Port deploy phase transition guards and cleanup markdown projection into
agentctl_w4, delete the unused automation module, and pin illegal jumps
with a regression test.
The second queue parser shadowed handler-compatible flags (--head,
cancel --task, schedule --drain), so enqueue/cancel/schedule failed
at runtime and queue_items stayed empty. Keep the first registration
and add regression coverage for parser flags, roundtrip, and schedule.
Six-track plan (R1-R6) grounded in the 2026-09-23 four-way read-only
survey: server/chat/bizdev/workflow residual coupling, event bus ops
loop gaps (dead letters, serial dispatch, dual outbox), panic
recovery, single-host HA (replicas, PG hot standby, backup
automation), concurrency hotspots (docgov engine lock, sync long
tasks, pool tuning). Planned only; no code changes.
Return assistant_msg_id from createTaskRun so live bubbles merge with history,
hide continue on terminal failed runs, and restart via a fresh turn/bubble.
Truncate execution.log patches and keep members aligned with patch bodies so
verbose MiniMax-M3 runs no longer exceed the Go 8MB fail-closed limit.
Surface body-too-large vs typed-reject reasons and map contract failures to
fatal restart instead of misleading resumable TASK_INTERRUPTED.
Mark W4 projection/deploy/recover/Darwin as landed in FEATURE-MATRIX,
close the superseded governance-automation short-term, and refresh
residual closeout SHAs after local_dev merges.
Mark W4 projection/deploy/recover/Darwin as landed in FEATURE-MATRIX,
close the superseded governance-automation short-term, and refresh
residual closeout SHAs after local_dev merges.
Add whole-doc and row projection with hash CAS, real enqueue→claim→
fake-deploy→SQLite receipt chain, Darwin lsof cwd visibility, and
black-box tests. PI image compose remains deferred.
When summarizing the latest upload, poll parse state up to MinerU timeout,
emit document_parsing phase events so the bubble stays live and input stays
locked, then summarize or return a clear slow/failed reply.
Recognize “刚刚上传” as @latest_upload and summarize the project’s newest CAS attachment (with clear parse pending/failed/no-asset replies) instead of searching only controlled workflow docs.
Add a login-visible user directory API and admin/self profile update
paths so project duty selectors stop falling back to "用户 N", and so
users can persist display fields with an admin-edit tip.
Provide phase-1/2 and cancel-contract self-check items for the off-host
refactor plan, with N01–N22 mapping placeholders and product-host backfill steps.
Prelim materializes with empty duty slots (author_id=0), so claim/edit is
impossible after UI-11; move conflict onto intake while it is still drafting.
Orphan streaming_status plus a leftover activeTaskRunId kept InputArea on
停止 after squad terminal. Gate taskRunLive on isThinking only and clear
runId on abortSession so stop/send can proceed for UI-05+.
Composer stop/send was gated only on message status; after squad
terminal, stale streaming bubbles kept 停止当前生成. Gate on live
turn/task-run runtime and settle orphans on explicit stop.
Introduce internal/contracts/vocabulary for state/role/error sentinels,
alias through docgov, and retarget hot production consumers so
coordinator no longer imports docgov for vocabulary-only use.
Keep registry key validation local to workflowdef with composition-root
injection, adapt FlatCatalog for projectworkflow, and drive the
orchestrator through LiveInstancePort views instead of projectinstance.
Replace FakeActionOwner with QueryOwner+QueryGuard at the composition
root; DispatchEligible reuses claim/execute/recover so confirm stays
zero-write before dispatch and default tier remains legacy.
Remove production *pgxpool.Pool from Server, centralize domain→HTTP
status mapping, and expose Runtime ports for task-store readiness,
duty heal, and artifact vault registry. Allow app→docduty for heal wiring.
Move document_records duty-slot writes into docgov, project ledger
heads through docgov/freedoc ports, and workspace deliverable I/O
through DeliverableStore so arch-check baseline drops to sql_write:1
path:13.
Record recommended approaches, risks, acceptance, and product/env
blockers for B1/B3–B5/B7/B11, F1/F4/F7/F8, I1/I4/I6; cross-link F5/I8
to t20-lowrisk without duplicating.
Route web/src/api modules through shared apiFetch so Bearer headers,
typed error envelopes, and GET/HEAD transient retries live in one place
without swallowing domain failures used by existing error cards.
Record SWBOOT L1–L4 (no real repo write), FAV ObserveShadow gates and
observation-window prerequisites, D7 Track E ID-only checklist, and stronger
PI narrative fallback negatives while keeping all redline flags off.
Keep 09-13 docrev audits/remediations in_progress with explicit W3 ownership, move the W1-D task body to *-w1d.md with evidence commands, and set phase2 remediation to in_progress because acceptance remains unchecked.
Invert chat dependencies onto composition-root adapters, replace
AssembleRequest coordinator embeds with local DTOs, and drop the
chat→app/* allowlist edges so arch-check can enforce the boundary.
Invert chat dependencies on chatflow/intentflow/stageflow through
composition-root adapters; replace AssembleRequest coordinator embeds
with local DTOs and tighten the module-boundaries allowlist.
T20-F2/F3/F5/F6: reset stuck executing cards, reclaim AbortControllers via removeTurn, wrap chat/doc panes, and split SSE on CRLF blank lines as well as LF.
T20-I2/I3/I5/I8: dev compose /api/v1/ready, main events networks match test/dev, Dockerfile golang:1.27.1-bookworm, and testing.Short skip for pi-agent docker build.
Close T20-B2/B6/B8/B9/B10 low-risk leaks: map-backed cancel reclaim, idempotency lock TTL in cleanupLoop, sync.Once information_schema probe, InvalidateLayer after chat memory upsert, and Subscribe before SSE headers.
go test under internal/server previously preferred package-local
data/test, so materials never reached the pi-agent bind mount and
intake quality gates failed closed on empty sandboxes.
Close project-context membership gap, register arch SSOT edges, and repair
CI PG fixtures so release short/vet/arch gates pass on schema 61.
Co-authored-by: Cursor <cursoragent@cursor.com>
Parallel NewServer bootstrap raced with goose fixed-id user rows and
sequence drift, panicking the server package on wangzong insert. Treat
unique violations as success when the demo username exists (or retry once).
Co-authored-by: Cursor <cursoragent@cursor.com>
Official main.v2 uses bd_intake (not intake); stage gates stayed closed when
fixtures approved the wrong task key. Task-run finalizers also require a real
project_id for outbox event scope—seed scoped projects in PG fixtures.
Co-authored-by: Cursor <cursoragent@cursor.com>
enforceChatProjectAccess before allowAnyStageAccess on GET /context/project
so activated projects are no longer readable by arbitrary authenticated users.
Align failing gate fixtures with official workflow keys, isolated TEST_DATABASE_URL,
unique project names (00057), duty membership, and in-memory bizdev-cli envs.
Co-authored-by: Cursor <cursoragent@cursor.com>
arch-check --mode block failed on frozen dev (23 NEW import findings):
modules materialindex/mineru/workflowscope and edges shipped via their
own accepted tasks were never registered in module-boundaries.yaml.
Register the intentional allowlist edges (precedent 97b868a9); no new
exceptions are added.
7 PG tests fell back to a hardcoded dev DB (127.0.0.1:5433) when
TEST_DATABASE_URL/CONTEXT_DB_DSN were unset, contradicting the isolated
test-DB contract (BUG-08) and polluting dev on a bare 'go test -short'.
Change the fallback to skip when no isolated DB env is provided.
Co-authored-by: Cursor <cursoragent@cursor.com>
macOS host exception recorded in task doc: agentctl lease path is
Linux-only (/proc); commits under this task use --no-verify with the
manual equivalent gates listed in the exception section.
Co-authored-by: Cursor <cursoragent@cursor.com>
Align prepared clients with role budgets and automatic approvals. Keep uncertain delivery from triggering duplicate work and preserve task worktree gates.
Consolidate approved policies and add local lease, document CAS, commit, candidate and environment gates. Preserve conservative recovery and cleanup limits.
Record the dev data-mount drift (worktree env-service violation) and the
Agent API 20-page limit as the two combined root causes, with the
chunked real-28-page-PDF workspace evidence. Retract the first-round
acceptance verdict.
Co-authored-by: Cursor <cursoragent@cursor.com>
The free Agent lightweight API rejects files over 20 pages (-30003)
and the precision token is expired, so a real 28-page PDF could not
parse at all. On -30003, parse in 20-page windows and renumber chunk
anchors to global pages; report engine mode agent_chunked.
Also log skipped assets in ResolveMaterials and return a bool from
EnqueueAsync so parse_state is only set when a job is enqueued.
Co-authored-by: Cursor <cursoragent@cursor.com>
A missing ledger body was reported as not found, so an in-scope view of a template document never reached the template reply.
Co-authored-by: Cursor <cursoragent@cursor.com>
The flag reaches all three compose app services and the sysadmin catalog, and unknown values stay on the existing hard block.
Co-authored-by: Cursor <cursoragent@cursor.com>
The document list now reports WORKFLOW_SCOPE_MODE, and weighted mode only blocks a cross-workflow write when that title outscores the active workflow.
Co-authored-by: Cursor <cursoragent@cursor.com>
Weighted mode keeps an in-scope document when a cross-workflow name is only mentioned beside it, while exact cross-workflow writes stay blocked and exact reads record the owning workflow.
Co-authored-by: Cursor <cursoragent@cursor.com>
Exact out-of-workflow documents can be summarized when WORKFLOW_SCOPE_MODE=weighted and the caller can still view the active instance; writes stay blocked.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep WORKFLOW_SCOPE_MODE=strict as the default so cross-workflow mentions stay blocked until weighted mode is turned on.
Co-authored-by: Cursor <cursoragent@cursor.com>
When precision API key is missing or expired (A0202/A0211), parse
via the no-token Agent API so document understanding still works.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive the short-term task, mark CURRENT done, and attach rebuild
evidence from the correct dev tree no-cache image.
Co-authored-by: Cursor <cursoragent@cursor.com>
Claim CURRENT mutex, archive short-term task, and document unit PASS
plus live A0211 token-expired blocker.
Co-authored-by: Cursor <cursoragent@cursor.com>
Async-trigger MinerU after CAS store and surface parse status in
assets API plus a lightweight preview badge.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prefer MinerU markdown, inject fulltext or toc+rag for large docs,
and wire kb.Embedder into CAS instead of nil.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cache MinerU parse results by blob hash and store project-scoped
chunk embeddings for large uploaded materials.
Co-authored-by: Cursor <cursoragent@cursor.com>
Update short-term/CURRENT claim for the extension branch and archive
unit/web evidence pending live rebuild after merge.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep weak write verbs off the task shortcut path, and once-only fall back
to chat when TASK_SCOPE_UNRESOLVED or DOC_TASK_NOT_IN_ACTIVE_STAGE.
Co-authored-by: Cursor <cursoragent@cursor.com>
Ask via PendingExpectation for weak-write verbs, mid confidence, or
stage-mismatched doc tasks instead of running blindly.
Co-authored-by: Cursor <cursoragent@cursor.com>
Map early-stage "整理一下需求" style phrases to intake with needs_confirmation,
and stop RDev "用户需求" from hijacking main-flow "编写用户需求表".
Co-authored-by: Cursor <cursoragent@cursor.com>
Scope intent slot filling and document matching to the active workflow;
cross-workflow mentions are blocked with switch guidance.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Document list returns workflow_key per item and active_workflow_key
- DeliverableItem keeps workflowKey through server sync
- resolveTaskTemplateForMessage filters the match pool and blocks
cross-workflow mentions with switch guidance
Co-authored-by: Cursor <cursoragent@cursor.com>
Adopt the approved workflow with explicit dev baselines, serialized candidate integration, scoped validation and safe cleanup. Keep automation work tracked separately from the active policy.
- ContextSnapshot gains ActiveWorkflowKey; ToSnapshot passes it downstream
- manifest-backed doc-title -> workflow index (main/pm/tm/rdev/sw)
- TRIGGER_TASK and DOCGOV write actions blocked with switch guidance when
the named document belongs to another active workflow
- legacy projects without an active workflow key keep the old behavior
Co-authored-by: Cursor <cursoragent@cursor.com>
The dev container was rebuilt and the health check, task-run errors, and new UI strings are filed with the report.
Co-authored-by: Cursor <cursoragent@cursor.com>
The chat window hook only exposed refresh helpers, so the continue path did not type-check after it started reading history bubbles.
Co-authored-by: Cursor <cursoragent@cursor.com>
Template bodies were read-only, but the status chip said 编制中 and the lock banner said the document was already controlled.
Co-authored-by: Cursor <cursoragent@cursor.com>
Continue looked up only the in-memory message list, so a refreshed card did nothing, and the stream path also dropped the stored workspace.
Co-authored-by: Cursor <cursoragent@cursor.com>
Progress lived only in the open SSE stream, and interrupted history was shown as completed so the card could not be continued.
Co-authored-by: Cursor <cursoragent@cursor.com>
Interrupted runs often have no done event, so a refresh replay would otherwise hold the SSE connection open.
Co-authored-by: Cursor <cursoragent@cursor.com>
「初始用户需求表」contains「用户需求表」, so title matching sent V0.1 wording to the V0.5 task and the stage gate rejected it.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the intent-routing, task-card resume, and template-badge work before code changes so the mutex is visible.
Co-authored-by: Cursor <cursoragent@cursor.com>
The report keeps the 6579 document backfill, the live-edit switch rejection, and the rebuilt dev health check.
Co-authored-by: Cursor <cursoragent@cursor.com>
The scope error now has its own copy, so the 4xx case should assert that text instead of the generic request-failed fallback.
Co-authored-by: Cursor <cursoragent@cursor.com>
Message routing follows the project's real task key, account switches clear local workbench state, and the duty matrix writes the reassignment API instead of a local drill.
Co-authored-by: Cursor <cursoragent@cursor.com>
Activation and list healing need a server-side document row per enabled task, without overwriting documents that already have content.
Co-authored-by: Cursor <cursoragent@cursor.com>
The requirements and impact summary no longer occupies the chat column. Open recheck marks arrive as an assistant card with a no-change action.
Co-authored-by: Cursor <cursoragent@cursor.com>
A new recheck mark is posted into the actor's existing project session, and a downstream-impact event does the same. Asking about what a change affects still resolves to impact analysis.
Co-authored-by: Cursor <cursoragent@cursor.com>
Chen Wei's intake request against a bd_intake snapshot now creates a run, and the chat window still returns the turn after refresh.
Co-authored-by: Cursor <cursoragent@cursor.com>
A 409 used to return before any message was written, so a refresh showed an empty conversation. Record the user turn and a failed assistant reply before rejecting the run.
Co-authored-by: Cursor <cursoragent@cursor.com>
New workflow instances store bd_* task keys, but chat still sends the old keys. Scope and document access now treat those aliases as the same task so a live instance no longer fails closed on an exact string miss.
Co-authored-by: Cursor <cursoragent@cursor.com>
Dev rebuild serves snake_case task run JSON and the real pi-agent backend, so failed runs are no longer labeled as network errors.
Co-authored-by: Cursor <cursoragent@cursor.com>
Show error_message for failed runs, a distinct cancelled state, and business 4xx codes instead of a generic network message.
Co-authored-by: Cursor <cursoragent@cursor.com>
The task run API was emitting PascalCase fields, so the client never saw status or error_message and treated every disconnect as a network error.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the NETWORK_ERROR misreport and defer HTTP access logs so the failure reason is no longer hidden behind a network fallback.
Co-authored-by: Cursor <cursoragent@cursor.com>
The slices share feature/stage-backtrack-impl. Migration 00059 is not applied to the running environments yet.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use the record tables when migration 00059 is present, and hide statements from documents the caller cannot see.
Co-authored-by: Cursor <cursoragent@cursor.com>
Selected documents return to drafting, and advance asks the creator to acknowledge an open recheck mark.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record how later materials can affect earlier stages without hard gates, and split the implementation into planned slices.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record that go vet passed and the two short-test failures are docker registry EOF, not this documentation change.
Co-authored-by: Cursor <cursoragent@cursor.com>
Give implementers one entry for narrow ports, the event bus, and the rule that a fault stays inside its module.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep the modular-monolith baseline and name the seven places where a fault still crosses a module boundary.
Co-authored-by: Cursor <cursoragent@cursor.com>
Load backup credentials from env/secrets files and push via a temporary credential helper so tokens never appear in process listings.
Co-authored-by: Cursor <cursoragent@cursor.com>
Bind preference writes and session-scoped project reads to the authenticated principal, and require an owned session_id for recategorize so empty ids cannot touch all messages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Absorb stalled capability fixes and avoid goose out-of-order on schema 57 DBs by shipping chat_summaries as 00058.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record test-env evidence for chenwei stage chat and post-activation
PATCH duty reassignment after merge and rebuild.
Co-authored-by: Cursor <cursoragent@cursor.com>
Show editable duty selects after activation when the user has
project:assign_lead, calling the new PATCH API instead of workflow-plan PUT.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add PATCH /doc-tasks/{taskKey}/duties that updates live snapshot,
assignments, and document_records while blocking when a squad run holds
the document lease. Planning PUT remains PLAN_FROZEN.
Co-authored-by: Cursor <cursoragent@cursor.com>
Live workflows still restrict document actions to duty holders, but
AllowedStageKeys now include active/completed stages so members can chat.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record E2E PASS for global unique names, member session visibility,
and asset raw preview; release integration slot and mark task done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Deny foreign user_id upsert without manage rights (403); unique project
names in ctxmgr PG fixture for global name index; add test-env data repair SQL.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add GET /assets/{id}/raw with project access checks; frontend falls back
to CAS by assetId or filename when local blob is gone. Align upload accept
list with backend whitelist and register binaries into CAS on chat upload.
Co-authored-by: Cursor <cursoragent@cursor.com>
Project managers can register sess-p{N}-u{uid} for other members; adding a
member also ensures their private session so the sidebar is never empty.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace per-creator name uniqueness with a global index among
non-retired projects, and reject cross-user duplicate creates with 409.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record rc-v1.0.0-beta.6 C-level evidence (pi-agent dialogue, intake docs,
12 regressions) and flip CURRENT to test schema 56 with idle integration slot.
Co-authored-by: Cursor <cursoragent@cursor.com>
A candidate used the same report later attached to the version, so a preview could be treated as the formal result. Proposed reports now close on replace or reject, and only the commit writes an authoritative successor.
The narrator only received counts, so it could not describe the actual change. Caps keep the full document out and leave the input digest unchanged; the flag stays off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Postgres and app reach ready in about a second. Vite cold cache is not the old ten-second stall, and the login form was not measured.
Co-authored-by: Cursor <cursoragent@cursor.com>
Software-plan N/A stayed closed and the proposal completed, but the planning review finished quality_failed at score 20. The poller now treats that status as terminal so it does not spin until timeout.
Co-authored-by: Cursor <cursoragent@cursor.com>
Session state stays in App. The shell, rights dialogs, and project modals now render from WorkbenchView, so App no longer mounts AppShell itself.
Co-authored-by: Cursor <cursoragent@cursor.com>
The workbench shell still owns session and modal state. Message stream, filters, and the composer now live in ChatColumn so App stops assembling that column inline.
Co-authored-by: Cursor <cursoragent@cursor.com>
The rebuilt bundle stays under the draft login budgets on this machine. Restart-to-health is under half a second, and the wider restart matrix is still open.
Co-authored-by: Cursor <cursoragent@cursor.com>
The revision toolbar, file preview, and governance bars stay with the document pane so the workbench shell no longer owns that column.
Co-authored-by: Cursor <cursoragent@cursor.com>
The rebuilt workbench issues one member request and one session list request. Slow-network samples improved, but twenty-run percentiles and the restart matrix are still open.
Co-authored-by: Cursor <cursoragent@cursor.com>
The in-memory authorizer treats any positive user id as a member, so the HTTP negative has to run against a real project row.
Co-authored-by: Cursor <cursoragent@cursor.com>
The checksum-immutable note inside 00001 contained a goose annotation and would fail a new database. Keep that warning out of files goose already applied.
Co-authored-by: Cursor <cursoragent@cursor.com>
The current workbench stays at one member fetch across 20 logins, while the deployed bundle still fans out. Slow-network samples stay diagnostic until the container is rebuilt.
Co-authored-by: Cursor <cursoragent@cursor.com>
Give the initial-load baseline a repeatable probe that strips query strings and can assert the login member fanout stays on the current project.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep private-library share, revoke, delete, and save-to-private off the workbench shell so those side effects stay testable without growing App.tsx.
Co-authored-by: Cursor <cursoragent@cursor.com>
Refresh the roster and workflow documents only after the member write succeeds, so a failed add does not invent a local session.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remember the new project id as soon as create succeeds so a later member failure retries members instead of creating a second project.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep plan confirmation, reject, undo, and approval on the same card so a revision conflict still reconciles before the card changes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Apply a controlled block only after the server patch succeeds, and keep insert, move, delete, and comments on the same document state.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep attachment registration, task dispatch, and the demo shortcuts on the same path so a failed upload still blocks before any local message is stored.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep claim, review, and approval on one server record so the open document and the sidebar stay in the same state.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep freeform append, workflow reconcile, and lease polling together so a failed list cannot wipe local docs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Project list, member roster, and session fetch ran as four effects inside the workbench component. They now share one hook so the entry file is not the only place that knows the login startup order.
Co-authored-by: Cursor <cursoragent@cursor.com>
Session, project, and deliverable caches were written from scattered effects, and the legacy message migration ran twice on mount. One hook keeps that write path in a single place.
Co-authored-by: Cursor <cursoragent@cursor.com>
The login entry no longer ships KaTeX. Chat bubbles and document text render formulas after a dynamic import, and rich-text copy does the same.
Co-authored-by: Cursor <cursoragent@cursor.com>
Published manifests now use bd_/pm_/tm_/sw_ prefixes so workflows cannot share a doc id. Frozen instances keep the old keys; lookup, templates, and duty checks treat the two names as the same task.
Co-authored-by: Cursor <cursoragent@cursor.com>
npm test and the production build passed on this branch. The entry bundle stays near 1 MB, and CURRENT still correctly says schema 52 until the containers are rebuilt.
Co-authored-by: Cursor <cursoragent@cursor.com>
Selecting the design-control workflow now repeats the server rule: business handover must finish with an approved CDO quote first. Other workflows stay quiet.
Co-authored-by: Cursor <cursoragent@cursor.com>
Later stages with more than four documents start collapsed, and one action can put the whole stage under human approval or take it back out. The workflow chip still names the design-control flow when the catalog has not loaded.
Co-authored-by: Cursor <cursoragent@cursor.com>
生成项目建议书 now resolves to rd_proposal. Longer titles win, so 系统设计方案 is not mistaken for the shorter business-stage phrase, and an explicit generate command is no longer swallowed by a progress question.
Co-authored-by: Cursor <cursoragent@cursor.com>
The project list is already limited to the current user, so other rosters wait until the member panel opens. Session reload no longer follows project updates, and a newer response cannot overwrite an older user.
Co-authored-by: Cursor <cursoragent@cursor.com>
Each rdev step now gets a role-filtered overlay so writing discipline stays out of the template. User needs, system requirements, review minutes, and upload indexes fail the quality gate when IDs, decisions, or attachment indexes are incomplete.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stage-specific squad steps now win over the kind default, including always-on regulatory and searcher roles. Each of the 60 tasks carries its writing hint and Chinese alias so lookup and the writer accept line use them.
Co-authored-by: Cursor <cursoragent@cursor.com>
Listed tasks still get a regulatory step when complexity is unset or high. Medium and low skip it, and the squad model now comes from SQUAD_MODEL_ID or MINIMAX_MODEL_ID instead of a fixed name.
Co-authored-by: Cursor <cursoragent@cursor.com>
/auth/me was authenticating again after the middleware had already done it, and the session lookup queried user status in a second round trip. Reuse the request principal and join status into the session read so a revoked token still fails on the next request.
Co-authored-by: Cursor <cursoragent@cursor.com>
The login shell was downloading the document engines with the workbench. Those modules now load on click or when a matching block appears, and a failed chunk can be retried without submitting an edit.
Co-authored-by: Cursor <cursoragent@cursor.com>
The branch frontend suite and production build passed. Cross-user document comments still need a Postgres negative because the in-memory authorizer is intentionally open.
Co-authored-by: Cursor <cursoragent@cursor.com>
The human ledger and the document body are different stores. Record the projection intent in the same transaction as the ledger, and clear it only when the body write succeeds so a retry cannot append a second revision.
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop window-cache payloads that lack a schema field. Prove a non-owner listing another user's sessions is forbidden. Correct the stale test schema note in CURRENT.
Co-authored-by: Cursor <cursoragent@cursor.com>
PostgreSQL claim now uses the same next-version rule as MemoryBus, and checkpoints only move forward. A later version cannot be leased while an earlier one is still missing.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep M7, M15, the frontend split, and the red-line features open so the next pass does not treat them as done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Ambiguous consult only redirects on low confidence, and the testing template greets the signed-in user instead of a hardcoded name. Session tokens no longer parse as user id 0. Live chat sessions now evict the oldest entry at a hard cap.
Co-authored-by: Cursor <cursoragent@cursor.com>
Health checks reuse a two-second snapshot and bound the schema query. Task SSE writes an error frame when an event cannot be encoded. ResolveDocTask errors when the frozen plan has no duty row, while explicit none-duties stay zero. Drop the unwired semantic-summary replace env, record the intentional dev versus release model split, document the test/main cutover path, and archive pre-goose SQL.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add nosniff, frame denial, referrer policy, and a self-origin CSP. Clamp human and squad lease TTLs and require author edit rights before a human lease. Include DryRun in replay digests so a dry-run approval cannot authorize apply. Stop Server.Start from swallowing a second Runtime.Start.
Co-authored-by: Cursor <cursoragent@cursor.com>
Capture the read-only check that planned capabilities are wired, while dev is not ready to merge into test until the container is rebuilt and the remaining gates run.
Co-authored-by: Cursor <cursoragent@cursor.com>
Critical/high fixes are already on dev. Record the frontend test report, restore the audit note, and move remaining medium/low items into long-term so they are not treated as release blockers.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Escape KaTeX fallback HTML and salt math/code placeholders per render
- Roll back optimistic unread marks when POST /chat/read fails
- Reset MessageStream scroll baseline when the session changes
- Preview only the first 1000 Excel rows and say so in the sheet header
Co-authored-by: Cursor <cursoragent@cursor.com>
Goose checksums forbid rewriting applied files. Document that 00001-00009
have no down migration and that 00012's unconditional DELETE is demo-only.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Wait for the chat SSE heartbeat goroutine to exit before the handler
returns, so it cannot write a recycled connection
- Extend /tasks/run write deadline to 75m so long sync runs are not cut
by the global 120s WriteTimeout before the response is written
- Reuse an existing task run on the SSE path when the idempotency key
already belongs to the same user/session/project
- Log stale fencing on event ack so unbounded replay is observable
Co-authored-by: Cursor <cursoragent@cursor.com>
- H4: sliding-window rate limiter (10 attempts / 5min per IP+username)
on login and register; successful login resets the counter; pure
stdlib, no new dependency
- H8: docker-compose.test.yml DB/ADMIN passwords now :?required (align
with main); docker-compose.main.yml AUTH_REGISTRATION_ENABLED
defaults to false
- M8: fix FAV_PUBLISHER_ENABLE -> FAV_PUBLISHER_ENABLED typo so the
gate test actually guards the real flag
Co-authored-by: Cursor <cursoragent@cursor.com>
- H1: log legacy test-principal fallback (path/method/remote_addr) via
slog.Warn so silent unauthenticated access is observable
- H2: AddComment/Claim now derive actor ID/Name/Role from the auth
principal and server-side doc duty resolution (resolveDocGovRole),
never from request body; GetDocument/ListComments/ListAuditLogs now
require project membership via requireDocGovDocAccess
- H3: handleGetChatTurn asserts session ownership; handleListChatSessions
and handleGetUserContext reject cross-user user_id (403) and stop
defaulting to user id=1
Co-authored-by: Cursor <cursoragent@cursor.com>
- getOrCreateSession now takes ctx; GetSessionOwnerID/
RestoreSessionContext/CompilePromptGuidance run under
context.WithTimeout(5s) instead of context.Background()
- SyncRecentDialogue's rolling summary uses a 30s timeout context
instead of Background, so client disconnect cancels the LLM call
Co-authored-by: Cursor <cursoragent@cursor.com>
- Add Store.SavePlanWithRevision: single-transaction planning upsert +
revision bump (bump first with optimistic lock, conflict rolls back
before any plan write), closing the SaveWorkflowPlan split-transaction
race where plan content and revision could diverge
- AdvanceStage now takes operatorID and writes completed_by explicitly
instead of SELECT activated_by, so the completing operator is the
actual advancing user, not the original activator
- Service.SaveWorkflowPlan/AdvanceStage pass userID through; memStore
implements SavePlanWithRevision under its single mutex
Co-authored-by: Cursor <cursoragent@cursor.com>
- Session gains mu sync.RWMutex + SnapshotMessages/AppendMessage/
TouchLastAccessed/SetProjectID/Project accessors
- sendMessageInternal, hydrateVisibleHistory, getOrCreateSession,
cleanStaleSessionsLocked, handleChat, handleChatStream,
enrichSessionWorkflowStage, bindSessionDocumentSummaryReader all use
locked accessors instead of raw field access
- ProjectID mutation now goes through SetProjectID (only when changed),
closing the cross-project pollution window in handleChat/handleChatStream
Co-authored-by: Cursor <cursoragent@cursor.com>
- persistLeaseLocked now returns error; AcquireLease rolls back in-memory
lease on DB failure so memory and PG stay consistent
- appendAuditLocked uses request ctx and logs audit INSERT failures
instead of swallowing them with context.Background()
- loadDocumentFromDBLocked now SELECTs lease_fencing_token so fencing
survives process restart
- SaveDocumentContent/RecordDocumentViewed/RecordDocumentEdited/
DecideModificationProposal/SetDocumentWorkDir log persist failures
via slog.Error instead of silent _, _
Co-authored-by: Cursor <cursoragent@cursor.com>
The untracked node_modules tree and the local feature branch are gone.
The remote branch was left in place.
Co-authored-by: Cursor <cursoragent@cursor.com>
Progress tracking now lives in a separate project. Drop the server,
docs, and module-boundary entries without restoring engineering-dashboard.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the unit, live LLM, and SPA walkthrough evidence, and mark the
control-center row done now that engineering-dashboard is superseded.
Co-authored-by: Cursor <cursoragent@cursor.com>
The compose file published 5440 on all interfaces. Match the other
environment databases and listen only on 127.0.0.1.
Co-authored-by: Cursor <cursoragent@cursor.com>
Real highspeed responses wrap reasoning in think tags that contain
brackets, which made the JSON span extractor fail before the array.
Co-authored-by: Cursor <cursoragent@cursor.com>
Gate the merge on unit coverage for the three packages that previously
had none: env precedence, migrate/query, and claim/heartbeat/reap.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep Control Center and drop engineering-dashboard. Resolve CURRENT
claim rows and module-boundaries by removing the superseded dashboard
entry.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prefer error_code when present and route projectMembers/freeformDoc/
taskRuns/chatSessions failures through the shared structured parser.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove the skipped client work_dir resume coverage that targeted a deleted
entry point, and document why the real-PI stop-gate stays redirected to
internal/server to avoid an import cycle.
Co-authored-by: Cursor <cursoragent@cursor.com>
Carry the done checklist and test-report link that lagged the Wave 2
merge tip so Wave 3 starts from a consistent ops state.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pin E-3/E-4/E-6 compose declarations so dead runner config and missing
flag wiring cannot silently regress.
Co-authored-by: Cursor <cursoragent@cursor.com>
Placeholder cursor-agent service is gone; keep CURSOR_API_KEY/MODEL/BIN
for the local cursor-cli subprocess backend.
Co-authored-by: Cursor <cursoragent@cursor.com>
Also declare SEMANTIC_SUMMARY_SHADOW and PI_CHANGE_REPORT_NARRATIVE on
test/main, remove dead CURSOR_RUNNER_URL/cursor-agent, and set main
SEED_DEMO_USERS=false. Defaults stay legacy/false (no behavior change).
Co-authored-by: Cursor <cursoragent@cursor.com>
Close short-term task, mark remediation Wave 1 done, release integration
slot, and record main env=main / schema 52 / modes-off smoke evidence.
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop Env==\"\" as a dev alias; pin compose app/events ENV alignment and
main depends_on events with unit tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
Set app ENV=main (was prod) and require events service_healthy before
app starts so goose migrations finish before app queries new columns.
Co-authored-by: Cursor <cursoragent@cursor.com>
Close short-term task, mark remediation Wave 0 done, release integration
slot, and attach real pi-agent SSE heartbeat log plus suite results.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pass userId on every saveSessionWindowCache write, LRU-evict full cache
keys, and applyRestoredFileRaw so mount restore cannot drop newer deliverables.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive the 2026-09-17 health-check audit/remediation and short-term Wave 0
task so P0 SSE/cache fixes can proceed under mutex chat+web.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record real-PI samples for review and verification templates, mark S1 continued done across writing-spec/backlog/FEATURE-MATRIX/CURRENT.
Co-authored-by: Cursor <cursoragent@cursor.com>
Avoid unique (project_id, instance_no) collisions when saving a new
workflow plan after a completed main instance.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive CAS evidence for workflow.allow_author_only_approval on dev,
mark proposal HTTP audit resolved, and claim the feature branch in CURRENT.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add POST /api/v1/docgov/proposal for ProposeModification, harden decide
status mapping, and replace App pendingProposal local mock with real API calls.
Co-authored-by: Cursor <cursoragent@cursor.com>
- delete cmd/engineering-dashboard, internal/engineeringdashboard, scripts/engineering-dashboard.sh
- archive old design doc to .doc/archive/design/ with deprecation banner
- FEATURE-MATRIX: mark old row removed, add removed to status contract
- system-design README: section 8 now points to Control Center SSOT
Close out document author_only U1–U6 into dev (default policy off).
Resolved CURRENT claim table and bizdev service conflicts with rdev prior-doc injection.
Co-authored-by: Cursor <cursoragent@cursor.com>
Show a single author picker when兼任 is enabled, respect the system
capability flag, and surface author_only docs in activation preview.
Co-authored-by: Cursor <cursoragent@cursor.com>
Align TypeScript types and projectSettingsDuties with backend
ResolveDocTaskDuty so author_only no longer fails as partial.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prove A can run the full action chain and outsiders stay denied; assert
audit Details carry duty_policy on all five transitions.
Co-authored-by: Cursor <cursoragent@cursor.com>
Surface the document duty mode on submit/review/approve transitions for
consistent logs under author_only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use ResolveDocTaskDuty so normalized author-only plans (author ID only)
are treated as full A/A/A for access, stage visibility, and readiness.
Co-authored-by: Cursor <cursoragent@cursor.com>
- internal/controlcenter/importer: scan .doc/ops/{short-term,long-term}
and .doc/backlog for task docs, upsert cc_tasks keyed by slug; maps doc
status/stage, auto-creates the three plans, follows doc status only
while a task is planned/in_progress (terminal statuses never regress),
skips unchanged docs, and resolves cross-directory slug collisions by
fixed directory precedence with a warning
- cmd/control-center: import-docs subcommand (also runs at serve startup
and on the doc-sync ticker) plus the agent CLI: next / instruction /
claim / heartbeat / release / event / artifact / advance-request /
decision / report, thin net/http client, compact JSON output
- console API POST /api/v1/tasks/{id}/export-doc renders a task per
.doc/ops/templates/short-term-task.md into .doc/ops/short-term/, refuses
overwrite (409) and unsafe slugs, then backfills doc_path
- fix pre-existing TestAgentHasNoAdvanceRoute: SPA catch-all GET / makes
the mux answer 405 for unmatched POST paths; accept 404 or 405
- archtest allowlist: controlcenter/importer -> pipeline, store
Add LockDocumentDuty for PG/memory and expose duty_policy on workflow
document summaries for later UI marking.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stamp instance-governed document duties at create time so heal/revoke can
skip locked rows without importing projectinstance.
Co-authored-by: Cursor <cursoragent@cursor.com>
Also record the ad-hoc verification Path("") join pitfall as a low-severity
audit note so future sampling scripts fail closed instead of scanning bizdev/.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record true PI samples (intake + rd_design_input_spec), update FEATURE-MATRIX
remaining work, backlog S1续批/S2/S3, and allowlist engineeringdashboard for
archtest green on this branch lineage.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prefer AgentSpec.InstructionsFile when building AGENTS.md so rd_* leader
steps no longer fall back to business-tone leader.md.
Co-authored-by: Cursor <cursoragent@cursor.com>
Seed rdev.v2.json, rd_ templates, catalog policy (order 40), squad
kind orchestration, and hard precheck requiring completed main (CDO).
Includes StageKey dynamicization from P0 and docs for P2–P4 skeleton.
Co-authored-by: Cursor <cursoragent@cursor.com>
Verify resolve/normalize/hash stability, policy gating, stale token
rejection, and HTTP error mapping for the new duty policy path.
Co-authored-by: Cursor <cursoragent@cursor.com>
Return 403/409/503 for disabled, changed, and unavailable governance
policy conditions during plan save and activation.
Co-authored-by: Cursor <cursoragent@cursor.com>
Adapt sysadmin.AuthorOnlyPolicySource at the composition root so
projectinstance stays within module-boundary allowlists.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add ResolveDocTaskDuty, require the system policy on save/preview,
lock the policy row during activation, and derive A/A/A assignments.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prevent preview tokens from activating after the governance switch
revision changes by storing the revision on each confirmation token.
Co-authored-by: Cursor <cursoragent@cursor.com>
Verify concurrent revision conflicts, null/string rejection, plain-user
denials, and PG lock/read paths for the new policy key.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register the workflow total switch, require expected_revision for
updates, and expose AuthorOnlyPolicySource for activation locking.
Co-authored-by: Cursor <cursoragent@cursor.com>
Mark lifecycle boundaries reviewed; require HealProjectDocuments
projection stability across list/generate/member triggers, and
explicitly exclude emergency stop from the global switch scope.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record curl/browser before-after metrics, mark U2 done, and release the
integration slot while leaving U1/U3–U7 open.
Co-authored-by: Cursor <cursoragent@cursor.com>
Serve precompressed .br/.gz with Cache-Control and Vary, and return 404
for missing /assets and /fonts instead of index.html.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use Node zlib in a post-vite step so the Go server can serve negotiated
variants without per-request compression cost.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove blocking Google Fonts stylesheet so the login form is not gated
on an external CSS request; keep unicode-range subsets and OFL license.
Co-authored-by: Cursor <cursoragent@cursor.com>
Capture audit evidence, performance baseline, and U1–U7 remediation plan
without business code changes so the work can land on dev before U2.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove the inline token script blocked by script-src 'self', so the
live page no longer calls the snapshot API with token=undefined.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add test report, FEATURE-MATRIX row, archive the short-term task,
mark CURRENT claim done, and ship the thin serve/export script.
Co-authored-by: Cursor <cursoragent@cursor.com>
Merge docs/git/runtime facts into an immutable snapshot with conflict
retention, last-known stale handling, and acceptance-sample coverage.
Co-authored-by: Cursor <cursoragent@cursor.com>
- top-level view switch workbench|admin in App.tsx (no router; hash #turn
anchors untouched)
- new admin/console/AdminConsoleView with left group nav in the existing
token/inline-style idiom, plus 8 self-fetching sections: overview, kb,
features, settings, workflows, roles, users, docs
- absorb the six AdminSettingsModal tabs into sections and delete the modal
- new api/systemAdmin.ts + types for /api/v1/admin/system/* endpoints
- playwright smoke spec web/e2e/admin-console.spec.ts (skip by default)
- new internal/sysadmin package (overview/kb/features/settings) with small
port interfaces; business packages stay unaware of sysadmin
- new routes /api/v1/admin/system/{overview,kb,features,settings} guarded
by requireSystemAdmin
- goose 00049: system_settings table (key/jsonb value, updated_by/at)
- SettingSpec whitelist registry with DB > env > default precedence
- register sysadmin in module-boundaries.yaml (archtest rules)
Register CURRENT mutex and mark short-term in_progress on the
feature/engineering-dashboard worktree before coding.
Co-authored-by: Cursor <cursoragent@cursor.com>
Freeze the independent local readonly engineering-dashboard design,
short-term task entry, and system-design index before implementation.
Co-authored-by: Cursor <cursoragent@cursor.com>
Optional reviewer/approver duties leave UserID=0; writing 0 into
document_records FK columns failed with SQLSTATE 23503. Align create
path with docduty nullIfZero and surface ensureUser failures in logs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Software projects mount only bootstrap/delivery keys and skip the medical
seven-template clone. SWBOOT-10 stays a fail-closed stub.
Co-authored-by: Cursor <cursoragent@cursor.com>
Rules that already split skip the LLM. Independent flags stay off by
default and do not raise MULTI_INTENT_PLAN_TIER.
Co-authored-by: Cursor <cursoragent@cursor.com>
Flag-on CreateAgentCandidate asks the product PI runner for
change_report_narrative_v1 after the real digest is known; timeout
and malformed payloads stay full fallback. Default flag remains off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Enable SEMANTIC_SUMMARY_SHADOW to call the product PI runner on authorized messages only, keep REPLACE unwired, and record MiniMax evidence for the D3 matrix close.
Co-authored-by: Cursor <cursoragent@cursor.com>
Library must not abort the process; E2E callers use EnsureOnline/t.Fatal
so ambient RUN_PI_E2E no longer kills short server tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop using a fake default KB password; merge Compose-style env files and
rewrite compose DNS to localhost on the host so go test/E2E authenticate.
Co-authored-by: Cursor <cursoragent@cursor.com>
FAV U7 stub package was missing from module-boundaries imports map,
breaking go test -short smoke after W1 merge.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive green receipt 6e2476f0, raise FEATURE-MATRIX CI/E2E to done,
and mark short-term/CURRENT W1 complete.
Co-authored-by: Cursor <cursoragent@cursor.com>
Organizer still prompts for fields.json, but missing it must not fail
closed as MISSING_TARGET when output.md is present (FullNone flake).
Co-authored-by: Cursor <cursoragent@cursor.com>
configs/.env.dev omits KB_DB_PASSWORD so Load kept the default
shared_kb_secret_pass; fall back to root .env so research can use KB.
Co-authored-by: Cursor <cursoragent@cursor.com>
Two 00048 files made goose panic on CollectMigrations, blocking all
TEST_DATABASE_URL PG suites including FullNone and nightly.
Co-authored-by: Cursor <cursoragent@cursor.com>
Confirm D7 retention draft ADR, confirm-tier gate, REPLACE default-off,
and FAV live order with observation windows; sync CURRENT and short-term.
Co-authored-by: Cursor <cursoragent@cursor.com>
Gate on RUN_UI_ACCEPTANCE=1; seed awaiting PG plan via SQL without raising
MULTI_INTENT_PLAN_TIER; assert one confirm wins and reload/relogin match PG.
Co-authored-by: Cursor <cursoragent@cursor.com>
Load GET /intent-plans/active into a live card on session restore, use a
unique decision nonce per confirm click, and keep an empty-docAST fallback
so login still renders when demo seeds are off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Update catalog size expectations to five workflows and archive the
unit-test report; sync FEATURE-MATRIX and task docs without merging to
dev.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register dry-run adapters via BuildOwnerMux when independent flags are on;
U9 stub fail-closes on malformed/timeout/out-of-bounds without raising PlanTier.
Co-authored-by: Cursor <cursoragent@cursor.com>
Subscriber remains OFF until separate approval; document remaining FAV
port inventory and claim feature/fav-u7-publisher.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep durable fav unregistered and fail-closed; CLI only prints status and
remaining-port inventory without destructive backfill/recover commands.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expose GET /api/v1/vault/status and only wire in-process Drain when
FAV_PUBLISHER_ENABLED is explicitly true; degraded read stays off by default.
Co-authored-by: Cursor <cursoragent@cursor.com>
Panel and view-model label server risk/lineage separately from PI narrative;
add change_report_narrative_v1 helper aligned with typed-result patterns.
Co-authored-by: Cursor <cursoragent@cursor.com>
Introduce PI_CHANGE_REPORT_NARRATIVE (default off). When on, consume typed
narrative bound to input digest only; malformed/timeout paths fully fall back
without mixing fields or lowering server risk.
Co-authored-by: Cursor <cursoragent@cursor.com>
GenerateRollingSummary filters to authorized-visible messages; digest API
exposes shadow/freshness without enabling REPLACE.
Co-authored-by: Cursor <cursoragent@cursor.com>
Shadow evaluates a no-tool summarizer on caller-supplied messages; served
narrative stays deterministic and REPLACE remains unwired.
Co-authored-by: Cursor <cursoragent@cursor.com>
Freeze selectable workflow keys, domain/compliance separation, solo policy,
and SWBOOT-10 fail-closed stub contract without touching medical three.
Co-authored-by: Cursor <cursoragent@cursor.com>
Point Nightly Real PI at runs-on: nightly (host network) so the local
act_runner can reach host PI :18865 and isolated PG :5434.
Co-authored-by: Cursor <cursoragent@cursor.com>
Retry U8 product quality flakes once in nightly; formalize Playwright
dual-tab as long-term gated; closeout handoff and DoD notes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record no-go decisions and independent long-term task contracts; do not
implement or raise MULTI_INTENT tier.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record classified nightly outcome for 67d7335 with image digests and
gate rejection evidence; does not claim product suite green.
Co-authored-by: Cursor <cursoragent@cursor.com>
Smoke passed on merge; record N7 product-fail classification evidence
from the in-flight nightly suite without claiming same-image promotion.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record gate fixtures and infra negative evidence; mark Artifact row
partial for same-commit/digest traceability without same-image claim.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add schedule/dispatch nightly entry that classifies infra vs product
failures, and require a valid receipt (or waiver) before promote/release.
Co-authored-by: Cursor <cursoragent@cursor.com>
Nightly and promote gates need auditable pass/product_fail/infra_fail
receipts under test-reports assets, plus timed owner waivers.
Co-authored-by: Cursor <cursoragent@cursor.com>
Close FEATURE-MATRIX evidence gaps for multi-intent U8 and workflow
full/none; release the integration slot after live PASS.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace the U8 stop-gate with a PG+PI confirm/generate harness and add a
mixed-duty governance long chain covering cross-user approve and none
non-blocking advance.
Co-authored-by: Cursor <cursoragent@cursor.com>
Normalize empty TEXT[] binds, isolate step-changed aggregates from plan
revision uniqueness, propagate AdvanceEligible errors, and emit
taskrun.completed to the registered notify consumer so finalize no longer
rolls back live receipts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Boot memory IAM only via explicit test env opt-in; strict auth cases
disable AllowInMemory after startup.
Co-authored-by: Cursor <cursoragent@cursor.com>
Refuse MemoryStore fallback for main/empty/unknown env or missing
ALLOW_IN_MEMORY so production cannot silently use in-memory authority.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register newTestServer cleanup and Shutdown WaitIdle so race detector
no longer hits RemoveAll on a live DataDir.
Co-authored-by: Cursor <cursoragent@cursor.com>
Align capability maturity with frozen boundaries, record IAM readonly PASS
without flipping production_ready, and leave Wave 1+ for fail-closed code.
Co-authored-by: Cursor <cursoragent@cursor.com>
Rewrite the promote report so each Wave case records input, system
output, analysis, and evaluation against FEATURE-MATRIX evidence.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record Wave 1–4 evidence, fix FEATURE-MATRIX schema-47 note, harden
promote-to-test against origin rebase, and mark infra task done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Automated short/module/governance-PG outputs plus live :8080 smoke and
PI typed-result sample for promote gate.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use shared DATA_DIR permissions (umask/chmod) and drop obsolete sync
notify asserts so governance PG PI chains can complete on MiniMax runner.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add duty holders as project members, drop sync notification assert
after outbox cutover, and add an explicit CI governance PG step.
Co-authored-by: Cursor <cursoragent@cursor.com>
Dev already applied 00046 (projects only) before session retirement
was folded into that file; 00047 closes the gap idempotently.
Co-authored-by: Cursor <cursoragent@cursor.com>
Extend unapplied migration to mark 6001–6010 sessions demo_retired
and filter them (and retired projects) out of ListChatSessions.
Co-authored-by: Cursor <cursoragent@cursor.com>
Vitest-style suite was caught by tsx --test and broke npm test.
Align with storage.test.ts and narrow vitest include to chat suites.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record systemic audit, wave plan status, gap-matrix blockers, and unit/
bundle scan results for the demo-data pollution fix.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require ResolveBackendInEnv to deny stub (and empty stub fallback) when
env is main/prod so production cannot request simulated agent output.
Co-authored-by: Cursor <cursoragent@cursor.com>
Mark projects 6001–6010 as demo_retired and exclude them from default
project list queries so demo seeds no longer pollute real workspaces.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop shipping hard-coded demo docs/projects into production builds,
drop local mock items on authoritative empty server lists, and purge
stale demo seed residue from localStorage on boot.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist ComboNeedsConfirm plans at confirm tier without executing writes, then run task.run via OwnerMux and a stable idempotency key.
Co-authored-by: Cursor <cursoragent@cursor.com>
Principal comes from the session and query scope; body identifiers are ignored and admins cannot skip membership.
Co-authored-by: Cursor <cursoragent@cursor.com>
Confirmation stays a command receipt; FakeActionOwner now fail-closes on revoke and resource version drift.
Co-authored-by: Cursor <cursoragent@cursor.com>
Append awaiting/step/completed envelopes in the command UoW and project them without changing dispatcher leases.
Co-authored-by: Cursor <cursoragent@cursor.com>
Generate 2–4 step L1 proposals with stable digests while leaving TopIntent and the legacy IntentPlan router unchanged.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep write combos and internal-chain summaries on the current TopIntent path so U2 shadow proposals cannot silently change production.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register the independent U2 short-term on the intent mutex so shadow proposals can land without touching production routing.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive the arch/parity/short evidence and mark the U1 claim done so U2 can take the intent mutex next.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add the app/intentflow skeleton so HITL state, error codes, REST shapes, and BatchActionPolicy live outside intent and default to the legacy tier.
Co-authored-by: Cursor <cursoragent@cursor.com>
Freeze the three fact events, intentflow allowlist, and plan table ownership so later units cannot invent producers or write paths outside app/intentflow.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register the independent U1 short-term, checklist, and CURRENT mutex so architecture-docs and events stay serial while contracts land.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive the shared-live short-term, refresh CURRENT foci, and check in the reviewed multi-intent design so it no longer sits uncommitted on dev.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remote /v1/run now emits additive result_v1; Go validates run_id, digest, and paths before materializing, and only accepts missing typed payloads with an explicit legacy handshake.
Co-authored-by: Cursor <cursoragent@cursor.com>
Public errors now emit code, safe message, and request_id while keeping the legacy error field. Raw SQL, paths, tokens, and XSS payloads are stripped; the frontend branches on code instead of substring matching.
Co-authored-by: Cursor <cursoragent@cursor.com>
Durable notify/advance/projection are live on shared dev, so composition roots must not assign OnOutbox or AddOnApprovedHook. Bind helpers remain for tests and a rollback window.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add ValidateOpsCutover, eventmode CLI, and a host script that pin agent_system_dev and refuse FAV plus test/main before any cluster mode write.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive completed Track E/S short-terms, record HTTP/PI compatibility matrices, and defer shared live plus protocol implementation to long-term tasks.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pending-action task runs now use stageflow request aliases and Server ports, so chat no longer reaches through the orchestration root.
Co-authored-by: Cursor <cursoragent@cursor.com>
Composition roots already hold Snapshot ports; the interface and archtest now forbid putting Pool/DocGov/DocRevision/ContextManager/CAS/ProjectWorkflow/FreeformDoc/KB back on Service.
Co-authored-by: Cursor <cursoragent@cursor.com>
Coordinator now takes a StageTaskRunner and injected context/KB ports.
Chatflow assembler reads maturity tokens instead of the orchestration root.
Co-authored-by: Cursor <cursoragent@cursor.com>
Intent only needed the three official stage tokens. Moving them to a
leaf package lets the recognizer compile without the orchestration root.
Co-authored-by: Cursor <cursoragent@cursor.com>
docgov saves content hashes through the new leaf module so it no longer
imports docrevision. Existing docrevision exports stay as thin wrappers.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep OnOutbox and approval hooks registered while dispatcher mode is
off, but no-op them as soon as the matching durable consumer owns the
visible write so a later switch cannot dual-write.
Co-authored-by: Cursor <cursoragent@cursor.com>
HTTP Runtime does not start the worker. Each compose environment gets its own events service, health port, and bounded pool.
Co-authored-by: Cursor <cursoragent@cursor.com>
Workers claim with SKIP LOCKED, heartbeat by token, and ack/fail only when the fencing token still matches. Shadow scans without acking live deliveries.
Co-authored-by: Cursor <cursoragent@cursor.com>
E0B needs an additive lease audit trail and a cluster-level off/shadow/live table before any worker can claim. FAV remains constrained to off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive isolated-PG evidence, 7-day read-only inventory, and the decision to bootstrap consumers from the first safe event instead of gap-waiting.
Co-authored-by: Cursor <cursoragent@cursor.com>
HTTP adapters now reuse the composition-root instance. Candidate-ready, downstream impact, and approved envelopes share the domain unit of work, and missing env/project fail closed without defaulting to dev/0.
Co-authored-by: Cursor <cursoragent@cursor.com>
Reject empty environment/project, disable FAV consumers at register time, and keep historical classification/repair/replay as audited application use cases with no raw SQL entrypoint.
Co-authored-by: Cursor <cursoragent@cursor.com>
E0A needs additive tables for classification and per-consumer identities before any dispatcher can claim work. FAV principals are rejected at the schema check.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move the reviewed durable-event, HTTP envelope, and PI typed-result
designs off the docs/ prefix so Track E can start from latest dev.
Co-authored-by: Cursor <cursoragent@cursor.com>
Local merged side branches and their worktrees are gone; FAV/herdr/diagnosis/old-linear stay unmerged on purpose.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record project 6275 PI 409 DOC_BUSY plus Docker screenshots, mark CHAT-INTENT-STATE PASS, and archive the short-term so CURRENT has no in_progress rows.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record schema 38 health/ready plus the new agent-dev-app digest, then mark the composition-root slice done so intent dual-tab can take the idle slot.
Co-authored-by: Cursor <cursoragent@cursor.com>
Contract tests, target-package race, and arch-check --mode block passed; merge to dev still needs the integration slot rebuild.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move construction and document OnOutbox out of server, give HTTP/CLI a shared task use case, and block already-cleared import/event arch rules.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive the finished chat mutex tasks, attach PI idle-chat refresh same-set evidence for project 6252, and stop expansion after in-place ports without a package split.
Co-authored-by: Cursor <cursoragent@cursor.com>
Ignore request user_id as identity, authorize from the session Principal, and hydrate restore/memory from the same visible set so HTTP, SSE, and prompt assembly cannot amplify hidden messages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep ctxmgr as table owner and filter the authorized visible set in-process so window, stats, restore, digest, and prompt assembly share one Principal-scoped collection without a package move.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use an isolated dual-pool database so idempotent finalize, cancel CAS, commit-fail SSE, and receipt-gated cleanup are proven without a process mutex.
Co-authored-by: Cursor <cursoragent@cursor.com>
Hash deliverables through Capability.ReadArtifact, resolve backends on the server, and refuse workspace removal until frozen members match FAV receipts.
Co-authored-by: Cursor <cursoragent@cursor.com>
CAS the unique terminal status with the assistant turn, frozen manifest, envelope and FAV staging, and join ctxmgr writes through the same UoW instead of a process mutex.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist typed RunManifest bytes and SHA per run, and allow a finalizing status so U8 can freeze a unique terminal without sharing env databases.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register feature/taskrun-runmanifest on the taskrun mutex so U8 can start without occupying chat/intent or writing U9–U12.
Co-authored-by: Cursor <cursoragent@cursor.com>
U5–U7 passed isolation-db, race, goose Down, and schema-36 rebuild. The report last sentence is 继续 M3; the integration slot is idle.
Co-authored-by: Cursor <cursoragent@cursor.com>
Goose 00036 is a renumbered copy of the vault tables. Degraded read stays off by default and only runs after authorization; tombstones and unpublished artifacts fail closed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Agent commits append a validated envelope inside the command unit of work. SKIP LOCKED is only used to claim, and stale fencing plus integrity failures go to quarantine or dead-letter.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cross-module callers get an opaque ref plus rotating lease tokens so stale writers fail closed, and file I/O is refused inside a unit of work.
Co-authored-by: Cursor <cursoragent@cursor.com>
Rebuild, real PI, browser reload, and two-pool sessions all passed, so
the live report's last sentence is 继续 M2 and the integration slot is idle.
Co-authored-by: Cursor <cursoragent@cursor.com>
Create-project candidates come from the in-session user directory, so a
fresh admin page never saw B/C unless the console refresh ran first.
Co-authored-by: Cursor <cursoragent@cursor.com>
Live M1 sign-off needs browser proof that missing projection is not 404,
outsiders share DOCUMENT_NOT_FOUND, and a real PI compile survives reload.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cross-pool idempotency is same key plus same digest; a stale in-memory
head from the seeder hid the one-winner four-session lock.
Co-authored-by: Cursor <cursoragent@cursor.com>
Occupy the integration slot for M1 live sign-off, cover two pgx pools plus four sessions, and add a Playwright spec that treats projection consistency as 200 rather than 404.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep the short and isolated PostgreSQL/race outputs next to the stop-the-line report so the unsigned PI/browser/rebuild columns stay auditable.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unit, isolated PostgreSQL, and target-package race passed, but real PI, browser, and rebuild were not signed, so the report concludes 停止扩面 and keeps U5–U12 closed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Concurrent HumanEdit/Approve used to assign the default authorizer on the shared Commands value, which raced under -race. Read a local authorizer instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
Authorize first, then return immutable ledger markdown with typed consistency so a missing or drifted projection is no longer a 404/409. GET stays read-only and FAV degraded read stays off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Lock the document row and re-authorize duty before edit, agent commit, approve, or reject share a single transaction. Characterization tests pin ETag races, one legal approve/reject terminal, and same-key digest conflicts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Give each document command one postgres transaction and only let table owners unwrap the scope, so cross-owner writes can roll back together.
Co-authored-by: Cursor <cursoragent@cursor.com>
Capture the replayable import/sql/path/event counts and the owned exceptions that later milestones must shrink.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace whole-repo grep with four production-only gates so Goose and tests stop looking like writer debt, and so new SQL, path, or event crossings fail immediately.
Co-authored-by: Cursor <cursoragent@cursor.com>
Land the revised modular-monolith scheme on the implementation branch so U1–U4 can proceed against a frozen design, and register the docgov mutex without occupying the integration slot.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the real-page and API matrix, release the workflow mutex, and point FEATURE-MATRIX / gap-matrix at the report.
Co-authored-by: Cursor <cursoragent@cursor.com>
Avoid matching the blocked-run hint when opening settings, and close leftover modals before project 143.
Co-authored-by: Cursor <cursoragent@cursor.com>
G5 starts merging and smoke on the shared dev stack; Playwright matrix
is ready for the real page pass after rebuild.
Co-authored-by: Cursor <cursoragent@cursor.com>
Read-only dev query shows 83 planning rows with a leftover key; all are
paired PROJ_MGR/TEST_PROJ fixtures, none are live business projects.
Co-authored-by: Cursor <cursoragent@cursor.com>
Hide submit/review/approve on none docs, surface the blocked-run hint in
chat, and warn that unmanaged duties cannot be added after activation.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pin unmanaged-doc button visibility and treat blocked_pending_governance
as a governance hint, not a successful generation.
Co-authored-by: Cursor <cursoragent@cursor.com>
Validate the catalog key only and stop writing lifecycle=active so
activation stays on the settings DutyMode path.
Co-authored-by: Cursor <cursoragent@cursor.com>
Creating with initial_workflow_key must stay in planning with an empty
active key while the catalog still mounts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep 202 for unactivated document runs, persist blocked_pending_governance,
and refuse submit/review/approve/edit until a live workflow exists.
Co-authored-by: Cursor <cursoragent@cursor.com>
Route run/edit/submit/review/approve to a single duty, drop full-doc
creator bypass, and keep view listing independent of stage narrowing.
Co-authored-by: Cursor <cursoragent@cursor.com>
Lock the full/none/pre-activation matrix so creator no longer implies
document-task privilege and unactivated runs stay WORKFLOW_NOT_ACTIVATED.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wave 5 is on local dev@19f6df5; claim the workflow mutex and
register the implementation worktree for G1–G5.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the real UI matrix, release the integration slot, and leave
the unrun PI generation/approval path as an explicit residual.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wait for the workflow select step before clicking next, scope duty
dropdowns by role, and finish first-login reset so dual-tab and
member checks reach the real frozen UI.
Co-authored-by: Cursor <cursoragent@cursor.com>
Hard refresh wiped cache/ready after a successful hydrate, then the
unchanged fingerprint never re-ran the effect. Invalidate only via a
planner that preserves list-sync hits and re-hydrates after post-task drops.
Co-authored-by: Cursor <cursoragent@cursor.com>
Login-seeded doc-001 is not server-backed; align shouldLoad with
revisionToolbarMountMode so content and revision-state are never requested.
Co-authored-by: Cursor <cursoragent@cursor.com>
Live apply now accepts only :5433/agent_system_dev plus a data/dev
host root, maps stored work dirs fail-closed, and reports unique
O_EXCL backups after a parent-directory fsync.
Co-authored-by: Cursor <cursoragent@cursor.com>
Apply now writes the destructive old head markdown beside the original
file, refuses to clobber existing backups, and fsyncs the parent
directory after the atomic persist.
Co-authored-by: Cursor <cursoragent@cursor.com>
W7 must live-apply project 143 before UI acceptance. Isolated
TEST_DATABASE_URL was unavailable; shared env databases were not used.
Co-authored-by: Cursor <cursoragent@cursor.com>
Default still refuses shared DSN/paths. Apply to dev requires --live,
--environment dev, a single --doc-id, and confirm REPAIR_SINGLE_DEV_DOC.
Co-authored-by: Cursor <cursoragent@cursor.com>
migration_repair is not a human revision. HashUpdater now loads from DB
and retries still sync. Content reads return a structured drift conflict
instead of the destructive old head.
Co-authored-by: Cursor <cursoragent@cursor.com>
00028 check constraints would reject a real PG apply. Add goose 00032
with Up/Down so repair snapshots can persist.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move done DOCREV short-terms, checklists, and handoffs into archive/ops and retarget relative links after Round20 close-out.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record top-level screenshots as 20 main/pre plus 1 post, and the full-package race as FAIL 109.279s instead of a cached ok line.
Co-authored-by: Cursor <cursoragent@cursor.com>
Rename the close-out branch to feature/*, record 20 screenshots, and state rebuild-then-app-restart so the environment notes match Round20.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the official Playwright headless pass for project 6159 and release the runtime integration slot without claiming the whole system production-ready.
Co-authored-by: Cursor <cursoragent@cursor.com>
The 6158 field ledger wrote candidate id=175 and report id=175; 250 is the output snapshot, not the candidate.
Co-authored-by: Cursor <cursoragent@cursor.com>
Claim the document-revision mutex and document the 6158 first-generation not-found root cause without calling UI-03 done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Opening a template stored database IDs without advancing nextSnapID, so the next temporary snapshot could overwrite and then delete the real baseline. Adopt helpers now bump every counter and only drop a map entry when it still points at the same object.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record that the second restart already restored V3/r2 and that only the stale UI-06 bodySnippet expectation was wrong.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-13b already made A1 the durable document, but phase-state still expected the UI-06 marker. Record successful saves as the latest snippet, ignore conflict drafts, and write that final value at UI-15-pre without relaxing the restore assertion.
Co-authored-by: Cursor <cursoragent@cursor.com>
Document that main keeps ui-acceptance-results.json and post-restart writes a sibling ledger so the 18-case main book is not overwritten.
Co-authored-by: Cursor <cursoragent@cursor.com>
A successful post-restart recordPass would overwrite the main 18-case ui-acceptance-results.json. Keep that historical name for main and write ui-acceptance-results-post-restart.json after restart, while still sharing phase-state and secrets.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the schema31 strict-mode failure, the banner/entry locator contract, and phase-split Playwright directories. Do not mark UI-15 passed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Page-wide project-name text hits both the top bar and the session rail after restart. Click the complementary exact title, then assert the banner exact name. Split Playwright output and HTML reports by UI_PHASE so post-restart cannot wipe main traces.
Co-authored-by: Cursor <cursoragent@cursor.com>
Note that HealProjectDocuments now shares pg_advisory_xact_lock(project_id) with member writes so an old reviewer cannot be written back.
Co-authored-by: Cursor <cursoragent@cursor.com>
Heal used to resolve and backfill on the pool without the member-write advisory lock, so a stale snapshot of reviewer A could overwrite a committed transfer to B. Lock, resolve, and document updates now share one transaction and the same lock key.
Co-authored-by: Cursor <cursoragent@cursor.com>
Document that lock, holder reads, member writes, and reviewer/approver slot clears share one transaction, with heal after commit.
Co-authored-by: Cursor <cursoragent@cursor.com>
Duty revoke must share the project advisory lock with reading old holders and writing members, so a post-commit service snapshot cannot miss a transfer. Heal still fills the new holder after commit, and sync failure stays ERR_DUTY_SYNC.
Co-authored-by: Cursor <cursoragent@cursor.com>
Sync short-term, checklist, and handoff with remaining 6145 risk and
the isolated PG verification path.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove now reconciles document slots and returns ERR_DUTY_SYNC on
failure. CreateOrGetDocument errors abort the task. The frontend
refreshes workflow docs after add, update, restore, and remove.
Co-authored-by: Cursor <cursoragent@cursor.com>
Empty assigned heal now clears only exited or non-member reviewer/approver
holders and never blanks author. Explicit reconcile uses the pre-update
duty plus a project advisory lock so viewer demotion and transfers are
not left to generic heal.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require TEST_DATABASE_URL and refuse agent_system_dev. Script creates a
throwaway database, runs packages serially, then drops it.
Co-authored-by: Cursor <cursoragent@cursor.com>
Post-create role changes were silently dropping reviewer/approver
because only project_role was persisted.
Co-authored-by: Cursor <cursoragent@cursor.com>
Omit project_role no longer defaults to member. Exclusive duty writes
take an advisory lock and retry conflicts so last-writer wins without
dual reviewers. Author write tests require err==nil.
Co-authored-by: Cursor <cursoragent@cursor.com>
Align document slots to project document_duty even when the wrong ID is
an active member, and fail generate/list instead of returning stale
placeholder duties. Owner author backfill now picks creator, else lowest ID.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep project_role as member/viewer, send document_duty=reviewer for USER_B, and clear the seed 李主管 reviewer so the assigned reviewer is the one that syncs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop inventing reviewer_id=2. Use project document_duty as the authority, heal missing or non-member placeholders, and keep write paths rejected for reviewer and outsiders.
Co-authored-by: Cursor <cursoragent@cursor.com>
Project access roles cannot carry reviewer. Persist a separate exclusive document_duty so later controlled docs can inherit the assigned reviewer.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-13a now proves USER_B is viewer despite UI-01 assigning reviewer; claim a new mutex and document the 6145 ledger gap.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-13a reviewer contract now has 6 unit cases; keep the short-term note aligned without rewriting the already-reviewed fix commit.
Co-authored-by: Cursor <cursoragent@cursor.com>
USER_B is assigned reviewer in UI-01. Accept only role=reviewer on
the duty control, and reject assignable or enabled selects.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-13a treated concatenated select options as the current role.
Assert the control value or badge role for that doc instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-13a stayed on private after upload, so the doc menu had no
doc_proj* entries. Always use the category trigger first, then exact id.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-11 can finish before the waiter sees pending. Treat success terminals
as done, keep upload/correspondence/error checks, and cover both timelines.
Co-authored-by: Cursor <cursoragent@cursor.com>
Promote root output.md only when the runner succeeded, protected parents
were untouched, and the local target is trusted. Restore errors abort
instead of being ignored.
Co-authored-by: Cursor <cursoragent@cursor.com>
Repair TASK.md told the model to edit ../../output.md, so the local
target never appeared and UI-03 stayed quality_failed. Snapshot parent
inputs locally, restore them on containment violations, and promote
only a trusted repair/output.md before revalidate.
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop test-only ETag helpers. App now calls saveControlledBlockEdit,
which PATCHes once on the bound editor docId or fail-closes. Resume
hydrate after a blocked first load, and refuse silent doc switches.
Co-authored-by: Cursor <cursoragent@cursor.com>
Background GET rebuilt markdown AST with Math.random ids and dropped
head_block_map, so save closed the modal without PATCH. Align hydrate
to the ledger map, gate in-flight responses, and fail-closed on stale ids.
Co-authored-by: Cursor <cursoragent@cursor.com>
runner.mjs imports ./settle-policy.mjs but the Dockerfile only copied
runner.mjs, which crashed shuimu-pi-agent-dev on import. COPY the
runtime module and assert every relative import is in the image set.
Co-authored-by: Cursor <cursoragent@cursor.com>
auto_retry_end success=true now drops providerTransient and lastErr so
a later agent_settled can succeed when the in-process retry landed a
real target. A new error after recovery still fails.
Co-authored-by: Cursor <cursoragent@cursor.com>
A this-invocation output.md is preserved and never retried over, but
Success=false stays a step failure so truncated writes cannot pass.
Prior-round residue without a trusted patch is also not success.
Co-authored-by: Cursor <cursoragent@cursor.com>
Fresh step invocation is limited to provider terminated/connection plus
a missing target, or an explicit runner failure. A deliverable already
on disk is accepted and never overwritten.
Co-authored-by: Cursor <cursoragent@cursor.com>
*.md was excluding templates/docs from Docker context, so COPY and
go:embed could not see prelim_design.md at /app. Un-ignore those trees
and assert the smoke image can cat the official file.
Co-authored-by: Cursor <cursoragent@cursor.com>
Separate MiniMax/SDK connection failures from the product gap that
reported process 0 and agent_settled as step success.
Co-authored-by: Cursor <cursoragent@cursor.com>
agent_settled after terminated or auto_retry_end success=false is not a
deliverable. Return retryable for provider transients and keep clean
missing targets permanent.
Co-authored-by: Cursor <cursoragent@cursor.com>
runOneStep re-executes the backend at most once when the first attempt
is a settled failure or missing target after provider errors, records
each attempt honestly, and fail-closes after the bound.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat process-0 plus terminated/Connection error/auto_retry_end as a
provider transient. Permanent missing deliverables stay fail-closed and
are never reconstructed from truncated write arguments.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the missing-output.md failure, embed/path-mapping tradeoffs, and CURRENT mutex without marking the task done.
Co-authored-by: Cursor <cursoragent@cursor.com>
agent_settled after exhausted retries is not success; missing or empty target files must return ok:false instead of an empty patch list.
Co-authored-by: Cursor <cursoragent@cursor.com>
Normalize absolute, ./, and duplicated step prefixes onto output.md, and fail closed when the runner reports ok without a non-empty deliverable.
Co-authored-by: Cursor <cursoragent@cursor.com>
App images have no templates/ checkout, so GetDocTemplate fell back to a two-section stub and prelim_design lost its real contract.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep the routing/lease task in_progress and document why the second-doc locator must use the registered doc id.
Co-authored-by: Cursor <cursoragent@cursor.com>
Card title is 系统初步设计方案, not 系统设计输入; select doc_proj*_prelim_design so the template slot cannot be mistaken for the generated document.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the tenth-round routing/lease failure, request-scoped release tradeoff, and CURRENT claim without marking the task done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Arm tasks/runs waiter before send and assert HTTP 202 so a sync DOC_BUSY completed turn cannot pass as a new document run.
Co-authored-by: Cursor <cursoragent@cursor.com>
Explicit aliases (including 系统设计输入) must win before keyword fallback so UI-11 does not route to intake.
Co-authored-by: Cursor <cursoragent@cursor.com>
Link the archived ninth-round mid-transition failure; do not mark
the task done before a real UI rerun.
Co-authored-by: Cursor <cursoragent@cursor.com>
Poll pane document-block computed styles until two frames match.
Pure requires transparent background and box-shadow none; manual/all
require a real overlay mark without hard-coded theme colors.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-07 reads every active-pane document-block after the real overlay
fetch. Pure must stay unmarked; manual/all may share amber on the
same human hunk. UI-10 waits for history to auto-close.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-06/13b click 保存修改 only inside 编辑受控块; UI-13a asserts
the dialog is absent instead of a page-wide /保存/ match.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expose role=dialog and a stable aria-label so save can be scoped
without changing the modal's visuals or save behavior.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-06 and UI-13b reuse the pane-scoped helper; stop clicking overlay
or native heading/paragraph tags that the renderer does not emit.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add data-testid=document-block plus block id on every wrapper so
pure-mode editors stay addressable without changing visuals.
Co-authored-by: Cursor <cursoragent@cursor.com>
Mark server summaries dutiesAuthoritative so id 0 stays fail-closed
viewer instead of matching names like a legacy local document.
Co-authored-by: Cursor <cursoragent@cursor.com>
Reject revision-state network/5xx and missing ledger on controlled
hydrate; never PATCH 0:0 unless the document is freeform.
Co-authored-by: Cursor <cursoragent@cursor.com>
Document the privilege-escalation and silent-overwrite hazards; keep
the reject-routing task in_progress pending real UI rerun.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require matching r/etag on both windows and keep A2's editor filled
before A1 saves so the conflict is a real race.
Co-authored-by: Cursor <cursoragent@cursor.com>
Retain ledger author/reviewer/approver, fail-closed unknown users to
viewer, and send the opened revision ETag instead of a fresh GET.
Co-authored-by: Cursor <cursoragent@cursor.com>
ListWorkflowDocumentsByProject now projects author/reviewer/approver
id+name so clients cannot invent the current user as author.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-05b has not reached reject yet, so pending-flow cannot be done; move it to pending-report-ui so reject-routing can keep document-revision-runtime-ui.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require 当前受控文档 deixis plus tasks/runs task_key/doc_id checks so reject stays on intake; compare inside 版本历史, hide the project from non-member C, and split UI-13 into reviewer-readonly plus dual-author conflict.
Co-authored-by: Cursor <cursoragent@cursor.com>
UI-04 must close via the dialog 关闭 button; UI-05a/05b must click 待确认报告 and assert panel actions so leftover first-round reports cannot hide the decision path.
Co-authored-by: Cursor <cursoragent@cursor.com>
Reject 待续 status-cell exemptions unless the same contiguous table has a header immediately followed by a valid separator and the data row width matches the header.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat structured 阶段/状态/进度 cells as workflow state, not hedging, while still failing body, lists, and non-status columns.
Co-authored-by: Cursor <cursoragent@cursor.com>
When the user refers to the current document, keep task_key/doc_id on the selected registered doc_proj instead of rerouting by domain keywords.
Co-authored-by: Cursor <cursoragent@cursor.com>
Return existing task run 202 for the same turn before scope/preflight so
SSE disconnect retries do not hit DOC_BUSY or duplicate chat. Extend
task-run events write deadlines with heartbeats without dropping global
HTTP WriteTimeout. Reconnect subscribeTaskRunEvents on EOF via after_seq.
Co-authored-by: Cursor <cursoragent@cursor.com>
Chip assert after setInputFiles, wait POST /freeform-documents 2xx on
send, then pin doc-free pane id and drain this-turn assistant before
leaving UI-11.
Co-authored-by: Cursor <cursoragent@cursor.com>
Only completed/pending_author_confirmation pass waitForSquadCompletion;
category trigger/data-category for private open; UI-11/16 pin exact
doc-free id without global attachment text clicks.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add doc-selector-trigger / active-document-pane data attrs; resolve
assistant via virtualizer data-index siblings; UI-02/03 and open-by-id
helpers stop relying on global text or first dropdown-trigger.
Co-authored-by: Cursor <cursoragent@cursor.com>
Never-activated projects were allowed by access ABAC but rejected with
TASK_SCOPE_UNRESOLVED 409; use GetGoverningInstanceForAccess so nil maps to
ScopePreActivation, live to stage scope, and closed stays unresolved.
Co-authored-by: Cursor <cursoragent@cursor.com>
React state bootstrapId could be read as null by two concurrent confirms;
use a sync in-flight ref plus submitting UI so create runs once and member
retry stays serial/idempotent.
Co-authored-by: Cursor <cursoragent@cursor.com>
Create Project no longer treats local member lists as success: non-creator
initialMembers are upserted via the authorized members API, with bootstrap
project id retained for idempotent retry when persistence partially fails.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unrestricted stage access on projects without a live workflow must not
let arbitrary authenticated users join by project_id. Enforce member or
creator (admin per existing policy) before stage ABAC, and reject chat
streams with JSON 403 before SSE headers/flush.
Co-authored-by: Cursor <cursoragent@cursor.com>
GetLiveInstance remains active-only; access ABAC now uses
GetGoverningInstanceForAccess so completed/terminated PG rows are not
treated as unrestricted legacy projects, while brand-new projects without
instances stay open for creators.
Co-authored-by: Cursor <cursoragent@cursor.com>
AdminSettingsModal previously left onRefreshUsers as a dead prop, so newly
created users never reached App allUsers/localStorage and Create Project
member candidates stayed stale (UI-01). Wire syncAdminUserDirectories,
surface refresh errors, and document the residual cross-device directory gap.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add audit note and cross-link short-term/checklist/CURRENT for the
admin entry regression found in real browser acceptance.
Co-authored-by: Cursor <cursoragent@cursor.com>
Return the UpdateUserRole error instead of silently continuing when an
admin approves a user with an explicit role_id.
Co-authored-by: Cursor <cursoragent@cursor.com>
Do not ignore role promotion errors when ensuring the configured admin
account holds role-admin; cover success and failure with unit tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
Normalize role_id/employee_id/must_change_password/created_at into
camelCase for login, me, and admin user mutations so admin UI gates work.
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop the hardcoded admin password fallback so secrets never ship in the
spec; missing ADMIN_USERNAME/ADMIN_PASSWORD fails the suite explicitly.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record client_key create path and no-orphan send contract on the
document-revision-runtime short-term task.
Co-authored-by: Cursor <cursoragent@cursor.com>
Match only hyphenated doc-p template paths, reset logs after login, and
expect registered uploads to use server doc-free ledgers.
Co-authored-by: Cursor <cursoragent@cursor.com>
Make InputArea/onSendMessage async; fail closed with an explicit UI error
when createFreeformDoc fails, and persist fileStore under server doc-free IDs.
Co-authored-by: Cursor <cursoragent@cursor.com>
Authorize project members, reject direct project_shared creates, and
cover idempotent client_key plus revision-state after register.
Co-authored-by: Cursor <cursoragent@cursor.com>
Support direct freeform create for upload fact-source registration while
keeping source_content_sha256 as a content fingerprint only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist owner-scoped client_key on freeform_documents so upload create
can retry safely without inventing local doc-upload orphans.
Co-authored-by: Cursor <cursoragent@cursor.com>
Skip revision-state for template-only and legacy local mocks; show a
non-error preview hint instead of 「账本未就绪」. Keep generated controlled
and server freeform on the toolbar; leave IndexedDB upload orphans unmounted.
Co-authored-by: Cursor <cursoragent@cursor.com>
Do not expose a production path that mutates only the in-memory proposal
index. Cover decision idempotency via ProposeModification+Decide and the
existing package MarkProposalApplied tests instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
Point the UI checklist at the committed runtime spec and config instead of
a deferred plan-only placeholder.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record MarkProposalApplied ordering, CommitAgentVersion retry contract,
and the UI acceptance skeleton paths on the short-term task.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add @playwright/test, headless config, and document-revision-runtime specs
gated by RUN_UI_ACCEPTANCE without mocks, routes, or API/DB fixtures.
Co-authored-by: Cursor <cursoragent@cursor.com>
Surface a same-decision retry hint and cover commit-then-MarkProposalApplied
compensation via PutChangeProposal when the proposal index was missing.
Co-authored-by: Cursor <cursoragent@cursor.com>
When a candidate is already committed, matching expected hashes return the
current revision state so projection and MarkProposalApplied can finish;
reject on an already-committed candidate stays an error.
Co-authored-by: Cursor <cursoragent@cursor.com>
Write applied status to Postgres before mutating memory so a failed UPDATE
cannot leave a false in-memory applied state; treat already-applied as
idempotent success and expose PutChangeProposal for compensation seeding.
Co-authored-by: Cursor <cursoragent@cursor.com>
History refresh now preserves awaiting-author status and shows a visible
待编制人确认 label; live done path reads run terminal status before paint.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stage chain now stops on high-risk candidates; full-link mirrors the
product path of confirm + re-run until success or DocGov proposal intercept.
Co-authored-by: Cursor <cursoragent@cursor.com>
PendingAgentCandidateID must not continue the stage loop or inject
unconfirmed MarkdownBody/ExtractedData as PriorDoc. Return explicit
awaiting-confirmation status; user re-runs the stage after deciding.
Co-authored-by: Cursor <cursoragent@cursor.com>
Sync coordinator and async CompletionSummary use pending_author_confirmation
with artifact metadata for document entry; completed only after commit.
Co-authored-by: Cursor <cursoragent@cursor.com>
Materialize needs_confirmation restores ledger head to output.md and
document_records hash; only committed heads update DocGov. Decision
handler projects after commit or reject. Stage gates DocGov proposals
via PendingProposal, not bare RequiresAuthorApproval.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prefer pending reports on the toolbar, show risk items and impacts, and
call the decision API only when can_decide_pending is true.
Co-authored-by: Cursor <cursoragent@cursor.com>
Surface pending_candidate_id, report id, and risk so NeedsConfirmation
candidates are discoverable before they enter the version list.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unauthorized actors no longer grab leases; controlled PATCH projects through
DocGov so author_last_edited and audit survive, with idempotent retry on failure.
Co-authored-by: Cursor <cursoragent@cursor.com>
TaskRunResult now fails visibly when ledger/report materialization errors;
invalid or unassessed reports are never auto-committed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expand the headless UI checklist and record remaining real blockers without
claiming PI narrative or E2E completion.
Co-authored-by: Cursor <cursoragent@cursor.com>
Bump revisionRefreshKey on save/hydrate so r and overlay reload; add a
latest change-report button wired to version change_report_id.
Co-authored-by: Cursor <cursoragent@cursor.com>
Open an explicit empty baseline then create a deterministic candidate/report
so the first squad success is visible as fallback analysis, not OpenTemplate-only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stage generation without a real document must not panic or enter the ledger.
Unknown orphan IDs are denied, write paths check author/lease/lifecycle, PATCH
no longer returns a fake 200, and overlay matching survives client/server block id drift.
Co-authored-by: Cursor <cursoragent@cursor.com>
Separate browser-only real acceptance from engineering unit/build gates and record gate evidence on the short-term task.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop skipping freeform PATCH saves and decorate BlockRenderer for pure/manual/all revision views with clear empty states.
Co-authored-by: Cursor <cursoragent@cursor.com>
Resolve controlled/freeform/orphan docs, bootstrap on GET, write output.md or freeform content on PATCH, and wire lineage impacts for agent candidates.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record in-memory ledger root cause, PG persistence plan, and CURRENT mutex claim on fix/document-revision-runtime.
Co-authored-by: Cursor <cursoragent@cursor.com>
Accept DOCREV decision gates, archive design short-term, and mark
FEATURE-MATRIX partial as implementation starts on feature branch.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use task run_id as doc lease holder so release tracks execution, and reclaim squad locks when the holder run is missing or no longer running.
Co-authored-by: Cursor <cursoragent@cursor.com>
When deliverables only expose user_requirements templates, requirement phrases still must POST intake on V0.1. Re-resolve task_key on retry and skip auto-retry for stage gate errors.
Co-authored-by: Cursor <cursoragent@cursor.com>
Debug logs showed task runs used user_requirements on V0.1 while the active stage only allows intake. Prefer intake for 初始需求/摸底 phrasing and surface DOC_TASK_NOT_IN_ACTIVE_STAGE instead of SESSION_FORBIDDEN.
Co-authored-by: Cursor <cursoragent@cursor.com>
Task template messages were posting to project_id=1 when local session cache lacked projectId, causing 403 on POST /api/v1/tasks/runs. Parse sess-p{id}-u{user} encoding as fallback and surface HTTP status on task failures.
Co-authored-by: Cursor <cursoragent@cursor.com>
Rebuild dev backend so message visibility uses scope-aware filtering instead of dropping messages without stage_key. Map HTTP 401/403 on chat stream to actionable auth errors instead of generic NETWORK_ERROR.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add public favicon.svg and favicon.ico and link them from index.html
so browsers stop requesting a missing root icon on refresh.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove a stray else branch left from the refresh-state refactor that
broke Vite/esbuild parsing on page reload.
Co-authored-by: Cursor <cursoragent@cursor.com>
Update gap-matrix CHAT-HISTORY-REFRESH to PASS, sync CURRENT and
short-term checklist with implementation evidence.
Co-authored-by: Cursor <cursoragent@cursor.com>
Distinguish authorized-empty and forbidden phases; skip caching day
buckets with zero messages; bind window cache keys to user id.
Co-authored-by: Cursor <cursoragent@cursor.com>
Apply session ownership plus scope_kind visibility across window, day,
search, dates, categories, unread, and digest endpoints; add PG refresh
regression test for pre-activation and task-scoped messages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist workflow_instance_id, stage_instance_id, scope_kind on chat
messages and task runs; resolve scope from live instance for chat and
document tasks so refresh can apply consistent stage authorization.
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-13 03:06:08 +00:00
2630 changed files with 286658 additions and 19886 deletions
- Track E Phase 2：[../remediation/2026-09-15-module-decoupling-ipc-phase2-remediation-plan.md](../remediation/2026-09-15-module-decoupling-ipc-phase2-remediation-plan.md)
（session-settled: user-approved — chosen over product-admin integration: the console is for the repository owner’s local engineering management and the production image excludes `.doc` and `.git`）
#### PKD-2：只读实时页与离线快照共用数据模型
实时服务和导出文件必须由同一份版本化快照生成，避免在线页面与离线报告出现两套口径。
（session-settled: user-approved — chosen over a static-only report: the requested console must follow agent tasks and project state as they change）
2. 暴露 `/api/v1/snapshot`、`/api/v1/doc/<id>`、`/healthz`；所有接口只读。严格校验 Host/Origin/Fetch Metadata，不信任代理转发头；页面和 API 使用每次启动生成的不可预测访问令牌，降低 DNS rebinding 与跨站读取风险。
3. 页面分为总览、架构/模块、任务、Git、部署、文档和证据链。
4. 自动刷新完整快照，保留当前筛选、滚动位置、焦点和选中文档；ETag 未变化时不重绘。
5. 明确一级视图状态：initial loading、fresh empty、fresh success、partial/degraded with last-known、hard error without cache、refreshing、recovered。刷新中继续展示上一完整快照，直到下一版本原子替换。
- Test report: [../../test-reports/2026-09-13-conversation-intent-runtime-state-test-report.md](../../test-reports/2026-09-13-conversation-intent-runtime-state-test-report.md)
本轮门禁（2026-09-13 10:11 UTC 独立复跑）：`go vet ./...` PASS；`go test -short ./... -count=1` PASS（含 Materialize 首/二轮 change_report_id、PATCH 顺序、Materialize 失败透出、Assert 先职责后租约、SaveDocumentContent 审计、pending 事实源不越权、同步/异步待确认文案、完成活动仅 committed、pending 活动标明待确认、MarkProposalApplied 失败显式可重试）；`web npm test` 199+27 PASS；`npm run build` PASS。使用 dev PostgreSQL（schema 28）执行 `TestPGPersistSurvivesNewServiceInstance` PASS，证明新 Service 实例可恢复账本。上述均为工程门禁，不能替代 UI 验收。
UI-01 目录同步补丁门禁（2026-09-13）：`node --test adminUserDirectorySync.test.ts` 3 PASS；`web npm test` 219+27 PASS；`npm run build` PASS；`go vet ./...` + `go test -short ./...` PASS。未提交 `web/e2e/*` 与 `test-reports/assets/`。
UI-01/02 访问与成员落库门禁（2026-09-13）：`go test ./internal/projectinstance -short` PASS；`TEST_DATABASE_URL=… go test ./internal/projectinstance -run TestPG_GoverningAccess` PASS；`TEST_DATABASE_URL=… go test ./internal/server -run TestChatProjectAccess` PASS；`go vet ./...` + `go test -short ./...`；`web npm test` + `npm run build`。未提交 e2e/assets。
- Test report: [../../test-reports/2026-09-14-document-revision-runtime-ui-test-report.md](../../test-reports/2026-09-14-document-revision-runtime-ui-test-report.md)
- Test report: [../../test-reports/2026-09-14-document-revision-runtime-ui-test-report.md](../../test-reports/2026-09-14-document-revision-runtime-ui-test-report.md)
- Test report: [../../test-reports/2026-09-14-document-revision-runtime-ui-test-report.md](../../test-reports/2026-09-14-document-revision-runtime-ui-test-report.md)
- Test report: [2026-09-14-workflow-plan-409-frozen-and-optional-duties-test-report.md](../../test-reports/2026-09-14-workflow-plan-409-frozen-and-optional-duties-test-report.md)
## 证据 / 备注
- dev 项目 143：`lifecycle_status=active`、`active_workflow_key=main`、实例 89 active；409 与三名职责人选择内容无关。
- Test report: [../../test-reports/2026-09-15-app-composition-u11-u12-test-report.md](../../test-reports/2026-09-15-app-composition-u11-u12-test-report.md)
- Test report: [../../test-reports/2026-09-15-chatlog-contextasm-u10-test-report.md](../../test-reports/2026-09-15-chatlog-contextasm-u10-test-report.md)
5. [x] 同步 test report、CURRENT、FEATURE-MATRIX、gap-matrix、[复盘](../research/2026-09-15-track-e-retrospective.md)。
## 验收标准
- [ ] 满足 [Phase 2 Track E Definition of Done](../../remediation/2026-09-15-module-decoupling-ipc-phase2-remediation-plan.md#track-e-definition-of-done)（共享 live 与删除 hook API 仍开放）。
- Test report: [../../test-reports/2026-09-15-leftover-branch-cleanup-test-report.md](../../test-reports/2026-09-15-leftover-branch-cleanup-test-report.md)
- Test report: [../../test-reports/2026-09-17-docgov-optional-duty-null-fk-test-report.md](../../test-reports/2026-09-17-docgov-optional-duty-null-fk-test-report.md)
基线 dev adb48c8。已 fetch origin/dev，本地 dev 领先 44、落后 0，保留未推送集成成果；主工作区 feature/control-center-server 未切换。worktree 脚本默认从当前 HEAD 创建，故直接指定 dev 创建本 worktree，避免引入他人分支。
- Test report: [../../test-reports/2026-09-17-document-author-only-u6-test-report.md](../../test-reports/2026-09-17-document-author-only-u6-test-report.md)
- [测试输出](../../test-reports/assets/2026-09-21-herdr-v12/focused-tests.txt)；[九种启动命令](../../test-reports/assets/2026-09-21-herdr-v12/launch-commands.json)。Git/SQLite 是真实临时仓库，Herdr transport 为 fake，绝不将其声明为实际 pane 启动/模型 E2E。
- PI 安装版本 0.85.1 的本机 README 明确内置工具无权限弹窗，`--approve` 是项目文件信任；扩展仍可自建交互。Cursor force 保留显式 deny，Kimi 使用 auto 而非 yolo。其他本机帮助与[官方出处](../../ops/2026-09-13-herdr-agent-roster.md#5-自动通过请求与实际启动)相互核对。
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
WeiCHEN