部署适配

.project-docs/30-worklog/tasks/20260828-ack-deploy-guide-8c1d.md

@@ -0,0 +1,66 @@
+# Task: Verify ACK image build and middleware requirements
+
+## Identity
+
+- Task ID: 20260828-ack-deploy-guide-8c1d
+- Mode: Integration
+- Branch: main
+- Worktree: D:\Datas\OthersProjects\LWLT-AIBOT
+- Base commit: 7b5d855b093af39bf834fab4f41f41b37be1170d
+- Owner: codex
+- Status: Completed
+
+## Scope
+
+- Repair the repository's missing `.project-docs` templates with the official non-overwriting initializer after explicit user approval.
+- Read-only verification of the existing Docker build, runtime entrypoint, production configuration, persistence, artifact storage, health probes, and ACK/ACR deployment constraints.
+- Provide a build-and-push command and a minimal middleware inventory; do not deploy, push an image, or read secrets.
+- Follow up on the production deployment by fixing Chrome extension recognition and bridge injection for the user-confirmed control-plane origin `https://lwlt.nianxx.cn`, then publish a synchronized versioned ZIP.
+
+## Intent And Constraints
+
+- Preserve all existing work and do not read `.env` or `LianSyn-platform/.env`.
+- Distinguish repository-confirmed requirements from deployment recommendations and unverified assumptions.
+- Treat the Chrome ERP extension as a client-side component, not an ACK workload.
+- Allow only the exact production control-plane origin; do not broaden content-script injection to arbitrary HTTPS sites.
+- Do not reload the user's browser extension, deploy services, or access ERP as part of the source/release fix.
+- Do not create sub-agents.
+- Reclaim the same task in Integration mode after the initialized canonical templates caused the Feature-mode drift check to block; the user explicitly approved the forced ownership recovery.
+
+## Outcome
+
+- The official initializer added 34 previously missing `.project-docs` template files without overwriting existing files, and `check_project_docs.py` passed afterward.
+- The existing multi-stage `Dockerfile` builds the TypeScript control plane and packages Node.js 22, LibreOffice Writer, Noto CJK fonts, compiled migrations, and the platform adapter into one runtime image exposing port 8786.
+- For ACK, the recommended image command is a `docker buildx build --platform <node-architecture> ... --push .` command targeting ACR. ACR login and an ACK image-pull mechanism are separate prerequisites.
+- Required production state is PostgreSQL. The current production template selects OSS artifact storage; Redis, Kafka, RabbitMQ, MongoDB, Elasticsearch, and a separate platform-adapter service are not dependencies in the active code/configuration.
+- Compose runs migrations before the server, while the image default `CMD` starts only the server. ACK therefore needs a single-run migration Job before the Deployment; starting an unmigrated Deployment fails closed on the required schema version.
+- Use an ACK Ingress/managed load balancer and TLS instead of the Compose-only Caddy service. Configure the long-lived HTTP path for SSE behavior.
+- Start with one application replica: AgentBus listeners and SSE event emission are process-local, so horizontally scaling the current service would create multiple listeners and incomplete cross-pod event propagation without an explicit coordination design.
+- The canonical templates remain neutral placeholders. Deployment findings were retained in this integration task record and were not promoted into accepted architecture without a separate architecture-memory decision.
+- Reproduced the reported Popup symptom with an agent-runnable VM harness: localhost was recognized while `https://lwlt.nianxx.cn` returned `未打开业务系统页面`.
+- Updated Popup URL matching, background tab discovery, Manifest host permission/content script matching, extension/runtime version declarations, platform minimum version, lifecycle mapping, release gate, tests, and extension documentation to `0.5.158`.
+- Archived the superseded `0.5.157` ZIP and manifest snapshot under `archive/releases/2026-08-29/`; generated `dist/ltjt-order-assistant-0.5.158.zip` with SHA-256 `99ba7b29d1d4418cb02fcbb345aeaf8494877dbc397ae8592b4e3fdb68b4cf9d`.
+- Verified the new archive contains exactly 19 source files and every entry matches the active extension source byte-for-byte.
+- Repaired Windows-reachable verification gaps encountered by the mandated gates: `.project-docs` is now an allowed governed root, text artifact comparison normalizes CRLF/LF only for explicit text extensions, `ajv` and `ajv-formats` are declared direct dev dependencies, URL fixtures use `fileURLToPath`, and Unix fake-converter success tests are explicitly skipped on Windows while remaining active on Linux/Docker.
+
+## Verification
+
+- Read: `README.md`, root planning files, business registry, `Dockerfile`, `.dockerignore`, `docker-compose.yml`, `package.json`, `.env.production.example`, infrastructure scripts, control-plane README, configuration, database, migration, server, artifact-store, and AgentBus-related source.
+- Confirmed `.dockerignore` excludes `.env` and `.env.*` from the image build context.
+- Confirmed health endpoints `/health/live` and `/health/ready`, service port 8786, required migration `014_task_input_attachments`, PostgreSQL pool usage, OSS production configuration, bundled document conversion, and lack of Redis/MQ/search dependencies.
+- The production-origin regression first failed with `false !== true`, then passed after the fix; the original Popup black-box no longer produced `未打开业务系统页面` for `https://lwlt.nianxx.cn`.
+- Final release verification includes repository hygiene 9/9, TypeScript check, control-plane tests, legacy tests, build, JavaScript syntax checks, package/source byte comparison, and `git diff --check`.
+- Final gate counts: repository hygiene 9/9; control-plane 123 passed, 0 failed, 4 Windows-only skips for Unix fake-converter fixtures; legacy 249/249; TypeScript check and build both exited 0.
+- Cross-checked current ACR build/push, private image pull, ACK ALB/Nginx Ingress, and long-connection guidance against Alibaba Cloud official documentation on 2026-08-28.
+- The Feature-mode boundary check correctly blocked on initialized canonical templates; after explicit approval, official `release --force` and `start --mode integration --adopt-existing` commands established matching Integration ownership and lock.
+- No Docker build, image push, Kubernetes mutation, database migration, browser-extension reload, ERP access/write, or deployment was executed.
+
+## Follow-ups
+
+- If requested, create task-scoped ACK manifests or a Helm chart containing Namespace, Secret/ConfigMap references, migration Job, single-replica Deployment, ClusterIP Service, Ingress, probes, and ACR pull configuration.
+- Load or distribute `dist/ltjt-order-assistant-0.5.158.zip`, then refresh `https://lwlt.nianxx.cn` and confirm the live handshake reports `0.5.158`; runtime reload remains a separate user/operations action.
+- Reconcile stable project facts from the populated root project-memory files into canonical `.project-docs` only through an explicitly scoped architecture-memory integration task.
+
+## Promotion Candidates
+
+- Target: `.project-docs/20-architecture/system-overview.md` and `.project-docs/30-worklog/current-state.md` through a separately confirmed architecture-memory integration. Proposal: record PostgreSQL as the sole required database/state middleware, OSS as the production artifact backend, the client-side Chrome extension boundary, the migration-before-start requirement, and the current single-replica constraint. Evidence: active Docker, Compose, production config, control-plane source, and README. Future impact: prevents incomplete ACK deployments and unsafe horizontal scaling. Semantic conflicts: canonical files are newly initialized placeholders; root project memory is populated but has not been reconciled into `.project-docs`. Human confirmation: required before promotion because this would establish canonical architecture memory.