shiyuyun/wyndham-ARR
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
ad3d9878c5aa8d956339ef6871322000e694f5ca
wyndham-ARR/.project-docs/30-worklog/current-state.md
Wyndham ARR ad3d9878c5 fix: enable XML processing in container entry
2026-07-29 18:34:03 +08:00

6.2 KiB
Raw Blame History

Current State

Current Focus

The controlled public-deployment source snapshot is published on main at https://git.nianxx.cn/shiyuyun/wyndham-ARR.git; initial deployment commit a701de9 contains the verified source snapshot. The Dockerfile default Web CMD and Compose Web command now both explicitly enable --enable-processing; Compose additionally uses --secure-cookies, while Caddy remains the documented public listener and MCP retains its independent bearer and exact Host allowlist. Direct source CLI execution remains fail-closed. The current suite passes 260 tests with 2 environment skips plus deployment-entry static assertions. No public-server runtime has been verified from this workspace.

Recently Completed

  • 2026-07-29: Fixed the direct Docker-image launch path so its default Web CMD explicitly includes --enable-processing, matching Compose. The controlled local launchd script was also updated and restarted: PID 50730 reports both database and processing ready, and a browser DOM check confirms the XML chooser is enabled. Added a regression test that opens only XML processing mutations; all 260 tests pass with 2 artifact-tool skips. Source CLI defaults and the runtime readiness gate remain fail-closed.
  • 2026-07-29: Published the deployment-ready snapshot to the empty self-hosted repository as main, established upstream tracking and verified that the remote branch contains initial commit a701de9.
  • 2026-07-29: Added a Linux Dockerfile, Compose, Caddy TLS boundary, production env example and deployment runbook. The Web health gate requires both database_ready and processing_ready; the production command opens XML processing without changing the source default.
  • 2026-07-29: Added opt-in HTTPS Secure session cookies, made the booking fixture root portable, removed local paths/test endpoints/temporary tunnel names from the publishable snapshot, and verified 271 final candidate files (about 2.0 MiB) contain no detected secrets, symlinks or files larger than 1 MiB.
  • 2026-07-29: Ran the complete Python suite in a dependency-complete Python 3.12 environment: 259 tests passed and 2 were skipped. Compose YAML, JSON contracts and controlled package checksums also passed static validation.
  • 2026-07-29: Restarted the controlled MCP and fixed-domain ngrok sessions. An initial authenticated 421 exposed a preserved public Host; the MCP was safely restarted with an exact loopback/public Host allowlist, after which public initialize and tools-list both returned 200.
  • 2026-07-29: Reverified gateway 1.0.1, protocol 2025-11-25, one tool, 2195-byte advertised schema, and zero $ref/$defs/$id keys without invoking the business tool.
  • 2026-07-29: Diagnosed the SuperAgent MCP failed state: ports 8890/4040 have no listeners, the old temporary PIDs are gone, TLS remains valid, and the public /mcp request is rejected by ngrok as an offline endpoint before reaching ARR authentication or MCP protocol handling.
  • 2026-07-29: Started a controlled upload-capable Web instance on 127.0.0.1:8766 and submitted one no-PII XML through the real page.
  • 2026-07-29: Confirmed job arrjob-fdc2c1a0695c41b3b372a52033b2f567 reached SuperAgent run 7e1ad2fe-cb59-4d04-b92c-9f09d98f4ef8; remote status was success, but MCP submission and all 2038-01-19 Finance facts remained absent.
  • 2026-07-29: Safely terminalized the failed test as PROCESSING_RESULT_MISSING, revoked its unconsumed grant, verified zero business writes, and stopped port 8766.
  • 2026-07-29: Confirmed that XML upload is the only required user action; successful structured-data commit must automatically trigger monthly processing.
  • 2026-07-29: Confirmed that TOTAL PRICE is required and must be an Excel formula equal to REAL PRICE × NIGHTS × NO_OF_ROOMS.
  • 2026-07-29: Initialized .project-docs and recorded the correction in ADR-001.

In Progress

  • No local repository publication work remains. Runtime deployment, DNS/Secret injection and SuperAgent stable-domain rebinding belong to the user's public server environment.

Next Recommended Steps

  1. Redeploy the latest repository image using deploy/README.md, inject real Secrets only on the server, and require the public Web health response to report database_ready=true and processing_ready=true; any platform override of Docker CMD must retain --enable-processing.
  2. Rebind SuperAgent to https://<MCP_PUBLIC_HOST>/mcp, rediscover exactly arr_submit_processing_result, save/publish the new Agent version, and stop relying on the temporary ngrok endpoint.
  3. Rerun the vertical slice with a fresh no-PII XML and require a committed/already_committed receipt plus matching Finance version, current pointer and fact rows.
  4. In separately authorized implementation work, add the automatic post-commit monthly dispatch and required TOTAL PRICE formula behavior.

Open Questions / Blockers

  • Docker and Caddy are not installed in this workspace, so image build, Compose runtime, DNS, ACME issuance and public HTTP checks must be performed on the deployment server.
  • SuperAgent administration requires the user's authenticated platform session; its stale MCP configuration must be replaced with the new stable public MCP domain after deployment.
  • The restored ngrok/MCP sessions remain temporary and are not the formal deployment target.
  • ProcessingRunner.poll() can emit delivery_missing, but the PostgreSQL state adapter has no matching status mapping. The live run therefore required a guarded manual terminalization transaction.
  • The exact automatic monthly dispatch mechanism and business-time/cutoff derivation policy still require implementation design; neither is a user input.

Risky Areas

  • A SuperAgent run reporting success is not business success; only an MCP receipt and committed database facts qualify.
  • Enabling upload on the current all-interface 8765 listener without a confirmed authentication boundary would expose a mutation endpoint.
  • Committing deploy/.env.production, publishing 8765/8890 directly, omitting TLS/Basic Auth, or reusing the MCP/SuperAgent/HMAC credentials would break the deployment boundary.
  • Triggering before commit, duplicate trigger delivery, deriving the wrong reporting period, or replacing formulas with cached/static amounts.

Last Updated

2026-07-29