/completed envelopes in the command UoW and project them without changing dispatcher leases.
Co-authored-by: Cursor <cursoragent@cursor.com>
Generate 2–4 step L1 proposals with stable digests while leaving TopIntent and the legacy IntentPlan router unchanged.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep write combos and internal-chain summaries on the current TopIntent path so U2 shadow proposals cannot silently change production.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register the independent U2 short-term on the intent mutex so shadow proposals can land without touching production routing.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive the arch/parity/short evidence and mark the U1 claim done so U2 can take the intent mutex next.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add the app/intentflow skeleton so HITL state, error codes, REST shapes, and BatchActionPolicy live outside intent and default to the legacy tier.
Co-authored-by: Cursor <cursoragent@cursor.com>
Freeze the three fact events, intentflow allowlist, and plan table ownership so later units cannot invent producers or write paths outside app/intentflow.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register the independent U1 short-term, checklist, and CURRENT mutex so architecture-docs and events stay serial while contracts land.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive the shared-live short-term, refresh CURRENT foci, and check in the reviewed multi-intent design so it no longer sits uncommitted on dev.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remote /v1/run now emits additive result_v1; Go validates run_id, digest, and paths before materializing, and only accepts missing typed payloads with an explicit legacy handshake.
Co-authored-by: Cursor <cursoragent@cursor.com>
Public errors now emit code, safe message, and request_id while keeping the legacy error field. Raw SQL, paths, tokens, and XSS payloads are stripped; the frontend branches on code instead of substring matching.
Co-authored-by: Cursor <cursoragent@cursor.com>
Durable notify/advance/projection are live on shared dev, so composition roots must not assign OnOutbox or AddOnApprovedHook. Bind helpers remain for tests and a rollback window.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add ValidateOpsCutover, eventmode CLI, and a host script that pin agent_system_dev and refuse FAV plus test/main before any cluster mode write.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive completed Track E/S short-terms, record HTTP/PI compatibility matrices, and defer shared live plus protocol implementation to long-term tasks.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pending-action task runs now use stageflow request aliases and Server ports, so chat no longer reaches through the orchestration root.
Co-authored-by: Cursor <cursoragent@cursor.com>
Composition roots already hold Snapshot ports; the interface and archtest now forbid putting Pool/DocGov/DocRevision/ContextManager/CAS/ProjectWorkflow/FreeformDoc/KB back on Service.
Co-authored-by: Cursor <cursoragent@cursor.com>
Coordinator now takes a StageTaskRunner and injected context/KB ports.
Chatflow assembler reads maturity tokens instead of the orchestration root.
Co-authored-by: Cursor <cursoragent@cursor.com>
Intent only needed the three official stage tokens. Moving them to a
leaf package lets the recognizer compile without the orchestration root.
Co-authored-by: Cursor <cursoragent@cursor.com>
docgov saves content hashes through the new leaf module so it no longer
imports docrevision. Existing docrevision exports stay as thin wrappers.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep OnOutbox and approval hooks registered while dispatcher mode is
off, but no-op them as soon as the matching durable consumer owns the
visible write so a later switch cannot dual-write.
Co-authored-by: Cursor <cursoragent@cursor.com>
HTTP Runtime does not start the worker. Each compose environment gets its own events service, health port, and bounded pool.
Co-authored-by: Cursor <cursoragent@cursor.com>
Workers claim with SKIP LOCKED, heartbeat by token, and ack/fail only when the fencing token still matches. Shadow scans without acking live deliveries.
Co-authored-by: Cursor <cursoragent@cursor.com>
E0B needs an additive lease audit trail and a cluster-level off/shadow/live table before any worker can claim. FAV remains constrained to off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive isolated-PG evidence, 7-day read-only inventory, and the decision to bootstrap consumers from the first safe event instead of gap-waiting.
Co-authored-by: Cursor <cursoragent@cursor.com>
HTTP adapters now reuse the composition-root instance. Candidate-ready, downstream impact, and approved envelopes share the domain unit of work, and missing env/project fail closed without defaulting to dev/0.
Co-authored-by: Cursor <cursoragent@cursor.com>
Reject empty environment/project, disable FAV consumers at register time, and keep historical classification/repair/replay as audited application use cases with no raw SQL entrypoint.
Co-authored-by: Cursor <cursoragent@cursor.com>
E0A needs additive tables for classification and per-consumer identities before any dispatcher can claim work. FAV principals are rejected at the schema check.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move the reviewed durable-event, HTTP envelope, and PI typed-result
designs off the docs/ prefix so Track E can start from latest dev.
Co-authored-by: Cursor <cursoragent@cursor.com>
Local merged side branches and their worktrees are gone; FAV/herdr/diagnosis/old-linear stay unmerged on purpose.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record project 6275 PI 409 DOC_BUSY plus Docker screenshots, mark CHAT-INTENT-STATE PASS, and archive the short-term so CURRENT has no in_progress rows.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record schema 38 health/ready plus the new agent-dev-app digest, then mark the composition-root slice done so intent dual-tab can take the idle slot.
Co-authored-by: Cursor <cursoragent@cursor.com>
Contract tests, target-package race, and arch-check --mode block passed; merge to dev still needs the integration slot rebuild.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move construction and document OnOutbox out of server, give HTTP/CLI a shared task use case, and block already-cleared import/event arch rules.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive the finished chat mutex tasks, attach PI idle-chat refresh same-set evidence for project 6252, and stop expansion after in-place ports without a package split.
Co-authored-by: Cursor <cursoragent@cursor.com>
Ignore request user_id as identity, authorize from the session Principal, and hydrate restore/memory from the same visible set so HTTP, SSE, and prompt assembly cannot amplify hidden messages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep ctxmgr as table owner and filter the authorized visible set in-process so window, stats, restore, digest, and prompt assembly share one Principal-scoped collection without a package move.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use an isolated dual-pool database so idempotent finalize, cancel CAS, commit-fail SSE, and receipt-gated cleanup are proven without a process mutex.
Co-authored-by: Cursor <cursoragent@cursor.com>
Hash deliverables through Capability.ReadArtifact, resolve backends on the server, and refuse workspace removal until frozen members match FAV receipts.
Co-authored-by: Cursor <cursoragent@cursor.com>
CAS the unique terminal status with the assistant turn, frozen manifest, envelope and FAV staging, and join ctxmgr writes through the same UoW instead of a process mutex.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist typed RunManifest bytes and SHA per run, and allow a finalizing status so U8 can freeze a unique terminal without sharing env databases.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register feature/taskrun-runmanifest on the taskrun mutex so U8 can start without occupying chat/intent or writing U9–U12.
Co-authored-by: Cursor <cursoragent@cursor.com>
U5–U7 passed isolation-db, race, goose Down, and schema-36 rebuild. The report last sentence is 继续 M3; the integration slot is idle.
Co-authored-by: Cursor <cursoragent@cursor.com>
Goose 00036 is a renumbered copy of the vault tables. Degraded read stays off by default and only runs after authorization; tombstones and unpublished artifacts fail closed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Agent commits append a validated envelope inside the command unit of work. SKIP LOCKED is only used to claim, and stale fencing plus integrity failures go to quarantine or dead-letter.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cross-module callers get an opaque ref plus rotating lease tokens so stale writers fail closed, and file I/O is refused inside a unit of work.
Co-authored-by: Cursor <cursoragent@cursor.com>
Rebuild, real PI, browser reload, and two-pool sessions all passed, so
the live report's last sentence is 继续 M2 and the integration slot is idle.
Co-authored-by: Cursor <cursoragent@cursor.com>
Create-project candidates come from the in-session user directory, so a
fresh admin page never saw B/C unless the console refresh ran first.
Co-authored-by: Cursor <cursoragent@cursor.com>
Live M1 sign-off needs browser proof that missing projection is not 404,
outsiders share DOCUMENT_NOT_FOUND, and a real PI compile survives reload.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cross-pool idempotency is same key plus same digest; a stale in-memory
head from the seeder hid the one-winner four-session lock.
Co-authored-by: Cursor <cursoragent@cursor.com>
Occupy the integration slot for M1 live sign-off, cover two pgx pools plus four sessions, and add a Playwright spec that treats projection consistency as 200 rather than 404.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep the short and isolated PostgreSQL/race outputs next to the stop-the-line report so the unsigned PI/browser/rebuild columns stay auditable.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unit, isolated PostgreSQL, and target-package race passed, but real PI, browser, and rebuild were not signed, so the report concludes 停止扩面 and keeps U5–U12 closed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Concurrent HumanEdit/Approve used to assign the default authorizer on the shared Commands value, which raced under -race. Read a local authorizer instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
Authorize first, then return immutable ledger markdown with typed consistency so a missing or drifted projection is no longer a 404/409. GET stays read-only and FAV degraded read stays off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Lock the document row and re-authorize duty before edit, agent commit, approve, or reject share a single transaction. Characterization tests pin ETag races, one legal approve/reject terminal, and same-key digest conflicts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Give each document command one postgres transaction and only let table owners unwrap the scope, so cross-owner writes can roll back together.
Co-authored-by: Cursor <cursoragent@cursor.com>
Capture the replayable import/sql/path/event counts and the owned exceptions that later milestones must shrink.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace whole-repo grep with four production-only gates so Goose and tests stop looking like writer debt, and so new SQL, path, or event crossings fail immediately.
Co-authored-by: Cursor <cursoragent@cursor.com>
Land the revised modular-monolith scheme on the implementation branch so U1–U4 can proceed against a frozen design, and register the docgov mutex without occupying the integration slot.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the real-page and API matrix, release the workflow mutex, and point FEATURE-MATRIX / gap-matrix at the report.
Co-authored-by: Cursor <cursoragent@cursor.com>
Avoid matching the blocked-run hint when opening settings, and close leftover modals before project 143.
Co-authored-by: Cursor <cursoragent@cursor.com>
G5 starts merging and smoke on the shared dev stack; Playwright matrix
is ready for the real page pass after rebuild.
Co-authored-by: Cursor <cursoragent@cursor.com>
Read-only dev query shows 83 planning rows with a leftover key; all are
paired PROJ_MGR/TEST_PROJ fixtures, none are live business projects.
Co-authored-by: Cursor <cursoragent@cursor.com>
Hide submit/review/approve on none docs, surface the blocked-run hint in
chat, and warn that unmanaged duties cannot be added after activation.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pin unmanaged-doc button visibility and treat blocked_pending_governance
as a governance hint, not a successful generation.
Co-authored-by: Cursor <cursoragent@cursor.com>
Validate the catalog key only and stop writing lifecycle=active so
activation stays on the settings DutyMode path.
Co-authored-by: Cursor <cursoragent@cursor.com>
Creating with initial_workflow_key must stay in planning with an empty
active key while the catalog still mounts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep 202 for unactivated document runs, persist blocked_pending_governance,
and refuse submit/review/approve/edit until a live workflow exists.
Co-authored-by: Cursor <cursoragent@cursor.com>
Route run/edit/submit/review/approve to a single duty, drop full-doc
creator bypass, and keep view listing independent of stage narrowing.
Co-authored-by: Cursor <cursoragent@cursor.com>
Lock the full/none/pre-activation matrix so creator no longer implies
document-task privilege and unactivated runs stay WORKFLOW_NOT_ACTIVATED.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wave 5 is on local dev@19f6df5; claim the workflow mutex and
register the implementation worktree for G1–G5.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the real UI matrix, release the integration slot, and leave
the unrun PI generation/approval path as an explicit residual.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wait for the workflow select step before clicking next, scope duty
dropdowns by role, and finish first-login reset so dual-tab and
member checks reach the real frozen UI.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Track E Phase 2：[../remediation/2026-09-15-module-decoupling-ipc-phase2-remediation-plan.md](../remediation/2026-09-15-module-decoupling-ipc-phase2-remediation-plan.md)
（session-settled: user-approved — chosen over product-admin integration: the console is for the repository owner’s local engineering management and the production image excludes `.doc` and `.git`）
#### PKD-2：只读实时页与离线快照共用数据模型
实时服务和导出文件必须由同一份版本化快照生成，避免在线页面与离线报告出现两套口径。
（session-settled: user-approved — chosen over a static-only report: the requested console must follow agent tasks and project state as they change）
2. 暴露 `/api/v1/snapshot`、`/api/v1/doc/<id>`、`/healthz`；所有接口只读。严格校验 Host/Origin/Fetch Metadata，不信任代理转发头；页面和 API 使用每次启动生成的不可预测访问令牌，降低 DNS rebinding 与跨站读取风险。
3. 页面分为总览、架构/模块、任务、Git、部署、文档和证据链。
4. 自动刷新完整快照，保留当前筛选、滚动位置、焦点和选中文档；ETag 未变化时不重绘。
5. 明确一级视图状态：initial loading、fresh empty、fresh success、partial/degraded with last-known、hard error without cache、refreshing、recovered。刷新中继续展示上一完整快照，直到下一版本原子替换。
- Test report: [../../test-reports/2026-09-13-conversation-intent-runtime-state-test-report.md](../../test-reports/2026-09-13-conversation-intent-runtime-state-test-report.md)
- Test report: [2026-09-14-workflow-plan-409-frozen-and-optional-duties-test-report.md](../../test-reports/2026-09-14-workflow-plan-409-frozen-and-optional-duties-test-report.md)
## 证据 / 备注
- dev 项目 143：`lifecycle_status=active`、`active_workflow_key=main`、实例 89 active；409 与三名职责人选择内容无关。
- Test report: [../../test-reports/2026-09-15-app-composition-u11-u12-test-report.md](../../test-reports/2026-09-15-app-composition-u11-u12-test-report.md)
- Test report: [../../test-reports/2026-09-15-chatlog-contextasm-u10-test-report.md](../../test-reports/2026-09-15-chatlog-contextasm-u10-test-report.md)
5. [x] 同步 test report、CURRENT、FEATURE-MATRIX、gap-matrix、[复盘](../research/2026-09-15-track-e-retrospective.md)。
## 验收标准
- [ ] 满足 [Phase 2 Track E Definition of Done](../../remediation/2026-09-15-module-decoupling-ipc-phase2-remediation-plan.md#track-e-definition-of-done)（共享 live 与删除 hook API 仍开放）。
- Test report: [../../test-reports/2026-09-15-leftover-branch-cleanup-test-report.md](../../test-reports/2026-09-15-leftover-branch-cleanup-test-report.md)
- Test report: [../../test-reports/2026-09-17-docgov-optional-duty-null-fk-test-report.md](../../test-reports/2026-09-17-docgov-optional-duty-null-fk-test-report.md)
基线 dev adb48c8。已 fetch origin/dev，本地 dev 领先 44、落后 0，保留未推送集成成果；主工作区 feature/control-center-server 未切换。worktree 脚本默认从当前 HEAD 创建，故直接指定 dev 创建本 worktree，避免引入他人分支。
- Test report: [../../test-reports/2026-09-17-document-author-only-u6-test-report.md](../../test-reports/2026-09-17-document-author-only-u6-test-report.md)
- [测试输出](../../test-reports/assets/2026-09-21-herdr-v12/focused-tests.txt)；[九种启动命令](../../test-reports/assets/2026-09-21-herdr-v12/launch-commands.json)。Git/SQLite 是真实临时仓库，Herdr transport 为 fake，绝不将其声明为实际 pane 启动/模型 E2E。
- PI 安装版本 0.85.1 的本机 README 明确内置工具无权限弹窗，`--approve` 是项目文件信任；扩展仍可自建交互。Cursor force 保留显式 deny，Kimi 使用 auto 而非 yolo。其他本机帮助与[官方出处](../../ops/2026-09-13-herdr-agent-roster.md#5-自动通过请求与实际启动)相互核对。
- Test report: [../../test-reports/2026-09-17-engineering-dashboard-test-report.md](../../test-reports/2026-09-17-engineering-dashboard-test-report.md)
- Test report: [../test-reports/2026-09-17-docgov-optional-duty-null-fk-test-report.md](../test-reports/2026-09-17-docgov-optional-duty-null-fk-test-report.md)
**依据**：`AGENTS.md:118`、`PROJECT.md:118` 明确纯工程规范/文档不调用产品 PI；`.cursor/rules/test-reports-standard.mdc:49,61` 仍要求报告包含全量 Go 回归，并在报告生成前做真实 PI 全链路。后者是 alwaysApply。旧收口分支虽包含相关澄清，但尚未进入本轮基线 dev。
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
WeiCHEN