{ "format": "openai4s-plan-crosswalk", "schema_version": 1, "plan": "OpenAI4S-next-version-integrated-report-20260725.md", "plan_section": "14", "baseline": "126ef915c2f37fc6eed3f7f77f06492f27eaec5e", "audited_at": "39bc788aa01d4f4436ff75762085b65ace44445a", "expected_rows": 56, "statuses": { "closed": "production call chain verified, a test that fails without the fix exists", "implemented_unverified": "on the production path, but the run that would prove it cannot be performed from a working copy; external_evidence names the missing run", "open": "a defect was located on the production call chain and is not fixed", "deferred_p2": "P2: enters no public API, schema or definition of done this version" }, "items": [ { "source": "R1", "original_id": "O4S-01", "original_priority": "P0", "original_proposal": "首次运行就绪闭环与 Gemini 配置入口", "integrated": "P0-2、P1-A", "plan_conclusion": "分拆：Profile 身份/入口 P0；就绪 UI P1", "status": "closed", "status_note": "profile_id+revision identity; gemini and openai_responses selectable", "tests": "tests/test_model_profile_identity.py,tests/test_model_protocol_menu.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "f89245edd204c074cc38b9790ece05f7f0a0f5778062623cbfc47b0bc6b9a919" }, { "source": "R1", "original_id": "O4S-02", "original_priority": "P0", "original_proposal": "不可变文本 Artifact 引用", "integrated": "P0-2、P1-A", "plan_conclusion": "身份合同 P0；Composer/历史 UI P1", "status": "closed", "status_note": "structured ArtifactRef: six fields persisted, not a re-parsed token", "tests": "tests/test_artifact_ref_chip.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "b4f9d13fa3f5f63d63a52c7fa6c353fcbf8ec8b6bd8fa50c1f21a6f77adaeb1d" }, { "source": "R1", "original_id": "O4S-03", "original_priority": "P0", "original_proposal": "运行中纯文本后续消息队列", "integrated": "P1-B", "plan_conclusion": "降为 P1；依赖稳定异步 identity 与 capacity", "status": "closed", "status_note": "follow-up queue reachable from the composer during a run", "tests": "tests/test_queued_followups.py", "browser_evidence": "tests/browser_admission_fault.mjs", "external_evidence": "", "evidence_digest": "bfa6945483fbe84ebc6d66a7e4e2945c75b56259703e2f8c71f8d0bc26a156ec" }, { "source": "R1", "original_id": "O4S-04", "original_priority": "P1", "original_proposal": "Delegation 停止与 steering 控件", "integrated": "P1-B", "plan_conclusion": "纳入", "status": "closed", "status_note": "delegation subtree stop and turn-boundary steering are POST routes on the real surface, wired in the UI (app.js `delegation.steer*`). A stop never reports a success it did not achieve, a record whose runner is gone is 409 rather than 404, and a steering message is length-bounded and refused before anything is looked up. The previous `open` label predated the work.", "tests": "tests/test_delegation_control.py,tests/test_delegation_persistence.py", "browser_evidence": "tests/browser_p1_controls.mjs", "external_evidence": "", "evidence_digest": "fb7807a090d78a5cffb02b91e878145df920b04bb4ba2957d703c9c67e2551b4" }, { "source": "R1", "original_id": "O4S-05", "original_priority": "P1", "original_proposal": "持久化远程计算只读任务中心", "integrated": "P1-B", "plan_conclusion": "纳入；不自动 poll、cancel 或重提", "status": "closed", "status_note": "owner-scoped remote task centre: `GET /frames//compute/tasks` plus an explicit `.../refresh`. Opening the page returns the durable record and says it did not poll; one session cannot enumerate another's; `unknown` is not rendered as a failure; process handles and cluster paths are not published. The previous `open` label predated the work. This row's conclusion -- no *automatic* poll, cancel or resubmit -- still holds after P1-4 added an explicit confirm-gated cancel: closing the page, stopping a turn, deleting a session, a timeout UI and a daemon restart are each asserted not to reach it.", "tests": "tests/test_compute_task_centre.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "84073d6671ba7a7a5e0b8f109e99604935b8f4b4d4b3426c46461dc9fe2c1e55" }, { "source": "R1", "original_id": "O4S-06", "original_priority": "P1", "original_proposal": "Skill requirements 与 readiness 契约", "integrated": "P1-B", "plan_conclusion": "纳入", "status": "closed", "status_note": "requirements and readiness carried loader -> route -> UI", "tests": "tests/test_skill_catalog_readiness_route.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "2f9aa117b024396ea360d0cb678b5626e4ff541d2fd6184f24462f6c946108e5" }, { "source": "R1", "original_id": "O4S-07", "original_priority": "P1", "original_proposal": "发布、超时与隔离证明加固", "integrated": "P0-0、P0-3", "plan_conclusion": "晋升并分拆", "status": "implemented_unverified", "status_note": "release-pipeline logic closed and falsified offline; the one real workflow_dispatch that would exercise the YAML has not been run", "tests": "tests/test_release_gate_manifest.py", "browser_evidence": "", "external_evidence": "one real workflow_dispatch of .github/workflows/release.yml" }, { "source": "R1", "original_id": "O4S-08", "original_priority": "P2", "original_proposal": "endpoint-scoped 模型能力持久化", "integrated": "P2", "plan_conclusion": "保留为设计项", "status": "deferred_p2", "status_note": "out of scope this version by decision D8", "tests": "", "browser_evidence": "", "external_evidence": "" }, { "source": "R2", "original_id": "P0-01", "original_priority": "P0", "original_proposal": "Profile 一致选择与显式连接验证", "integrated": "P0-2、P1-A", "plan_conclusion": "身份 P0；显式 probe/UI P1", "status": "closed", "status_note": "selection by profile_id, not a bare model string", "tests": "tests/test_model_profile_identity.py,tests/test_model_protocol_menu.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "f89245edd204c074cc38b9790ece05f7f0a0f5778062623cbfc47b0bc6b9a919" }, { "source": "R2", "original_id": "P0-02", "original_priority": "P0", "original_proposal": "远程计算 owner 隔离与 Artifact 闭环", "integrated": "P0-2", "plan_conclusion": "纳入", "status": "closed", "status_note": "remote-compute owner isolation and the artifact loop: a job is owner-scoped at submit and at harvest, a harvested file lands as this session's Artifact version with a lineage edge, and a foreign or absent job id is refused identically so the refusal cannot be read as an existence oracle.", "tests": "tests/test_compute_owner_and_harvest.py,tests/test_compute_harvest_safety.py,tests/test_compute_lifecycle.py,tests/test_compute_trust_boundary.py,tests/test_artifact_scope_closure.py,tests/test_materialisation_atomicity.py,tests/test_stage11_remote_compute.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "366457648a55792feb79c71496547c8ec042fad6127632a1b58bb16d5fe01902" }, { "source": "R2", "original_id": "P0-03", "original_priority": "P0", "original_proposal": "内置科研 Skill 的统一网络边界", "integrated": "P0-2", "plan_conclusion": "纳入", "status": "open", "status_note": "The original three first-party research skills moved to guarded Host APIs, but the newly imported pinned bioSkills collection contains raw-network Python, shell, R, and recipe-code paths that are not covered by the Host allowlist/SSRF boundary. The merge review broadened the detection gate from two urllib files to a fingerprinted inventory of common clients including requests, Bio.Entrez, curl, and wget, but detection is not enforcement. The unified-boundary proposal remains open until those recipes are runtime-confined. Reopened at e20bd966 (2026-08-21), after this file's declared audit at audited_at. Waived for v0.3.0 only, as a declared known limitation (docs/v03-decisions.md, D12-W1, recorded 2026-09-14); the waiver does not change this status.", "tests": "tests/test_host_network_capability.py,tests/test_egress_surface.py,tests/test_egress.py", "browser_evidence": "", "external_evidence": "" }, { "source": "R2", "original_id": "P1-01", "original_priority": "P1", "original_proposal": "全局/Project 记忆作用域与注入预算", "integrated": "P1-B", "plan_conclusion": "纳入，保留独特项", "status": "closed", "status_note": "global and project tiers with inheritance; per-item size and per-scope count enforced before the insert; scoped delete. The UI wrote to \"default\" while injection read the session's project, so a memory was invisible to the sessions it was written for. Re-audited: expiry withheld a memory from injection and kept its quota slot, so a scope of expired rows refused every new write; admission now counts live rows against a separate stored ceiling. Memory also gained the edit it never had, with `updated_at` so a correction does not expire on the clock of what it replaced. Also re-audited over the wire: `/memory/([^/]+)` matched the `categories`, `context` and `enabled` sub-resources, so every verb but GET treated them as memory ids.", "tests": "tests/test_memory_scope_and_budgets.py,tests/test_memory_edit_and_expiry_quota.py", "browser_evidence": "tests/browser_p1_controls.mjs", "external_evidence": "", "evidence_digest": "ee5153eaa7d823ead821c192b896daea477390f6b0e0c12f78e2212eeff6d4a2" }, { "source": "R2", "original_id": "P1-02", "original_priority": "P1", "original_proposal": "Session、消息与导出端到端分页", "integrated": "P1-A", "plan_conclusion": "纳入", "status": "closed", "status_note": "keyset cursor with a real browser consumer; full branch export", "tests": "tests/test_session_and_message_paging.py", "browser_evidence": "tests/browser_p1_controls.mjs", "external_evidence": "", "evidence_digest": "40085cbfceab23dae20c277feb09562fbe0f271343f85898afe6e1a44afc7d35" }, { "source": "R2", "original_id": "P1-03", "original_priority": "P1", "original_proposal": "有界执行输出、并发与 Bash 终止", "integrated": "P0-3", "plan_conclusion": "晋升", "status": "closed", "status_note": "producer-side output budgets plus the workspace scan budgets", "tests": "tests/test_producer_output_budgets.py,tests/test_workspace_streaming_budgets.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "afd518e4ca3d6029fd4ff9acc79749bf40a8f92cf0e7d220048ef0f4e3570ba7" }, { "source": "R2", "original_id": "P1-04", "original_priority": "P1", "original_proposal": "发布质量门禁与 Python 3.13 一致性", "integrated": "P0-0", "plan_conclusion": "晋升；解释器版本以当前事实重新冻结", "status": "implemented_unverified", "status_note": "release-pipeline logic closed and falsified offline; the one real workflow_dispatch that would exercise the YAML has not been run", "tests": "tests/test_release_gate_manifest.py", "browser_evidence": "", "external_evidence": "one real workflow_dispatch of .github/workflows/release.yml" }, { "source": "R2", "original_id": "P2-01", "original_priority": "P2", "original_proposal": "Artifact 版本检索来源面板", "integrated": "P1-A", "plan_conclusion": "提前为只读 P1，依赖 scoped source", "status": "closed", "status_note": "the Artifact version retrieval-source panel is allowlisted, length-capped and redacted, and the route never sends the credential. Rendered by app.js `versions.retrievalSource`. The previous `open` label predated the work.", "tests": "tests/test_retrieval_source.py,tests/test_retrieval_provenance.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "d13e86658f7b7ac7d9fd2b135b9739468a24b76d049772fb3c112592c24d3485" }, { "source": "R3", "original_id": "P0-01", "original_priority": "P0", "original_proposal": "本地 Web 控制面默认身份校验", "integrated": "P0-1", "plan_conclusion": "纳入", "status": "closed", "status_note": "local auth required on loopback, and on every bind with no opt-out since 0.3.0 (the loopback-only OPENAI4S_REQUIRE_TOKEN=0 hatch granted for one minor release by D1 is removed, and a daemon started with it is driven over the wire and still refuses an anonymous caller); the DNS-rebinding Host allowlist verified on the wire against a real server, ahead of both the Origin guard and the token gate. The exit matrix itself was added later: an unauthenticated WebSocket upgrade, a sweep of every routable path from contract.http_routes(), and a cookie replayed against a handler that did not issue it -- three legs this row previously claimed without evidence.", "tests": "tests/test_auth_exit_matrix.py,tests/test_gateway_host_allowlist.py,tests/test_token_query_bootstrap.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "88903e3fec7ebba0629469e230ddb888435121d7a97a3ab7a66b596fb083badc" }, { "source": "R3", "original_id": "P0-02", "original_priority": "P0", "original_proposal": "首次运行就绪检查与默认无隐式任务", "integrated": "P0-1、P0-2", "plan_conclusion": "分拆", "status": "closed", "status_note": "a fresh data dir boots with no kernel spawned, no cell executed, no artifact row and no outbound socket -- asserted as the property, not as the flag", "tests": "tests/test_startup_no_implicit_side_effects.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "92fcaed7df234df1e19416cd70e7e2f759b3a6434c04cd112c42b8c2be2f222a" }, { "source": "R3", "original_id": "P0-03", "original_priority": "P0", "original_proposal": "精确发布源码质量门禁与发布事实一致性", "integrated": "P0-0", "plan_conclusion": "纳入", "status": "implemented_unverified", "status_note": "release-pipeline logic closed and falsified offline; the one real workflow_dispatch that would exercise the YAML has not been run", "tests": "tests/test_release_gate_manifest.py", "browser_evidence": "", "external_evidence": "one real workflow_dispatch of .github/workflows/release.yml" }, { "source": "R3", "original_id": "P1-01", "original_priority": "P1", "original_proposal": "会话与消息历史完整分页", "integrated": "P1-A", "plan_conclusion": "纳入", "status": "closed", "status_note": "session and message history reachable past the first page", "tests": "tests/test_session_and_message_paging.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "dbd35e6338e8d5aea5ccd50b420b147ff472cdd03aa0272a6d77678e82501db3" }, { "source": "R3", "original_id": "P1-02", "original_priority": "P1", "original_proposal": "绑定 Artifact version 的结构化引用", "integrated": "P0-2、P1-A", "plan_conclusion": "身份晋升 P0；UI P1", "status": "closed", "status_note": "structured ArtifactRef bound to a version", "tests": "tests/test_artifact_ref_chip.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "b4f9d13fa3f5f63d63a52c7fa6c353fcbf8ec8b6bd8fa50c1f21a6f77adaeb1d" }, { "source": "R3", "original_id": "P1-03", "original_priority": "P1", "original_proposal": "计算任务所有权、安全边界与持久任务可见性", "integrated": "P0-2、P0-3、P1-B", "plan_conclusion": "分拆并晋升安全部分", "status": "closed", "status_note": "both halves are on the production path now: idempotency is owner-scoped and a native harvest becomes one Artifact version per file, and the P1-B persistent task centre is the owner-scoped read-only projection above. The note that recorded the second half as STILL OPEN predated it.", "tests": "tests/test_compute_owner_and_harvest.py,tests/test_compute_task_centre.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "83a05fdfe088278a205a5c6b0ef425e65f5002c6de3ca598ec4ee5203e0b7e47" }, { "source": "R3", "original_id": "P1-04", "original_priority": "P1", "original_proposal": "Skills 前置条件与就绪状态", "integrated": "P1-B", "plan_conclusion": "纳入", "status": "closed", "status_note": "ready/needs_setup/unknown surfaced without a subprocess or a network call", "tests": "tests/test_skill_catalog_readiness_route.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "2f9aa117b024396ea360d0cb678b5626e4ff541d2fd6184f24462f6c946108e5" }, { "source": "R3", "original_id": "P2-01", "original_priority": "P2", "original_proposal": "Linux PID namespace 隔离实验", "integrated": "P2", "plan_conclusion": "保留真实 Runner 实验", "status": "deferred_p2", "status_note": "out of scope this version by decision D8", "tests": "", "browser_evidence": "", "external_evidence": "" }, { "source": "R4", "original_id": "P0-1", "original_priority": "P0", "original_proposal": "计划暂停状态与剩余步骤续跑", "integrated": "P0-4", "plan_conclusion": "纳入", "status": "closed", "status_note": "paused->executing is a CAS; the UPDATE's rowcount decides. Re-audited: `approve` had the same read-then-write race `resume` was fixed for and none of the fix; it now claims with the same compare-and-swap, and two concurrent approves start exactly one turn.", "tests": "tests/test_plan_resume_claim.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "9f1a4449b5647d98222bda98caad254ecdcb5738b167a2bd0b96791d806af156" }, { "source": "R4", "original_id": "P0-2", "original_priority": "P0", "original_proposal": "MCP deadline、协议边界与坏连接驱逐", "integrated": "P0-3", "plan_conclusion": "纳入", "status": "closed", "status_note": "MCP fault-driven eviction, bounded reads, process-group close. Re-audited: `_MAX_FRAME_BYTES` was counted in characters off a `text=True` pipe, one `read(1)` per character, so a frame at the limit allocated a four-million-element list of one-character strings. The reader is now raw and chunked and the budget is bytes. The wrong-ID flood arm had no test until tests/test_mcp_lifecycle.py grew one; the budget could be deleted without turning anything red. Re-audited 2026-08-23 after tests/test_mcp_lifecycle.py changed: four connections stopped putting the cold-subprocess `initialize` handshake on the same short deadline as the request under test (construct at 30s, then `connection._timeout = `, the idiom the file already used at its flush points), and the late-reply-discard case waits for the abandoned id to be popped instead of sleeping four seconds. No assertion moved: the eviction bound, `len(_abandoned)`, the desync flush and the byte budget are asserted exactly as before, and the late-reply case now also asserts the late answer arrived, which it previously assumed.", "tests": "tests/test_mcp_lifecycle.py,tests/test_kernel_oversized_frame.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "93e535b97691298da945bb9ce49727213adcf6830629e7ac16c92d9cd2ec803f" }, { "source": "R4", "original_id": "P0-3", "original_priority": "P0", "original_proposal": "Python/R 执行期有界输出", "integrated": "P0-3", "plan_conclusion": "纳入", "status": "closed", "status_note": "producer-side byte budgets for stdout/stderr/traceback and the R error", "tests": "tests/test_producer_output_budgets.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "b9dcd59d0446d14a5f5222fe20102b54cff48d4ade6a9a195c62739173b4e282" }, { "source": "R4", "original_id": "P1-1", "original_priority": "P1", "original_proposal": "项目级 Artifact 精确引用与安全物化", "integrated": "P0-2、P1-A", "plan_conclusion": "身份晋升 P0；物化 UI P1", "status": "closed", "status_note": "atomic materialisation (validate, stage, replace) plus the structured ref", "tests": "tests/test_materialisation_atomicity.py,tests/test_artifact_ref_chip.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "8c90760f5b3f7199cac530515abb5034b7e6cf5ef65cfd1a86dd395bb0717ec1" }, { "source": "R4", "original_id": "P1-2", "original_priority": "P1", "original_proposal": "Web readiness 与发送前预检", "integrated": "P0-2、P1-A", "plan_conclusion": "本地合同 P0；UI P1", "status": "closed", "status_note": "local-only readiness; the pin decides dispatch or refuses 409", "tests": "tests/test_model_profile_identity.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "c9c16c6f06026d8c5d96a7117dae13417c43e5d70b7f72d5d6c0f855fc9195cf" }, { "source": "R4", "original_id": "P1-3", "original_priority": "P1", "original_proposal": "Specialist Skills/Connectors 运行时约束", "integrated": "P1-B", "plan_conclusion": "纳入；若 UI 已承诺 exact，必须先隐藏或实现", "status": "closed", "status_note": "tri-state for skills AND connectors; a nested child can no longer widen", "tests": "tests/test_specialist_connector_allowlist.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "0d1c29a7369de45dd14111c2194698c1fea2ea150752872ac42611545b39a13e" }, { "source": "R4", "original_id": "P1-4", "original_priority": "P1", "original_proposal": "远程访问令牌从写请求 URL 中迁出", "integrated": "P0-1", "plan_conclusion": "晋升", "status": "closed", "status_note": "a ?token= is exchanged for an HttpOnly SameSite=Strict cookie on the root page ONLY and the 303 strips it from the URL; a token in the query of any other path is refused", "tests": "tests/test_token_query_bootstrap.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "6f2484d2b4cc42bc48163f1f016ce66feac50d74d0153ceff7a7a59de75f050e" }, { "source": "R4", "original_id": "P2-1", "original_priority": "P2", "original_proposal": "持久远程计算 Web 投影设计合同", "integrated": "P2、P1-B", "plan_conclusion": "owner-scoped 只读面板可进 P1；完整合同 P2", "status": "closed", "status_note": "the P1-B half this version promised -- an owner-scoped panel that does not poll on open -- is on the production path and covered. Decision D8 kept the full Poll/Harvest/Cancel/Reconcile workbench at P2 with no public API; the next-version report has since promoted the Cancel half to core scope (P1-4), and `POST /frames//compute/tasks//cancel` is now a public route. Harvest, Reconcile and the imported/quarantined semantics remain P2 under D8; the panel is no longer read-only.", "tests": "tests/test_compute_task_centre.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "84073d6671ba7a7a5e0b8f109e99604935b8f4b4d4b3426c46461dc9fe2c1e55" }, { "source": "R5", "original_id": "P0-01", "original_priority": "P0", "original_proposal": "MCP 有界请求、回收与重连", "integrated": "P0-3", "plan_conclusion": "纳入", "status": "closed", "status_note": "MCP fault-driven eviction, bounded reads, process-group close Re-audited with R4/P0-2: same reader, same byte budget. The wrong-ID flood arm had no test until tests/test_mcp_lifecycle.py grew one; the budget could be deleted without turning anything red. Re-audited 2026-08-23 after tests/test_mcp_lifecycle.py changed: four connections stopped putting the cold-subprocess `initialize` handshake on the same short deadline as the request under test (construct at 30s, then `connection._timeout = `, the idiom the file already used at its flush points), and the late-reply-discard case waits for the abandoned id to be popped instead of sleeping four seconds. No assertion moved: the eviction bound, `len(_abandoned)`, the desync flush and the byte budget are asserted exactly as before, and the late-reply case now also asserts the late answer arrived, which it previously assumed.", "tests": "tests/test_mcp_lifecycle.py,tests/test_kernel_oversized_frame.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "93e535b97691298da945bb9ce49727213adcf6830629e7ac16c92d9cd2ec803f" }, { "source": "R5", "original_id": "P0-02", "original_priority": "P0", "original_proposal": "SSH alias 校验与 transport 收口", "integrated": "P0-2", "plan_conclusion": "纳入", "status": "closed", "status_note": "ssh alias validation and transport closure: an agent could name any ssh destination and the daemon dialled it. Registration validates the alias, and the other two thirds -- the durability path and the sdk-side submit -- go through the same closure rather than round their own.", "tests": "tests/test_compute_alias_registration.py,tests/test_compute_trust_boundary.py,tests/test_compute_durability.py,tests/test_sdk_compute.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "a071098892f48b88944f750fe9fe1177f1b5bcbf1a7c3b10bc3dbb4be817593c" }, { "source": "R5", "original_id": "P0-03", "original_priority": "P0", "original_proposal": "版本锁定的结构化 Artifact 引用", "integrated": "P0-2、P1-A", "plan_conclusion": "分拆", "status": "closed", "status_note": "version-locked structured reference", "tests": "tests/test_artifact_ref_chip.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "b4f9d13fa3f5f63d63a52c7fa6c353fcbf8ec8b6bd8fa50c1f21a6f77adaeb1d" }, { "source": "R5", "original_id": "P1-04", "original_priority": "P1", "original_proposal": "工作区文本工具真实资源预算", "integrated": "P0-3", "plan_conclusion": "晋升", "status": "closed", "status_note": "streaming/scan budgets with structured counters; chunked artifact hashing", "tests": "tests/test_workspace_streaming_budgets.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "0cb6ce9f3639a160e6b6fee37173a11523851dd4854068110976d76bfa6c4bf3" }, { "source": "R5", "original_id": "P1-05", "original_priority": "P1", "original_proposal": "私有异常、审计摘要与结构化前端错误", "integrated": "P0-4", "plan_conclusion": "晋升", "status": "closed", "status_note": "one safe exception projector; str(e) removed from every public surface. Re-audited: three more public bodies answered with the OS's words (`restore failed: {error}`, `write failed: {error}`, and the attachment problem card). Author-written refusals are now a type, so they survive to the caller while an escapee from the OS layer does not.", "tests": "tests/test_public_exception_projector.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "58b4e953f7e7571aadcc1d78503dab126b67f2431bd822541d942471f3b5d9c3" }, { "source": "R5", "original_id": "P1-06", "original_priority": "P1", "original_proposal": "会话绑定模型 profile 身份", "integrated": "P0-2", "plan_conclusion": "晋升", "status": "closed", "status_note": "a session is bound to a model profile id and a sealed revision, not to a bare model string: the request's `model` no longer wins, a revoked key or any exception no longer silently falls back to the globally active profile, and a legacy session that matches nothing is told so instead of being pinned to whatever happens to be active.", "tests": "tests/test_model_profile_identity.py,tests/test_model_revision_binding.py,tests/test_model_binding_recovery.py,tests/test_model_catalog.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "66e7b87b38fb579362ed511fef09cfe4eb4b9d030d01506d1876881812aaabf6" }, { "source": "R5", "original_id": "P1-07", "original_priority": "P1", "original_proposal": "发布输入所指向提交的质量门", "integrated": "P0-0", "plan_conclusion": "晋升", "status": "implemented_unverified", "status_note": "release-pipeline logic closed and falsified offline; the one real workflow_dispatch that would exercise the YAML has not been run", "tests": "tests/test_release_gate_manifest.py", "browser_evidence": "", "external_evidence": "one real workflow_dispatch of .github/workflows/release.yml" }, { "source": "R5", "original_id": "P2-08", "original_priority": "P2", "original_proposal": "会话隔离的持久远程任务工作台", "integrated": "P2、P1-B", "plan_conclusion": "只读入口 P1；完整控制 P2", "status": "closed", "status_note": "same split as R4/P2-1, with the same amendment: the session-isolated entry is delivered and covered, and P1-4 has promoted explicit cancel out of D8's P2 bucket into a public route. The rest of the workbench stays P2.", "tests": "tests/test_compute_task_centre.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "84073d6671ba7a7a5e0b8f109e99604935b8f4b4d4b3426c46461dc9fe2c1e55" }, { "source": "R6", "original_id": "O4S-01", "original_priority": "P0", "original_proposal": "本地 Compute Job 最小权限与生命周期闭环", "integrated": "P0-3", "plan_conclusion": "纳入", "status": "closed", "status_note": "the envelope was already closed (minimal env, non-login shell, active capacity claimed before the spawn, realpath cwd). This audit closed the rest: a per-job deadline with its own `timeout` terminal state, output bounded in bytes at the read rather than trimmed after an unbounded `readline()`, `JobManager.close()` joined and wired into `_GatewayHTTPServer.server_close`, and no raw `str(e)` on either the job log or the submit refusal.", "tests": "tests/test_local_job_envelope.py,tests/test_local_job_lifecycle.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "865dc95c3bae6c29af3fe8b6ea468dd567dde6c1bc5ddd2ad42a3cbb756df650" }, { "source": "R6", "original_id": "O4S-02", "original_priority": "P0", "original_proposal": "Host Artifact/lineage 范围闭环", "integrated": "P0-2", "plan_conclusion": "纳入", "status": "closed", "status_note": "SQLite authorizer + session-scoped my_* views; foreign and absent refusals made indistinguishable; lineage inputs validated before write", "tests": "tests/test_artifact_scope_closure.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "9bb7cc940bebb74b255c460ec1bcd26b050265e496fc24eac92b9b19ad29298c" }, { "source": "R6", "original_id": "O4S-03", "original_priority": "P0", "original_proposal": "严格上传字节契约", "integrated": "P0-2", "plan_conclusion": "纳入", "status": "closed", "status_note": "identity/scope: closed. Agent-SQL authorizer with session-scoped my_* views; foreign and absent artifact refusals made indistinguishable; view_image and lineage inputs scope-validated; materialisation and upload validate before mutating, stage, and replace atomically (the live file is no longer hardlinked to an immutable snapshot); model dispatch honours profile_id+revision including on a queued follow-up, and delete is a tombstone; compute idempotency is owner-scoped; compute_result declares writes_files so a native harvest becomes one Artifact version per file. Re-audited: the byte contract was closed, but the route it guards answered 500 for every session outside the `default` project -- `upload` asserted a project the client had never sent, and the resulting scope refusal escaped as a bare ValueError. Found by uploading through a running daemon.", "tests": "tests/test_artifact_scope_closure.py,tests/test_artifact_mutation_service.py,tests/test_materialisation_atomicity.py,tests/test_model_profile_identity.py,tests/test_compute_owner_and_harvest.py,tests/test_upload_scope_resolution.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "c0e68e61454239cb26ab35a68ff1d6fa84858cd9d4dc59f890c73c16ec02ad58" }, { "source": "R6", "original_id": "O4S-04", "original_priority": "P1", "original_proposal": "模型 Profile 校验、探测与 Session 绑定", "integrated": "P0-2、P1-A", "plan_conclusion": "身份晋升 P0；UI P1", "status": "closed", "status_note": "immutable revision, credential checked at bind, tombstone delete", "tests": "tests/test_model_profile_identity.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "c9c16c6f06026d8c5d96a7117dae13417c43e5d70b7f72d5d6c0f855fc9195cf" }, { "source": "R6", "original_id": "O4S-05", "original_priority": "P1", "original_proposal": "Project 内 Artifact 身份引用", "integrated": "P0-2、P1-A", "plan_conclusion": "身份晋升 P0；物化 P1", "status": "closed", "status_note": "same-project reference identity and safe materialisation", "tests": "tests/test_materialisation_atomicity.py,tests/test_artifact_ref_chip.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "8c90760f5b3f7199cac530515abb5034b7e6cf5ef65cfd1a86dd395bb0717ec1" }, { "source": "R6", "original_id": "O4S-06", "original_priority": "P1", "original_proposal": "多 Agent 用户控制面", "integrated": "P1-B", "plan_conclusion": "纳入", "status": "closed", "status_note": "the multi-agent control surface is three things and all three are real: delegation stop/steer, the running-turn follow-up FIFO with per-item cancel that leaves the running turn and the siblings alone, and the specialist connector allowlist -- exact three-state, deny-first, enforced on direct Host RPC as well as in the catalogue. The previous note said the allowlist did not exist; `openai4s/host/mcp.py` and `host_dispatch.py` implement it.", "tests": "tests/test_delegation_control.py,tests/test_queued_followups.py,tests/test_specialist_connector_allowlist.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "71bb8860433f850d2d0b45e574477918656be607676bd6eabab6025d75f8d322" }, { "source": "R6", "original_id": "O4S-07", "original_priority": "P1", "original_proposal": "诚实的表格预览与 TSV 修复", "integrated": "P1-A", "plan_conclusion": "纳入，保留独特项", "status": "closed", "status_note": "the Viewer's table path reported neither true totals nor hidden counts while the Notebook path did; sort/filter/compare_versions were declared with no consumer anywhere; parquet/arrow are download-only", "tests": "tests/test_renderer_capability_honesty.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "4bf2944794c004eecda3f9c5a690cb0f867baa87c178a7fc775701f45b6e6e09" }, { "source": "R6", "original_id": "O4S-08", "original_priority": "P2", "original_proposal": "macOS DMG 公证门禁", "integrated": "P2、P0-0", "plan_conclusion": "文档真实性 P0；真实公证 P2", "status": "implemented_unverified", "status_note": "release-pipeline logic closed and falsified offline; the one real workflow_dispatch that would exercise the YAML has not been run", "tests": "tests/test_release_gate_manifest.py", "browser_evidence": "", "external_evidence": "one real workflow_dispatch of .github/workflows/release.yml" }, { "source": "R7", "original_id": "P0-01", "original_priority": "P0", "original_proposal": "启动默认零隐式科研执行", "integrated": "P0-1", "plan_conclusion": "纳入", "status": "closed", "status_note": "no implicit scientific execution at startup; the demo seed is opt-in behind a confirmed route", "tests": "tests/test_startup_no_implicit_side_effects.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "92fcaed7df234df1e19416cd70e7e2f759b3a6434c04cd112c42b8c2be2f222a" }, { "source": "R7", "original_id": "P0-02", "original_priority": "P0", "original_proposal": "本地后台作业统一资源信封与可恢复收据", "integrated": "P0-3", "plan_conclusion": "纳入", "status": "closed", "status_note": "the resource envelope and truncation receipt were closed; this audit added the two that were named as missing -- a per-job deadline, and a receipt that survives the daemon so a restart names an unterminated job `abandoned` rather than losing it. `abandoned` is terminal, never revived, and deliberately distinct from `failed` and `cancelled`.", "tests": "tests/test_local_job_lifecycle.py,tests/test_local_job_envelope.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "865dc95c3bae6c29af3fe8b6ea468dd567dde6c1bc5ddd2ad42a3cbb756df650" }, { "source": "R7", "original_id": "P0-03", "original_priority": "P0", "original_proposal": "统一安全错误信封与异步请求关联", "integrated": "P0-4", "plan_conclusion": "纳入", "status": "closed", "status_note": "one safe exception projector with a local request id on every surface. Re-audited with R5/P1-05: the artifact restore/write paths and the attachment card now project through the same envelope.", "tests": "tests/test_public_exception_projector.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "58b4e953f7e7571aadcc1d78503dab126b67f2431bd822541d942471f3b5d9c3" }, { "source": "R7", "original_id": "P1-01", "original_priority": "P1", "original_proposal": "Model Profile 身份化选择与能力预检", "integrated": "P0-2、P1-A", "plan_conclusion": "身份晋升 P0；probe/UI P1", "status": "closed", "status_note": "identity-based selection and local capability pre-check", "tests": "tests/test_model_profile_identity.py,tests/test_model_protocol_menu.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "f89245edd204c074cc38b9790ece05f7f0a0f5778062623cbfc47b0bc6b9a919" }, { "source": "R7", "original_id": "P1-02", "original_priority": "P1", "original_proposal": "Session 内消息级图像附件", "integrated": "P1-A", "plan_conclusion": "纳入，依赖精确视觉 Profile", "status": "closed", "status_note": "attachments bound to an immutable version; magic-byte MIME. Re-audited: the annotation version binding did not survive a checkpoint restore -- captured by `SELECT *`, restored by an explicit column list without `version_id`/`checksum` -- so every restore put the resolve-to-latest behaviour back.", "tests": "tests/test_annotation_version_binding.py,tests/test_checkpoint_binding_survival.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "fa3962f71b667467bdd578ab2118dcda1a013ddd994f04dd48af18d2230f955b" }, { "source": "R7", "original_id": "P1-03", "original_priority": "P1", "original_proposal": "会话列表完整分页", "integrated": "P1-A", "plan_conclusion": "纳入", "status": "closed", "status_note": "the 100-session hard cap removed; cursor walked over 260", "tests": "tests/test_session_and_message_paging.py", "browser_evidence": "", "external_evidence": "", "evidence_digest": "dbd35e6338e8d5aea5ccd50b420b147ff472cdd03aa0272a6d77678e82501db3" }, { "source": "R7", "original_id": "P1-04", "original_priority": "P1", "original_proposal": "Notebook 单语言与 Bundle 下载选择器", "integrated": "P1-A", "plan_conclusion": "纳入，保留独特项", "status": "closed", "status_note": "the Python/R/Bundle selector is in the UI (`NOTEBOOK_EXPORTS`) and on the route; this audit added a fourth `markdown` form, both languages in execution order, for reading rather than re-running. The previous `open` label predated the selector.", "tests": "tests/test_notebook_export.py,tests/test_gateway_session_domain_routes.py", "browser_evidence": "tests/browser_smoke.mjs", "external_evidence": "", "evidence_digest": "11ad4df8f1a83b1a9eee549491de024cb9d3023b436ebeb65ff1cda57dcabd14" }, { "source": "R7", "original_id": "P2-01", "original_priority": "P2", "original_proposal": "受管环境事务变更契约", "integrated": "P2", "plan_conclusion": "保留为设计项", "status": "deferred_p2", "status_note": "out of scope this version by decision D8", "tests": "", "browser_evidence": "", "external_evidence": "" } ], "audit": { "method": "read-only production call-chain audit; 14 areas; no area came back fully wired", "rule": "a capability counts only when an unbroken chain runs from the externally reachable entry point to the enforcing code. An enforcement function whose every call site is a test is not implemented, and a check that fires after the side effect is not a check." } }