wangxuming/NianAIGC
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: reconcile authenticated SSR production state

Browse Source
This commit is contained in:
brother7
2026-08-16 18:39:10 +08:00
parent 498c2fa242
commit ca12cc88da
7 changed files with 101 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
.project-docs/20-architecture/data-flow.md
View File

@@ -1,6 +1,8 @@
# Data Flow
## Primary Flows
## Local Full-Stack Flows
These repository flows remain available for local development and do not establish which Service currently owns a path in the live production cluster.
| Flow | Source | Destination | Notes |
|---|---|---|---|
@@ -11,12 +13,12 @@
## Approved Target Flows
The Go implementation for these flows is merged into `main` under `backend/`; they become active on the first production deployment, which routes `/api`, `/uploads`, and `/generated-results` to Go from day one:
The Go implementation and desired ACK routing for these flows are present in the repository. Production is already online, but its exact live Service ownership has not been confirmed from cluster configuration or logs:
| Flow | Source | Destination | Required behavior |
|---|---|---|---|
| Browser UI | Browser | Same-origin Ingress -> Next.js or Go by path | Preserve current URLs; avoid cross-origin Cookie/CORS changes. |
| SSR identity/data | Next.js | Internal Go HTTP Interface | Forward Cookie and origin; Go remains the sole authorization authority. |
| SSR identity | Next.js `getOptionalAuthSession()` | Internal Go `GET /api/auth/me` | Implemented in `498c2fa` when `ZHINIAN_GO_INTERNAL_BASE_URL` is configured: forward only enumerated `zhinian_session` Cookie chunks, use no-store transport, strictly validate authenticated/anonymous response shape and identity binding, and fail closed on bridge errors. No unrelated Cookie or origin forwarding. Without the URL, local full-stack mode keeps direct-store authorization. The live revision does not yet contain this fix. |
| Backend persistence | Go Modules | PostgreSQL Adapter -> RDS | Parameterized queries and transactions; fail closed in production. |
| Task execution | Embedded Go WorkerLoop | RDS claim -> provider -> OSS -> RDS -> Webhook | Bounded concurrency, recoverable leases, one owner for external side effects. |
| Asset lifecycle | Go Assets | OSS plus RDS metadata | Shared storage required before horizontal scaling. |
@@ -32,10 +34,13 @@ The Go implementation for these flows is merged into `main` under `backend/`; th
- Alibaba Cloud RDS PostgreSQL via its internal endpoint and verified TLS CA.
- Alibaba Cloud ACK resources under `deploy/ack/`.
- Live production at `https://nianxxaigc.nianxx.cn`; public `/api/ready` has returned HTTP 200 with PostgreSQL configured, without proving the owning Service.
- Internal Worker HTTP endpoint is cluster-internal and blocked from public Ingress routing.
The internal Worker HTTP endpoint remains part of the local-development implementation only; production never deploys the Node Worker and uses the embedded Go WorkerLoop from the first rollout.
The accepted production topology uses the embedded Go WorkerLoop rather than the local-development Node Worker. The exact live workload set remains to be confirmed from the cluster.
The SSR identity bridge and ACK internal URL are merged but not yet deployed. The current live revision produces a production RSC error for authenticated `/create`; the repair rollout must deploy `498c2fa` and verify the flow with an authenticated smoke test.
## Last Updated
2026-08-14
2026-08-16

14
.project-docs/20-architecture/module-map.md
View File

@@ -8,10 +8,11 @@
| `lib/server/{data-store,account-store,billing-store}.ts` | Domain persistence with PostgreSQL/local implementations | Preserve exported interfaces for callers. |
| `database/migrations/` | Immutable versioned PostgreSQL schema changes | Executed manually for the first deployment (0001 initial schema, 0002 generation lifecycle fencing); the Node runner and Job manifest are retained but not part of the deployment path. |
| `scripts/postgres-client.mjs` | Validated database configuration for Node operations scripts | Shared by migration/bootstrap/import scripts. |
| `deploy/ack/` | ACK deployment resources and secret/config templates | First production deployment uses the split topology; the migration Job manifest is deprecated (manual SQL). |
| `deploy/ack/` | ACK deployment resources and secret/config templates | Desired production split topology; the `498c2fa` Web configuration is pending rollout, and the migration Job manifest is deprecated (manual SQL). |
| `app/api/ready/route.ts` | Database/schema/privilege readiness endpoint | Separate from process-level liveness. |
| `backend/cmd/zhinian-api` | Go application entrypoint, configuration, HTTP server composition, readiness | Locally runnable; production routing still owned by Next.js. |
| `backend/internal/*` | ADR-003 deep modules and adapters, 18 packages: `identity`, `administration`, `assets`, `billing`, `usage`, `jobs`, `providers`, `webhook`, `httpapi`, `publicapi`, `application`, `orchestration`, `postgres`, `localstore`, `logging`, `settings`, `templates`, `prompt` | Merged into `main`; unrouted until cutover. |
| `lib/server/auth/current-user.ts` | In revision `498c2fa`, resolves the current SSR user through internal Go `/api/auth/me` when `ZHINIAN_GO_INTERNAL_BASE_URL` is set; otherwise uses the local direct-store authorization path | Sends only enumerated `zhinian_session` chunks, validates the Go response and identity binding strictly, and fails closed on bridge errors. The fixed revision is not yet live. |
| `backend/cmd/zhinian-api` | Go application entrypoint, configuration, HTTP server composition, readiness | Locally runnable and targeted by checked-in ACK routing; exact live request ownership remains unverified. |
| `backend/internal/*` | ADR-003 deep modules and adapters, 18 packages: `identity`, `administration`, `assets`, `billing`, `usage`, `jobs`, `providers`, `webhook`, `httpapi`, `publicapi`, `application`, `orchestration`, `postgres`, `localstore`, `logging`, `settings`, `templates`, `prompt` | Merged; production is online, but the deployed revision and live routing do not yet reflect the `498c2fa` repair configuration. |
| `contracts/**/*.json` | Language-neutral HTTP/Cookie/auth/jobs/billing/storage/webhook contract fixtures | Shared acceptance source for TypeScript and Go consumers. |
## Dependency Direction
@@ -22,11 +23,11 @@
## Approved Target Module Map
The target below is implemented in `backend/internal/` and merged into `main`; the first production deployment remains pending:
The target below is implemented in the repository. The first production deployment has occurred; the `498c2fa` repair rollout and confirmation of the live cluster shape remain pending:
| Target Module | Go package | Implementation notes |
|---|---|---|
| Next.js frontend | (Next.js, unchanged) | Forwards Cookie/request context to Go; no direct persistence or domain ownership after cutover. |
| Next.js frontend | `lib/server/auth/current-user.ts` | In `498c2fa`, production SSR forwards only enumerated signed session Cookie chunks to Go `/api/auth/me`; the live revision does not yet contain this fix. Local full-stack mode uses direct stores when the internal Go URL is absent. |
| Go Identity | `internal/identity` | Login/logout/session/password/authorization; preserves the signed chunked Cookie and per-request account/organization/sessionVersion validation. |
| Go Administration | `internal/administration` | Organizations, accounts, settings visibility, logs, administrative usage; enforces super-admin and organization-admin rules. |
| Go Assets | `internal/assets` | Register/upload/list/get/delete/download; uses object-storage Adapter; preserves owner-scoped 404 and storage metadata. |
@@ -44,7 +45,8 @@ Real internal seams are PostgreSQL transport, object storage, generation provide
- Account authentication/password transactions and billing wallet idempotency.
- ACK Secrets, RDS CA mounting, Ingress protection for internal Worker routes, and pool connection budgeting.
- `backend/internal/{postgres,jobs,billing}`: claim and wallet correctness across Go replica scaling until WorkerLoop concurrency is deliberate.
- Live request-path ownership and deployed workload revisions must be confirmed from ACK configuration or logs; do not infer them from the public endpoint alone.
## Last Updated
2026-08-14
2026-08-16

22
.project-docs/20-architecture/system-overview.md
View File

@@ -2,9 +2,9 @@
## Current Architecture
There is no deployed production architecture yet. Local development keeps the Next.js full-stack Web workload plus the HTTP-polling Node Worker; production server state is stored directly in PostgreSQL through a shared server-only adapter, and development/tests can explicitly use local JSON.
The first production deployment is online at `https://nianxxaigc.nianxx.cn`. The public `/api/ready` endpoint has been observed returning HTTP 200 with PostgreSQL configured. The exact live Service owner for each path has not been confirmed through cluster configuration or logs, so the deployed routing shape is not inferred here.
The first production deployment will run the ADR-003 split topology directly: Next.js serves pages/static/SSR, and the merged Go backend under `backend/` owns `/api`, `/uploads`, and `/generated-results`. There is no legacy production instance, so there is no cutover and no Node Worker in production — the Go process embeds the WorkerLoop from day one. The deployment artifacts are checked in: `backend/Dockerfile` (non-root static Go image), `deploy/ack/go-api.yaml` (Deployment plus Service), and the split-path Ingress in `deploy/ack/ingress.yaml`; the image build/push and target-cluster validation remain.
The live revision predates `498c2fa` and authenticated `/create` currently triggers a production RSC error. The fixed repository revision implements the ADR-003 boundary: Next.js serves pages/static/SSR without database credentials and refreshes authenticated SSR through internal Go `/api/auth/me`; the checked-in production topology assigns backend routes, database-backed authorization, RDS access, and the embedded WorkerLoop to Go. The updated Web image and ACK configuration have not yet been deployed, and the authenticated smoke test remains open. Local development remains a separate Next.js full-stack shape with explicit PostgreSQL or local JSON stores and the HTTP-polling Node Worker.
## Approved Target Architecture
@@ -13,24 +13,24 @@ The accepted target in ADR-003 is a same-origin Next.js frontend plus Go modular
| Target component | Responsibility | Constraint | Implementation state |
|---|---|---|---|
| Next.js frontend | Pages, static assets, SSR, browser UI | Calls Go over HTTP; no RDS/provider/OSS/business Secret. | Local dev also runs its API routes; production serves pages only. |
| Go backend | Existing HTTP/file contracts, identity, administration, assets, jobs, billing, usage, providers, storage, Webhooks, readiness | Owns relational access and embeds the WorkerLoop. | Implemented in `backend/` and merged; first production deployment pending. |
| Go backend | Existing HTTP/file contracts, identity, administration, assets, jobs, billing, usage, providers, storage, Webhooks, readiness | Owns relational access and embeds the WorkerLoop in the approved topology. | Implemented in `backend/`; production is online, but exact live path ownership is not asserted without cluster evidence. |
| RDS PostgreSQL | Relational state and cross-instance concurrency | Retains versioned migrations and both concurrency-sensitive database functions. | Schema initialized by manual SQL (migrations 0001/0002) plus role grants. |
| Migration Job | Schema and application-role grants | Remains one-shot and separate from long-lived workloads. | Manifest retained but not used; initial schema is executed manually. |
| Alibaba Cloud OSS | Shared generated/uploaded assets | Must be production-ready before horizontal workload scaling. | Still behind a storage Adapter; not validated against real OSS. |
Ingress will route page/static paths to Next.js and `/api`, `/uploads`, and `/generated-results` to Go from the first deployment. The initial target is two long-lived Pods (`Next x1 + Go x1`).
The checked-in Ingress routes page/static paths to Next.js and `/api`, `/uploads`, and `/generated-results` to Go. Production is already online; confirming that the live cluster matches this desired state is part of the repair rollout. The approved initial target is two long-lived Pods (`Next x1 + Go x1`).
## Main Components
| Component | Responsibility | Notes |
|---|---|---|
| Next.js Web | Browser/API routes, domain services, persistence calls, internal Worker tick endpoint | Owns the PostgreSQL pool and `/api/ready` until cutover. |
| Next.js Web | Local full-stack browser/API routes and stores; fixed production revision serves pages/static/SSR plus the internal Go identity bridge | Local development may use direct stores. The database-free production configuration in `498c2fa` is not yet deployed. |
| Worker | Periodically invokes the internal Worker tick endpoint | Local development only; production uses the embedded Go WorkerLoop. |
| PostgreSQL adapter | Backend selection, Pool lifecycle, TLS, parameterized queries, transactions, readiness | Server-only module at `lib/server/database.ts`. |
| Go backend | `cmd/zhinian-api` plus 18 `internal/` packages: identity, administration, assets, billing, usage, jobs, providers, webhook, httpapi, publicapi, application, orchestration, postgres, localstore, logging, settings, templates, prompt | Merged into `main`; locally runnable and contract-tested; unrouted in production. |
| Go backend | `cmd/zhinian-api` plus 18 `internal/` packages: identity, administration, assets, billing, usage, jobs, providers, webhook, httpapi, publicapi, application, orchestration, postgres, localstore, logging, settings, templates, prompt | Merged and contract-tested; checked-in manifests route backend paths to Go, while exact live routing remains to be confirmed from the cluster. |
| Contract fixtures | Language-neutral JSON contracts for auth, admin, assets, billing, http, jobs, logs, providers, settings, usage, webhook under `contracts/` | Shared executable acceptance source for TypeScript and Go consumers. |
| RDS PostgreSQL | Accounts, assets, jobs, usage, templates, billing state | Schema managed by versioned migrations (0001, 0002). |
| Migration Job | Applies migrations and exact application-role privileges | Must complete before Web rollout. |
| Migration Job | Retained one-shot migration artifact | Not used for the first production deployment; the operator executes versioned SQL and grants manually. |
| Runtime/object storage | Uploads, generated assets, and logs | Container-local/PVC by default; use OSS/shared storage before scaling horizontally. |
## Important Boundaries
@@ -38,15 +38,15 @@ Ingress will route page/static paths to Next.js and `/api`, `/uploads`, and `/ge
- Production backend selection is explicit and fail-closed; never turn a PostgreSQL configuration failure into local JSON fallback.
- Store callers depend on stable store interfaces, not `pg` or SQL details.
- Multi-statement consistency uses one transaction client; atomic job claim and wallet posting remain database functions.
- Database credentials are injected only into Web and migration workloads; Worker uses the internal HTTP boundary.
- The Go implementation must be validated against non-production RDS/OSS/provider/Webhook dependencies before the first production rollout; Next Route Handlers stay in the repository for local development.
- In the approved production split topology, database credentials belong to Go and the manual migration operator; the fixed Next.js Web configuration and any local-only Node Worker do not receive them.
- The live production environment requires post-deployment validation against RDS/OSS/provider/Webhook dependencies; Next Route Handlers stay in the repository for local development.
## Related Decisions
- Current implementation: `RDS-001` and `RDS-002` (schema execution now manual SQL per `DEP-001`).
- Accepted target: `ADR-003`; it supersedes ACK-001 once the first production deployment runs the Go stack.
- Accepted target: `ADR-003`; production is online, but its exact live realization must be confirmed from cluster evidence.
- First-deployment model: `DEP-001`.
## Last Updated
2026-08-14
2026-08-16

24
.project-docs/30-worklog/current-state.md
View File

@@ -13,10 +13,11 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
- `f10cdd9` (record of completed task `20260812-architecture-task-breakdown-a83f61c2`)
- `ff055c9` (config-driven super-admin bootstrap in the Go backend, task `20260814-go-bootstrap-admin-6e2b7d9c`)
- `4a8f2d5` (Go workload deployment artifacts and split Ingress routing, task `20260814-go-deploy-artifacts-2a5f8e1d`)
- `498c2fa` (authenticated Next.js SSR-to-Go identity bridge and ACK Web internal Go URL, task `20260816-fix-authenticated-ssr-6c3f8a21`)
## Current Focus
ADR-003's Go modular-monolith backend is implemented and merged into `main` under `backend/` (`cmd/zhinian-api`, 18 `internal/` packages, 24 contract fixtures, migration 0002). There is no production instance of this application yet: the **first production deployment** will run the ADR-003 split topology directly — Next.js serves pages/static/SSR, Go owns `/api`, `/uploads`, and `/generated-results` — so there is no legacy cutover, no Node Worker drain, and no legacy production session compatibility to preserve. Next.js route handlers remain in the repository for local development only. The production schema is initialized by manually executing the versioned SQL files; the ACK migration Job is not part of the deployment path.
The first production deployment is live at `https://nianxxaigc.nianxx.cn`. Its deployed revision does not yet include `498c2fa`: authenticated `/create` currently triggers a production RSC error, while the public `/api/ready` endpoint has been observed returning HTTP 200 with PostgreSQL configured. The repository now contains the authenticated Next.js SSR-to-Go identity bridge in `lib/server/auth/current-user.ts`; when `ZHINIAN_GO_INTERNAL_BASE_URL` is configured it refreshes identity through internal Go `/api/auth/me`, and without that environment variable local Next.js full-stack development retains the direct-store path. Current work is the production repair rollout: publish the updated Web image and ACK configuration, then complete an authenticated `/create` smoke test. The exact live Service owner for each request path remains unverified until confirmed from cluster configuration or logs.
## Recently Completed
@@ -28,31 +29,32 @@ ADR-003's Go modular-monolith backend is implemented and merged into `main` unde
- 2026-08-14: Added config-driven first-super-administrator bootstrap to the Go backend (task `20260814-go-bootstrap-admin-6e2b7d9c`).
- 2026-08-14: Recorded the first-deployment model: no production cutover, manual schema initialization without the migration Job pod (task `20260814-deploy-model-reconcile-9b4c2e7f`).
- 2026-08-14: Built the Go workload deployment artifacts: `backend/Dockerfile`, `deploy/ack/go-api.yaml`, split-path Ingress routing, non-root/read-only-filesystem workload config, and updated manifest assertions (task `20260814-go-deploy-artifacts-2a5f8e1d`).
- 2026-08-16: Implemented authenticated production SSR identity refresh through Go `/api/auth/me`, forwarding only enumerated `zhinian_session` chunks, strictly validating the response, preserving the local direct-store path when the internal URL is absent, and keeping the updated ACK Web configuration database-free (task `20260816-fix-authenticated-ssr-6c3f8a21`, commit `498c2fa`; not yet deployed).
## In Progress
- None.
- Release `498c2fa` to the existing production environment and verify authenticated `/create` SSR; the live revision still exhibits the RSC failure.
## Next Recommended Steps
1. Build and push the `zhinian-go-api` image from `backend/Dockerfile`, then validate all manifests with `kubectl apply --dry-run=server` on the target ACK cluster.
2. Initialize the production schema by manually executing `database/migrations/0001_initial_schema.sql` then `0002_generation_lifecycle_fencing.sql` as the migration role, then apply the application-role grants (tables plus the two concurrency functions).
3. Configure `ZHINIAN_BOOTSTRAP_ADMIN_*` on the first Go startup; the process creates the first super administrator exactly once.
4. Validate against non-production RDS (real application role, verified-CA TLS), real OSS, provider credentials, and external Webhooks before the first production rollout.
5. Confirm the public `/api/v1` compatibility promise for external consumers.
1. Build and push the updated Web image containing `498c2fa`, and validate the updated ACK configuration with a server-side dry run on the production cluster.
2. Apply the updated Web image and ACK configuration without assuming the current live Service ownership beyond what cluster configuration and logs confirm.
3. Smoke-test an authenticated request to `/create`, confirming the production RSC error is resolved and SSR refreshes the user through internal Go `/api/auth/me`.
4. Recheck public `/api/ready` after the rollout; it currently returns HTTP 200 with PostgreSQL configured.
5. Continue real RDS/OSS/provider/Webhook validation and confirm the public `/api/v1` compatibility promise for external consumers.
## Open Questions / Blockers
- Target RDS PostgreSQL version, connection budget, endpoint, TLS enforcement, CA bundle, database roles, and ACK network policy remain deployment inputs.
- Canonical memory does not yet record the live RDS PostgreSQL version, connection budget, endpoint, TLS/CA details, database roles, ACK network policy, or confirmed request-path Service ownership.
- Real OSS bucket/credential configuration is still needed for shared asset storage.
- Public `/api/v1` support promises for external consumers need explicit confirmation.
## Risky Areas
- Database grants and least-privilege roles must be tested against the actual RDS instance before the first rollout.
- Database grants and least-privilege roles still require documented validation against the live RDS instance.
- The current image runs as root; moving to a non-root user requires an explicit writable-path ownership design.
- The Go code is contract-tested but has never run against real provider, OSS, RDS, and Webhook traffic; parity gaps can only surface under real dependencies.
- Real provider, OSS, RDS, and Webhook coverage is not fully documented; do not infer which live workload owns those paths without cluster evidence.
## Last Updated
2026-08-14
2026-08-16

2
.project-docs/30-worklog/task-history.md
View File

@@ -16,6 +16,8 @@
| 2026-08-14 | `20260814-deploy-model-reconcile-9b4c2e7f` | Recorded the first-deployment model (split topology from day one, manual SQL schema initialization, config-driven bootstrap) across canonical memory and deployment docs. | Current state, decisions (DEP-001), architecture, commitments, deployment docs |
| 2026-08-14 | `20260814-go-bootstrap-admin-6e2b7d9c` | Config-driven first-super-administrator bootstrap in the Go backend. | Task record, backend README |
| 2026-08-14 | `20260814-go-deploy-artifacts-2a5f8e1d` | Go workload deployment artifacts: `backend/Dockerfile`, `deploy/ack/go-api.yaml`, split-path Ingress, database-free Web workload, updated manifest assertions. | Task record, deployment docs, READMEs |
| 2026-08-16 | `20260816-fix-authenticated-ssr-6c3f8a21` | Revision `498c2fa` implements authenticated SSR identity refresh through internal Go `/api/auth/me` using only enumerated session Cookie chunks; strict response validation, local direct-store behavior, and a database-free ACK Web configuration are preserved. The task performed no live deployment. | Task record |
| 2026-08-16 | `20260816-integrate-auth-ssr-9d7e4c2a` | Serialized integration of source commit `498c2fa` and canonical reconciliation for the authenticated SSR-to-Go identity bridge. No live deployment was performed. | Current state, task history, system overview, module map, data flow, commitments |
## Notes

51
.project-docs/30-worklog/tasks/20260816-integrate-auth-ssr-9d7e4c2a.md Normal file
View File

@@ -0,0 +1,51 @@
# Task: Integrate authenticated SSR fix into main
## Identity
- Task ID: 20260816-integrate-auth-ssr-9d7e4c2a
- Mode: Integration
- Branch: codex/20260816-integrate-auth-ssr-9d7e4c2a-integrate-auth-ssr
- Worktree: D:\Datas\OthersProjects\NianAIGC-integrate-auth-ssr-9d7e4c2a
- Base commit: 498c2fa2423abb1706f92f27ef7c1e71fc7345ca
- Owner: codex
- Status: In Progress
## Scope
- Integrate completed feature commit `498c2fa` (`20260816-fix-authenticated-ssr-6c3f8a21`) into `main` without mixing unrelated ready or planning tasks.
- Reconcile canonical project memory with the now-implemented Next.js SSR-to-Go identity boundary and database-free production Web workload.
- Re-run repository and project-document gates, complete read-only review, and advance the reviewed integration commit to `main`.
## Intent And Constraints
- Use the serialized Integration Gate and this dedicated worktree; do not mutate the occupied `main` worktree before a separately owned final fast-forward step.
- Integrate only the authenticated SSR fix and necessary canonical-memory reconciliation; the source task record remains read-only in this task baseline.
- Preserve accepted ADR-003 and DEP-001 semantics: production Next.js serves pages/SSR and calls Go over internal HTTP; Go owns database-backed authorization and the Web workload receives no database credentials.
- Treat the diagnosis promotion candidate as satisfied by the public-seam regression suite and retain a durable deployment commitment for authenticated SSR smoke testing.
- Do not merge the unrelated provider-settings or other ready task branches.
## Outcome
- Completed feature commit `498c2fa` is the verified baseline of this Integration Gate; its source task record remains unchanged.
- The user confirmed that `https://nianxxaigc.nianxx.cn` is the production environment and that the currently running revision is the first deployment. Canonical memory is therefore being reconciled as a live production remediation, not as a future first deployment.
- Canonical current state, task history, system overview, module map, data flow, and commitments now describe the implemented production SSR-to-Go identity bridge, database-free Web workload, local direct-store fallback, and required authenticated `/create` rollout smoke test.
- No unrelated ready/planning task branch was merged. Creating the reviewed integration documentation commit and advancing it to `main` remain the final steps.
## Verification
- Source feature final `sol_reviewer`: PASS for Standards and Spec.
- `cmd /c npm.cmd test` — 58 files and 183 tests passed on commit `498c2fa` in this integration worktree.
- `cmd /c npx.cmd tsc --noEmit --incremental false` — passed.
- `cmd /c npm.cmd run deploy:check` — `ACK manifest assertions passed (9 files)`.
- `cmd /c npm.cmd run build` — Next.js 15.5.18 production build passed; `/create` remains dynamically server-rendered.
- Canonical-memory reconciliation ran `git diff --check` successfully and touched only the six authorized canonical files.
- `uv run python .../check_project_docs.py` — passed in the correctly based integration worktree.
- `uv run python .../check_doc_drift.py --task-id 20260816-integrate-auth-ssr-9d7e4c2a` — passed; only this integration task record and authorized canonical documents changed relative to `498c2fa`.
## Follow-ups
- Build and publish the updated Web image, apply the checked-in ACK configuration, and complete the open authenticated `/create` smoke-test commitment before declaring the production remediation complete.
## Promotion Candidates
- None. This integration applies the already accepted ADR-003/DEP-001 boundary and records the remaining deployment verification obligation.

11
.project-docs/80-commitments/commitments.md
View File

@@ -4,15 +4,16 @@ Track future-facing memory: promised follow-ups, unfinished loops, timed checks,
| Date | Commitment | Trigger / Due | Owner | Status | Next Action |
|---|---|---|---|---|---|
| 2026-08-12 | Validate migration, TLS, permissions, and readiness against the real Alibaba Cloud RDS instance. | Before the first production rollout | Deployment owner | Open | Back up RDS, provision roles/CA/network access, then execute the SQL files manually. |
| 2026-08-12 | Validate migration, TLS, permissions, and readiness against the real Alibaba Cloud RDS instance. | Production hardening follow-up | Deployment owner | Open | Record the live RDS roles/CA/network configuration and validation evidence; public `/api/ready` currently returns HTTP 200 with PostgreSQL configured. |
| 2026-08-12 | Keep each workload at one replica until generated assets use OSS or another shared store. | Before raising replicas | Deployment owner | Open | Configure and validate external object storage. |
| 2026-08-12 | Harden the runtime image to non-root after writable paths are designed. | Security hardening follow-up | Application owner | Open | Define ownership for runtime and settings paths, then update Docker/ACK security context. |
| 2026-08-12 | Implement ADR-003 only after executable compatibility contracts exist. | Before starting the Go migration | Application owner | Completed | Contracts exist under `contracts/`; Go implementation merged 2026-08-14. |
| 2026-08-14 | Build the Go workload deployment artifacts: container image, ACK Deployment/Service manifests, and Ingress routing that sends page/static paths to Next.js and `/api`, `/uploads`, `/generated-results` to Go. | Before the first production deployment | Application owner | Completed | `backend/Dockerfile`, `deploy/ack/go-api.yaml`, and the split Ingress are merged (2026-08-14); remaining work is image build/push and cluster dry-run validation. |
| 2026-08-14 | Initialize the production schema by manually executing `database/migrations/0001_initial_schema.sql`, then `0002_generation_lifecycle_fencing.sql`, then the application-role grants. No migration Job pod is deployed. | Before the first Go/Web rollout | Deployment owner | Open | Run the SQL as the migration role against RDS and verify the application-role grants with the readiness checks. |
| 2026-08-14 | Configure `ZHINIAN_BOOTSTRAP_ADMIN_PHONE` / `ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD` / `ZHINIAN_BOOTSTRAP_ADMIN_NAME` for the first Go startup; the process creates the first super administrator exactly once. | First Go startup | Deployment owner | Open | Provide strong bootstrap credentials through the deployment Secret/ConfigMap. |
| 2026-08-14 | Validate the Go backend against non-production RDS, real OSS, provider credentials, and external Webhooks before the first production rollout. | Before the first production deployment | Deployment owner | Open | Stand up non-production RDS/OSS and run the contract and recovery suites against the Go binary. |
| 2026-08-14 | Confirm the public `/api/v1` support promise for external consumers. | Before the first production deployment | Product owner | Open | Product decision on which v1 endpoints and behaviors are guaranteed for partners. |
| 2026-08-14 | Confirm that the production schema was initialized by manually executing `database/migrations/0001_initial_schema.sql`, then `0002_generation_lifecycle_fencing.sql`, then the application-role grants. No migration Job pod is deployed. | Production configuration audit | Deployment owner | Open | Record execution evidence and application-role grant verification; do not infer completion solely from the public readiness response. |
| 2026-08-14 | Confirm the live status of `ZHINIAN_BOOTSTRAP_ADMIN_PHONE` / `ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD` / `ZHINIAN_BOOTSTRAP_ADMIN_NAME`; the Go process creates the first super administrator exactly once. | Production configuration audit | Deployment owner | Open | Verify the deployed configuration and bootstrap outcome without exposing credentials. |
| 2026-08-14 | Validate the Go backend against non-production RDS, real OSS, provider credentials, and external Webhooks. | Production hardening follow-up | Deployment owner | Open | Run the contract and recovery suites against representative external dependencies and record any live parity gaps. |
| 2026-08-14 | Confirm the public `/api/v1` support promise for external consumers. | Production compatibility follow-up | Product owner | Open | Product decision on which v1 endpoints and behaviors are guaranteed for partners. |
| 2026-08-16 | Release and smoke-test authenticated `/create` SSR through the internal Go identity bridge while confirming the updated production Web configuration remains database-free. | Before closing the `498c2fa` production repair rollout | Deployment owner | Open | Publish and deploy the updated Web image and ACK configuration, authenticate as a platform user, request `/create`, verify the RSC error is resolved through Go `/api/auth/me`, and recheck public readiness. |
## Use