宜博 / lemonboss

按 27-p3-p4-work-graph-console.md v0.3 实现，三轮开发+校验后测试全绿
（693/693，P2 26/26、DevLoop 230/230 未被打破，web:build 干净）。

服务层
- work-graph-db.js  定义层(work_graph_*) + 运行时层(graph_runs/graph_run_nodes/
  graph_run_loop_records) 五张表；状态转换表照 unit-registry 模式；
  复用 org-graph-service 四项校验 + 新增第五项 fail-fallback-edge
- graph-engine.js   advanceOne 幂等原语；agent_call / subgraph 两种 executor；
  手动与自动共用同一原语；双层熔断（单边 loop_count + 按 root_run_id 共池的
  backward_count）；任务级预算挂 root run；三层暂停/停止级联；
  重试按 contract_hash unchanged 判据
- graph-run-sse.js  按 run_id 广播，状态转换+timeline+SSE 三者原子化
- goal-contract.js  验收契约格式与执行器（R-15.6 验收先行）

引擎泛化（R-15.4）：org graph 与 work graph 走同一套 advanceOne，
定义层两套、运行时层一套，三层下钻用 parent_run_id 链。

R-16 失败归因：validator-reflection 专职归因节点；fail_reason 多边路由
（精确匹配→兜底边→死路）；子 run 收敛透传 success/fail + fail_reason +
remediation_note 三值；infra_flake 不烧任何计数。

路由 / 前端 / 模板
- routes/graph-run.js 八个端点；company.js 任务入口
- WorkGraphCanvas.vue 扩展 UnitsDAG（subgraph 角标、backward 虚线曲线、
  N/3 循环徽标、异常流程视觉降权）；GraphConsole.vue 三栏 + 四 tab 详情
- 五个新 agent 模板：validator-reflection / org-validator / planner-validator /
  coder-validator / workgraph-planning

命名统一（R-15.3 + NAMING §三）：org 节点改为 org-{职能}，
三个 org-graph 模板末节点收敛到 org-validator；org_graph_edges 加 fail_reason
列并把唯一索引补上该列（避免精确边与兜底边互相吞掉）。

三轮校验修掉的主要缺陷：subgraph 重跑不起新子 run 导致永久死锁；
SSE/timeline 零调用方；org 侧 fail_reason 写入被丢弃；fail-fallback-edge
只做了一层；backward_count 跨 run 树重置架空熔断外层；
seedEntryNodes 误点亮只有 fail 入边的节点。

已知缺口见后续提交：remediation_note 仅在 backward 边落库、
total_tokens 预算维度无生产方。

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

■ 前端路由遮蔽（既有 bug，被 P2 的 T8 暴露）
web/src/router/index.js: CompanyAgentChat 的 path 是 /:id/agents/:agentId? ——
agentId 可选，导致它抢占 /:id/agents，而导航栏「Team」正是指向这个地址。
结果 CompanyDashboard 的团队 tab（连同 P2 新增的 Org Graph 区块）完全不可达，
点 Team 打开的一直是 AgentChat。改为 :agentId 必填。

■ Org Graph 空边时凭空画出流程链（P2 T8 的 bug）
0 条 forward 边时所有节点入度都是 0，全部落进拓扑序且 degraded=false，
模板照常在节点间渲染 → 箭头，凭空捏造出一条并不存在的流转顺序。
P0 迁移进来的存量公司（有节点无边）全部中招。新增 orgGraphNoEdges 判定：
这种情况只平铺、不画箭头，并明确提示「尚未定义流转顺序」。

■ create() 仍在建 goals/ 目录（我在 OKR 正名 74ea1ff 里的遗漏）
company-service.js 的 subdirs 列表没跟着 goals→okr 一起改，新建公司仍然产出
goals/ 空目录。改为 okr/。

■ test-company-e2e.js 从「第 4 个断言就崩」修到 114/114 全绿
该脚本长期整体失效，HEAD 版本同样全断言失败。四类问题：
1. 路径过期：data/{id}/ → data/companies/{id}/；data/templates/ →
   system/templates/；data/agents/master → system/agents/master
2. Phase 4 用 ceo 模板测「骨架是否完整复制」——但 system/templates/ceo/ 只有
   plan.md + todo.md，没有 agent.md/soul.md/config.json，测不出东西，且缺
   config.json 就没有 type='cxo'，company.ceo 也标不上。改用同为 cxo 且文件
   完整的 coo。（ceo 模板本身的残缺是另一个待补的问题）
3. 断言停留在 P1 之前：P1 虚拟引用（226489d）之后 agent.md 不再物理拷贝，
   改为 config.json.systemAgentRef + company-context.md。按新模型改写
4. 断言停留在 T5b 之前：模板不存在时返回 hired_from_base 而非 training

顺带记录一个设计缺口（未改，仅在测试注释里说明）：system/templates/base/
目前只有 agent.md + config.json，所以 base 继承出的骨架不含 soul.md /
identity.md / tools.md / todo.md，也不含 AgentScaffold 的标准子目录结构
（memory/short-term、knowledge、workspace 等）。这些依赖 agent-creator 填充。

另删除 OKR 迁移的 *.bak-goals 备份目录及其 .gitignore 规则。

验证：npm run test:unit 676 全绿；test-company-e2e 114/114；web:build 通过；
Chrome 实机确认 Team tab 可达、空边提示正确。

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

用 9 个并行 agent 按「文件独占」划分实现 P2 的 T1-T9（T0 已于 2255f09 完成）。
详见 docs/todo/system-design/27-p2-org-graph.md §五。

阶段 A · 数据层
- graph-db.js: org_graph_nodes 加 status/reports_to_node_id（PRAGMA 探测后 ALTER，
  幂等）；全量唯一索引换成 WHERE status='active' 的部分索引，使「fire 后重新 hire
  同角色」可行；org_graph_edges 重建为执行流边（condition/edge_kind/status）
- graph-service.js: ensureOrgGraphNodeIndex 同步改建部分索引，且 upsertOrgGraphNode
  的 ON CONFLICT 必须写成 ON CONFLICT(company_id, role_name) WHERE status='active'
  —— SQLite 的冲突目标要与部分索引谓词逐字对应，否则整条 INSERT 直接失效
- org-graph-service.js（新）: validateGraph 四项校验 + writeGraph/patchGraph/
  getGraph/removeNode，事务化，节点软删除级联失效相关边
- routes/company.js: 四个端点 POST/PATCH/GET /org-graph + POST /org-graph/replan；
  /create 接入自动招聘 orggraph-planning + 异步触发（失败降级为空壳公司）；
  /fire 接入节点软删除

阶段 B · 自动生成
- system/org-graph-templates/{dev,content,ops}.json + README：三张三段式骨架
  （规划→执行→验收，验收失败回退到执行节点），角色名遵循 {domain}-{职能}
- system/templates/orggraph-planning/：新 system agent（type='meta-bootstrap'），
  含 §4.1 八步工作流
- company-service.js: 模板不存在时从 system/templates/base/ 元 agent 继承骨架
  （自动带 RESEARCH→PLAN→EXECUTE→VERIFY 四段式）+ agent-creator 填充，
  新建 agent scope='company'。这是 27-E2E §八bis 元 agent 继承的落地点

阶段 C · 展示
- CompanyDashboard.vue: 组织流程拓扑链渲染 + 空态降级 + 环深度保护

并行编排中发现并修复的三处（均不在原任务划分内）：
- AppNav.vue 建公司表单缺 goal 输入框 —— T0 只改了后端，前端表单没同步，
  company-goal 实际传不进来。这是上一轮 T0 的遗漏
- graph-seed-service.js 会把 type='meta-bootstrap' 的 orggraph-planning 塞回
  org graph，与 hire() 的 guard 不一致
- graph-agent-p1-acceptance.test.js: hire 未知角色的返回从 needs_training 改为
  hired_from_base（T5b 的行为变更），断言同步

验证（独立复核，非 agent 自述）：
- npm run test:unit 676 passed / 63 files（基线 652，+24 为新增的 org-graph 用例）
- npm run web:build 通过
- 三个模板 JSON 实跑 validateGraph 全部通过；四类非法图各自被对应 rule 拒绝；
  writeGraph→getGraph→removeNode 级联验证通过（删中间节点后 3 条边全部失效）

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

起因：逐条比对 27-REQ 的原话与 P2 v0.4，发现四处偏离，其中两处是设计悄悄
改变了原意。本次修正并落定。

代码（P2 §五 T0）：
- company.json 新增 goal 字段（company-goal），create({id,name,goal,description})
- POST /api/company/create 与 update() 同步支持
- 修的是一个实打实的遗漏：R-6 原话是"写入 company 的目标和描述"（两个字段），
  而 create() 一直只有 description。orggraph-planning 规划流水线的主依据本该是
  company-goal，此前根本拿不到。

文档定案（R-13）：
- R-13.1 goal 三层递归：company-goal / task-goal / subagent-goal，与"验收逐层
  递归"对应。澄清 R-12 说的"唯一的那个 goal"其实是 task-goal；三个验收 agent
  保持通用不按层级拆分。记录一处待定：subagent-goal 按执行者命名，与另两个的
  作用域命名轴不一致（按轴应为 subtask-goal）。
- R-13.2 公司类型完全由 orggraph-planning 推断 —— 这条**推翻了我自己记的一个
  缺陷**：审计时我把"不加 type 枚举字段"记为擅自偏离原话，实际那正是所需，
  当前设计无需改动。
- R-13.3 新 agent 从 system/templates/base 元 agent 继承骨架（自动带四段式
  RESEARCH→PLAN→EXECUTE→VERIFY）+ agent-creator 填充，而非直接走 needs_training
  全量培养；新建一律 scope='company'；innovator 训练是可选后置步骤。
  这是 R-9.2"所有 node agent 由元 agent 继承生成"在 P2 的落地点（新增 T5b）。
- R-13.4 org graph 强制单入口，原 open question 关闭。

顺带修掉 P2 的一处内部不一致：§六 承诺"提供手动触发 orggraph-planning 的端点"
给存量公司补图，但 §四.3 API 表和 §五 任务表都没有。已补 POST …/org-graph/replan。

另更正 R-11 中"代码层未执行"的过期表述——OKR 正名已于 74ea1ff 实施完毕。

回归：npm run test:unit 652 例全绿。

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

代码层：
- server/services/goals.js → okr-service.js；GoalsService → OkrService
  · this.goalsDir → okrDir，目录 goals/ → okr/
  · ID 前缀 G- → O-；落盘文件 goal.json → objective.json
  · updateGoal → updateObjective，_nextGoalId/_saveGoal 等同步改名
  · parseNodeId 层级名 ['Goal','Objective','KeyResult','SubTask']
    → ['Objective','KeyResult','SubTask','SubTask']（OKR 无 Goal 这一层）
- server/routes/goals.js → okr.js；:goalId → :objectiveId
- 7 处调用点同步：index.js / agent-server.js / agent-chat.js / company.js /
  company-heartbeat-service.js / prompt-builder.js / test-company-e2e.js
- 前端 OkrDashboard.vue / CompanyDashboard.vue 切到 /api/okr（前后端命名终于一致）
- bin/lemon.js 新增 okr create/add-node/list/status

向后兼容（不破坏任何现有调用方）：
- /api/goals/* 与 /api/company/:cid/goals/* 全部保留为别名，与新路径同时挂载
- task dispatch/report 同时接受 objectiveId(新) 与 goalId(旧)，写入时两字段都留
- bin/lemon.js 保留 goal * 命令别名

迁移脚本 scripts/migrate-goals-to-okr.js（npm run okr:migrate）：
- 目录 data/{,companies/*/}goals/ → okr/；条目 G-xxx → O-xxx
- 改写 objective.json 的 id / nodes 的 key / children 数组、_index.json、
  progress.json 的 goalId、history.log 文本、system/tasklog/*.json 的 goalId+nodeId
- --dry-run 预演；幂等；迁移前自动备份为 *.bak-goals（已加入 .gitignore）
- 处理一个反直觉边界：OkrService 构造函数会自动 mkdir 目标目录，"okr/ 已存在"
  不等于"已迁移过"——只要服务被 require 过一次就留下空壳。用 isEmptyOkrDir()
  区分空壳与真实数据，空壳移除后继续迁移。这个 bug 是在 fixture 上验证时发现的。
- 同样在 fixture 上发现并修掉：nodeId 的值漏改写、tasklog 迁移不幂等

验证：新增 server/tests/unit/okr-service.test.js（7 例，覆盖新命名工作正常 +
迁移纯函数的 ID 改写）；全量 npm run test:unit 652 例全绿。

范围说明：NAMING §五 的 benchmark 三分（skill-/agent-/goal-）本轮未动代码——
该节自身的建议就是存量保持现状、只对新增代码强制前缀，因为 benchmark_runs 等表
服务于线上 Arena 排行榜，改表名/路由是另一次独立迁移。
§二-四 的新 agent id 尚不存在实体，待 P2/P3 实现时按规范创建。

已知遗留（非本次引入）：server/scripts/test-company-e2e.js 早已失效——它按
data/{id}/ 找公司，而 company-service 用的是 data/companies/{id}/，在 HEAD 版本
同样全部断言失败。本次只同步了其中的 OKR 命名，未修这个路径问题。

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

四处写 _registry.json 的地方都用 JSON.stringify(registry, null, 2) 直接落盘，
不带末尾换行。文件在仓库里是带换行的，导致任何一次 hire()/depositTemplate()/
模板增删改之后，git diff 都会多出一行 "\ No newline at end of file" 的噪音，
把真实的数据变更淹掉。

写入点：
- company-service.js:374  depositTemplate()
- company-service.js:824  _updateTemplateUsedCount()
- routes/company.js:86    PATCH /templates/:templateId
- routes/company.js:120   DELETE /templates/:templateId

同时提交一次真实的运行时数据变更：qa-judge usedCount 7 → 8。

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

# Conflicts:
#	system/agents/master/.claude/scheduled_tasks.json

…_DIR move, stray files

- CLAUDE.md: document DevLoop subsystem (spec-first workflow, project root/git-vault,
  mock mode, L1 loop, unit layout, audit trail) and add missing test commands
- server/routes/agent-chat.js, server/services/task-service.js: TASK_META_DIR moved
  from system/agents/.tasks to system/tasklog
- system/agents/master/.claude/scheduled_tasks.json: scheduled task state update
- remove stray memory/daily/2026-04-02.md and a garbled-filename artifact left under
  system/agents/digester-youtube-crawler/

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hire() now checks system_agents (source_kind='template') before provisioning a new
company agent: if the role has a shared template row, skip copying agent.md and
instead let AgentManager.getAgentConfig()/PromptBuilder.build() resolve the prompt
from the shared legacy_path at call time, with per-company context assembled from a
new company-context.md. Roles without a template row (including the 6 ids that exist
in both system/agents/ and system/templates/, e.g. evolver-youtube-crawler) fall back
to the existing full-copy behavior unchanged.

- server/services/graph-service.js (new): lookupSharedAgentMd(), upsertOrgGraphNode()
- server/services/company-service.js: hire() reference-mode branch, _provisionReferenceAgent()
- server/src/core/agent-manager.js: getAgentConfig() resolves prompt/companyContextPath
- server/src/core/prompt-builder.js: build() concatenates company-context.md
- unit + integration tests covering all 6 acceptance criteria from
  docs/todo/system-design/27-p1-virtual-reference.md §6, including a regression test
  against the real idearun:evolver-youtube-crawler naming-collision case

Full regression suite (587 tests) passes; independent adversarial review found 0
blocking/major issues.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Adds server/services/graph-db.js (new data/graph.sqlite: system_agents,
org_graph_nodes, org_graph_edges) and graph-seed-service.js, which scans
system/agents/, system/templates/, and data/companies/*/company.json into
seed rows without touching company-service.js's existing hire/copy path.

Real repo data diverged from the design doc's original estimates (8 not 10
global agents; 39 not 34 template dirs; system/agents/ and system/templates/
turn out to share 6 ids describing the "same" agent from two different
files) — documented in docs/todo/system-design/27-graph-agent-architecture.md
section 7 for P1/P2 to resolve.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

First successful real-CLI agent invocation. After REAL.1 (system-prompt
injection) + REAL.2 (mtime-diff file detection) wired, the only remaining
gate was Claude auth. Once CLAUDE_CODE_OAUTH_TOKEN was added to the
project .env, scripts/real-pm-smoke.js completed cleanly:

  Wire-up status:
    ✓ process spawn
    ✓ stream chunks       (3)
    ✓ result text          (Claude returned "DONE")
    ✓ files written        (6: prd/index, feature-tree, user-flows,
                              product/overview, assets/shell.{css,js})
    ✓ git commit           (8cb0493)
  5/5 checks passed · elapsed 163s

PM output quality (real Claude, not mock):
- valid <article data-doc="prd" data-rev="1"> + <section data-rev="1">
  structure per system prompt
- nav links use correct relative paths across 4 chapters
- pid (p-7gwlbl) embedded in HTML metadata
- 中文 prose in the requested 克制 voice

Spec-deviation confirmed (no MCP tool gateway yet — Claude only has
built-in Read/Write/Bash):
- ✗ agent-state/pm.json (no update_runtime_state tool)
- ✗ agent-state/pm-todo.json (no write_todolist tool)
- ✗ history/prd-rev-001.html (no archive_doc tool)
- ✗ timeline.ndjson 'prd_drafted' event (no timeline_append tool)
- ✓ core PRD site IS produced — sufficient to prove pipeline

──── code ────

- scripts/real-pm-smoke.js — loads root .env via dotenv resolved
  from server/node_modules (script dir has no node_modules of its own).

──── ambient ────

Files modified by user/linter while real-CLI work was in flight; merged
without revert:
- server/routes/devloop.js — new GET /:pid/requirements endpoint
- server/services/devloop/path-resolver.js — listProjects() includes
  archived flag + helpers; supports project archive lifecycle
- server/services/devloop/git-vault.js — commit() now accepts files[]
  to scope which paths the commit covers (avoids dragging linked-existing
  user's unstaged files into chore commits)
- server/src/core/devloop/loop-controller.js — createProject uses
  explicit files:['project.json','timeline.ndjson'] for first chore
  commit (avoids same issue)
- server/tests/devloop/path-resolver.test.js — coverage for archive/
  patch/hardDelete helpers
- web/src/components/devloop/RequirementListSection.vue (new)
- web/src/views/DevLoopNewRequirement.vue (new)
- web/src/views/DevLoopDashboard.vue — mounts RequirementListSection
- web/src/views/DevLoopProjects.vue — list page polish
- web/src/router/index.js — adds /devloop/:pid/requirements/new route
- web/src/components/devloop/DashboardHeader.vue — back link tweak

Test results: 233/233 vitest pass (was 230 → +3 path-resolver cases).

──── ⚠ SECURITY NOTE ────

.env is currently TRACKED in git (committed in b1a348b) even though
.gitignore lists it. Existing committed contents include credentials for
DOUBAO / FEISHU / GITHUB / GOOGLE / JWT. The CLAUDE_CODE_OAUTH_TOKEN +
AZURE_OPENAI_API_KEY I just added to .env are NOT in this commit — they
stay in your working tree only.

Recommended follow-up (separate commit):
  git rm --cached .env
  git commit -m "chore: stop tracking .env (already gitignored)"
And rotate every key that was in the previous committed .env.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Two parallel pieces of plumbing — neither has been exercised end-to-end yet
(real CLI gated on `claude /login`; Projects list view served alongside
existing pages):

──── real-CLI wire-up (REAL.1 + REAL.2) ────

LemonBoss now has a clean toggle between mock & real Claude CLI:

- packages/acp-core/protocol/ClaudeCliProtocol.js
  * `options.systemPrompt` → `--append-system-prompt <prompt>` so each
    devloop agent receives its role-specific prompt.md without losing
    Claude's default tool-use conventions.
  * `options.maxBudgetUsd` → `--max-budget-usd` (note: only effective in
    `--print` mode; documented inline).

- server/src/core/devloop/loop-controller.js
  * callAgent now branches on `opts.mock`:
    - mock (P1-P5 path, untouched): fixture sequence + `mock/files` event
    - real: read system/templates/{agent}/prompt.md, pass as systemPrompt,
      snapshot project file mtimes pre-call, diff post-call to compute
      `files_written` — no fixture, no mock/files needed.
  * `_snapshotMtimes(root)` helper walks the project tree (skipping
    .git / node_modules / .cache / .tmp) and returns Map<relPath,mtime>.
  * timeline event payload now carries `real: true` flag.

- scripts/real-pm-smoke.js — minimal real-CLI sanity:
  spawns claude, injects PM prompt, prints which files were written +
  git commit sha. Hard timeout 5min. Single agent → expected spend
  $0.10-0.30 per run when authenticated.

Current status: process spawn + system-prompt injection + stream-json
flow all verified up to the `Not logged in · Please run /login` gate.
Auth is the only remaining blocker for executing the real smoke.

──── project CRUD routes ────

server/routes/devloop.js + server/services/devloop/path-resolver.js
add the lifecycle pieces the Projects list view needs:

- GET    /projects?include_archived=true   list w/ archive filter
- PATCH  /projects/:pid                    edit name + idea_summary
- DELETE /projects/:pid                    soft delete (archive)
- DELETE /projects/:pid?hard=true          hard delete (rm -rf sandbox;
                                            unregister linked)
- POST   /projects/:pid/restore            un-archive

path-resolver exposes matching helpers: listProjects({includeArchived}),
patchProjectMeta(pid,patch), hardDeleteProject(pid).

──── UI ────

- web/src/views/DevLoopProjects.vue (320 lines, new)  — Projects list
- web/src/router/index.js — adds `/devloop` → DevLoopProjects
- web/src/components/devloop/DashboardHeader.vue — back-link now points
  to `/devloop` (project list) instead of `/company`.

──── housekeeping ────

- CLAUDE.md / start.sh — start.sh now boots server/index.js (full route
  surface incl. /api/devloop) instead of the historical agent-server.js;
  docs updated to reflect this.

──── tests (+12) ────

- server/tests/devloop/routes-crud.test.js — 12 cases:
  PATCH validation (4) · soft DELETE + list filter (4) · POST /restore
  (1) · hard DELETE (2) · GET /projects default behavior (1).

Results:
- phase0-verify .. phase5-verify: 8+7+7+6+9+9+7 all pass
- vitest devloop+acp-core: 230/230 (was 218 → +12)

Specs:
- docs/prd/newfunction/_spec/arch-acp-bridge.md · Mock Mode
- docs/prd/newfunction/_spec/plan-migration.md · "自举乐趣" (real path
  prep)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

First concrete code commit for DevLoop. Implements all 7 services that
P0.A tools will depend on, per plan-migration P0.0.

Services (server/services/devloop/, ~900 lines):
- path-resolver.js   foundation — resolveProjectRoot + 12 derived paths;
                     sandbox + linked-new mode support; sensitive path
                     blacklist (with /tmp + os.tmpdir() exemptions);
                     ~/.devloop/linked-projects.json registry
- doc-store.js       PRD/SDD multi-file site IO + cheerio validateHTML +
                     validateUnitsSchema + canonical-JSON hashContract
                     + automatic history/ archival
- unit-registry.js   FSM (M-2: pending→coding→testing→passed/failed/blocked);
                     l2GateOpen; diffUnits (added/changed/removed);
                     reset semantics for L2 + L3
- bug-tracker.js     bugs.ndjson append-only + dedupKey + P-9 transition
                     state machine + list/stats/history aggregation
- timeline-logger.js M-13 ProcessTimeline — append/read/tail;
                     summary truncate to 280; payload oversize → ref form
- changelog-writer.js M-15 — append/read/latest for prd/sdd/units revs
- sse-broker.js      per-pid pub/sub + 25s heartbeat + stream.log replay
                     via Last-Event-ID; emit returns monotonic id
- git-vault.js       spawn-git wrapper — init/commit/tag/log/diff/status/
                     resetWorkingTree/revert/archive; per-pid mutex;
                     nothing-to-commit returns {skipped:true} not throw

Tests (server/tests/devloop/, 71 passing):
- path-resolver.test.js  (17 cases) — sensitive path · sandbox alloc · linked-new
- doc-store.test.js      (12 cases) — validateHTML · validateUnitsSchema · hashContract
- unit-registry.test.js  (15 cases) — FSM transitions · l2GateOpen · diffUnits
- bug-tracker.test.js    (10 cases) — open dedup · transition · list filter · history
- timeline-logger.test.js (9 cases) — append/read/tail · summary truncate · oversize
- git-vault.test.js      (8 cases)  — init idempotent · commit · tag · status · archive

vitest config (`globals: true`) means tests use describe/it/expect globally,
no `require('vitest')` needed (and would fail under vitest 4).

Dep added: cheerio@^1.0.0 (used by docStore.validateHTML; HTML parsing).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Layer 1 (P0): Per-agent session mutex
- heartbeat-service.js: skip heartbeat if previous session still active (30min safety valve)
- agent-chat.js: reject concurrent /chat requests for same agentId with different convId (429)
  Multi-turn conversations on same convId still work normally

Layer 2 (P1): Advisory file lock utility
- server/utils/file-lock.js: O_EXCL-based .lock file mechanism
  Auto-cleanup stale locks, graceful degradation on timeout

Root cause: HeartbeatService creates new convId per heartbeat, spawning
independent Claude CLI processes that concurrently write config.json and
SKILL.md, causing rollbacks and FRAUDULENT scores.

…to prevent EADDRINUSE

Fixed 4 hidden bugs where path.join(DATA_ROOT, "system", ...) was used instead
of direct path.resolve to root-level system/:

- agent-chat.js: billing log scan (line 804) and agent list scan (line 909)
- company-service.js: TEMPLATES_DIR and GLOBAL_AGENTS_DIR constants
- heartbeat-service.js: system agents scan directory

These were missed because they used path.join with a variable (DATA_ROOT)
rather than the literal string "data/system" that sed caught.

- Moved data/system/ → system/ (agents, templates, skills, data, workspace)
- Updated all server route/service path references
- Updated all script path references
- Updated all documentation references
- Restructured .gitignore for cleaner system/ vs data/ boundary

system/ = platform-shared assets (system agents, template library)
data/ = tenant-specific company instance data

- Add TaskTimeline.vue: two-pane dashboard with task list + message timeline
- Add task-service.js: aggregate cross-agent conversations into task tree
  - 4-strategy parent-child inference (explicit meta, time-overlap, conv→tpl, master→T)
  - Read messages.log for full tool call details (not just history.json)
- Add tasks.js API routes: GET /api/tasks, GET /api/tasks/:taskId/timeline
- Mount /api/tasks in agent-server.js
- Add 'Task Logs' nav entry in AppNav.vue after Templates
- Support taskId in URL (/tasks/:taskId?) for sharing/bookmarking
- Add --parent flag to CLI task dispatch for explicit parentTaskId
- Auto-detect parentTaskId in task/dispatch from sender's active task
- Add --instructions flag to template train CLI command
- Update master tools.md with new parameters

…ictly enforce empty shell company creation

- System agents: 只保留 master (data/system/agents/master)
- Templates: 所有可复用 agent 模板 (data/system/templates/)
- Companies: 公司创建时自动部署 5 个元 Agent (innovator/hunter/digester/evolver/agent-creator)

路径修复:
- agent-chat.js: /list 扫描路径修正 (system/agents + companies/*/agents)
- agent-manager.js: 动态 agent 查找路径修正
- skill-config-loader.js: 修正 agents root
- pipeline-service.js: pipelines 输出到 companies/{id}/pipelines/
- billing.log: 移至 companies/{id}/logs/ 下

Skills 标准化:
- 所有 template agent 建立 .claude/skills/main_skill/SKILL.md
- company-service._copyTemplate() 新增 .claude/ 目录复制
- innovator SKILL.md v3.0: 移除旧 l3-hunt/l2-digest 命名
- 清理重复 agent_creator, 统一为 agent-creator

清理:
- 移除 data/agents, data/workspace, data/logs, data/goals 旧目录
- 清除所有未使用的 DATA_DIR 声明
- 清除 template 中的 conversations/logs/memory 运行态数据

- Add task transition CLI and API for Context Flush & Hot Swap
- Enforce strict bash-only tool policy for Base Agents
- Inject  into system prompt for self-retrying loop
- Implement Goal node updates on transitions
- Add P0 Execute pre-approval block (Human-in-the-loop)
- Track token metrics to billing.log

- Add Company Overview tab as default landing page
- Show company info: status, uptime, agent count, heartbeat status
- Start/Stop company buttons (activate/deactivate all agent heartbeats)
- Per-agent heartbeat controls: interval dropdown, start/stop buttons
- Backend APIs: GET status, POST start/shutdown, PUT/POST agent heartbeat
- Track startedAt timestamp for uptime calculation
- Update CEO agent.md with mandatory 5-step startup workflow
- Fix company nav to default to overview tab

Phase 3 反馈进化闭环:

1. DataSourceService (运营数据接入):
   - 新增 datasource-service.js: 抽象适配器模式
   - MockAdapter: 模拟运营数据 (开发调试)
   - FileAdapter: 从本地 JSON 文件读取数据
   - 可扩展: 预留 WechatAdapter/DouyinAdapter 接口
   - API: GET /data/metrics, /data/trending, /data/attribution

2. 归因分析引擎:
   - analyzeAttribution(): 自动对比两个时间段指标
   - 计算变化百分比和趋势方向
   - 自动提取显著变化维度并生成洞察文本
   - API: GET /api/company/:id/data/attribution

3. Know-how 自动更新 (memory-service.js):
   - 新增 updateAgentKnowhow() 函数
   - autoReflect 产出的 patterns/lessons 自动写回 SKILL.md
   - 在 SKILL.md 末尾维护'经验教训(自动沉淀)'段落
   - 保留最近 20 条记录，自动清理过旧条目
   - 闭环: Agent执行 → 反思 → 经验写入SKILL → 下次读取改进行为

Phase 2 改进:

1. 工作日历系统 (ScheduleService):
   - 新增 schedule-service.js: 公司级日程管理
   - 支持按小时调度、按周几过滤、时区感知
   - 心跳触发时自动检查到期 slots 并触发 Agent
   - 执行去重（同日同 slot 不重复触发）
   - CRUD API: GET/POST/PUT/DELETE /api/company/:id/schedule/slots
   - CLI: schedule add / schedule list

2. 告警通道 (Alert Channel):
   - Pipeline 步骤超时自动告警 Master Agent
   - 心跳异常自动告警 Master Agent
   - _sendAlertToMaster() 统一告警接口

3. CEO → Pipeline 自动生成:
   - CEO 模板从 3 步升级为 5 步工作流
   - 新增 Step 2: Pipeline JSON 设计（含 loop/cron/steps 结构)
   - 新增 Step 4: OKR 创建
   - Pipeline 设计输出为 CTO 搭建流水线的蓝图

4. Master 晨会日报:
   - 每天 08:00 自动生成全公司运营日报
   - 包含公司状态、Pipeline 运行、OKR 进度、Agent 活跃度
   - 自动推送给 Master Agent
   - 防重复机制（每天只生成一次）

5. Pipeline 驳回信息注入:
   - 驳回步骤被心跳重新触发时，__rejection 信息注入 prompt
   - 让 Agent 知道被驳回的原因和重做次数
   - 替换原有 curl 汇报指令为 task report CLI

Phase 1 核心改进:

1. Pipeline↔Task 系统打通:
   - task/report 回调自动推进 Pipeline 步骤
   - findActiveRunStep() 按 agentId 定位活跃步骤
   - 扫描所有公司的 Pipeline Runs 实现跨公司桥接

2. Pipeline 循环执行:
   - 新增 pipeline.loop 配置项
   - Run 完成后自动启动下一轮 (最大 maxLoops=365)
   - loopCount 计数器追踪循环轮次

3. COO 质量门控:
   - 新增 rejectStep() 驳回方法，含驳回历史记录
   - POST /api/agent/task/reject API 端点
   - POST /api/company/:id/pipelines/runs/:runId/reject 路由
   - node bin/lemon.js task reject CLI 命令
   - 驳回后自动唤醒 Agent 重做，注入改进意见

4. COO 模板全面强化:
   - agent.md: 4维度评分体系、质量审核流程图
   - soul.md: 性格、价值观、决策原则
   - tools.md: 新增 task reject 核心工具
   - heartbeat.md: 结构化巡检清单 + 升级规则

…ter Agent cognitive auto-recovery loop

- Refactored CompanyDashboard into read-only Observer UI
- Enforced strict companyId:roleId namespacing across Node APIs and AgentManager
- Added dynamic <env_status> injection to PromptBuilder for robust context
- Introduced bin/lemon.js CLI for structured LLM tool execution
- Implemented in-stream error interceptors for implicit silent retry loop

- CompanyHeartbeatService: company-level heartbeat with timer registration
- Auto-trigger: cron-based pipeline scheduling (intervalHours)
- Active run driving: dispatch tasks to agents, timeout detection
- CEO heartbeat: periodic company status check
- Pipeline cron field support in definitions
- Registered in server startup alongside agent heartbeat
- E2E test: 113/113 passed (all phases + autonomous loop)

- PipelineService: define pipelines with ordered agent-assigned steps
- Run lifecycle: start → markStepStarted → advanceStep → complete
- Step output automatically flows as next step input
- Pipeline CRUD + Run management REST API routes
- E2E test: 106/106 passed (Phase 1 + 2 + 3 + 4)

- GoalsService refactored: constructor accepts optional companyId
  - With companyId: goals stored in data/{companyId}/goals/
  - Without: backward-compatible data/goals/ (global)
- Company Goals REST API: full OKR CRUD under /api/company/:id/goals
- OKR isolation verified: different companies have independent goal spaces
- E2E test: 81/81 passed (Phase 1 + 2 + 3)

- scaffoldNewAgent: create agent skeleton via AgentScaffold directly
- depositTemplate: benchmark gating (≥95) + auto-deposit to templates/
- hireWithTraining: full flow (template lookup → scaffold fallback)
- Company route: /hire uses hireWithTraining, new /deposit-template endpoint
- E2E test: 69/69 passed (Phase 1 + Phase 2)

- CompanyService: CRUD (create/get/list/update/shutdown)
- Agent Hiring Pipeline: template lookup → copy → context injection
- Template registry (_registry.json) with CEO and qa-judge initial templates
- resolveAgentDir(companyId, agentId) unified agent directory resolution
- Company REST API routes (/api/company/*)
- E2E test: 46/46 passed