docs: integrate leadership dashboard definition

.project-docs/10-decisions/AUTH-001-fixed-scope-account-authorization.md

@@ -19,7 +19,8 @@ The platform already required login but treated the fixed deployment scope as a
 - Administrators manage account lifecycle, passwords, sessions, global settings/audit, AgentBus/system tasks, and all manual tasks. They always hold all 18 registered manual business routes.
 - Team leads and ordinary users use normal business APIs only for their own manual tasks. New non-administrator accounts start with no task-type grants and may invoke only routes explicitly granted by an administrator.
 - Re-read route authorization before intake and relevant task state transitions. Known denied routes and unknown/non-unique routes fail closed before parsing, plugin dispatch, or ERP execution.
-- Give team leads a dedicated read-only operations dashboard over all manual account tasks. It exposes who acted, the business instruction, and the readable business result, but not parser/executor payloads or mutation authority.
+- Give team leads a dedicated read-only platform-operations dashboard over all manual account tasks. It is an aggregate-first leadership view across task, person, original input, final output, time, task type, and completion state; every aggregate may drill into the same bounded business-facing task projection.
+- Keep the leadership dashboard separate from audit and engineering diagnostics. It never renders parser/executor payloads, internal identifiers, codes, machine-shaped historical input, or technical failure text; those values are replaced by a concise business explanation without changing the underlying audit evidence.
 - Preserve creator and input-turn attribution with encrypted input at rest. Routine removal is archive/restore; irreversible purge is not exposed.
 - Keep AgentBus authorization as a separate administrator-controlled channel boundary.
 
@@ -33,6 +34,7 @@ This model fits a single-organization deployment while enforcing least privilege
 - Existing accounts migrate as administrators; newly created team leads and users require explicit task grants.
 - Permission revocation can block an existing task at confirmation or browser claim even when an administrator attempts the transition.
 - Cross-user operational visibility is intentionally separated from normal task mutation and technical debugging surfaces.
+- Dashboard acceptance is based on leadership questions and business-readable drill-through, not on reproducing task history or technical audit records.
 
 ## Supersedes
 
@@ -44,3 +46,4 @@ This model fits a single-organization deployment while enforcing least privilege
 - `control-plane/migrations/016_team_lead_operations_dashboard.sql`
 - `control-plane/migrations/017_user_business_route_authorizations.sql`
 - `.project-docs/30-worklog/tasks/20260901-account-system-impl-d4e7a2.md`
+- `.project-docs/30-worklog/tasks/20260901-leadership-dashboard-c4b9e1.md`

.project-docs/10-decisions/decision-index.md

@@ -10,7 +10,7 @@
 | RELEASE-001 | Current artifacts, filenames, versions, and SHA-256 values are defined only by `dist/release-manifest.json`. | Active | 2026-08-28 | Release and delivery | [Release manifest](../../dist/release-manifest.json) |
 | SAFETY-001 | Real ERP access/write, task mutation, extension reload, service restart, deployment, and external delivery require explicit task-scoped authorization. | Active | 2026-08-28 | Operations and maintenance | [Governance](../../AGENTS.md) |
 | NETWORK-001 | In the trusted internal deployment, AgentBus roster attachment URLs may resolve to internal/private addresses; HTTPS, credential rejection, DNS pinning, redirect validation, bounds, and digest checks remain. | Active | 2026-08-31 | AgentBus attachment ingress | [Reply contract](../../agent设计规范/agentbus-reply-contract.md) |
-| AUTH-001 | The fixed deployment scope uses administrator-managed `admin`, `team_lead`, and `user` accounts, owner-isolated normal tasks, a read-only leadership dashboard, and explicit non-admin task-route allowlists. | Active | 2026-09-01 | Authentication, authorization, audit, and operations oversight | [ADR](AUTH-001-fixed-scope-account-authorization.md) |
+| AUTH-001 | The fixed deployment scope uses administrator-managed `admin`, `team_lead`, and `user` accounts, owner-isolated normal tasks, an aggregate-first read-only leadership dashboard, and explicit non-admin task-route allowlists. | Active | 2026-09-01 | Authentication, authorization, audit, and operations oversight | [ADR](AUTH-001-fixed-scope-account-authorization.md) |
 
 ## Superseded Decisions
 

.project-docs/20-architecture/data-flow.md

@@ -14,7 +14,7 @@
 | WeChat roster attachment | Strict transport envelope plus one structured `payload.attachments[]` entry | Existing `awaiting_attachment` task | Explicit conversation ID wins; otherwise strict `Conversation:` supplies the fallback. Placeholder text alone never creates a task. |
 | Internal attachment download | Credential-free HTTPS URL | Bounded in-memory workbook bytes | Internal/private DNS answers are allowed; the selected address is pinned, every redirect is revalidated, and URL/host/IP/bytes are omitted from logs. |
 | Operational diagnostics | Service, request, task, parser, AgentBus, attachment, database, and cleanup stages | Structured stdout/stderr and bounded Docker logs | Correlation identifiers, codes, outcomes, and durations only; no secrets or business payloads. |
-| Operations oversight | Manual task creator, encrypted instruction history, and readable outcome | Team-lead/administrator dashboard projection | Read-only who/instruction/result view; no parser/executor payloads or task mutation authority |
+| Platform operations oversight | Manual task creator, encrypted instruction history, and readable outcome | Team-lead/administrator leadership projection | Aggregate-first task/person/input/output/time/type/completion view with clickable business drill-through; no machine payloads, technical failure text, internal identifiers, or task mutation authority |
 | Confirmation export | ERP source file | Archived source plus mobile delivery artifact | Visitor XLS becomes real XLSX; other types prefer PDF |
 | Release | Editable source | `dist/release-manifest.json` and versioned artifacts | Manifest owns current hashes and filenames |
 

.project-docs/20-architecture/system-overview.md

@@ -21,7 +21,8 @@ Authenticated manual or AgentBus input is routed through task-scoped AI/Shadow/A
 
 - AI/Program parsing and ERP resolution/execution share the final operation contract but do not share authority.
 - Platform envelope fields such as task ID, account identity, authorization revision, session, parser decision, confirmation, transport, and audit never enter the business operation.
-- The product is one fixed internal organization scope with three roles. Administrators manage accounts and all 18 manual routes; team leads and users are owner-scoped for normal tasks and require explicit per-route grants. Team leads additionally receive a dedicated read-only, manual-task-only operations dashboard.
+- The product is one fixed internal organization scope with three roles. Administrators manage accounts and all 18 manual routes; team leads and users are owner-scoped for normal tasks and require explicit per-route grants. Team leads additionally receive a dedicated read-only, manual-task-only platform-operations dashboard.
+- The leadership dashboard is an aggregate-first projection across task, person, original input, final output, time, task type, and completion state. Its drill-through stays business-facing; technical payloads, internal identifiers, machine-shaped historical input, and technical failure text remain in separate authorized audit/engineering surfaces.
 - Authorization is enforced in server and service paths, not by navigation visibility. A denied or unresolved non-admin business route stops before parsing, plugin dispatch, and ERP execution; creator authorization is rechecked at confirmation and browser claim.
 - Creator and manual input-turn attribution remain durable while business input stays encrypted at rest. Routine removal is reversible archive/restore; physical purge is not an operator capability.
 - Unknown, ambiguous, unverified, or post-write-uncertain states fail closed; automatic retries must not create duplicate writes.

.project-docs/30-worklog/current-state.md

@@ -11,10 +11,12 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 - Commit `b08f2960fa4db09c807b6fb61dfba33dc524a274` for the read-only list-attachment behavior inspection record; no product behavior changed.
 - Commit `191c1a1aad6f4bb1651143df3e0c1dc98dcd09e0` for the fixed-scope account system, three-role authorization, owner isolation, operations dashboard, audit/archive behavior, and per-account task-route grants.
 - Integration task `20260901-integrate-account-system-7b2f4d` for canonical authorization reconciliation, migrations 015–017, and the authorized standard-panel restart.
+- Commit `823d1cb6305077e1743f8783176d2cae3b5aec39` for the aggregate-first leadership platform-operations dashboard and business-safe input/result projections.
+- Integration task `20260901-integrate-leadership-dashboard-9e2b6c` for the leadership-dashboard product-definition correction.
 
 ## Current Focus
 
-Operate the current `0.5.163` extension baseline and the deployed fixed-scope account model safely, provision roles and task grants through administrator workflows, and preserve Program/AI plus ERP execution boundaries.
+Operate the current `0.5.163` extension baseline and the deployed fixed-scope account model safely, provision roles and task grants through administrator workflows, use the aggregate-first leadership dashboard for business oversight, and preserve Program/AI plus ERP execution boundaries.
 
 ## Recently Completed
 
@@ -26,6 +28,7 @@ Operate the current `0.5.163` extension baseline and the deployed fixed-scope ac
 - 2026-08-31: Integrated structured privacy-safe diagnostics across service, HTTP, task/audit, parser, AgentBus, attachment, database, and cleanup stages, with bounded Docker stdout retention and a read-only server diagnostic command.
 - 2026-08-31: Confirmed from the supplied production log that attachment correlation succeeded and the failure was private/reserved DNS rejection; removed that rejection for the trusted internal deployment while retaining credential-free HTTPS, DNS pinning, redirect validation, size, timeout, and SHA-256 controls.
 - 2026-09-01: Integrated and started the three-role account system on the standard 8786 control plane. Migrations 015–017 added owner/audit/archive state, team-lead dashboard support, and administrator-managed task-route allowlists; the existing account migrated as administrator.
+- 2026-09-01: Reframed the leadership dashboard from instruction-history/audit presentation to a platform-running view across tasks, people, input, output, time, type, and completion, with clickable drill-through and no visible technical payload language.
 
 ## In Progress
 

.project-docs/30-worklog/tasks/20260901-integrate-leadership-dashboard-9e2b6c.md

@@ -0,0 +1,50 @@
+# Task: Integrate leadership dashboard product definition
+
+## Identity
+
+- Task ID: 20260901-integrate-leadership-dashboard-9e2b6c
+- Mode: Integration
+- Branch: main
+- Worktree: /Users/inmanx/Documents/lwltAPI
+- Base commit: 823d1cb6305077e1743f8783176d2cae3b5aec39
+- Owner: codex
+- Status: Ready for integration
+
+## Scope
+
+- Integrate feature commit `823d1cb6305077e1743f8783176d2cae3b5aec39` and its accepted leadership-dashboard product correction into canonical project memory.
+- Reconcile `AUTH-001`, architecture/data-flow, domain rules, current state, evidence, and reflection indexes.
+- Do not change runtime behavior, restart services, access ERP, mutate tasks, or send data externally.
+
+## Intent And Constraints
+
+- Preserve the accepted three-role authorization and read-only manual-task dashboard boundary.
+- Record the user-confirmed distinction between an aggregate-first leadership operations view and an audit/debug history surface.
+- Canonicalize the rule that technical payloads and machine-shaped historical input are not rendered in the leadership dashboard while underlying audit evidence remains unchanged.
+
+## Outcome
+
+- Accepted the feature task's promotion candidates without semantic conflict: the correction narrows presentation and product framing but does not widen access or change task mutation authority.
+- Updated `AUTH-001`, decision index, system overview, data flow, business rules, current state, evidence index, and reflection index.
+- Recorded feature commit `823d1cb6305077e1743f8783176d2cae3b5aec39` and this integration task under `Integrated Through`.
+- No runtime, database, ERP, external-system, or service-process state was changed.
+
+## Verification
+
+- Source feature verification: repository check 10/10, control-plane 153/153, legacy 256/256, TypeScript check/build, JavaScript syntax, focused 8/8, diff check, and authenticated browser drill-through all passed.
+- `check_project_docs.py`: passed.
+- `check_doc_drift.py --task-id 20260901-integrate-leadership-dashboard-9e2b6c`: passed for all canonical writes.
+- `node --run check:repo`: 10/10 passed after canonical integration.
+- `node --run check`: passed after canonical integration.
+- `node --run test:control-plane`: 153/153 passed after canonical integration.
+- `node --run test:legacy`: 256/256 passed after canonical integration.
+- `node --run build`: passed after canonical integration.
+
+## Follow-ups
+
+- Create representative team-lead and ordinary-user accounts through the existing administrator workflow so the people-comparison dimension contains more than the migrated administrator.
+- Apply the control-plane projection on the next separately authorized service restart; the running static page already enforces the same leadership-safe presentation.
+
+## Promotion Candidates
+
+- None. The accepted feature candidates were promoted in this integration task.

.project-docs/40-domain/business-rules.md

@@ -7,7 +7,7 @@
 - The platform exposes one fixed deployment scope, not an organization-management product. Accounts use `admin`, `team_lead`, and `user` roles.
 - Administrators always hold all 18 manual business routes. Team leads and ordinary users start with no task grants, require explicit administrator allowlists, and may use normal task APIs only for their own manual tasks.
 - A known ungranted route or a non-unique/unresolved route for a non-administrator fails before parsing, plugin dispatch, or ERP execution. Authorization is rechecked for supplemental input, attachments, confirmation, automatic confirmation, and browser claim.
-- Team leads may read all manual account work only through the operations dashboard's who/instruction/result projection; this does not grant cross-user task mutation, artifacts, SSE, technical payloads, global settings, audit administration, or AgentBus access.
+- Team leads may read all manual account work only through the platform-operations dashboard. The dashboard is aggregate-first across task, person, original input, final output, time, task type, and completion state, with business-facing drill-through. It is not an audit log and never renders technical payloads, internal identifiers, machine-shaped historical input, or technical failure text; this visibility does not grant cross-user task mutation, artifacts, SSE, global settings, audit administration, or AgentBus access.
 - Creator and input-turn attribution are durable, business inputs remain encrypted at rest, denial audit excludes plaintext, and routine task removal uses archive/restore rather than physical purge.
 - The two passenger-list import routes are Program-only and wait for exactly one `.xls` or `.xlsx` attachment before deterministic normalization.
 - A WeChat attachment card is transport placeholder text, not file content. Only a structured `payload.attachments[]` entry can resume a roster task; missing metadata fails before ingestion and leaves the original task in `awaiting_attachment` instead of creating a new task.

.project-docs/50-evidence/evidence-index.md

@@ -13,6 +13,7 @@ Use this index for searchable, traceable evidence records.
 | 2026-08-31 | Privacy-safe server diagnostics | Repository verified; not deployed by this task | [Diagnostics task](../30-worklog/tasks/20260830-server-diagnostics-c4d8a1f2.md) | Structured lifecycle diagnostics, redaction, bounded Docker retention, and read-only server inspection command. |
 | 2026-08-31 | Production attachment failure | Root cause verified from supplied log | [Log-inspection task](../30-worklog/tasks/20260831-inspect-server-log-5d1e8a7c.md) | The original task remained waiting; the later structured attachment failed because DNS returned a private/reserved address. |
 | 2026-09-01 | Fixed-scope account authorization and dashboard | Repository and standard local runtime verified | [Integration task](../30-worklog/tasks/20260901-integrate-account-system-7b2f4d.md) | Three roles, owner isolation, creator/input audit, archive/restore, leadership dashboard, and 18-route allowlists passed full regression; migrations 015–017 and standard-panel readiness were verified. |
+| 2026-09-01 | Leadership platform-operations dashboard | Repository and authenticated browser verified | [Feature task](../30-worklog/tasks/20260901-leadership-dashboard-c4b9e1.md) | Aggregate-first task/person/input/output/time/type/completion presentation, business-safe projections, clickable drill-through, and full regression passed against the standard 8786 runtime. |
 
 ## When To Add Evidence
 

.project-docs/60-reflection/reflection-index.md

@@ -5,6 +5,7 @@ Use this index for second-order workflow lessons.
 | Date | Reflection | Trigger | Action | Detail |
 |---|---|---|---|---|
 | 2026-08-28 | Shared rolling planning files created repeated size pressure and forced semantic compression. | Root `task_plan.md` repeatedly approached or exceeded its fixed limit. | Replaced the legacy system with task-scoped records plus serialized canonical integration in `.project-docs/`. | [Migration task](../30-worklog/tasks/20260828-migrate-project-docs-6f1a9c2d.md) |
+| 2026-09-01 | A leadership dashboard is not a task audit log. | Human correction after an audit/history-oriented first implementation. | Start with audience and decision questions; keep leadership aggregates and business drill-through separate from engineering diagnostics. | [Reflection](cases/20260901-leadership-dashboard-c4b9e1__leadership-dashboard-boundary.md) |
 
 ## When To Reflect