宜博 / lemonboss

新增四份文档：

- 27-e2e-task-execution-flow.md — 跨阶段总览：建公司 → 下达任务 → org graph
  逐节点执行 → work graph 规划与循环 → 验收收敛。核心发现：这套流程 70-80%
  已在 docs/prd/newfunction/_spec/ 里被完整设计（DevLoop 的 L1/L2/L3 三层循环、
  BugTriager 四分类归因、分级预算熔断、contract_hash 闸门），DevLoop 实为本
  架构唯一跑通的参考实现，通用引擎应从它抽象而来。
- 27-example-dev-company-walkthrough.md — 参考场景走查，把架构在一家具体公司
  上跑一遍数（各阶段 JSON 形态、fan-out/fan-in 图、成本估算 ~44 次调用、
  按阻塞程度排序的 8 个断点清单），作为实现靶子与端到端验收场景。
- 27-naming-conventions.md — 统一命名规范 {作用域}-{职能}。消歧三种 benchmark
  （skill- / agent- / task-）；OKR 体系正名（goal → okr，第 1 层 Goal → Objective）；
  规划类统一为 orggraph-planning / workgraph-planning / brd-prd-sdd-planning。
- 27-p3-p4-work-graph-console.md — P3/P4 合并设计：Work Graph 执行引擎（支持
  启动/下一步/暂停/停止/重试，手动与自动共用同一 advance 原语）+ 执行控制台页面。

重写 27-p2-org-graph.md 至 v0.4：Org Graph 从「静态汇报结构」重定位为
「company 级别生成的 workflow」，与 Work Graph 同构（condition/edge_kind 执行流边），
两层共用同一套 schema、执行引擎与画布组件。org_graph_edges 从未写入过数据，
可直接 DROP 重建，零迁移负担；hire() 不再需要 reportsTo（图整体规划整体写入），
P2 对 company-service.js 的侵入缩至零。

同步修正总纲至 v0.3：Org Graph/Work Graph 术语定义、§3.1 架构图、§3.3 整节；
标注 P1 已实现（226489d）；P6「DevLoop 收编」从「可选」改为「应前置」。

修正三处过期陈述：P1 已实现（非设计稿）、runProject 已完整实现（非 501）、
UnitsDAG.vue 已实现 Kahn 分波 DAG 渲染（画布应扩展而非重写）。
并记录一处待处理冲突：graph-service.js:44 已落地的全量唯一索引与 P2 需要的
部分唯一索引冲突，实现 T1 时必须先 DROP。

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

- New docs/README.md indexes the tree: done/ (shipped features + reference manuals),
  todo/ (current focus — Graph Agent architecture), todo/future/ (deprioritized
  roadmaps: FDE pipeline todo list, stale v1.1 milestones, harness engineering
  proposal — orthogonal to the Graph Agent work, not blocking it)
- Move completed/reference docs into docs/done/ (LEMONBOSS-SYSTEM-DESIGN, architecture-v5,
  claude-code-cron, open-api-manual, qa_judge_req, task_timeline_design, user-guides/,
  system-design/01-26 minus the three moved to todo/future/) — verified against actual
  code (qa-judge template, Task Timeline route/service/view) before filing as done
- Fix the two TOC links in LEMONBOSS-SYSTEM-DESIGN.md that would otherwise point at the
  old paths after the move
- docs/todo/system-design/27-graph-agent-architecture.md: add the P2 Org Graph doc link
  in the roadmap table and 关联文档 section
- Add docs/todo/system-design/27-p2-org-graph.md (P2 requirements & design, drafted in
  parallel while P0/P1 landed)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hire() now checks system_agents (source_kind='template') before provisioning a new
company agent: if the role has a shared template row, skip copying agent.md and
instead let AgentManager.getAgentConfig()/PromptBuilder.build() resolve the prompt
from the shared legacy_path at call time, with per-company context assembled from a
new company-context.md. Roles without a template row (including the 6 ids that exist
in both system/agents/ and system/templates/, e.g. evolver-youtube-crawler) fall back
to the existing full-copy behavior unchanged.

- server/services/graph-service.js (new): lookupSharedAgentMd(), upsertOrgGraphNode()
- server/services/company-service.js: hire() reference-mode branch, _provisionReferenceAgent()
- server/src/core/agent-manager.js: getAgentConfig() resolves prompt/companyContextPath
- server/src/core/prompt-builder.js: build() concatenates company-context.md
- unit + integration tests covering all 6 acceptance criteria from
  docs/todo/system-design/27-p1-virtual-reference.md §6, including a regression test
  against the real idearun:evolver-youtube-crawler naming-collision case

Full regression suite (587 tests) passes; independent adversarial review found 0
blocking/major issues.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Adds server/services/graph-db.js (new data/graph.sqlite: system_agents,
org_graph_nodes, org_graph_edges) and graph-seed-service.js, which scans
system/agents/, system/templates/, and data/companies/*/company.json into
seed rows without touching company-service.js's existing hire/copy path.

Real repo data diverged from the design doc's original estimates (8 not 10
global agents; 39 not 34 template dirs; system/agents/ and system/templates/
turn out to share 6 ids describing the "same" agent from two different
files) — documented in docs/todo/system-design/27-graph-agent-architecture.md
section 7 for P1/P2 to resolve.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Before P0 coding begins, the doc set was missing three things that would
have stalled implementation on day 3:

1. Day-1 Quick-Start (plan-migration top section)
   - 8-step "what command do I type first" walkthrough
   - pnpm install → cp .env.example → extract-manifest verification → P0.0
     services → MOCK_CLAUDE=1 phase0-verify → real phase0-verify → P1
   - Anyone cloning can reach step 4 (doc verification) immediately

2. P0.0 服务层 7 件套 (plan-migration P0 子任务表)
   - Previously P0.A "工具实现" depended on docStore/unitRegistry/sseBroker/
     bugTracker/timelineLogger/pathResolver/GitVault but none were listed
     as a task — engineer would hit "docStore.writePRD doesn't exist"
   - Now P0.0 lists them as a sequenced 4.5-day task: pathResolver first
     (everyone depends on it), then 5 other services, finally GitVault
   - GitVault tasks consolidated into P0.0 (removed duplicate P0.I)
   - Total P0: 13.5 → 17 days (3 → 3.5 weeks)

3. Mock Claude CLI Mode (arch-acp-bridge §⑦, NEW)
   - MOCK_CLAUDE=1 env toggles ClaudeCliProtocol to read stubs from
     system/mock-responses/{agent}/{mode}.json instead of real Claude
   - Mock JSON: array of steps (text emit / tool_use), $pid placeholder
   - When mock vs real: mock for dev + CI, real for prompt quality + P1+
   - Enables zero-token tool dev + phase0-verify
   - Sections renumbered (⑧ → ⑨ etc) to accommodate insertion

Total project: 10 → 10.5 weeks (still honest, still includes everything).
No new MVCP defs (54). Search index 195.7KB. _spec/ regenerated by hook.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

The 50-page PRD HTML totals ~520KB; loading it all costs Claude ~222K
tokens just for context. This adds a token-efficient sibling layer:

- scripts/extract-spec.js → npm run spec:extract / spec:check
  Walks docs/prd/newfunction/*.html and produces stripped MD into _spec/.
  Strategy varies per page (full-extract for SDD/process/data,
  shell-strip for agents to keep long system prompts intact).
  Result: 327.9KB MD (~84K tokens) — 38% of full load, saves ~138K tokens
  for every Agent invocation that reads the spec.

- scripts/git-hooks/pre-commit + scripts/install-hooks.sh
  Pre-commit guard: when any docs/prd/newfunction/*.html changes, the
  hook checks the corresponding _spec/*.md is up to date; fails commit
  if stale, telling user to `npm run spec:extract`. Auto-installed via
  package.json `prepare` script on `npm install`.

- docs/prd/newfunction/_spec/ (51 .md files + CONVENTIONS.md)
  Machine-readable mirror of HTML. Used by:
  - Coder/Architect/Tester agents when reading spec at runtime
  - External Claude Code sessions doing reproducibility
  - CI checks (npm run spec:check)
  NOT hand-edited; regenerated from HTML by extract-spec.js.

- CLAUDE.md: 1-line note directing future agents to read _spec/*.md
  preferentially, fall back to *.html only for wireframes/SVG/full
  human-readable context.

This is the user's pre-existing scaffolding that the previous commits
hadn't pulled in yet. Now tracked + enforced by hook.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Fills the gap: where does a DevLoop project actually live, and how does a user
create one? Previous docs assumed everything goes under
data/companies/{cid}/projects/{pid}/ with no user control.

Design:
- A DevLoop "project" = one directory + project.json + git history;
  the directory is the project root, the anchor for everything
- 3 modes:
  - sandbox (default, v1): root auto-generated under data/.../projects/{pid}/
  - linked-new (v1): user picks any empty path, e.g. ~/code/auto-todo
  - linked-existing (v2): bind to existing git repo subdirectory
- 3 creation entry points:
  - REST: POST /api/devloop/projects with optional {mode, target_path}
  - CLI: scripts/devloop-new.js with --path / --name / --requirement / --list
  - UI: Dashboard "+ NEW PROJECT" modal with mode radio + path picker
- New pathResolver service (path-resolver.js): single source of truth for
  resolveProjectRoot(pid). All paths derive from it; nothing hardcodes
  data/companies/... anymore
- linked projects registered in ~/.devloop/linked-projects.json
- memory stays at company level (~/data/companies/{cid}/memory/) even for
  linked projects — privacy + cross-project knowledge isolation
- Strict sandbox: blacklist /, /etc, /System, ~/.ssh, ~/.aws etc. for
  target_path; writeAllowList relative to root_path

Pages changed:
- arch-project-root.html (NEW, 15-section comprehensive design)
- sdd-model.html       (M-1 ProjectMeta + mode + root_path fields)
- sdd-control.html     (C-1 POST /projects accepts mode + target_path)
- assets/shell.js      (sidebar adds arch-project-root)
- assets/search-index.json + build-manifest.json (rebuilt)

Adds ~2 days to P0 (pathResolver + schema migration), ~1.5 days to P1
(CLI + mode params), ~1 day to P4 (UI modal). Total 10 → 10.5 weeks.

Key insight: linked-new mode means a user can DevLoop code straight into
~/code/auto-todo, then `git push origin main` to ship — without manually
exporting from the sandbox. The sandbox-vs-linked choice is path-transparent
to LoopController and all Agents.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Fills a gap pointed out post-v0.3: docs had file-mtime + history/ archival
only, no real version control. Now every Agent that completes work triggers
LoopController to git commit; project ship/sign-off/abandon tag the repo.

Design:
- One git repo per project at data/companies/{cid}/projects/{pid}/.git
- LoopController-centralized commits (Agents stay sandboxed, no git access)
- Commit cadence: each Agent success → commit; Tester red → no commit;
  shipped/sign-off/abandon → tag
- New GitVault service (C-18): spawn-git wrapper, ~150 lines,
  init/commit/tag/log/diff/status/archive/revert/resetWorkingTree
- New process P-10 (Process.GitCommit): commitAfterAgent hook in
  callAgentWithPersistence; recoverOnBoot extended to detect dirty trees
- .gitignore excludes agent-state/ (high-write) + history/ (git is history)
  + stream.log + runs stdout (too large)
- New SSE events: git.committed · git.tagged · recovery_dirty_tree
- Defer git push-to-remote to v2 (no network deps in v1)

Pages changed:
- arch-git-versioning.html (NEW, comprehensive design, 16 sections)
- sdd-control.html       (+C-18 GitVault spec)
- sdd-process.html       (+P-10 commitAfterAgent + recoverOnBoot dirty-check)
- data-layout.html       (.git/ + .gitignore in project tree)
- plan-migration.html    (P0 +3 days for GitVault, total 10 weeks)
- assets/shell.js        (sidebar adds arch-git-versioning)
- assets/search-index.json (rebuilt, 189.5KB, 50 pages)
- build-manifest.json    (52 → 54 defs, 100% extraction)

Key benefit: Coder 3-retry chain can be `git diff`-ed; L2 fail allows clean
revert; project export becomes `git archive HEAD` (tracked files only,
not the ~30MB project dir).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Earlier PRD attempt scoped to LemonBoss-only (excludes ArenaSK Skill
marketplace / Arena / Master / Innovator / Open API / Evolution).
Generated 2026-05-12, exists side-by-side with the later 50-page
DevLoop PRD under docs/prd/newfunction/.

Structure:
- index.html (single-page shell with collapsible sidebar + lunr search)
- assets/ (app.css/js, chapter.css, menu.js, search-index.json)
- chapters/01-overview ~ 10-reproducibility (10 chapters)
- _scan-manifest.json (scope manifest pinning what's in/out)
- scripts/build-search-index.js (chapter HTML → lunr index)

This commit just brings the existing files under version control;
no edits to content.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

DevLoop: a 3-layer Loop (L1 Unit / L2 Integration / L3 Human) auto-development
system that takes a one-line human requirement and produces multi-page HTML
PRD + SDD + units.json + full backend/frontend code via 6 specialized agents.

This commit adds the complete documentation set:

50 HTML pages organized in 8 sections (3-level menu + global search):
- 01 Overview · 02 PRD · 03 Design (loops + 6 agents)
- 04 SDD (MVCP × 4) · 05 Prototype · 06 Architecture
- 07 API · 08 Ops · 09 Plan

Key specs:
- 6 agent skills (PM/Architect/Coder/Tester/Integrator/BugTriager), each with
  full system prompt, 13-17 tool signatures, 3 E2E samples, helper source code
- 52 MVCP definitions, 100% machine-extractable via data-* anchors
- 79 tool signatures with implementation guidance (arch-tool-registry)
- ACP bridge spec (arch-acp-bridge): how LoopController calls into LemonBoss
  agent-manager without breaking existing Master/Innovator flows
- 5-phase plan P0→P4 (~9.5 weeks): P0 bootstrap (tool impl + ACP bridge),
  P1 docs MVP, P2 single unit L1, P3 L1+L2 loop, P4 L3 feedback + UI
- Persistence layer: AgentState (M-10), Memory (M-11), Todolist (M-12),
  Timeline (M-13), Bugs (M-14), Changelog (M-15) + crash recovery (P-8)
- Cost & concurrency budgets (plan-cost-concurrency)
- Code lifecycle: stay-in-sandbox v1 + export API + future GitHub PR (v2)

Plus supporting scripts (zero deps, regex-based):
- scripts/extract-manifest.js: extracts MVCP defs to build-manifest.json,
  used to verify all definitions have path + shape (currently 100%)
- scripts/build-search-index.js: builds assets/search-index.json (183KB),
  enables Ctrl+K global search across all 50 pages

The PRD itself is meta-executable: a future Claude Code session reading
plan-reproducibility.html can rebuild the entire DevLoop runtime from the
docs alone.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- Moved data/system/ → system/ (agents, templates, skills, data, workspace)
- Updated all server route/service path references
- Updated all script path references
- Updated all documentation references
- Restructured .gitignore for cleaner system/ vs data/ boundary

system/ = platform-shared assets (system agents, template library)
data/ = tenant-specific company instance data

- Add TaskTimeline.vue: two-pane dashboard with task list + message timeline
- Add task-service.js: aggregate cross-agent conversations into task tree
  - 4-strategy parent-child inference (explicit meta, time-overlap, conv→tpl, master→T)
  - Read messages.log for full tool call details (not just history.json)
- Add tasks.js API routes: GET /api/tasks, GET /api/tasks/:taskId/timeline
- Mount /api/tasks in agent-server.js
- Add 'Task Logs' nav entry in AppNav.vue after Templates
- Support taskId in URL (/tasks/:taskId?) for sharing/bookmarking
- Add --parent flag to CLI task dispatch for explicit parentTaskId
- Auto-detect parentTaskId in task/dispatch from sender's active task
- Add --instructions flag to template train CLI command
- Update master tools.md with new parameters

- CompanyDashboard Goals Tab: upgraded from flat list to full OKR tree view
  with progress bars, node hierarchy, status animations, owner/priority badges
- ClaudeCliProtocol: added --effort flag support (low=disable thinking)
- agent-chat.js: per-agent effort config from config.json cli.effort
- .gitignore: exclude data/companies/, apiconversation/, agent memory/tasks
- New views: TemplateAgents, JobsPanel, PipelineEditor, SkillsMarket
- docs/architecture-v5.md: added decision #13 (thinking control)

The plugin bootstrap was calling resolveOpenclawDist() synchronously
at module load time, which crashed the entire server if the optional
@mas/openclaw-dist package wasn't installed. Now all three call sites
defer resolution to runtime with try/catch graceful fallback.

- Add task transition CLI and API for Context Flush & Hot Swap
- Enforce strict bash-only tool policy for Base Agents
- Inject  into system prompt for self-retrying loop
- Implement Goal node updates on transitions
- Add P0 Execute pre-approval block (Human-in-the-loop)
- Track token metrics to billing.log

文档更新:
- 重写 11-directory-structure.md (data/system/ + data/{companyId}/)
- 重写 13-api-design.md (100+ 实际 API 端点)
- 更新 24-company-layer-architecture.md (规划中→已实现, Todo 全标完成)
- 更新 23-agent-active-heartbeat.md (规划中→已完成)
- 更新 architecture-v5.md (v5.3, Phase 4-6 新增)
- 更新 21-fde-pipeline-architecture.md (阈值 90→95, 路径修正)
- 更新 LEMONBOSS-SYSTEM-DESIGN.md (v2.0, 章节 15-26 索引)
- 新增 25-bootstrap-mechanism.md (公司自举机制)
- 新增 26-automated-hiring-orchestration.md (全自动招聘编排)

Bug 修复:
- fix(server): 修复 body sanitizer 空 body 时未设置 _bodyParsed
  导致 express.json() 重复读取已消费流的 stream-not-readable 错误

- Extracted HeartbeatService to periodically wake up agents flagged with 'heartbeat.enabled'
- Sends a silent [SYSTEM HEARTBEAT] message to trigger self-checks (e.g. OKR state validation)
- Automatically integrated service dispatch hook in server startup sequence
- Configured qa-judge to run autonomous heartbeat every 10 min

- New: docs/system-design/21-fde-pipeline-architecture.md
  Complete FDE training pipeline documentation with:
  - Triple-layer architecture (Hunt→Digest→Evolve)
  - Dual-path output convention (workspace + agents)
  - Dispatch protocol examples
  - buildSystemPrompt skills scanning fix details
  - CEO training verification results (92/100)
- Update: architecture-v5.md
  - Phase 3 OKR checkboxes updated (Goals API done)
  - Phase 3.5 FDE added as completed milestone
  - 3 new architecture decisions (#10-12)
  - File path index expanded with meta agents

- Implement OKR GoalsService with hierarchical node tracking
- Add /api/goals routes and integrate with dispatch/report APIs
- Create Innovator agent with Hunt→Digest→Evolving pipeline
- Create Hunter (l3-hunt), Digester (l2-digest), Evolver (evolving) meta agents
- Copy L1/L2 dependency skills into each agent's .claude/skills/
- Fix buildSystemPrompt to scan ALL skill subdirectories (critical)
- Fix agent list sorting: master pinned top, rest by lastActiveAt
- Rename master-001→master, innovator-001→innovator
- Establish meta agent output convention: write to target agent dir
- Add CXO agent base class for management agents
- Update CEO agent with delegation-first management model

- Agent as Micro-Container: each agent lives in data/agents/{id}/ with full encapsulation
- Persona vs Capability split: agent.md (identity) + .claude/skills/main_skill/SKILL.md (workflow)
- Conversations co-located: data/agents/{id}/conversations/ replaces global dir
- Meta Skills renamed: meta_hunt, meta_digest, meta_creator, meta_evolving, meta_benchmark, meta_research
- Dynamic Hot-Reload: AgentManager.getAgentConfig() falls back to filesystem scan
- Parallel Sub-Agent orchestration via Promise.all with multi-terminal UI
- Removed SQLite dependency, global skills/ directory, and legacy conversations/
- Full architecture docs: 18-local-filesystem-first-agent-encapsulation.md