From b7bb1d6b529f70408f3c3accbb22aeb7905a9d47 Mon Sep 17 00:00:00 2001 From: inman Date: Thu, 3 Sep 2026 09:55:32 +0800 Subject: [PATCH] docs: reconcile account-scoped execution decisions --- .project-docs/00-brief/success-criteria.md | 4 +- ...H-001-fixed-scope-account-authorization.md | 10 +++- ...count-scoped-execution-and-force-delete.md | 55 +++++++++++++++++++ .project-docs/10-decisions/decision-index.md | 4 +- .project-docs/20-architecture/data-flow.md | 7 ++- .../20-architecture/system-overview.md | 10 ++-- .project-docs/30-worklog/current-state.md | 23 +++++--- .project-docs/40-domain/business-rules.md | 7 ++- .project-docs/50-evidence/evidence-index.md | 1 + .project-docs/80-commitments/commitments.md | 2 +- agent设计规范/business-adaptation-registry.md | 2 +- 11 files changed, 101 insertions(+), 24 deletions(-) create mode 100644 .project-docs/10-decisions/AUTH-002-account-scoped-execution-and-force-delete.md diff --git a/.project-docs/00-brief/success-criteria.md b/.project-docs/00-brief/success-criteria.md index b9df609..631982c 100644 --- a/.project-docs/00-brief/success-criteria.md +++ b/.project-docs/00-brief/success-criteria.md @@ -4,6 +4,8 @@ - 已登记业务能从手工输入或 AgentBus 输入稳定路由到统一 operation 契约。 - 写能力只在唯一对象、页面身份、ownership、写前投影、明确服务端响应和 action-specific 完成凭据成立时执行。 +- ERP 执行以不可变任务归属账号为队列边界：同账号保持 FIFO 与单活跃执行，不同账号互不阻塞；管理员查看权限不能进入他人任务的事件、领取或插件回执链路。 +- 归档/恢复与永久强制删除保持为两个明确操作；强制删除不受任务状态门禁限制、完整移除任务平台记录，并明确不代表回滚既有 ERP 写入。 - 当前发布物、源码和机器可读发布清单逐文件、逐哈希一致。 - 项目记忆能在并行任务下保持任务隔离，并只通过串行 Integration Gate 更新 canonical 状态。 @@ -25,4 +27,4 @@ ## Last Reviewed -2026-08-28 +2026-09-03 diff --git a/.project-docs/10-decisions/AUTH-001-fixed-scope-account-authorization.md b/.project-docs/10-decisions/AUTH-001-fixed-scope-account-authorization.md index 3ec9656..006bedc 100644 --- a/.project-docs/10-decisions/AUTH-001-fixed-scope-account-authorization.md +++ b/.project-docs/10-decisions/AUTH-001-fixed-scope-account-authorization.md @@ -2,12 +2,16 @@ ## Status -Accepted +Accepted; superseded in part by AUTH-002 ## Date 2026-09-01 +## Supersession Note + +AUTH-002 supersedes only this ADR's organization-wide ERP FIFO and archive-only removal clauses. The remaining fixed-scope account, role, route-grant, owner-isolation, dashboard, AgentBus assignment, browser-worker, and ERP-identity decisions remain active. Current execution-queue and deletion behavior must be read from AUTH-002. + ## Context The platform already required login but treated the fixed deployment scope as a shared administrator workspace. It needed administrator-maintained accounts, per-user task isolation, a team-lead oversight role, creator/original-input audit, explicit task-type eligibility, and a deterministic employee-to-AgentBus-to-ERP execution binding without introducing tenant or organization administration. @@ -23,11 +27,11 @@ The platform already required login but treated the fixed deployment scope as a - Give team leads a dedicated read-only platform-operations dashboard over all manual account tasks. It is an aggregate-first leadership view across task, person, original input, final output, time, task type, and completion state; every aggregate may drill into the same bounded business-facing task projection. - Keep the leadership dashboard separate from audit and engineering diagnostics. It never renders parser/executor payloads, internal identifiers, codes, machine-shaped historical input, or technical failure text; those values are replaced by a concise business explanation without changing the underlying audit evidence. - Keep leadership summary cards display-only. Status changes are explicit filter-form actions, default to all results, and retain the business-facing merge of internal attention states into “进行中”. -- Preserve creator and input-turn attribution with encrypted input at rest. Routine removal is archive/restore; irreversible purge is not exposed. +- Superseded by AUTH-002 for removal behavior: preserve creator and input-turn attribution with encrypted input at rest. The original decision exposed archive/restore only and did not expose irreversible purge. - Bind each enabled AgentBus channel to exactly one active `user` or `team_lead` account with a configured, case-insensitively unique expected ERP account. Administrator accounts remain unbound from employee channels. - Execute inbound AgentBus work under the bound employee identity and that account's route allowlist. Persist one immutable task assignee for both manual and AgentBus work; confirmation, browser claim/result, reconciliation, and resume require the assignee even when the caller is an administrator. - Allow only one fresh browser execution worker per account. Heartbeats must match the account's expected ERP identity; a second fresh worker or mismatched ERP session fails closed, and automatic failover begins only after the prior worker is stale. -- Preserve organization-wide ERP FIFO serialization. Employee worker binding chooses who may execute; it does not authorize parallel ERP writes. +- Superseded by AUTH-002 for queue scope: the original decision preserved organization-wide ERP FIFO serialization. Employee worker binding chose who could execute but did not authorize parallel ERP writes. ## Rationale diff --git a/.project-docs/10-decisions/AUTH-002-account-scoped-execution-and-force-delete.md b/.project-docs/10-decisions/AUTH-002-account-scoped-execution-and-force-delete.md new file mode 100644 index 0000000..ec34914 --- /dev/null +++ b/.project-docs/10-decisions/AUTH-002-account-scoped-execution-and-force-delete.md @@ -0,0 +1,55 @@ +# AUTH-002: Account-scoped ERP execution and explicit force delete + +## Status + +Accepted + +## Date + +2026-09-03 + +## Context + +AUTH-001 bound each task to one employee account and one matching ERP browser worker, but retained organization-wide ERP FIFO and archive-only operator removal. In production, one blocked or stale account could therefore hold every other employee's work behind the same queue. Administrator-wide task visibility also shared paths with executable event delivery, allowing an administrator page and plugin to observe or attempt to process another employee's task. Finally, an active or waiting task could fail the archive gate and then could not be permanently removed, leaving the same blocked state in place. + +The user explicitly required independent execution across accounts, FIFO only within the same account, strict separation between administrator inspection and employee execution routing, and an authoritative force-delete operation that is not blocked by task state. + +## Decision + +- Use immutable `tasks.assigned_user_id` as the ERP execution queue and routing partition. +- Serialize browser claims with an advisory transaction lock scoped to organization plus assigned account. Active-execution checks, confirmed FIFO selection, and queue positions include only that account's tasks. +- Preserve deterministic FIFO and at most one active ERP execution for one assigned account. A different assigned account's active, queued, stale, or uncertain task does not block this account and does not occupy its queue position. +- Keep administrator-wide task visibility as a read model only. Executable SSE history/live events, browser claims, plugin-result ingestion, and browser cleanup commands are accepted or delivered only for the authenticated account matching the task's immutable assignee, including when the signed-in role is administrator. +- Keep archive and restore as the reversible routine workflow, with their existing lifecycle-state guard. +- Expose separately confirmed force delete through the single-task and bulk-delete APIs. Force delete intentionally has no parse, handoff, queue, or ERP-execution status gate, while retaining organization and owner authorization. +- On force delete, remove the task, task-owned records through existing cascades, and task outbox entries atomically. Retain only a minimal non-content `task.hard_deleted` audit marker, then request OSS artifact cleanup and owner-plugin local cancellation/cache cleanup after commit on a best-effort basis. +- Force delete removes platform state only. It cannot roll back an ERP write that already happened, and the operator warning must state this explicitly. + +## Rationale + +The execution account is already the durable link between the platform user, AgentBus channel, expected ERP identity, and browser worker. Using it as the serialization boundary preserves same-account write safety without coupling unrelated employees. Separating inspection feeds from executable feeds prevents broad administrator visibility from becoming accidental execution authority. Keeping archive and force delete as distinct operations provides both recoverability and a deliberate escape from irrecoverably blocked platform state. + +## Consequences + +- Two employees with distinct assigned accounts and valid matching workers may execute concurrently; tasks for either employee remain FIFO and single-active within that employee's queue. +- An uncertain ERP result blocks only the same assigned account's later claims unless an authorized operator explicitly force-deletes the platform task or resolves it through the existing reconciliation workflow. +- Administrators may inspect and force-delete authorized organization tasks, but their browser never receives or submits another employee's executable task events, plugin results, or cleanup command. +- A force-deleted task and its task-owned evidence cannot be restored. The retained audit marker proves the destructive action without retaining task content. +- No database migration or Chrome extension source/version change is required. The control-plane and platform UI must be deployed together before relying on the behavior. +- Runtime acceptance requires an authorized administrator-plus-two-employees staging matrix, including cross-account concurrency, same-account FIFO, administrator event isolation, and waiting/active force deletion. + +## Supersedes + +- AUTH-001's organization-wide ERP FIFO clause. +- AUTH-001's archive-only removal and unavailable-physical-purge clause. + +All other AUTH-001 account, role, route-grant, ownership, dashboard, session, AgentBus, and expected-ERP-identity decisions remain active. + +## Related + +- `.project-docs/10-decisions/AUTH-001-fixed-scope-account-authorization.md` +- `.project-docs/30-worklog/tasks/20260902-per-account-queue-hard-delete-a6d9f2c1.md` +- `.project-docs/30-worklog/tasks/20260903-integrate-account-routing-9f2c7a61.md` +- `control-plane/src/task-service.ts` +- `control-plane/src/server.ts` +- `LianSyn-platform/app.js` diff --git a/.project-docs/10-decisions/decision-index.md b/.project-docs/10-decisions/decision-index.md index 10948a1..986e409 100644 --- a/.project-docs/10-decisions/decision-index.md +++ b/.project-docs/10-decisions/decision-index.md @@ -10,13 +10,15 @@ | RELEASE-001 | Current artifacts, filenames, versions, and SHA-256 values are defined only by `dist/release-manifest.json`. | Active | 2026-08-28 | Release and delivery | [Release manifest](../../dist/release-manifest.json) | | SAFETY-001 | Real ERP access/write, task mutation, extension reload, service restart, deployment, and external delivery require explicit task-scoped authorization. | Active | 2026-08-28 | Operations and maintenance | [Governance](../../AGENTS.md) | | NETWORK-001 | In the trusted internal deployment, AgentBus roster attachment URLs may resolve to internal/private addresses; HTTPS, credential rejection, DNS pinning, redirect validation, bounds, and digest checks remain. | Active | 2026-08-31 | AgentBus attachment ingress | [Reply contract](../../agent设计规范/agentbus-reply-contract.md) | -| AUTH-001 | The fixed deployment scope uses administrator-managed `admin`, `team_lead`, and `user` accounts, owner-isolated normal tasks, display-only leadership metrics with explicit filtering, explicit non-admin route grants, and assignee-bound AgentBus/browser/ERP execution. | Active | 2026-09-01 | Authentication, authorization, audit, AgentBus workers, and operations oversight | [ADR](AUTH-001-fixed-scope-account-authorization.md) | +| AUTH-001 | The fixed deployment scope uses administrator-managed `admin`, `team_lead`, and `user` accounts, owner-isolated normal tasks, display-only leadership metrics with explicit filtering, explicit non-admin route grants, and assignee-bound AgentBus/browser/ERP execution. | Active except clauses superseded by AUTH-002 | 2026-09-01 | Authentication, authorization, audit, AgentBus workers, and operations oversight | [ADR](AUTH-001-fixed-scope-account-authorization.md) | +| AUTH-002 | ERP execution is serialized per immutable assigned account, administrator visibility is never execution routing, and explicit force delete physically removes authorized tasks regardless of lifecycle state. | Active | 2026-09-03 | ERP claim queues, executable events/results, and task removal | [ADR](AUTH-002-account-scoped-execution-and-force-delete.md) | ## Superseded Decisions | ID | Decision | Superseded By | Date | |---|---|---|---| | DOC-LEGACY-001 | Root `task_plan.md`, `findings.md`, and `progress.md` were the active project-memory system. | DOC-001 | 2026-08-28 | +| AUTH-001 (partial) | Organization-wide ERP FIFO and archive-only operator removal. | AUTH-002 | 2026-09-03 | ## Decision Criteria diff --git a/.project-docs/20-architecture/data-flow.md b/.project-docs/20-architecture/data-flow.md index 188fa66..64df028 100644 --- a/.project-docs/20-architecture/data-flow.md +++ b/.project-docs/20-architecture/data-flow.md @@ -17,12 +17,15 @@ | Operational diagnostics | Service, request, task, parser, AgentBus, attachment, database, and cleanup stages | Structured stdout/stderr and bounded Docker logs | Correlation identifiers, codes, outcomes, and durations only; no secrets or business payloads. | | Platform operations oversight | Manual task creator, encrypted instruction history, and readable outcome | Team-lead/administrator leadership projection | Display-only summaries plus explicit filters drive an aggregate-first task/person/input/output/time/type/completion view; list reads are bounded to one read-only connection and hydrate full details only for the current page. | | Browser worker selection | Immutable task assignee | One fresh account-bound browser connection | The heartbeat must match the account's expected ERP identity; a second fresh worker or identity mismatch is non-executable, with failover only after staleness. | +| Account-scoped ERP queue | Confirmed task assignee | Assigned account's browser worker | Organization-plus-account advisory locking preserves FIFO and at most one active execution for that account; another account's active, queued, stale, or uncertain work is outside this queue. | +| Executable event and result routing | Immutable task assignee | Matching authenticated platform page and plugin | SSE history/live events, claims, plugin results, and browser cleanup commands never use administrator-wide visibility and fail closed when the authenticated account is not the assignee. | +| Task removal | Authorized operator | Archive/restore or permanent force delete | Archive/restore remains reversible and state-gated. Explicit force delete has no lifecycle-state gate, removes task-owned platform records atomically, retains a minimal deletion audit marker, and performs post-commit artifact/plugin cleanup best effort. | | Confirmation export | ERP source file | Archived source plus mobile delivery artifact | Visitor XLS becomes real XLSX; other types prefer PDF | | Release | Editable source | `dist/release-manifest.json` and versioned artifacts | Manifest owns current hashes and filenames | ## State Ownership -- PostgreSQL owns durable control-plane account, role, expected ERP identity, task-route grant, AgentBus channel owner, immutable task assignee, browser worker, session, confirmation, audit, archive, and outcome state. +- PostgreSQL owns durable control-plane account, role, expected ERP identity, task-route grant, AgentBus channel owner, immutable task assignee, account-scoped queue/lease state, browser worker, session, confirmation, audit, archive, and outcome state. A force-deleted task no longer exists in task state; only its minimal non-content deletion audit marker remains. - Production attachment bytes use the configured OSS provider; normalized sensitive fields remain encrypted. - Chrome extension local state is bounded execution/reconciliation support, not canonical business history. - `.project-docs/30-worklog/tasks/` owns task-local project memory; canonical project state is an integrated projection. @@ -36,4 +39,4 @@ ## Last Updated -2026-09-01 +2026-09-03 diff --git a/.project-docs/20-architecture/system-overview.md b/.project-docs/20-architecture/system-overview.md index 98192c4..bc1db44 100644 --- a/.project-docs/20-architecture/system-overview.md +++ b/.project-docs/20-architecture/system-overview.md @@ -2,7 +2,7 @@ ## Current Architecture -Authenticated manual or account-bound AgentBus input is routed through task-scoped AI/Shadow/Auto/Program orchestration into one validated operation contract. The control plane owns account, channel owner, immutable task assignee, browser worker, session, task-type authorization, confirmation, audit, and archive state. The Chrome extension verifies the expected ERP account, resolves the unique ERP object, enforces page and write gates, performs native actions, and returns action-specific evidence. +Authenticated manual or account-bound AgentBus input is routed through task-scoped AI/Shadow/Auto/Program orchestration into one validated operation contract. The control plane owns account, channel owner, immutable task assignee, account-scoped execution queue, browser worker, session, task-type authorization, confirmation, audit, reversible archive, and explicit force-delete behavior. The Chrome extension verifies the expected ERP account, resolves the unique ERP object, enforces page and write gates, performs native actions, and returns action-specific evidence. ## Main Components @@ -26,8 +26,9 @@ Authenticated manual or account-bound AgentBus input is routed through task-scop - The leadership dashboard is an aggregate-first projection across task, person, original input, final output, time, task type, and completion state. Summary cards are display-only; filtering is explicit and defaults to all results. List reads use one bounded read-only database transaction, SQL prefiltering, selective historical-message hydration, and full detail projection only for the current 20-row page. Its drill-through stays business-facing; technical payloads, internal identifiers, machine-shaped historical input, and technical failure text remain in separate authorized audit/engineering surfaces. - Authorization is enforced in server and service paths, not by navigation visibility. A denied or unresolved non-admin business route stops before parsing, plugin dispatch, and ERP execution; creator authorization is rechecked at confirmation and browser claim. - Each enabled AgentBus channel owns one active non-admin employee account. Inbound work uses that account and route allowlist, persists the same account as immutable task assignee, and is returned only to that account's executable feed. -- Each employee account has one expected ERP identity and at most one fresh browser execution worker. Mismatched ERP identity, concurrent fresh workers, unbound channels, or unassigned tasks fail closed; stale-worker failover does not weaken organization-wide ERP FIFO serialization. -- Creator and manual input-turn attribution remain durable while business input stays encrypted at rest. Routine removal is reversible archive/restore; physical purge is not an operator capability. +- Each employee account has one expected ERP identity and at most one fresh browser execution worker. Mismatched ERP identity, concurrent fresh workers, unbound channels, or unassigned tasks fail closed. Browser claims, active-execution checks, and confirmed FIFO are serialized per immutable task assignee, so one account cannot block or occupy another account's queue. +- Administrator-wide task visibility is a read model, not an executable feed. Task SSE history/live events, browser claims, plugin-result ingestion, and browser cleanup commands are always scoped to the authenticated account matching `assigned_user_id`, including for administrators. +- Creator and manual input-turn attribution remain durable while business input stays encrypted at rest. Routine removal is reversible archive/restore. Separately confirmed force delete physically removes an authorized task regardless of lifecycle state, retains only a minimal non-content deletion audit marker, and cannot undo an ERP write that already occurred. - Unknown, ambiguous, unverified, or post-write-uncertain states fail closed; automatic retries must not create duplicate writes. - PostgreSQL is the sole required durable database/state middleware, and the production artifact provider is OSS. Redis, message queues, MongoDB, and search services are not runtime dependencies. - Migrations through `018_agentbus_account_workers` must complete before the updated application starts. The current ACK topology starts with one application replica because AgentBus listeners and SSE emission are process-local; horizontal scale requires explicit coordination first. @@ -44,7 +45,8 @@ Authenticated manual or account-bound AgentBus input is routed through task-scop - SAFETY-001 - NETWORK-001 - AUTH-001 +- AUTH-002 ## Last Updated -2026-09-02 +2026-09-03 diff --git a/.project-docs/30-worklog/current-state.md b/.project-docs/30-worklog/current-state.md index 8974838..6475224 100644 --- a/.project-docs/30-worklog/current-state.md +++ b/.project-docs/30-worklog/current-state.md @@ -26,10 +26,12 @@ This file is the integrated default-branch snapshot. Feature tasks record progre - Merge commit `336ca6e` integrating source commit `b26001e` from task `20260902-account-permission-ui-6c9e21ad` for a scroll-safe account task-permission editor layout and focused regression coverage. - Merge commit `e4fd916` integrating source commit `b5c727b` from task `20260902-diagnose-parse-error-7f3a9c2d` for native non-empty ERP product search in scatter-plan creation and independent batch-order creation, synchronized as extension `0.5.165`. - Integration task `20260902-integrate-product-search-3b7f6a20` for canonical product-search promotion, full release verification, and normal non-force synchronization to `origin/main`. +- Merge commit `bbbb44d` integrating source commit `d09b303` from task `20260902-per-account-queue-hard-delete-a6d9f2c1` for account-scoped ERP FIFO, strict assignee-only executable routing, and explicit lifecycle-independent physical force deletion. +- Integration task `20260903-integrate-account-routing-9f2c7a61` for AUTH-002 acceptance, canonical queue/removal reconciliation, full repository verification, and normal non-force synchronization to `origin/main`. ## Current Focus -Operate the repository's current `0.5.165` extension baseline and fixed-scope account model safely, bind each enabled AgentBus channel to one employee/ERP identity, provision narrow route grants, use explicit leadership-dashboard filters, and preserve Program/AI plus organization-wide ERP execution boundaries. Migration 018, extension reload, guarded product-search retry, and service rollout remain separately authorized runtime work. +Operate the repository's current `0.5.165` extension baseline and fixed-scope account model safely, bind each enabled AgentBus channel to one employee/ERP identity, provision narrow route grants, use explicit leadership-dashboard filters, and preserve Program/AI plus per-assigned-account ERP execution boundaries. Same-account tasks remain FIFO and single-active; distinct accounts are independent, and administrator visibility never enters another account's executable event/result path. Migration 018, extension reload, guarded product-search retry, and service rollout remain separately authorized runtime work. ## Recently Completed @@ -51,25 +53,29 @@ Operate the repository's current `0.5.165` extension baseline and fixed-scope ac - 2026-09-02: Reworked leadership-dashboard reads into a bounded one-connection transaction with business SQL prefiltering, selective message hydration, page-only detail hydration, request/database deadlines, and 20-row pages; metric cards are now display-only and explicit filters default to all results. - 2026-09-02: Corrected the account-management task-permission editor so opening it expands a dedicated five-row layout, keeps the account list below the editor, and allows vertical page scrolling on desktop and narrow screens without changing authorization semantics. - 2026-09-02: Integrated extension `0.5.165`: scatter-plan creation and independent batch-order creation now try loaded product candidates, then the form's native non-empty `S_chanpinming` search, and finally one bounded empty-query compatibility reload. A user-authorized search-only ERP check returned exactly one target row in both forms without selecting or saving it; zero or multiple local matches continue to fail closed. +- 2026-09-03: Accepted AUTH-002 and integrated account-scoped ERP queues. Each immutable assignee now owns one FIFO/single-active claim partition, different accounts no longer block one another, and executable SSE/results/cleanup commands are owner-only even when an administrator is signed in. +- 2026-09-03: Restored explicit permanent force deletion as a separate operation from reversible archive/restore. It bypasses lifecycle-state gates, physically removes task-owned platform records, retains a minimal deletion audit marker, performs post-commit cleanup best effort, and warns that prior ERP effects are not rolled back. ## In Progress - The standard database currently contains one administrator account and no non-administrator task grants. Multi-account operational smoke testing remains for an administrator-led staging window. -- Migration `018_agentbus_account_workers`, employee ERP identities/channel bindings, extension `0.5.165`, and the merged dashboard/runtime changes have not been applied to or restarted on the standard service in this integration task. +- Migration `018_agentbus_account_workers`, employee ERP identities/channel bindings, extension `0.5.165`, account-scoped queue/routing changes, force-delete behavior, and the merged dashboard/runtime changes have not been applied to or restarted on the standard service in this integration task. ## Next Recommended Steps -1. In an explicitly authorized staging/rollout window, back up PostgreSQL, apply migration 018, restart the control plane, load extension `0.5.165`, verify its runtime handshake, configure employee ERP identities and channel bindings, and run the multi-cloud-PC/identity/failover matrix before production assurance. +1. In an explicitly authorized staging/rollout window, back up PostgreSQL, apply migration 018, restart the control plane, load extension `0.5.165`, verify its runtime handshake, configure employee ERP identities and channel bindings, and run the multi-cloud-PC/identity/failover plus account-queue matrix before production assurance. 2. Through the administrator UI, create representative team-lead and ordinary accounts, assign narrow task grants, and verify owner isolation, leadership dashboard reads, grant/revoke behavior, and denial prompts without ERP writes. -3. With explicit authorization, run a live read-only ERP verification of the shared-mother-plan `tid-only` whole-visitor export path. -4. With explicit authorization, perform ERP write verification for independent-order SGL/TWN and adult/child/leader headcount mappings. +3. In the same authorized staging window, verify that an administrator receives no employee executable events/results, then force-delete disposable waiting and active employee tasks and confirm database absence plus cleanup only in the owning employee plugin. +4. With explicit authorization, run a live read-only ERP verification of the shared-mother-plan `tid-only` whole-visitor export path. +5. With explicit authorization, perform ERP write verification for independent-order SGL/TWN and adult/child/leader headcount mappings. ## Open Questions / Blockers - Shared-mother-plan whole-visitor export has historical read evidence and static coverage but lacks a fresh authorized runtime ERP read verification. - Independent-order SGL/TWN and four headcount categories lack authorized current-version ERP write evidence. -- The standard service was last restarted before commits `3062ed5`, `b5f5847`, `cc09506`, `336ca6e`, and `e4fd916`; its runtime schema, extension, account UI, and dashboard behavior must not be represented as the newly integrated repository state until an authorized rollout. -- AgentBus account-worker routing still lacks a live two-employee/two-cloud-PC staging matrix covering mismatched ERP login, same-account device conflict, 90-second stale failover, and both manual and automatic channel work. +- The standard service was last restarted before commits `3062ed5`, `b5f5847`, `cc09506`, `336ca6e`, `e4fd916`, and merge `bbbb44d`; its runtime schema, extension, account UI, queue/routing, force-delete, and dashboard behavior must not be represented as the newly integrated repository state until an authorized rollout. +- AgentBus account-worker routing still lacks a live two-employee/two-cloud-PC staging matrix covering mismatched ERP login, same-account device conflict, 90-second stale failover, same-account FIFO, cross-account independence, administrator executable-feed isolation, and both manual and automatic channel work. +- Lifecycle-independent force deletion has repository regression evidence but lacks an authorized runtime smoke test for waiting/active deletion, database absence, OSS cleanup, and owner-plugin-only cleanup. - A live internal AgentBus attachment verification remains separately unperformed. ## Risky Areas @@ -79,8 +85,9 @@ Operate the repository's current `0.5.165` extension baseline and fixed-scope ac - AgentBus channels and their upstream bridge are now a trusted network boundary because attachment URLs may target internal HTTPS hosts. - Account role changes, session revocation, creator-based task-route revocation, cross-user dashboard projection, and encrypted input audit are security-sensitive boundaries. - AgentBus channel ownership, immutable task assignment, expected ERP identity, browser-worker freshness/failover, and administrator non-execution are security- and write-safety-sensitive boundaries. +- Account-scoped advisory locking, per-assignee FIFO queries, executable SSE/result routing, and irreversible force deletion are concurrency-, authorization-, and evidence-sensitive boundaries. - Release synchronization across extension source, minimum platform version, mapping, ZIP, Skills, DOCX, and `dist/release-manifest.json`. ## Last Updated -2026-09-02 +2026-09-03 diff --git a/.project-docs/40-domain/business-rules.md b/.project-docs/40-domain/business-rules.md index 5b8ad4d..b56c40e 100644 --- a/.project-docs/40-domain/business-rules.md +++ b/.project-docs/40-domain/business-rules.md @@ -9,9 +9,10 @@ - Administrators always hold all 18 manual business routes. Team leads and ordinary users start with no task grants, require explicit administrator allowlists, and may use normal task APIs only for their own manual tasks. - A known ungranted route or a non-unique/unresolved route for a non-administrator fails before parsing, plugin dispatch, or ERP execution. Authorization is rechecked for supplemental input, attachments, confirmation, automatic confirmation, and browser claim. - Team leads may read all manual account work only through the platform-operations dashboard. The dashboard is aggregate-first across task, person, original input, final output, time, task type, and completion state, with business-facing drill-through. Its five summary cards are display-only; the explicit task-result filter defaults to all results. Internal attention or waiting-for-input states remain unchanged in task storage but are presented and filtered as “进行中”; the leadership view exposes no separate “待跟进” category. It is not an audit log and never renders technical payloads, internal identifiers, machine-shaped historical input, or technical failure text; this visibility does not grant cross-user task mutation, artifacts, SSE, global settings, audit administration, or AgentBus access. -- Creator and input-turn attribution are durable, business inputs remain encrypted at rest, denial audit excludes plaintext, and routine task removal uses archive/restore rather than physical purge. +- Creator and input-turn attribution are durable, business inputs remain encrypted at rest, and denial audit excludes plaintext. Archive/restore is the reversible routine removal path. Explicit force delete is a separate irreversible operation that may physically remove an authorized task in any lifecycle state, retains only a minimal non-content deletion audit marker, and cannot undo ERP effects already written. - Each non-admin employee may carry one case-insensitively unique expected ERP account and one AgentBus channel. New manual and AgentBus tasks persist an immutable assignee; only that account may confirm, claim, reconcile, resume, or submit ERP execution results. Administrators manage and inspect but do not execute another assignee's work. -- A browser is execution-ready only when it is the account's sole fresh worker and the active ERP session matches the expected account. Concurrent fresh workers, identity mismatch, unbound channels, and historical unassigned AgentBus tasks fail closed; stale failover waits 90 seconds and organization-wide ERP FIFO remains. +- A browser is execution-ready only when it is the account's sole fresh worker and the active ERP session matches the expected account. Concurrent fresh workers, identity mismatch, unbound channels, and historical unassigned AgentBus tasks fail closed; stale failover waits 90 seconds. Claim locking, active-execution detection, confirmed FIFO, and queue position are scoped to immutable `assigned_user_id`: the same account stays serialized while different accounts execute independently. +- Administrator-wide task visibility never grants execution routing. Executable SSE history/live events, browser claims, plugin-result ingestion, and force-delete browser cleanup commands are scoped to the authenticated account matching the task assignee, so an administrator page or plugin cannot receive or process an employee's task. - The two passenger-list import routes are Program-only and wait for exactly one `.xls` or `.xlsx` attachment before deterministic normalization. - Passenger workbooks must contain exactly one complete ERP-semantic header within rows 1–100. The header may be on row 1 or follow metadata, column order is arbitrary, and only the finite approved source/ERP aliases—including `NAME`, `证件号码`, `签发日`, and `身份证`—are mapped. Unknown or unheaded data columns, duplicate semantic fields, multiple candidate headers, and non-passport identity data fail closed; the internal 13-column canonical TSV contract remains unchanged. - A WeChat attachment card is transport placeholder text, not file content. Only a structured `payload.attachments[]` entry can resume a roster task; missing metadata fails before ingestion and leaves the original task in `awaiting_attachment` instead of creating a new task. @@ -32,4 +33,4 @@ ## Last Reviewed -2026-09-02 +2026-09-03 diff --git a/.project-docs/50-evidence/evidence-index.md b/.project-docs/50-evidence/evidence-index.md index aaa7098..c7997d8 100644 --- a/.project-docs/50-evidence/evidence-index.md +++ b/.project-docs/50-evidence/evidence-index.md @@ -19,6 +19,7 @@ Use this index for searchable, traceable evidence records. | 2026-09-02 | AgentBus employee/account/browser/ERP routing | Repository, release, and regression verified; migration/restart/extension rollout not performed | [Integration record](../30-worklog/tasks/20260902-integrate-all-push-c93a7f21.md) | Migration 018, immutable task assignees, channel-owner/route gates, one fresh matching worker, administrator non-execution, extension `0.5.164`, and release hashes were integrated and verified. | | 2026-09-02 | Leadership-dashboard filtering and summary interaction | Repository and focused regression verified; merged runtime not restarted | [Integration record](../30-worklog/tasks/20260902-integrate-all-push-c93a7f21.md) | Single-connection bounded reads, SQL prefiltering, selective hydration, 20-row paging, cancellation/timeout feedback, and display-only metric cards with explicit filters passed combined regression. | | 2026-09-02 | Native ERP product search for ordering forms | Root cause and live search-only behavior verified; repository/release verified; extension not reloaded | [Integration task](../30-worklog/tasks/20260902-integrate-product-search-3b7f6a20.md) | Both `plan_add.asp` and `orders_adds.asp` returned exactly one target product for the full keyword with radios left unchecked and no save; extension `0.5.165` now uses native non-empty search before its bounded empty-query fallback while retaining deterministic unique matching. | +| 2026-09-03 | Account-scoped ERP queues, assignee-only executable routing, and force delete | Repository and full regression verified; runtime not deployed or mutated | [Integration task](../30-worklog/tasks/20260903-integrate-account-routing-9f2c7a61.md) | Source task `20260902-per-account-queue-hard-delete-a6d9f2c1` replaced global head-of-line blocking with per-assignee FIFO/advisory locks, isolated SSE/plugin-result/browser-command routing from administrator read visibility, and separated reversible archive from lifecycle-independent physical deletion. | ## When To Add Evidence diff --git a/.project-docs/80-commitments/commitments.md b/.project-docs/80-commitments/commitments.md index 4ceff7d..d10eac5 100644 --- a/.project-docs/80-commitments/commitments.md +++ b/.project-docs/80-commitments/commitments.md @@ -7,7 +7,7 @@ Track future-facing memory: promised follow-ups, unfinished loops, timed checks, | 2026-08-28 | Verify shared-mother-plan `tid-only` whole-visitor export against the current runtime ERP path. | Explicit user authorization for ERP read access | Future authorized task | Pending authorization | Run read-only source and artifact checks without external delivery. | | 2026-08-28 | Verify independent-order SGL/TWN and adult/child/leader headcount mappings with real ERP writes. | Explicit user authorization for controlled ERP writes | Future authorized task | Pending authorization | Use reversible values and action-specific requery evidence. | | 2026-08-28 | Resolve AgentBus OSS attachment rejection caused by private/reserved local DNS answers. | User scheduled integration and confirmed the environment is trusted internal networking | Integration task `20260831-integrate-server-diagnostics-8b42c6d1` | Completed in repository | Deploy/restart and run one live internal attachment verification only under separate authorization. | -| 2026-09-02 | Roll out and stage-test AgentBus account workers. | Explicit authorization for database backup/migration, service restart, extension reload, account/channel configuration, and staging traffic | Future authorized rollout task | Pending authorization | Apply migration 018 and extension `0.5.165`, then verify two employee accounts/cloud PCs, ERP identity mismatch, same-account worker conflict, 90-second failover, and manual/AgentBus execution routing. | +| 2026-09-02 | Roll out and stage-test AgentBus account workers, account-scoped queues, and force deletion. | Explicit authorization for database backup/migration, service restart, extension reload, account/channel configuration, staging traffic, and disposable task mutation | Future authorized rollout task | Pending authorization | Apply migration 018 and extension `0.5.165`; verify two employee accounts/cloud PCs, ERP identity mismatch, same-account worker conflict/FIFO, cross-account independence, 90-second failover, administrator executable-feed isolation, manual/AgentBus routing, and waiting/active force-delete cleanup. | | 2026-09-02 | Verify the integrated native product-search execution path. | Explicit authorization for extension reload and a guarded ERP preflight/retry | Future authorized rollout task | Pending authorization | Load extension `0.5.165`, confirm the runtime handshake, then verify deterministic product selection and normal write gates without automatically retrying the earlier failed task. | ## Use diff --git a/agent设计规范/business-adaptation-registry.md b/agent设计规范/business-adaptation-registry.md index 143557c..932b87c 100644 --- a/agent设计规范/business-adaptation-registry.md +++ b/agent设计规范/business-adaptation-registry.md @@ -1,6 +1,6 @@ # 业务适配登记表 -这是跨会话和交付的业务入口。它回答三个问题：业务人员怎么输入、ERP 怎么执行、Skill 在哪里维护。运营统一复制入口见[运营业务 AI 输入模板总表](templates/business-input-templates.md)，AI 业务路由参考见 [business-behavior-registry.md](business-behavior-registry.md)，18 项确定性解析的指令、字段、action 和版本唯一机器源见 [`control-plane/src/business-routes.ts`](../control-plane/src/business-routes.ts)。该机器路由、任务级解析模式快照和组织全自动化规则对手工与 AgentBus 新任务全局共用，来源只负责输入和回执适配；AgentBus 渠道必须绑定一个员工平台账号，并使用该账号的业务白名单、任务归属、唯一云电脑 worker 和 ERP 身份门禁。 +这是跨会话和交付的业务入口。它回答三个问题：业务人员怎么输入、ERP 怎么执行、Skill 在哪里维护。运营统一复制入口见[运营业务 AI 输入模板总表](templates/business-input-templates.md)，AI 业务路由参考见 [business-behavior-registry.md](business-behavior-registry.md)，18 项确定性解析的指令、字段、action 和版本唯一机器源见 [`control-plane/src/business-routes.ts`](../control-plane/src/business-routes.ts)。该机器路由、任务级解析模式快照和组织全自动化规则对手工与 AgentBus 新任务全局共用，来源只负责输入和回执适配；AgentBus 渠道必须绑定一个员工平台账号，并使用该账号的业务白名单、任务归属、唯一云电脑 worker 和 ERP 身份门禁。ERP 领取队列按不可变的任务归属账号分别保持 FIFO 与单活跃执行，不同账号互不阻塞；管理员跨账号查看权限不得进入员工任务的可执行事件、插件回执或浏览器清理链路。 ## 状态定义