docs: accept leader summary notification architecture

.project-docs/00-brief/success-criteria.md

@@ -5,6 +5,7 @@
 - 已登记业务能从手工输入或 AgentBus 输入稳定路由到统一 operation 契约。
 - 写能力只在唯一对象、页面身份、ownership、写前投影、明确服务端响应和 action-specific 完成凭据成立时执行。
 - ERP 执行以不可变任务归属账号为队列边界：同账号保持 FIFO 与单活跃执行，不同账号互不阻塞；管理员查看权限不能进入他人任务的事件、领取或插件回执链路。
+- 启用组长任务摘要时，系统只将未来稳定结果通过独立加密队列发送到已核验的组长 AgentBus 目标；通知失败不改变任务状态，摘要不扩大任务或 ERP 权限，也不暴露原始指令、客户资料或技术载荷。
 - 归档/恢复与永久强制删除保持为两个明确操作；强制删除不受任务状态门禁限制、完整移除任务平台记录，并明确不代表回滚既有 ERP 写入。
 - 当前发布物、源码和机器可读发布清单逐文件、逐哈希一致。
 - 项目记忆能在并行任务下保持任务隔离，并只通过串行 Integration Gate 更新 canonical 状态。
@@ -27,4 +28,4 @@
 
 ## Last Reviewed
 
-2026-09-03
+2026-09-07

.project-docs/05-agent-entry/integration-gate.md

@@ -6,6 +6,7 @@ Use this gate to promote completed task facts into canonical project memory.
 
 - Run in an exclusively owned integration worktree.
 - Hold the repository integration lock.
+- For a single completed Feature, create the Integration worktree from that Feature commit so its task-owned records are already inside the Integration task's recorded base. Verify the target default branch is an ancestor or reconcile it explicitly before canonical edits; starting from the older default branch and then introducing another task's record will correctly fail the drift gate.
 - Verify the task commits being integrated are present.
 - Review source task records, task-prefixed supporting records, promotion candidates, and semantic conflicts in read-only mode.
 - Write integration notes only to the integration task's own task record or `{task_id}__<slug>.md` supporting records.

.project-docs/05-agent-entry/read-before-planning.md

@@ -3,11 +3,11 @@
 Before writing any coding plan, follow this order:
 
 1. Run the Concurrent Task Gate.
-2. Read memory-index.md.
+2. Read `.project-docs/05-agent-entry/memory-index.md`.
 3. Read the active task record at `.project-docs/30-worklog/tasks/{task_id}.md`.
-4. Read project-positioning.md.
-5. Read current-state.md as the integrated snapshot.
-6. Read decision-index.md and system-overview.md.
+4. Read `.project-docs/00-brief/project-positioning.md`.
+5. Read `.project-docs/30-worklog/current-state.md` as the integrated snapshot.
+6. Read `.project-docs/10-decisions/decision-index.md` and `.project-docs/20-architecture/system-overview.md`.
 7. Inspect other locally active task scopes.
 
 Then read additional files when relevant:

.project-docs/10-decisions/AUTH-003-leader-task-summary-notifications.md

@@ -0,0 +1,49 @@
+# AUTH-003: Team-lead task-summary notifications
+
+## Status
+
+Accepted
+
+## Date
+
+2026-09-07
+
+## Context
+
+Team leads could inspect manual employee work through the read-only operations dashboard, but they had no bounded proactive notification path. Reusing employee AgentBus replies or fabricating inbound correlation would mix oversight with task ownership and execution routing. The fixed deployment also has no team-membership model from which a narrower supervisor scope can be derived.
+
+## Decision
+
+- Model each recipient as one administrator-managed subscription for an active `team_lead` and that leader's enabled AgentBus channel. The scope is the fixed organization, the feature defaults off, and manual and AgentBus task sources are independently selectable.
+- Project only results created after the current subscription revision starts. Include stable completed, failed, cancelled, and uncertain outcomes for tasks assigned to other non-administrator employees; never backfill history or copy transient progress.
+- Keep the summary projection read-only. It does not alter `assigned_user_id`, route grants, confirmation, queue position, executable SSE, browser claim, plugin result handling, reconciliation, or ERP authority, and delivery failure never changes task state.
+- Use a dedicated revisioned durable outbox rather than `agentbus_deliveries`. Encrypt recipient address, conversation ID, and payload at rest; expose only bounded fingerprints and counts to administration and diagnostics.
+- Require an explicitly verified recipient/conversation route before enablement. A subscription, target, role, ownership, or channel change cancels obsolete unsent rows without automatically rerouting them.
+- Keep messages deterministic and business-safe: employee username, registered business label, public task ID, submission time, generic outcome wording, and allowlisted group/order identifiers only. Do not copy original instructions, attachments, customer or traveller details, URLs, technical payloads, or technical errors.
+- Send employee replies before the smaller leader-summary batch. Proactive frames use event `task.summary`, stable ID `leader-summary-<delivery-id>`, explicit `to` and `conversation_id`, and no `reply_to`; inbound `task.summary` is reserved so an echo cannot create work.
+- Treat WebSocket delivery as at-least-once. Downstream routing should deduplicate the stable frame ID, and deleting platform data cannot retract a message already accepted by AgentBus or WeChat.
+
+## Rationale
+
+A separate projection preserves the existing employee reply and ERP execution invariants while giving leaders timely, privacy-bounded awareness. Default-off administration, target verification, encryption, revisioned deduplication, and future-only projection limit accidental disclosure and make route changes fail closed.
+
+## Consequences
+
+- Migration `020_leader_task_summary_notifications` is required before the updated control plane starts.
+- The `/channels` administrator page configures and observes subscriptions; it is not an arbitrary message composer and deliberately exposes no live test-send endpoint.
+- Repository verification proves projection, privacy, retry, priority, echo rejection, and database behavior, but production enablement still requires an authorized migration/restart plus a controlled AgentBus/WeChat canary for the exact target.
+- A later real team-membership model may narrow scope, but role labels alone must not be used to invent reporting relationships.
+
+## Supersedes
+
+- None. This extends the read-only leadership model without superseding AUTH-001 or AUTH-002.
+
+## Related
+
+- `.project-docs/10-decisions/AUTH-001-fixed-scope-account-authorization.md`
+- `.project-docs/10-decisions/AUTH-002-account-scoped-execution-and-force-delete.md`
+- `.project-docs/30-worklog/tasks/20260907-implement-leader-agentbus-copy-b7e31a94.md`
+- `control-plane/migrations/020_leader_task_summary_notifications.sql`
+- `control-plane/src/leader-notification-service.ts`
+- `control-plane/src/agentbus.ts`
+- `agent设计规范/agentbus-reply-contract.md`

.project-docs/10-decisions/decision-index.md

@@ -12,6 +12,7 @@
 | NETWORK-001 | In the trusted internal deployment, AgentBus roster attachment URLs may resolve to internal/private addresses; HTTPS, credential rejection, DNS pinning, redirect validation, bounds, and digest checks remain. | Active | 2026-08-31 | AgentBus attachment ingress | [Reply contract](../../agent设计规范/agentbus-reply-contract.md) |
 | AUTH-001 | The fixed deployment scope uses administrator-managed `admin`, `team_lead`, and `user` accounts, owner-isolated normal tasks, display-only leadership metrics with explicit filtering, explicit non-admin route grants, and assignee-bound AgentBus/browser/ERP execution. | Active except clauses superseded by AUTH-002 | 2026-09-01 | Authentication, authorization, audit, AgentBus workers, and operations oversight | [ADR](AUTH-001-fixed-scope-account-authorization.md) |
 | AUTH-002 | ERP execution is serialized per immutable assigned account, administrator visibility is never execution routing, and explicit force delete physically removes authorized tasks regardless of lifecycle state. | Active | 2026-09-03 | ERP claim queues, executable events/results, and task removal | [ADR](AUTH-002-account-scoped-execution-and-force-delete.md) |
+| AUTH-003 | Administrator-configured team-lead task summaries are a default-off, organization-wide read projection with a verified proactive AgentBus target and a separate encrypted outbox; they never grant task or ERP authority. | Active | 2026-09-07 | Team-lead notifications, AgentBus outbound routing, and summary privacy | [ADR](AUTH-003-leader-task-summary-notifications.md) |
 
 ## Superseded And Reverted Decisions
 

.project-docs/20-architecture/data-flow.md

@@ -16,6 +16,7 @@
 | Internal attachment download | Credential-free HTTPS URL | Bounded in-memory workbook bytes | Internal/private DNS answers are allowed; the selected address is pinned, every redirect is revalidated, and URL/host/IP/bytes are omitted from logs. |
 | Operational diagnostics | Service, request, task, parser, AgentBus, attachment, database, and cleanup stages | Structured stdout/stderr and bounded Docker logs | Correlation identifiers, codes, outcomes, and durations only; no secrets or business payloads. |
 | Platform operations oversight | Manual task creator, encrypted instruction history, and readable outcome | Team-lead/administrator leadership projection | Display-only summaries plus explicit filters drive an aggregate-first task/person/input/output/time/type/completion view; list reads are bounded to one read-only connection and hydrate full details only for the current page. |
+| Team-lead task summary | Future stable manual/AgentBus task outcome for another non-admin employee | Separate encrypted durable outbox → leader-owned AgentBus channel → verified WeChat conversation | Administrator-configured and default-off; employee replies are sent first, summary frames use stable IDs and explicit routing with no `reply_to`, and delivery failure never changes task state. |
 | Browser worker selection | Immutable task assignee | One fresh account-bound browser connection | The heartbeat must match the account's expected ERP identity; a second fresh worker or identity mismatch is non-executable, with failover only after staleness. |
 | Account-scoped ERP queue | Confirmed task assignee | Assigned account's browser worker | Organization-plus-account advisory locking preserves FIFO and at most one active execution for that account; another account's active, queued, stale, or uncertain work is outside this queue. |
 | Executable event and result routing | Immutable task assignee | Matching authenticated platform page and plugin | SSE history/live events, claims, plugin results, and browser cleanup commands never use administrator-wide visibility and fail closed when the authenticated account is not the assignee. |
@@ -25,7 +26,7 @@
 
 ## State Ownership
 
-- PostgreSQL owns durable control-plane account, role, expected ERP identity, task-route grant, AgentBus channel owner, immutable task assignee, account-scoped queue/lease state, browser worker, session, confirmation, audit, archive, and outcome state. A force-deleted task no longer exists in task state; only its minimal non-content deletion audit marker remains.
+- PostgreSQL owns durable control-plane account, role, expected ERP identity, task-route grant, AgentBus channel owner, immutable task assignee, account-scoped queue/lease state, browser worker, session, confirmation, audit, archive, outcome state, and revisioned team-lead notification subscriptions/deliveries. Notification destinations and payloads remain encrypted at rest. A force-deleted task no longer exists in task state; only its minimal non-content deletion audit marker remains, while an already delivered external message cannot be retracted.
 - Production attachment bytes use the configured OSS provider; normalized sensitive fields remain encrypted.
 - Chrome extension local state is bounded execution/reconciliation support, not canonical business history.
 - `.project-docs/30-worklog/tasks/` owns task-local project memory; canonical project state is an integrated projection.
@@ -39,4 +40,4 @@
 
 ## Last Updated
 
-2026-09-03
+2026-09-07

.project-docs/20-architecture/system-overview.md

@@ -2,7 +2,7 @@
 
 ## Current Architecture
 
-Authenticated manual or account-bound AgentBus input is routed through task-scoped AI/Shadow/Auto/Program orchestration into one validated operation contract. The control plane owns account, channel owner, immutable task assignee, account-scoped execution queue, browser worker, session, task-type authorization, confirmation, audit, reversible archive, and explicit force-delete behavior. The Chrome extension verifies the expected ERP account, resolves the unique ERP object, enforces page and write gates, performs native actions, and returns action-specific evidence.
+Authenticated manual or account-bound AgentBus input is routed through task-scoped AI/Shadow/Auto/Program orchestration into one validated operation contract. The control plane owns account, channel owner, immutable task assignee, account-scoped execution queue, browser worker, session, task-type authorization, confirmation, audit, reversible archive, explicit force-delete behavior, and default-off team-lead task-summary subscriptions. The Chrome extension verifies the expected ERP account, resolves the unique ERP object, enforces page and write gates, performs native actions, and returns action-specific evidence.
 
 ## Main Components
 
@@ -10,7 +10,7 @@ Authenticated manual or account-bound AgentBus input is routed through task-scop
 |---|---|---|
 | `agent设计规范/` | Agent Prompt, five parsing Skills, business templates, business registry, and stable fixtures | Editable source for business semantics; not runtime evidence |
 | `schemas/` and `mappings/` | Parse-state, execution-state, ERP form, field, and lifecycle contracts | Current contracts only |
-| `control-plane/` | Task/session persistence, parser orchestration, confirmation, audit, AgentBus channel ownership, task assignment, browser workers, attachments, receipts, and structured diagnostics | TypeScript source; build output goes to `.build/` |
+| `control-plane/` | Task/session persistence, parser orchestration, confirmation, audit, AgentBus channel ownership, task assignment, browser workers, attachments, receipts, encrypted leader-summary projection/outbox, and structured diagnostics | TypeScript source; build output goes to `.build/` |
 | `LianSyn-platform/` | Operator workbench and external parser adapter | Source and UI, not local task output |
 | `chrome-extension/ltjt-order-assistant/` | Logged-in ERP resolution, preflight, native execution, response handling, requery, and dormant idle/reload safety handlers | Current server/platform does not trigger automatic updates; any code change requires synchronized versioned release updates |
 | `dist/` | Versioned current deliverables and machine-readable release manifest | Not a compilation directory |
@@ -24,15 +24,16 @@ Authenticated manual or account-bound AgentBus input is routed through task-scop
 - The product is one fixed internal organization scope with three roles. Administrators manage accounts, channels, and all 18 manual routes; team leads and users are owner-scoped for normal tasks and require explicit per-route grants. Team leads additionally receive a dedicated read-only, manual-task-only platform-operations dashboard. Administrator-wide visibility does not permit executing another account's assigned ERP work.
 - Account passwords are accepted when non-empty without an application-level length rule. First-login forced password changes are disabled; voluntary changes and administrator resets still revoke the relevant sessions, while the historical `must_change_password` column remains compatibility-only storage.
 - The leadership dashboard is an aggregate-first projection across task, person, original input, final output, time, task type, and completion state. Summary cards are display-only; filtering is explicit and defaults to all results. List reads use one bounded read-only database transaction, SQL prefiltering, selective historical-message hydration, and full detail projection only for the current 20-row page. Its drill-through stays business-facing; technical payloads, internal identifiers, machine-shaped historical input, and technical failure text remain in separate authorized audit/engineering surfaces.
+- Team-lead task summaries are a separate administrator-configured read projection, not an extension of dashboard, task, or ERP authority. Each default-off subscription uses the leader's own enabled AgentBus channel and a verified encrypted target, covers only future stable outcomes for other non-admin employees from explicitly selected manual/AgentBus sources, and never copies raw instructions, attachments, customer/traveller data, URLs, or technical errors.
 - Authorization is enforced in server and service paths, not by navigation visibility. A denied or unresolved non-admin business route stops before parsing, plugin dispatch, and ERP execution; creator authorization is rechecked at confirmation and browser claim.
-- Each enabled AgentBus channel owns one active non-admin employee account. Inbound work uses that account and route allowlist, persists the same account as immutable task assignee, and is returned only to that account's executable feed.
+- Each enabled AgentBus channel owns one active non-admin employee account. Inbound work uses that account and route allowlist, persists the same account as immutable task assignee, and is returned only to that account's executable feed. A team-lead channel may additionally carry its leader's lower-priority proactive summary outbox; those rows use explicit destination/conversation routing and never become executable task traffic.
 - Each employee account has one expected ERP identity and at most one fresh browser execution worker. Mismatched ERP identity, concurrent fresh workers, unbound channels, or unassigned tasks fail closed. Browser claims, active-execution checks, and confirmed FIFO are serialized per immutable task assignee, so one account cannot block or occupy another account's queue.
 - Administrator-wide task visibility is a read model, not an executable feed. Task SSE history/live events, browser claims, plugin-result ingestion, and browser cleanup commands are always scoped to the authenticated account matching `assigned_user_id`, including for administrators.
 - Extension `0.5.167` is the current manually published/loaded plugin baseline. It retains an idle-proof and guarded-reload message protocol, but the active control plane has no extension-release tables, ECS host mapping, OSS publication endpoint, Cloud Assistant dispatcher, or platform trigger; required migration remains 018.
 - Creator and manual input-turn attribution remain durable while business input stays encrypted at rest. Routine removal is reversible archive/restore. Separately confirmed force delete physically removes an authorized task regardless of lifecycle state, retains only a minimal non-content deletion audit marker, and cannot undo an ERP write that already occurred.
 - Unknown, ambiguous, unverified, or post-write-uncertain states fail closed; automatic retries must not create duplicate writes.
 - PostgreSQL is the sole required durable database/state middleware, and the production artifact provider is OSS. Redis, message queues, MongoDB, and search services are not runtime dependencies.
-- Migrations through `018_agentbus_account_workers` must complete before the updated application starts. The current ACK topology starts with one application replica because AgentBus listeners and SSE emission are process-local; horizontal scale requires explicit coordination first.
+- Migrations through `020_leader_task_summary_notifications` must complete before the updated application starts; migration 019 remains intentionally absent after the extension-updater rollback. The current ACK topology starts with one application replica because AgentBus listeners and SSE emission are process-local; horizontal scale requires explicit coordination first.
 - Operational diagnostics are privacy-safe structured JSON on stdout/stderr. Docker owns bounded rotation; repository files and a second mutable log database are not log sinks.
 - In the trusted internal deployment, AgentBus roster attachment downloads may resolve to private/reserved addresses. Credential-free HTTPS, DNS resolution/pinning, redirect revalidation, size, timeout, and digest checks remain mandatory, and trusted channels/bridges own the network-input boundary.
 - Canonical project memory is updated only under Integration Gate; feature tasks write only their task-scoped records.
@@ -47,7 +48,8 @@ Authenticated manual or account-bound AgentBus input is routed through task-scop
 - NETWORK-001
 - AUTH-001
 - AUTH-002
+- AUTH-003
 
 ## Last Updated
 
-2026-09-03
+2026-09-07

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,7 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- Source commit `1a3ab63` from feature task `20260907-implement-leader-agentbus-copy-b7e31a94` for default-off team-lead task summaries over future manual and AgentBus outcomes, a separate encrypted/revisioned outbox, verified proactive AgentBus routing, administrator configuration/health UI, and migration 020; integration task `20260907-integrate-leader-summaries-84c1d7ea` accepted AUTH-003 and canonical notification boundaries.
 - Correction commit `fe1cc2cddc29e4dead81e53c16d31bb71493602d` from integration task `20260903-backup-revert-extension-update-c71a4e92` preserved the complete former `0.5.167`/migration-019 stack at remote branch `codex/backup-extension-update-20260903-b2e33e2`, removed the central private-OSS/ECS automatic-update service architecture without rewriting history, and retained the exact Chrome extension `0.5.167` source/package on the active main line with migration 018.
 - Merge commit `3224758` and integration task `20260903-finalize-extension-update-a6c4e192` remain historical records of the full-stack extension-update design. Only the plugin `0.5.167` release, adaptive entry readiness, and dormant plugin-side idle/reload safeguards remain active; the server orchestration is preserved on the backup branch only.
 - Commit `c4c469f4441d744627af2d34abe693b6783e833c` for the independently advanced remote deployment/extension line.
@@ -33,7 +34,7 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Current Focus
 
-Operate the repository's current `0.5.167` extension baseline and fixed-scope account model safely, bind each enabled AgentBus channel to one employee/ERP identity, provision narrow route grants, use explicit leadership-dashboard filters, and preserve Program/AI plus per-assigned-account ERP execution boundaries. Same-account tasks remain FIFO and single-active; distinct accounts are independent, and administrator visibility never enters another account's executable event/result path. Migration 018, manual extension reload, guarded product-search retry, and service rollout remain separately authorized runtime work; server-side automatic extension updating is not part of the active main line.
+Operate the repository's current `0.5.167` extension baseline and fixed-scope account model safely, bind each enabled AgentBus channel to one employee/ERP identity, provision narrow route grants, use explicit leadership-dashboard filters, and preserve Program/AI plus per-assigned-account ERP execution boundaries. Same-account tasks remain FIFO and single-active; distinct accounts are independent, and administrator or team-lead visibility never enters another account's executable event/result path. Team-lead task summaries remain default-off until an administrator verifies the exact proactive route; migration 020, manual extension reload, guarded product-search retry, and service rollout remain separately authorized runtime work. Server-side automatic extension updating is not part of the active main line.
 
 ## Recently Completed
 
@@ -58,19 +59,21 @@ Operate the repository's current `0.5.167` extension baseline and fixed-scope ac
 - 2026-09-03: Accepted AUTH-002 and integrated account-scoped ERP queues. Each immutable assignee now owns one FIFO/single-active claim partition, different accounts no longer block one another, and executable SSE/results/cleanup commands are owner-only even when an administrator is signed in.
 - 2026-09-03: Restored explicit permanent force deletion as a separate operation from reversible archive/restore. It bypasses lifecycle-state gates, physically removes task-owned platform records, retains a minimal deletion audit marker, performs post-commit cleanup best effort, and warns that prior ERP effects are not rolled back.
 - 2026-09-03: Backed up the complete adaptive-readiness and central extension-update stack at remote branch `codex/backup-extension-update-20260903-b2e33e2`, then removed the central OSS/ECS update service and migration 019 from `main` with normal history-preserving commits. After correcting an initially over-broad rollback, the active repository retains the exact extension `0.5.167` source/package and uses migration 018; the removed server architecture was never deployed by these tasks.
+- 2026-09-07: Integrated AUTH-003 and migration 020 for administrator-managed team-lead task summaries. Future stable manual/AgentBus outcomes for other non-admin employees project into a separate encrypted outbox and use the leader's verified AgentBus/WeChat target without changing task ownership, employee reply priority, or ERP execution authority.
 
 ## In Progress
 
 - The standard database currently contains one administrator account and no non-administrator task grants. Multi-account operational smoke testing remains for an administrator-led staging window.
-- Migration `018_agentbus_account_workers`, employee ERP identities/channel bindings, extension `0.5.167`, account-scoped queue/routing changes, force-delete behavior, and the merged dashboard/runtime changes have not been applied to or restarted on the standard service in this integration task.
+- Required migrations through `020_leader_task_summary_notifications`, employee ERP identities/channel bindings, extension `0.5.167`, account-scoped queue/routing changes, force-delete behavior, and the merged dashboard/notification runtime changes have not been applied to or restarted on the standard service in this integration task. No production team-lead target is configured or enabled.
 
 ## Next Recommended Steps
 
-1. In an explicitly authorized staging/rollout window, back up PostgreSQL, apply migration 018, restart the control plane, manually load extension `0.5.167`, verify its runtime handshake, configure employee ERP identities and channel bindings, and run the multi-cloud-PC/identity/failover plus account-queue matrix before production assurance.
+1. In an explicitly authorized staging/rollout window, back up PostgreSQL, apply all migrations through 020, restart the control plane, manually load extension `0.5.167`, verify its runtime handshake, configure employee ERP identities and channel bindings, and run the multi-cloud-PC/identity/failover plus account-queue matrix before production assurance.
 2. Through the administrator UI, create representative team-lead and ordinary accounts, assign narrow task grants, and verify owner isolation, leadership dashboard reads, grant/revoke behavior, and denial prompts without ERP writes.
 3. In the same authorized staging window, verify that an administrator receives no employee executable events/results, then force-delete disposable waiting and active employee tasks and confirm database absence plus cleanup only in the owning employee plugin.
 4. With explicit authorization, run a live read-only ERP verification of the shared-mother-plan `tid-only` whole-visitor export path.
 5. With explicit authorization, perform ERP write verification for independent-order SGL/TWN and adult/child/leader headcount mappings.
+6. With explicit external-send authorization, configure one controlled team-lead route, verify proactive `task.summary` handling and stable-frame deduplication through AgentBus/WeChat, then observe one manual and one AgentBus task before wider enablement.
 
 ## Open Questions / Blockers
 
@@ -80,6 +83,7 @@ Operate the repository's current `0.5.167` extension baseline and fixed-scope ac
 - AgentBus account-worker routing still lacks a live two-employee/two-cloud-PC staging matrix covering mismatched ERP login, same-account device conflict, 90-second stale failover, same-account FIFO, cross-account independence, administrator executable-feed isolation, and both manual and automatic channel work.
 - Lifecycle-independent force deletion has repository regression evidence but lacks an authorized runtime smoke test for waiting/active deletion, database absence, OSS cleanup, and owner-plugin-only cleanup.
 - A live internal AgentBus attachment verification remains separately unperformed.
+- Proactive team-lead `task.summary` delivery has repository, mock-WebSocket, and disposable-PostgreSQL evidence but no deployed AgentBus/WeChat canary; exact production target verification and enablement remain pending authorization.
 
 ## Risky Areas
 
@@ -89,8 +93,9 @@ Operate the repository's current `0.5.167` extension baseline and fixed-scope ac
 - Account role changes, session revocation, creator-based task-route revocation, cross-user dashboard projection, and encrypted input audit are security-sensitive boundaries.
 - AgentBus channel ownership, immutable task assignment, expected ERP identity, browser-worker freshness/failover, and administrator non-execution are security- and write-safety-sensitive boundaries.
 - Account-scoped advisory locking, per-assignee FIFO queries, executable SSE/result routing, and irreversible force deletion are concurrency-, authorization-, and evidence-sensitive boundaries.
+- Team-lead summary target verification, encrypted projection/delivery rows, at-least-once stable-frame deduplication, privacy allowlisting, and non-retractable external delivery are authorization- and disclosure-sensitive boundaries.
 - Release synchronization across extension source, minimum platform version, mapping, ZIP, Skills, DOCX, and `dist/release-manifest.json`.
 
 ## Last Updated
 
-2026-09-03
+2026-09-07

.project-docs/30-worklog/task-history.md

@@ -11,3 +11,4 @@ This is integrated history. Feature tasks write only their task-scoped records;
 | 2026-09-02 | Leadership dashboard query and filter contract | Integrated bounded single-connection reads, 20-row paging, cancellation/timeout feedback, display-only metrics, and explicit result filtering. | [Integration task](tasks/20260902-integrate-all-push-c93a7f21.md) |
 | 2026-09-03 | Adaptive ERP readiness and extension host updates | Integrated immediate-first scatter-plan readiness plus private OSS/ECS host updating as extension `0.5.167`; the server-update architecture was later reverted before deployment while the plugin release was retained. | [Original integration task](tasks/20260903-finalize-extension-update-a6c4e192.md) |
 | 2026-09-03 | Extension-update iteration backup and scoped rollback | Preserved exact commit `b2e33e2` on remote branch `codex/backup-extension-update-20260903-b2e33e2`, removed migration 019 and server-side automatic updating, and retained extension `0.5.167` plus migration 018 through non-force commits. | [Rollback task](tasks/20260903-backup-revert-extension-update-c71a4e92.md) |
+| 2026-09-07 | Team-lead AgentBus task summaries | Integrated default-off future-only summaries for other non-admin employees' manual/AgentBus outcomes through a separate encrypted outbox and verified proactive target, without changing task or ERP authority. | [Integration task](tasks/20260907-integrate-leader-summaries-84c1d7ea.md) |

.project-docs/30-worklog/tasks/20260907-integrate-leader-summaries-84c1d7ea.md

@@ -0,0 +1,55 @@
+# Task: Integrate leader AgentBus task summaries
+
+## Identity
+
+- Task ID: 20260907-integrate-leader-summaries-84c1d7ea
+- Mode: Integration
+- Branch: codex/20260907-integrate-leader-summaries-84c1d7ea-integrate-leader-summaries
+- Worktree: /Users/inmanx/Documents/lwltAPI-integrate-leader-summaries-6d42be91-v2
+- Base commit: 1a3ab6370071d80720f50efc64a97053ad3fe7fc
+- Owner: codex
+- Status: Integration in progress
+
+## Scope
+
+- Use completed feature commit `1a3ab63` as the Integration baseline for administrator-managed team-lead task-summary notifications.
+- Review and promote the source task's accepted durable notification, authorization, privacy, protocol, data-model, operational, and rollout facts into canonical project memory.
+- Run complete repository/document/test/build gates, then advance remote `main` through a normal non-force push without modifying the occupied local `main` worktree.
+
+## Intent And Constraints
+
+- The user explicitly authorized merging to `main` and pushing the repository. This authorizes Git integration/push, not a database migration, service restart/deployment, channel configuration, task mutation, ERP access, or a real external message.
+- Preserve AUTH-001/002 task ownership and account-scoped ERP execution. Accept the user-confirmed fixed-organization subscription and both manual/AgentBus sources as AUTH-003, while keeping the notification read-only, default-off, future-only, privacy-safe, and independent of employee AgentBus replies.
+- Source task records remain read-only. Integration owns only its task record and canonical reconciliation files in this exclusive worktree.
+- The local `main` checkout remains occupied by task `20260902-migrate-restart-confirmed-4f8c2a71` and contains its untracked record; do not modify, adopt, stash, reset, clean, or fast-forward that worktree.
+- The previous completed integration-lock owner was clean and recorded as integrated/pushed, so it was released normally without `--force` before this task acquired the lock.
+
+## Outcome
+
+- Started from source commit `1a3ab63`, which directly descends from current `origin/main` `f466499` and already contains the immutable source task record required by the Integration drift gate.
+- Accepted AUTH-003 and reconciled decision index, system overview, data flow, business rules, success criteria, current state, task history, evidence index, and rollout commitments around the separate default-off encrypted leader-summary projection and proactive AgentBus contract.
+- Corrected three stale paths in the required read-before-planning entry so they point to the actual memory index, project positioning, and current-state files.
+- An initial unpushed integration worktree had been based on `origin/main`; its drift check correctly rejected the newly introduced source task record as foreign. That clean intermediate history was retained locally, its lock was normally released, and this final integration restarted from the source commit without force, reset, or lost changes.
+- Remote push pending final verification.
+
+## Verification
+
+- `npm run check:repo`: passed (10/10), including active Markdown links and repository/release hygiene.
+- `npm run check`: passed.
+- `npm run test:control-plane`: passed (174/174).
+- `npm run test:legacy`: passed (270/270).
+- `npm run build`: passed.
+- `node --check LianSyn-platform/app.js`: passed.
+- `git diff --check`: passed.
+- `check_project_docs.py`: passed.
+- `check_doc_drift.py --task-id 20260907-integrate-leader-summaries-84c1d7ea`: passed from the corrected source-commit baseline, with no foreign task-owned document changes.
+- `git merge-base --is-ancestor origin/main 1a3ab63`: passed before integration, proving the current remote main tip is contained in the source baseline.
+- The final Integration worktree reused the Feature worktree's byte-identical ignored `node_modules` through a temporary symlink; the link was removed after verification.
+
+## Follow-ups
+
+- Production migration 020, service restart/deployment, exact leader target configuration, and controlled AgentBus/WeChat canary remain separately authorized rollout work.
+
+## Promotion Candidates
+
+- None. Accepted source facts were promoted through AUTH-003 and the canonical architecture/domain/state/evidence/commitment documents in this Integration task.

.project-docs/40-domain/business-rules.md

@@ -9,7 +9,8 @@
 - Administrators always hold all 18 manual business routes. Team leads and ordinary users start with no task grants, require explicit administrator allowlists, and may use normal task APIs only for their own manual tasks.
 - A known ungranted route or a non-unique/unresolved route for a non-administrator fails before parsing, plugin dispatch, or ERP execution. Authorization is rechecked for supplemental input, attachments, confirmation, automatic confirmation, and browser claim.
 - Team leads may read all manual account work only through the platform-operations dashboard. The dashboard is aggregate-first across task, person, original input, final output, time, task type, and completion state, with business-facing drill-through. Its five summary cards are display-only; the explicit task-result filter defaults to all results. Internal attention or waiting-for-input states remain unchanged in task storage but are presented and filtered as “进行中”; the leadership view exposes no separate “待跟进” category. It is not an audit log and never renders technical payloads, internal identifiers, machine-shaped historical input, or technical failure text; this visibility does not grant cross-user task mutation, artifacts, SSE, global settings, audit administration, or AgentBus access.
-- Creator and input-turn attribution are durable, business inputs remain encrypted at rest, and denial audit excludes plaintext. Archive/restore is the reversible routine removal path. Explicit force delete is a separate irreversible operation that may physically remove an authorized task in any lifecycle state, retains only a minimal non-content deletion audit marker, and cannot undo ERP effects already written.
+- Separately, an administrator may configure one default-off organization-wide task-summary subscription on a team lead's own AgentBus channel. It may include future manual and/or AgentBus tasks assigned to other non-admin employees, but only stable completed, failed, cancelled, uncertain, and uncertain-then-resolved outcomes. The verified target and summary payload are encrypted, history is not backfilled, employee replies retain priority, and the message never includes raw instructions, attachments, customer/traveller data, URLs, or technical errors. This notification grants no task mutation, executable event, confirmation, browser, reconciliation, or ERP authority.
+- Creator and input-turn attribution are durable, business inputs remain encrypted at rest, and denial audit excludes plaintext. Archive/restore is the reversible routine removal path. Explicit force delete is a separate irreversible operation that may physically remove an authorized task in any lifecycle state, retains only a minimal non-content deletion audit marker, and cannot undo ERP effects already written or retract a task summary already accepted by AgentBus/WeChat.
 - Each non-admin employee may carry one case-insensitively unique expected ERP account and one AgentBus channel. New manual and AgentBus tasks persist an immutable assignee; only that account may confirm, claim, reconcile, resume, or submit ERP execution results. Administrators manage and inspect but do not execute another assignee's work.
 - A browser is execution-ready only when it is the account's sole fresh worker and the active ERP session matches the expected account. Concurrent fresh workers, identity mismatch, unbound channels, and historical unassigned AgentBus tasks fail closed; stale failover waits 90 seconds. Claim locking, active-execution detection, confirmed FIFO, and queue position are scoped to immutable `assigned_user_id`: the same account stays serialized while different accounts execute independently.
 - Administrator-wide task visibility never grants execution routing. Executable SSE history/live events, browser claims, plugin-result ingestion, and force-delete browser cleanup commands are scoped to the authenticated account matching the task assignee, so an administrator page or plugin cannot receive or process an employee's task.
@@ -33,4 +34,4 @@
 
 ## Last Reviewed
 
-2026-09-03
+2026-09-07

.project-docs/50-evidence/evidence-index.md

@@ -22,6 +22,7 @@ Use this index for searchable, traceable evidence records.
 | 2026-09-03 | Account-scoped ERP queues, assignee-only executable routing, and force delete | Repository and full regression verified; runtime not deployed or mutated | [Integration task](../30-worklog/tasks/20260903-finalize-account-routing-7c4e2a91.md) | Source task `20260902-per-account-queue-hard-delete-a6d9f2c1` replaced global head-of-line blocking with per-assignee FIFO/advisory locks, isolated SSE/plugin-result/browser-command routing from administrator read visibility, and separated reversible archive from lifecycle-independent physical deletion. |
 | 2026-09-03 | Adaptive ERP readiness and central extension host updates | Mixed disposition: plugin/release retained; server architecture reverted before production rollout | [Original integration task](../30-worklog/tasks/20260903-finalize-extension-update-a6c4e192.md) | Exact extension `0.5.167` source/package and adaptive readiness remain active. Migration 019 and central private-OSS/ECS orchestration are recoverable only at exact commit `b2e33e2` on remote branch `codex/backup-extension-update-20260903-b2e33e2`. |
 | 2026-09-03 | Extension-update iteration scoped rollback | Backup ref verified; `0.5.167` retained; server/migration rollback and regression rechecked | [Rollback task](../30-worklog/tasks/20260903-backup-revert-extension-update-c71a4e92.md) | The full stack was backed up before normal non-force commits removed server-side automatic updating and migration 019; active main keeps extension `0.5.167` and migration 018 without rewriting Git history. |
+| 2026-09-07 | Team-lead task-summary projection and proactive AgentBus delivery | Repository and disposable-PostgreSQL verified; not deployed or externally sent | [Feature task](../30-worklog/tasks/20260907-implement-leader-agentbus-copy-b7e31a94.md) | Migration 020, future-only encrypted projection, privacy allowlist, stale-uncertainty supersession, employee-first outbound priority, stable proactive frame IDs, no `reply_to`, echo rejection, and administrator controls passed full regression; exact AgentBus/WeChat routing still needs an authorized canary. |
 
 ## When To Add Evidence
 

.project-docs/60-reflection/cases/20260907-integrate-leader-summaries-84c1d7ea__integration-source-baseline.md

@@ -0,0 +1,19 @@
+# Reflection: Integration source baseline
+
+## Trigger
+
+The first leader-summary Integration worktree was created from `origin/main` and then merged the completed Feature commit. Because `check_doc_drift.py` compares the Integration tree with its recorded base, the Feature's required task record appeared as a foreign task-owned change even though Integration had not edited it.
+
+## Lesson
+
+For one completed Feature, the Integration task should start from the Feature commit that already contains its task record. The target default branch must then be verified as an ancestor or reconciled before canonical edits. This preserves the source record as read-only while making the drift boundary mechanically accurate.
+
+## Action
+
+- Restarted the Integration task from source commit `1a3ab63` after preserving the first attempt and normally releasing its lock.
+- Added the single-Feature baseline rule to `.project-docs/05-agent-entry/integration-gate.md`.
+- Kept the occupied `main` worktree untouched and used no force, reset, stash, or history rewrite.
+
+## Reuse
+
+Apply this baseline choice to future one-Feature integrations. Multiple-source integrations still require an explicitly reviewed combined strategy; do not bypass foreign task-record checks.

.project-docs/60-reflection/reflection-index.md

@@ -6,6 +6,7 @@ Use this index for second-order workflow lessons.
 |---|---|---|---|---|
 | 2026-08-28 | Shared rolling planning files created repeated size pressure and forced semantic compression. | Root `task_plan.md` repeatedly approached or exceeded its fixed limit. | Replaced the legacy system with task-scoped records plus serialized canonical integration in `.project-docs/`. | [Migration task](../30-worklog/tasks/20260828-migrate-project-docs-6f1a9c2d.md) |
 | 2026-09-01 | A leadership dashboard is not a task audit log. | Human correction after an audit/history-oriented first implementation. | Start with audience and decision questions; keep leadership aggregates and business drill-through separate from engineering diagnostics. | [Reflection](cases/20260901-leadership-dashboard-c4b9e1__leadership-dashboard-boundary.md) |
+| 2026-09-07 | A single-Feature Integration baseline must already contain the source task record. | An Integration worktree started from the older default branch introduced the Feature record after its recorded base, so the drift gate rejected it as a foreign task-owned change. | Restart from the completed Feature commit, verify default-branch ancestry, and document the baseline rule in the Integration Gate. | [Reflection](cases/20260907-integrate-leader-summaries-84c1d7ea__integration-source-baseline.md) |
 
 ## When To Reflect
 

.project-docs/80-commitments/commitments.md

@@ -10,6 +10,7 @@ Track future-facing memory: promised follow-ups, unfinished loops, timed checks,
 | 2026-09-02 | Roll out and stage-test AgentBus account workers, account-scoped queues, and force deletion. | Explicit authorization for database backup/migration, service restart, extension reload, account/channel configuration, staging traffic, and disposable task mutation | Future authorized rollout task | Pending authorization | Apply migration 018 and extension `0.5.165`; verify two employee accounts/cloud PCs, ERP identity mismatch, same-account worker conflict/FIFO, cross-account independence, 90-second failover, administrator executable-feed isolation, manual/AgentBus routing, and waiting/active force-delete cleanup. |
 | 2026-09-02 | Verify the integrated native product-search execution path. | Explicit authorization for extension reload and a guarded ERP preflight/retry | Future authorized rollout task | Pending authorization | Load extension `0.5.165`, confirm the runtime handshake, then verify deterministic product selection and normal write gates without automatically retrying the earlier failed task. |
 | 2026-09-03 | Bootstrap and canary the central extension-update channel. | Former rollout plan for reverted server-side `EXT-001` architecture | None while reverted | Cancelled by user rollback | Extension `0.5.167` remains the current manual plugin release. Do not deploy migration 019 or the removed server updater from `main`; consult `codex/backup-extension-update-20260903-b2e33e2` only if a future explicit decision revives that architecture. |
+| 2026-09-07 | Deploy and canary team-lead task-summary notifications. | Explicit authorization for database backup/migration, service restart, channel/target configuration, and controlled external AgentBus/WeChat delivery | Future authorized rollout task | Pending authorization | Apply migrations through 020, verify one exact team-lead route, confirm `task.summary` routing and stable-ID deduplication, then observe one manual and one AgentBus task before wider enablement. |
 
 ## Use