宜博 / lemonboss

company-service.js：company.json 加 ownerId（无 SQL 表，纯 JSON 字段）；create() 接收
ownerId；list({ user }) 按传入用户过滤，不传就不过滤（company-heartbeat-service.js 等
系统内部巡检要看全部公司）；新增 canAccessCompany(company, user) 作为全仓库唯一一份
归属判据（admin 不过滤，判负一律 404 不是 403，不暴露"这个 id 存在只是不是你的"）。

company.js 用 router.param('companyId', ...) 统一收口（约 50 条路由，含 okrPath() 系列
动态路由）。graph-run.js 的两个挂载点参数形状不一样，设计阶段的描述不准确，实现时才
发现：companyRouter 唯一路由是 /:companyId/graph-runs 直接查；主 router 全部路由是
/:id/...，:id 指的是 run 不是公司，改成先查 run 的 company_id 再判断，run 不存在或
公司不是你的统一回"run 不存在"。devloop.js 用 :pid 反查 company_id；POST /projects
单独校验 body 里的 company_id（放在基本字段校验之后，避免归属检查打乱输入校验的错误
优先级）；GET /projects 按归属过滤列表。

okr.js 最终没有按原计划接入 companyId 归属校验——实现前查证发现 OkrDashboard.vue
挂载的 /okr 页面全站没有任何导航入口指向它，是个孤儿页面，给访问不到的页面建"选公司"
前端交互不划算，改成 requireAdmin（跟 dream.js 同款），先堵住直接拼 URL 看到跨公司
聚合数据的口子。真正在用的公司级 OKR（company.js 的 /:id/okr）已随 company.js 一起隔离。

存量数据迁移：scripts/backfill-company-owner.js（npm run backfill:company-owner），
两家存量公司已划给种子账号，幂等验证过。

8 个既有测试文件用的公司 id 都是从没真正建过的字符串标签，挂锁后集体 404——新增共享
helper server/tests/helpers/ensure-test-company.js 修复；两处原有的"跳过已有
company.json 的目录，那是真公司"防御逻辑，判据从"有没有 company.json"改成"ownerId
是不是 -1 这个测试专用标记"，否则新出现的测试夹具会被误判成真公司永远不清理。

验证：真实 curl 走过（admin 看到全部存量公司、新用户看到空列表、新用户拼 URL 访问
别人的公司 404、新建公司 ownerId 精确落在创建者、admin 和创建者都看得到其他人看不到）；
全量 vitest 1427 passed，3 个无关既有失败不受影响。

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

设计见 docs/done/system-design/28-agent-registry-unification.md。

改造前 Agent 本体散在三处（system/agents/ 11 个、system/templates/ 50 个、
data/companies/{id}/agents/ 17 个），同一个 AgentScaffold 被三个 baseDir 实例化。
后果是同一角色在 N 家公司下有 N 份互不相干的副本，模板更新不会同步；
org-coder / org-planner 这类走 hireFromBaseMetaAgent 造出来的本体
legacy_path 指回自己公司目录，永远无法被第二家公司复用。

本次：
- G1 单一注册表：system/templates/ 整体并入 system/agents/，base → _base。
  7 个同名 id 逐个裁决，被丢弃的一份归档到 docs/_archive/ 而非删除。
  source_kind(template/global_agent/company_hired) → origin(builtin/created)。
- G2 运行态下沉：CLI 的 cwd 从本体根改为 system/agents/{aid}/{cid}/{taskId}/。
  memory / conversations 落公司态 {aid}/{cid}/，按公司隔离不串。
  sessionPool 的 key 含 (companyId, taskId)，两家公司调同一 agent 不复用会话。
- G2b 产物不下沉：交付物仍落 data/companies/{cid}/，system/agents/ 只留运行痕迹。
  写入边界按链路分叉——graph 节点走节点私有目录（被 indexNodeOutputs 索引），
  chat 走公司 workspace，同一提示词里不再出现两条互斥指令。
- G3 公司只存引用：data/companies/{id}/agents/ 删除，新增 company_agents 关联表。
  不复用 org_graph_nodes——后者是执行流图，work 层本体被雇时不写它，天生覆盖不全。
- G4 缺则创建：本体缺失时从 _base 复制骨架进 system/agents/{id}/，
  agent-creator 填 agent.md/soul.md 后才从 draft 转 active（哨兵判据，
  骨架未填时哨兵仍在，不许被 hire）。产物即刻是全系统可复用的本体。

新增 server/services/agent-locator.js 收编原先散在 6 处的寻址逻辑。

边界守卫（graph-engine）的豁免从「本体根上五个文件名」放宽为整棵 system/agents/：
新本体的骨架本来就要进 git，gitignore 挡不住 ?? system/agents/{newId}/，
旧判据会把一个真正成功的招聘节点判成 boundary_escape fail。

存量迁移见 scripts/migrate-agent-registry.js（幂等，备份到 data/_migration-backup-*）。

真 Claude CLI E2E 已验证：新建公司 → orggraph-planning 自动规划 →
自动招聘 org-planner/org-coder/org-validator 三节点流水线；
data/companies/{cid}/agents/ 不存在，company_agents 4 行，
system_agents 56→56（零新建私有本体，纯复用），git status 零增量。

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…b-pages + UI endpoints)

Completes the §P4 acceptance UI scope that was deferred in commit
0594b1d. Adds the full Vue Dashboard + Ops sub-pages with live SSE
stream + auto-reconnect, unit DAG with detail drawer, PRD/SDD diff
panel, feedback modal, and 4 ops views (Bugs / Loops / Changelog /
Progress).

Vue surface (≈1480 lines):
- web/src/views/DevLoopDashboard.vue (~110 lines)
  * 4-region grid: status header / loop bar / units DAG / live stream /
    PRD diff. Polls /state every 2.5s; opens feedback modal & unit
    drawer; mounts Sign Off / Abandon controls.
- web/src/views/DevLoopOps.vue (~50 lines) — tab container.
- web/src/components/devloop/DashboardHeader.vue
  * Status badge (7 states color-coded), NEW REQUIREMENT button,
    Sign Off / Abandon buttons (disabled per FSM), Ops nav link.
- web/src/components/devloop/LoopStatusBar.vue
  * 4-phase pipeline (Docs → L1 → L2 → Ship), highlights active phase.
- web/src/components/devloop/UnitsDAG.vue
  * SVG DAG rendered from topological waves; per-unit status color;
    click → emits select → opens UnitDrawer.
- web/src/components/devloop/UnitDrawer.vue
  * Slide-in panel showing unit metadata + last 3 runs + result
    summary + coder.log tail (last 1KB).
- web/src/components/devloop/LiveAgentStream.vue
  * EventSource subscriber listening to project.status,
    unit.state, integration.result, triage.result, sdd.updated,
    prd.updated, human_intervention_needed, etc. Manual 5s reconnect
    on disconnect (browser's built-in Last-Event-ID is honored).
- web/src/components/devloop/PrdDiffPanel.vue
  * Reads changelog.ndjson, renders prd_rev / sdd_rev entries with
    trigger labels.
- web/src/components/devloop/FeedbackModal.vue
  * POSTs /feedback with PM incremental — shows rev bump on success.
- web/src/components/devloop/ops/BuglistView.vue
  * Filterable bug table; status badges; severity / category columns.
- web/src/components/devloop/ops/LoopLogView.vue
  * Timeline grouped by L1 (unit.*) / L2 (integration/triage/sdd/l2_*) /
    L3 (project.status/shipped/prd.updated/human_intervention) /
    System (rest). Free-text substring filter.
- web/src/components/devloop/ops/ChangelogView.vue
  * Tabular prd_rev/sdd_rev entries with by/trigger/summary columns.
- web/src/components/devloop/ops/ProgressView.vue
  * 6 metric cards (status, PRD rev, SDD rev, units passed bar,
    L2 rounds bar, open bugs) + per-unit breakdown table.

Router:
- web/src/router/index.js — adds:
  * /devloop/:pid              → DevLoopDashboard
  * /devloop/:pid/ops/:tab(bugs|loops|changelog|progress) → DevLoopOps

Backend UI-supporting endpoints (server/routes/devloop.js):
- GET /api/devloop/projects/:pid/timeline?limit=N
    Reads timeline.ndjson, returns last N events reversed.
- GET /api/devloop/projects/:pid/changelog
    Returns full changelog.ndjson entries reversed.
- GET /api/devloop/projects/:pid/units/:unitId
    Returns { unit, runs (last 3 result.json), coder_log_tail }.
    404 on unknown unit.

Tests (+5 cases):
- server/tests/devloop/routes.test.js — new P5 UI endpoints block:
  * timeline / changelog / units happy-paths
  * 404 on unknown unit and unknown pid

Acceptance:
- scripts/phase5-verify.js — 7 steps:
  ① Vue build artifacts (DevLoopDashboard.js + DevLoopOps.js chunks)
  ② POST /projects → state returns status + units
  ③ GET /timeline returns events
  ④ GET /changelog returns entries
  ⑤ GET /units/todo-be returns unit + runs
  ⑥ GET /bugs returns bug list
  ⑦ SSE /stream delivers ≥1 event after a triggering feedback POST

Vue build:
- npm run web:build → DevLoopDashboard chunk 15.63 kB,
  DevLoopOps chunk 9.09 kB, both with co-loaded CSS bundles.

Results — all 7 phase gates green:
- phase0-verify: 8/8
- phase0-test-call: 7/7
- phase1-verify: 7/7
- phase2-verify: 6/6
- phase3-verify: 9/9
- phase4-verify: 9/9
- phase5-verify: 7/7
- vitest devloop+acp-core: 218/218 (was 213 → +5)

Specs: docs/prd/newfunction/_spec/plan-migration.md · P4 L3 + UI

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Implements the §P3 acceptance gate from plan-migration.md: a single
POST /api/devloop/projects/:pid/run drives the full project from L1
through L2 with 4 distinct BugTriager branches, observability via SSE
stream + bugs.ndjson + changelog.ndjson, and a tiny static status page.

Mock protocol — fallback dir:
- packages/acp-core/protocol/ClaudeCliProtocol.js
  * New options.mockFallbackDir: when scenario dir lacks a per-agent
    fixture, fall back to the baseline fixtures/devloop-mock/.
    Enables scenario dirs to override only the agents that differ
    (Integrator + Triager + sometimes Architect).

Scenario fixtures — 4 L2 branches:
- fixtures/devloop-mock-scenarios/contract_mismatch/
  * Architect: sequence[init, patch] — patch bumps sdd_rev → 2,
    units.json l2_rounds → 1, marks todo-be back to pending.
  * Integrator: sequence[fail (500 vs 201), pass].
  * Triager: contract_mismatch confidence 0.85 with proposed_sdd_patch.
- fixtures/devloop-mock-scenarios/impl_bug/
  * Integrator: sequence[fail (ReferenceError), pass].
  * Triager: impl_bug confidence 0.78 affected=[todo-be], proposed=null.
- fixtures/devloop-mock-scenarios/spec_ambiguous/
  * Triager: confidence 0.4 → LoopController emits human_intervention.
- fixtures/devloop-mock-scenarios/infra_flake/
  * Integrator: sequence[crashed (EADDRINUSE), pass].
  * Triager: infra_flake confidence 0.95 affected=[].
- Each scenario also includes a 1-unit (todo-be) Architect.init fixture
  so baseline Coder/Tester (todo-be) can drive L1.

LoopController:
- server/src/core/devloop/loop-controller.js — adds:
  * runProject(pid, opts) — wave-scheduled L1 via _groupUnitsByWave,
    runIntegrator (devloop-integrator), runTriager (devloop-triager),
    then branch dispatch:
      - contract_mismatch+conf≥0.5 → Architect(patch) writes new
        units.json (already pending, l2_rounds++); emits sdd.updated +
        changelog sdd_rev entry; loop back to L1.
      - impl_bug+conf≥0.5 → unitRegistry.reset(affected); loop, no
        budget burn.
      - spec_ambiguous OR conf<0.5 → emit human_intervention_needed
        SSE, exit l2_blocked.
      - infra_flake → loop directly (no reset, no budget burn).
  * runDocsPhase + runUnit + callAgent all thread opts.mockFixtureDir
    through to the protocol.
  * Auto-attaches sseBroker to unit-registry and bug-tracker on module
    load — every FSM transition + bug op fires an SSE event.
  * bug_open at integration failure, bug_transition → fixed when
    subsequent L2 round passes.

Routes:
- server/routes/devloop.js:
  * POST /projects/:pid/run now defaults to full runProject; ?only=<id>
    still drills into single-unit runUnit (P2 compatibility).
  * GET  /projects/:pid/stream — SSE with Last-Event-ID replay.
  * GET  /projects/:pid/bugs?status=&unit_id=&severity= — bug list.
- server/index.js + agent-server.js mount /public for static assets.

Static status page:
- server/public/devloop-status.html (~100 lines) — pure HTML, polls
  GET /state every 2s, renders unit DAG with status pills + timeline
  tail. URL ?pid= or input box.

Acceptance:
- scripts/phase3-verify.js — 9 steps across 4 scenarios + observability:
  ① contract_mismatch ships at sdd_rev=2 l2_rounds=1, sdd.updated SSE,
    changelog sdd_rev entry, bug open → fixed.
  ② impl_bug ships, sdd_rev=1, l2_rounds=0 (no budget burn).
  ③ spec_ambiguous → l2_blocked + human_intervention_needed SSE.
  ④ infra_flake ships, rerun_integrator action, l2_rounds=0.
  ⑤ Observability: timeline/bugs/changelog/stream.log present.
  ⑥ SSE replay from Last-Event-ID returns ≥2 historical events.

Tests (+13 cases):
- server/tests/devloop/run-project.test.js (11) — 4 scenarios end to
  end + SSE event capture.
- server/tests/devloop/routes.test.js (+2) — full-project mode + bugs
  404. Updated P2 ?only stub test → full-project 404 on unknown pid.

Results:
- phase0-verify: 8/8
- phase0-test-call: 7/7
- phase1-verify: 7/7
- phase2-verify: 6/6
- phase3-verify: 9/9
- vitest devloop+acp-core: 194/194 (was 181 → +13)

Specs:
- docs/prd/newfunction/_spec/plan-migration.md · P3 验收
- docs/prd/newfunction/_spec/loops-l2.md (failure attribution + budget)
- docs/prd/newfunction/_spec/agents-integrator.md
- docs/prd/newfunction/_spec/agents-triager.md

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Implements the §P2 acceptance gate from plan-migration.md: a single
POST /api/devloop/projects/:pid/run?only=todo-be drives the L1 inner
loop (Coder → Tester → fail → Coder → Tester → pass), with the second
Coder pass demonstrably reflecting on the first failure.

Mock protocol — stateful sequences:
- packages/acp-core/protocol/ClaudeCliProtocol.js
  * Mock fixtures now support `sequence: [{chunks,result,files}, ...]`.
    Each protocol.connect() + sendPrompt() consumes the next variant;
    sticks on the last entry after exhausted.
  * Static `ClaudeCliProtocol.resetMockState()` clears counters between
    test runs.

Fixtures:
- fixtures/devloop-mock/devloop-architect.json — units.json now has
  status:pending + retries:0 + retry_budget per unit, plus
  units/{todo-be,todo-db,todo-fe}/spec.json so Tester has acceptance
  criteria to read.
- fixtures/devloop-mock/devloop-coder.json — sequence: implement (with
  intentional missing 400 branch) → retry (reflective fix, coder.log
  attempt:2 has last_failure/last_cause/this_fix/rationale).
- fixtures/devloop-mock/devloop-tester.json — sequence: fail (1/3
  failure with hint pointing at missing body validation) → pass (3/3).

LoopController:
- server/src/core/devloop/loop-controller.js — adds:
  * runUnit(pid, unitId, opts) — drives the L1 loop via unit-registry
    FSM (pending → coding → testing → failed → coding → testing →
    passed/blocked). Calls Coder then Tester per attempt; on failure,
    builds a retry context summarizing prior coder.log + tester
    failures and feeds it into the next Coder prompt.
  * _buildRetryContext + _findLatestTesterResult helpers.
  * callAgent now rewrites units.json.project_id to the real pid after
    mock writes (so unit-registry validation passes).

Route:
- server/routes/devloop.js — adds POST /projects/:pid/run?only=<unitId>.
  Without ?only, returns 501 (full project run lands in P3).

Acceptance:
- scripts/phase2-verify.js — 6 steps:
  1. POST /projects (PM + Architect)
  2. POST /run?only=todo-be returns ok=true, attempts=2, final=passed
  3. FSM trail matches expected 6-step transition sequence
  4. coder.log second entry has all 4 reflection fields
  5. runs/ has ≥2 result.json with first.ok=false, last.ok=true
  6. sandbox cross-unit + prd writes blocked by ToolSandboxError

Tests (5 new cases):
- server/tests/devloop/run-unit.test.js (4) — FSM trail, coder.log
  reflection, runs/ result chain, sandbox enforcement.
- server/tests/devloop/routes.test.js (+3) — POST /run validation,
  full P2 loop, 404 on unknown unit.

Results:
- phase0-verify: 8/8
- phase0-test-call: 7/7
- phase1-verify: 7/7
- phase2-verify: 6/6
- vitest devloop+acp-core: 181/181 (was 174 → +7)

Specs:
- docs/prd/newfunction/_spec/plan-migration.md · P2 验收
- docs/prd/newfunction/_spec/loops-l1.md (retryWithReflection)
- docs/prd/newfunction/_spec/agents-coder.md
- docs/prd/newfunction/_spec/agents-tester.md

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Implements the §P1 acceptance gate from plan-migration.md: a single
POST /api/devloop/projects produces a runnable todo-demo project with
multi-page PRD/SDD sites, units.json, integration spec, agent-state,
and history snapshots — all via mock agents (no real Claude CLI cost).

Code additions:
- packages/acp-core/protocol/ClaudeCliProtocol.js
  * mock mode now emits an extra `mock/files` acp_event when the fixture
    contains a files[] array. LoopController applies it to the project
    root, letting mock agents produce real outputs.
- server/src/core/devloop/loop-controller.js (now ~280 lines)
  * callAgent(pid, agentName, prompt, opts) — single-agent invocation:
    reads system/templates/{agent}/prompt.md, runs mock protocol,
    applies fixture files[], timeline-logs, auto-commits.
  * runDocsPhase(pid, requirement) — orchestrates PM → Architect with
    `docs.complete` timeline marker.
  * getProjectState(pid) — returns project.json + units + prd_rev/sdd_rev
    + timeline tail for the GET /state endpoint.
- server/routes/devloop.js (new)
  * POST /api/devloop/projects — createProject + runDocsPhase
  * GET  /api/devloop/projects
  * GET  /api/devloop/projects/:pid/state
- server/index.js / server/agent-server.js — mount /api/devloop.

Mock fixtures (drive the full acceptance file tree):
- fixtures/devloop-mock/devloop-pm.json
  * 14 files: prd/{index,reading-guide,product/*,feature/*,flow/*,prototype/*}.html,
    prd/assets/{shell.css,shell.js,search-index.json},
    agent-state/{pm.json,pm-todo.json}, history/prd-rev-001.html.
- fixtures/devloop-mock/devloop-architect.json
  * 13 files: sdd/{index,mvcp/*}.html, sdd/assets/*,
    units.json (3 units, DAG), integration/spec.json,
    agent-state/{architect.json,architect-todo.json}, history/sdd-rev-001.html.

Acceptance:
- scripts/phase1-verify.js — spins ephemeral express app, POSTs the
  todo-demo project, asserts 23 expected paths exist + 3 units with
  l2_rounds/l2_budget + git ≥4 commits + timeline events.

Tests (12 new cases):
- server/tests/devloop/loop-controller.test.js (7) — callAgent +
  runDocsPhase + state.
- server/tests/devloop/routes.test.js (5) — POST validation, full
  POST, GET state, 404 on unknown pid.

Results:
- phase0-verify: 8/8
- phase0-test-call: 7/7
- phase1-verify: 7/7
- vitest devloop+acp-core: 174/174 (was 162 → +12)

Specs: docs/prd/newfunction/_spec/plan-migration.md · P1 Docs MVP

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>