docs: record account system deployment

.project-docs/30-worklog/current-state.md

@@ -9,10 +9,12 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 - Commit `161f90d09d6ad1368973b1a85d51059059495223` for trusted-intranet attachment compatibility and canonical reconciliation.
 - Integration task `20260831-finalize-main-push-4e1c7a9b` for verified non-force synchronization to `origin/main`.
 - Commit `b08f2960fa4db09c807b6fb61dfba33dc524a274` for the read-only list-attachment behavior inspection record; no product behavior changed.
+- Commit `191c1a1aad6f4bb1651143df3e0c1dc98dcd09e0` for the fixed-scope account system, three-role authorization, owner isolation, operations dashboard, audit/archive behavior, and per-account task-route grants.
+- Integration task `20260901-integrate-account-system-7b2f4d` for canonical authorization reconciliation, migrations 015–017, and the authorized standard-panel restart.
 
 ## Current Focus
 
-Operate the current `0.5.163` extension release baseline safely, keep Program/AI routing and ERP execution boundaries synchronized, and prepare the integrated control-plane revision for a separately authorized deployment.
+Operate the current `0.5.163` extension baseline and the deployed fixed-scope account model safely, provision roles and task grants through administrator workflows, and preserve Program/AI plus ERP execution boundaries.
 
 ## Recently Completed
 
@@ -23,30 +25,32 @@ Operate the current `0.5.163` extension release baseline safely, keep Program/AI
 - 2026-08-31: Integrated strict WeChat envelope conversation fallback, placeholder-only attachment rejection before task ingestion, and safe attachment error summaries while preserving the original `awaiting_attachment` task.
 - 2026-08-31: Integrated structured privacy-safe diagnostics across service, HTTP, task/audit, parser, AgentBus, attachment, database, and cleanup stages, with bounded Docker stdout retention and a read-only server diagnostic command.
 - 2026-08-31: Confirmed from the supplied production log that attachment correlation succeeded and the failure was private/reserved DNS rejection; removed that rejection for the trusted internal deployment while retaining credential-free HTTPS, DNS pinning, redirect validation, size, timeout, and SHA-256 controls.
+- 2026-09-01: Integrated and started the three-role account system on the standard 8786 control plane. Migrations 015–017 added owner/audit/archive state, team-lead dashboard support, and administrator-managed task-route allowlists; the existing account migrated as administrator.
 
 ## In Progress
 
-- No separate repository feature task is recorded at this integration snapshot; deployment and restart remain unperformed.
+- The standard database currently contains one administrator account and no non-administrator task grants. Multi-account operational smoke testing remains for an administrator-led staging window.
 
 ## Next Recommended Steps
 
 1. With explicit authorization, run a live read-only ERP verification of the shared-mother-plan `tid-only` whole-visitor export path.
 2. With explicit authorization, perform ERP write verification for independent-order SGL/TWN and adult/child/leader headcount mappings.
-3. Under separate deployment authorization, publish the integrated control-plane image with `DEPLOYMENT_REVISION` set and verify one real internal AgentBus roster attachment through the new diagnostic stages.
+3. Through the administrator UI, create representative team-lead and ordinary accounts, assign narrow task grants, and verify owner isolation, leadership dashboard reads, grant/revoke behavior, and denial prompts without ERP writes.
 
 ## Open Questions / Blockers
 
 - Shared-mother-plan whole-visitor export has historical read evidence and static coverage but lacks a fresh authorized runtime ERP read verification.
 - Independent-order SGL/TWN and four headcount categories lack authorized current-version ERP write evidence.
-- The repository fix for internal attachment URLs is not active on the server until a separately authorized image build/deployment/restart occurs.
+- The restarted service now runs current local `main`; a live internal AgentBus attachment verification remains separately unperformed.
 
 ## Risky Areas
 
 - Any ERP write, uncertain post-write state, automatic retry, or scope widening.
 - Passenger workbook normalization, encrypted attachment persistence, leader-contact projection, and native ERP row capacity.
 - AgentBus channels and their upstream bridge are now a trusted network boundary because attachment URLs may target internal HTTPS hosts.
+- Account role changes, session revocation, creator-based task-route revocation, cross-user dashboard projection, and encrypted input audit are security-sensitive boundaries.
 - Release synchronization across extension source, minimum platform version, mapping, ZIP, Skills, DOCX, and `dist/release-manifest.json`.
 
 ## Last Updated
 
-2026-08-31
+2026-09-01

.project-docs/30-worklog/tasks/20260901-integrate-account-system-7b2f4d.md

@@ -8,7 +8,7 @@
 - Worktree: /Users/inmanx/Documents/lwltAPI-integrate-account-system-5e8c1a
 - Base commit: 191c1a1aad6f4bb1651143df3e0c1dc98dcd09e0
 - Owner: codex
-- Status: Planning
+- Status: Completed
 
 ## Scope
 
@@ -29,16 +29,39 @@
 
 ## Outcome
 
-- Not completed.
+- Preserved and committed the prior main-sync task record under its original task ownership, released that worktree cleanly, and fast-forwarded the integration base without deleting or adopting foreign changes.
+- Integrated source commit `375fda1` as `191c1a1`, excluding the unrelated roster-workbook and other peer feature tasks. Local `main` was fast-forwarded through `ffda0d5` before runtime migration.
+- Accepted `AUTH-001` and updated the canonical decision index, architecture, data flow, business rules, current state, and evidence index for the fixed internal scope, `admin`/`team_lead`/`user` roles, owner isolation, leadership dashboard, creator/input audit, archive/restore, and non-admin task-route allowlists.
+- Applied migrations `015_account_roles_and_task_audit`, `016_team_lead_operations_dashboard`, and `017_user_business_route_authorizations` to the configured standard database. The existing account migrated as `admin`; no non-admin grant rows were invented.
+- Restarted only the standard `127.0.0.1:8786` control plane. The old server released the listener after `SIGTERM` but remained blocked by long-lived connections; after the new server was listening and the old PID no longer owned the port, the old process tree was force-cleaned. PID `80644` is the sole current 8786 listener.
+- Opened the standard `/accounts` page in the application browser and confirmed the deployed task-authorization panel, operations-dashboard navigation, and versioned application asset. The existing browser session was expired, so no real credentials were read, reset, or submitted.
+- Did not access ERP, trigger business execution, reload the extension, send external messages, or push to the remote repository.
 
 ## Verification
 
-- Not run.
+- `node --run check:repo`: 10/10 passed on the integrated tree after canonical updates.
+- `node --run check`: passed.
+- `node --run test:control-plane`: 153/153 passed.
+- `node --run test:legacy`: 256/256 passed.
+- `node --run build`: passed.
+- `node --check LianSyn-platform/app.js`: passed.
+- `git diff --check`: passed.
+- `check_project_docs.py`: passed.
+- `check_doc_drift.py --task-id 20260901-integrate-account-system-7b2f4d`: passed before final task-record completion.
+- Migration command applied exactly 015–017; a second startup migration reported no pending versions.
+- `/health/live`: HTTP 200 with `ok=true`.
+- `/health/ready`: HTTP 200 with `database=true`, `schema=true`, and required migration `017_user_business_route_authorizations`.
+- Aggregate read-only database verification: one `admin` account, zero team-lead/user accounts, and zero explicit task-route grant rows.
+- `/accounts` and `/operations-dashboard`: HTTP 200; unauthenticated `/api/accounts` and `/api/operations-dashboard`: HTTP 401.
+- Deployed DOM: `任务类型授权`, `保存授权`, and operations-dashboard navigation are present; `app.js` is loaded with `20260901-business-authorization-1`.
+- Process check: only PID `80644` listens on `127.0.0.1:8786`.
 
 ## Follow-ups
 
-- None recorded.
+- The existing administrator should sign in and create representative team-lead/user accounts, assign narrow task grants, and run the non-ERP staging checks recorded in current state. Login was intentionally not simulated because the existing session had expired and this task did not access or reset real credentials.
+- AgentBus remains enabled but disconnected with no active channels, matching the pre-restart readiness state; reconnect/channel configuration was outside this account-system integration.
+- Remote `origin/main` was not pushed because the request authorized synchronization to the local main branch and restart, not a remote repository write.
 
 ## Promotion Candidates
 
-- None recorded.
+- Applied during this Integration task as `AUTH-001` plus canonical architecture, data-flow, business-rule, current-state, and evidence updates; no unresolved promotion remains.

.project-docs/50-evidence/evidence-index.md

@@ -12,6 +12,7 @@ Use this index for searchable, traceable evidence records.
 | 2026-08-31 | WeChat attachment correlation | Repository verified; not deployed by this task | [Attachment-correlation task](../30-worklog/tasks/20260830-wechat-attachment-correlation-9f3a2c.md) | Strict conversation fallback and placeholder-only failure preserve the waiting task and prevent accidental task creation. |
 | 2026-08-31 | Privacy-safe server diagnostics | Repository verified; not deployed by this task | [Diagnostics task](../30-worklog/tasks/20260830-server-diagnostics-c4d8a1f2.md) | Structured lifecycle diagnostics, redaction, bounded Docker retention, and read-only server inspection command. |
 | 2026-08-31 | Production attachment failure | Root cause verified from supplied log | [Log-inspection task](../30-worklog/tasks/20260831-inspect-server-log-5d1e8a7c.md) | The original task remained waiting; the later structured attachment failed because DNS returned a private/reserved address. |
+| 2026-09-01 | Fixed-scope account authorization and dashboard | Repository and standard local runtime verified | [Integration task](../30-worklog/tasks/20260901-integrate-account-system-7b2f4d.md) | Three roles, owner isolation, creator/input audit, archive/restore, leadership dashboard, and 18-route allowlists passed full regression; migrations 015–017 and standard-panel readiness were verified. |
 
 ## When To Add Evidence