fix: support internal AgentBus attachments

.project-docs/20-architecture/data-flow.md

@@ -10,6 +10,9 @@
 | ERP execution | Confirmed task | Chrome extension and logged-in ERP page | Requires unique object, page identity, ownership, and write preflight |
 | Completion evidence | ERP response/requery | Control-plane receipt and business reply | Evidence is action-specific; uncertain writes fail closed |
 | Passenger workbook | Single `.xls/.xlsx` attachment | Deterministic encrypted canonical TSV | First row ignored, second row fixed header, exact leader-contact rules |
+| WeChat roster attachment | Strict transport envelope plus one structured `payload.attachments[]` entry | Existing `awaiting_attachment` task | Explicit conversation ID wins; otherwise strict `Conversation:` supplies the fallback. Placeholder text alone never creates a task. |
+| Internal attachment download | Credential-free HTTPS URL | Bounded in-memory workbook bytes | Internal/private DNS answers are allowed; the selected address is pinned, every redirect is revalidated, and URL/host/IP/bytes are omitted from logs. |
+| Operational diagnostics | Service, request, task, parser, AgentBus, attachment, database, and cleanup stages | Structured stdout/stderr and bounded Docker logs | Correlation identifiers, codes, outcomes, and durations only; no secrets or business payloads. |
 | Confirmation export | ERP source file | Archived source plus mobile delivery artifact | Visitor XLS becomes real XLSX; other types prefer PDF |
 | Release | Editable source | `dist/release-manifest.json` and versioned artifacts | Manifest owns current hashes and filenames |
 
@@ -29,4 +32,4 @@
 
 ## Last Updated
 
-2026-08-28
+2026-08-31

.project-docs/20-architecture/system-overview.md

@@ -10,7 +10,7 @@ Manual or AgentBus input is routed through task-scoped AI/Shadow/Auto/Program or
 |---|---|---|
 | `agent设计规范/` | Agent Prompt, five parsing Skills, business templates, business registry, and stable fixtures | Editable source for business semantics; not runtime evidence |
 | `schemas/` and `mappings/` | Parse-state, execution-state, ERP form, field, and lifecycle contracts | Current contracts only |
-| `control-plane/` | Task/session persistence, parser orchestration, confirmation, audit, AgentBus, attachments, and receipts | TypeScript source; build output goes to `.build/` |
+| `control-plane/` | Task/session persistence, parser orchestration, confirmation, audit, AgentBus, attachments, receipts, and structured diagnostics | TypeScript source; build output goes to `.build/` |
 | `LianSyn-platform/` | Operator workbench and external parser adapter | Source and UI, not local task output |
 | `chrome-extension/ltjt-order-assistant/` | Logged-in ERP resolution, preflight, native execution, response handling, and requery | Any code change requires synchronized versioned release updates |
 | `dist/` | Versioned current deliverables and machine-readable release manifest | Not a compilation directory |
@@ -22,6 +22,10 @@ Manual or AgentBus input is routed through task-scoped AI/Shadow/Auto/Program or
 - AI/Program parsing and ERP resolution/execution share the final operation contract but do not share authority.
 - Platform envelope fields such as task ID, session, parser decision, confirmation, transport, and audit never enter the business operation.
 - Unknown, ambiguous, unverified, or post-write-uncertain states fail closed; automatic retries must not create duplicate writes.
+- PostgreSQL is the sole required durable database/state middleware, and the production artifact provider is OSS. Redis, message queues, MongoDB, and search services are not runtime dependencies.
+- Migrations must complete before the application starts. The current ACK topology starts with one application replica because AgentBus listeners and SSE emission are process-local; horizontal scale requires explicit coordination first.
+- Operational diagnostics are privacy-safe structured JSON on stdout/stderr. Docker owns bounded rotation; repository files and a second mutable log database are not log sinks.
+- In the trusted internal deployment, AgentBus roster attachment downloads may resolve to private/reserved addresses. Credential-free HTTPS, DNS resolution/pinning, redirect revalidation, size, timeout, and digest checks remain mandatory, and trusted channels/bridges own the network-input boundary.
 - Canonical project memory is updated only under Integration Gate; feature tasks write only their task-scoped records.
 
 ## Related Decisions
@@ -31,7 +35,8 @@ Manual or AgentBus input is routed through task-scoped AI/Shadow/Auto/Program or
 - ROUTE-001
 - RELEASE-001
 - SAFETY-001
+- NETWORK-001
 
 ## Last Updated
 
-2026-08-28
+2026-08-31