# AGENTS.md — cloudsite AI/Developer Entry Point ## Current maintenance - Issue185 unlimited cloud downloads (2026-11-10) The human requests investigation/fix of CONCURRENCY_LIMIT and removal of download count restrictions, with a GitHub patch and production update. v1.0.2 removes website lifetime and per-account submission caps, including legacy customized rows, while retaining atomic owner serialization, idempotent operation replay, authentication, serial Worker execution and uncertain provider-start protection. See `docs/releases/v1.0.2.md`. Schema20 stays unchanged. Do not mutate/replay historical recovery tasks or unrelated IndexCore/storage services. Validate exact head/main CI, publish immutable artifacts, and use backup/isolated restore, health and preservation checks for the product-only deployment. This explicit maintenance request supersedes historical candidate-only integration pointers. ## Maintenance request - simple permanent account deletion (2026-11-02) The human explicitly requested a simpler account-delete flow and rejected soft-disable/restore semantics. Implement v1.0.1 as specified in `docs/releases/v1.0.1.md`: one confirmation, physical website-account cleanup, terminal-download/concurrency/authorization guards, retained task and audit history, no native storage deletion or migration. Existing production accounts are not test fixtures; validate destructive commands only on isolated data. The project remains in maintenance after this bounded fix. ## Release 1.0.0 closeout - 2026-10-30 The human explicitly requested the final 1.0 release and the end of this feature-development phase. This supersedes older candidate-only handoff pointers for this release integration/publication/deployment. Integrate the completed PR181 admin UI cleanup and PR182 magnet compatibility fix, freeze VERSION1.0.0, require exact merged-main CI success, then publish immutable v1.0.0 artifacts and perform the separately verified production cutover. No new business feature, migration, provider command, AI131 or paused private139 work is included. Project mode after release: MAINTENANCE. Retain existing state and capability; no further feature work without a new human request. Source, release artifacts and production must have distinct receipts. Production is not accepted merely because this documentation or a tag exists. See docs/releases/v1.0.0.md. ## Current delivery - Issue180 admin information architecture (2026-10-28) PR179 merged as750f5281217d92bc2ed48b71bb28256bd0101e82. Exact merged-main CI40652403381 completed SUCCESS3/3: quality/race/vet/build, PostgreSQL16 and PostgreSQL18. Issue180 now owns one bounded UI-only cleanup PR. Capture desktop 1440px and mobile390px before editing presentation code; identify evidence-backed noise, then preserve the existing shell, APIs, audit/CAS/UNKNOWN recovery and accessibility while simplifying navigation and progressively disclosing internals. Implementation is complete on the review branch:201 frontend tests and the producthttp Go package pass. Chrome before/after evidence includes12 pairs plus4 interaction captures, all isolated synthetic fixtures. See docs/admin-ui-180/README.md. Review-branch CI and merge remain separate; do not claim production deployment. No backend, schema, provider or IndexCore changes and no production deployment under180. Parent155 remains open; production153 verifies the real host separately. Do not self-merge; retain review. Earlier delivery pointers are history, not current unfinished work. ## Current delivery - Issue176 complete resource editor (2026-10-28) PR177 merged as1611d37bd443e01b82c1eb66381bb91ecc3ee0d2; main CI40549771841 completed SUCCESS3/3. Issue176 accelerated instruction supersedes backend-only pointers: deliver the actual row/detail editor, strict capability/exact GET, confirmation and single audited PUT with scoped GET-only UNKNOWN recovery in ONE complete PR. Read docs/ADMIN-RESOURCE-EDITOR-UI.md. No new migration, provider, IndexCore or consumer/share access change. Stop for one independent review; no self-merge. Parent155 OPEN; completed170/172/174 are not reopened. AI131/private139 excluded. Production153 prep may overlap; live16->20 mutation requires a separate scoped release decision and actual backup/restore gates. Earlier pointers are history. ## Historical bounded task - Issue 176 Copy presentation backend (2026-10-28) PR 175 is merged at f868da264255ddf93457c8f8f67117bb8bb33349. Exact main CI 40532208171 completed SUCCESS in all three jobs before this implementation. Issue 176 Stage 1 adds a CopyID-keyed product-owned alias/category/presentation-only hidden overlay, protected exact read and specific audited CAS action. Read `docs/ADMIN-COPY-PRESENTATION.md`. Append-only schema20; old 0001-0019 unchanged. One backend draft PR for independent review; no self-merge or editor UI. No provider/IndexCore mutation or access/share policy change. Parent155 remains OPEN; production153 owns the separate upgrade/backup/rollback; AI131/private139 excluded. Earlier pointers below are historical, not current unfinished work. This repository uses AI-assisted development. Before planning, changing, or reviewing code, **read these files first**: 1. `docs/AI-ARCHITECTURE-MEMORY.md` 2. `PROJECT-STATE.md` 3. newest relevant entries in `docs/DECISIONS.md` 4. current authorized GitHub Issue 5. actual current contracts/code/tests Chat history is not a source of truth. ## Historical bounded task - Issue174 audit reads (2026-10-27) PR173 merged atbb603f7e1dbe and exact main CI40465107546 completed SUCCESS in all three jobs. Backend170/UI172 are integrated, not production activation. Issue174 adds only the current ADMIN's persisted product action ledger, strict filters/keyset paging and safe evidence detail. Read docs/ADMIN-AUDIT-HISTORY.md. One draft PR for independent review; no self-merge, new commands, migration, provider/IndexCore calls or production changes. Parent155/production153 remain OPEN; AI131/private139 remain paused. Earlier candidate pointers are historical. ## Historical bounded task - Issue172 UI (2026-10-27) Backend PR171 merged at4b1329a47ee2; exact main CI40457606174 is SUCCESS in all three jobs. Issue172 adds strict no-Job CANCELED compatibility and a fresh exact-read, capability-gated confirmation with one audited POST and GET-only UNKNOWN reconciliation. Read docs/ADMIN-PENDING-CANCEL-UI.md and its fixture QA. One candidate PR for independent Architect review; no self-merge or production activation/migration. Parent155/170/153 stay OPEN; AI131/private139 remain paused. ## Historical bounded task - Issue170 backend (2026-10-27) PR169 is merged at9903279e4ee7; exact main CI40342381266 completed SUCCESS in all three jobs, and Issue168 is CLOSED. Issue170 adds only audited conditional cancellation of a persisted PENDING intent with no Job/provider/admission evidence. Read docs/ADMIN-PENDING-CANCELLATION.md for ports, lock order, schema19 and tests. Backend candidate only: one PR for independent Architect review, no self-merge, UI button, production migration/deployment, provider action or IndexCore changes. Parent155/production153 remain OPEN. AI131 and private139 remain paused. ## Historical bounded task - Issue168 (2026-10-26) Homepage167 merged in8094ff36704f; exact main CI40329349106 SUCCESS verified. Issue168 adds only ADMIN acquisition detail and Manifest-state/owner filters, with narrow read ports, coherent PG snapshots and cursor/session/UI fences. Read docs/ADMIN-DOWNLOAD-DIAGNOSTICS.md. One unmerged implementation PR for Architect review; do not self-merge. No task/provider mutations, migration, production153 upgrade, AI131, paused private139 or unrelated IndexCore work. Parent155 stays OPEN. Earlier candidate pointers below are historical. ## Historical task - Issue166 (2026-10-26) Base main a8acd3479198 includes backend overview PR164 (025813ca) and consumer navigation PR165. Issue166 implements only the read-only operator homepage in one candidate PR, with separate DirectoryReads users and validated Manifest/Job counts. Read docs/ADMIN-OVERVIEW.md. Await independent Architect review; do not self-merge, claim deployment/full UI-3B acceptance or close parent155. No migration or production153 rollout, provider probe/write, AI131 or paused private139 work. The dated integration pointers below are history, not current unfinished tasks. ## Historical integration pointer - 2026-10-23 Issue155 Admin UI-3B continues as bounded non-AI slices. USER lifecycle backend PR156/schema17, lifecycle UI157, search158, DTO-backed details159 and real user total160 are merged. PR159 merged `bf931b18417b`; PR160 merged `1a86e5c4d458`; their merged-main CI39921715814/39922283505 succeeded. This tree additionally implements PR161 share-list/audited-revoke backend with append-only schema18; read `docs/ADMIN-SHARE-MANAGEMENT.md`. Check the actual PR/head CI for acceptance. PR161 merged205c28e6619e; exact-head CI39922782277 and main CI39923298349 succeeded. The separate PR-D2 UI implementation in this tree consumes those existing ports; verify its actual PR/head review and CI before acceptance. No new migration, USER receipt widening, production rollout or provider write. Existing Issue155 authorization permits separate same-agent code review and merge after exact-head CI; label it honestly, not independent human approval. No production deployment/migration is implied. AI131 and private139 remain paused; cloud-acquisition incident investigation is not the current work item. Preserve provider reservations, canonical data and unrelated .50 services. Read current code/contracts rather than treating historical pointers below as unfinished current tasks. UI-3B as a whole is not accepted or complete. ## Historical task pointer - 2026-10-22 Issue155 supersedes the UI-3A-only development scope below. PR-A implements USER lifecycle CRUD/search/detail and append-only schema17 in isolation. Read `docs/ADMIN-USER-LIFECYCLE.md`. No private139, provider actions, production migration/deployment, IndexCore recovery, or UI-3B whole-program acceptance. UI/homepage PR-B and other operating modules remain separate reviewable PRs. Issue149 / LIVE UI-3A authorizes one implementation PR from `97cb94fee932e231147c25c74bcbf773f27538fe` (UI-2B148 merged; main CI39701070318 all3 SUCCESS checked). Implement manual real protected115 GetInfo and audited USER create/enable/disable commands. Read `docs/PRODUCT-ADMIN-LIVE-OPERATIONS-ACCEPTANCE.md` for module/port, audit, idempotency, schema16 and deployment gates. Tests are isolated; runtime uses real configured PG/session bindings with no fixture fallback. No production deployment/migration or live canary yet. No native download/directory/delete, Root repair, task commands, per-user GB quotas or private139 work. UI-2B's old read-only scope paragraphs are historical, not a prohibition of Issue149. Stop at an unmerged implementation PR for Architect review. ## Current execution pointer — 2026-10-18 **Oct20 superseding pointer: Issue136 / D-064 live verified02:15Z.** PR137 runtimebf89f5a/CI39261559684 is deployed;60 Node tests PASS, served asset exact. IndexCore115/PR119 restores trusted deletion and bounded root-watch recovery: three fresh trusted scans, six confirmed Q8 removals, public274/library274/cloud0, zero unrelated identity changes and all4 copy-conflict paths preserved. Empty legacy Alias disabled only, history and eight reservations retained. CloudSite closes deleted/replaced selection only after a COMPLETE successful current read; failed/partial/late reads cannot clear data. Live browser playback not claimed. No provider starts, source changes, new scanner, migration or AI work. The Oct18 incident snapshots below are historical, not current acceptance. REGRESSION: IndexCore Issue115/PR116 supersedes the earlier deletion acceptance below. The backend incorrectly removed749 rows from a virtual-only successful OpenList list, leaving library1. Physical files remain; root mirror/watch disabled and valid-directory queue CAS recovery is in progress. Do not call this a UI filter issue or claim deletion sync fully enabled. Verify separate library and download partitions plus surviving sibling trees over subsequent observations. No canonical SQL resurrection, physical deletion or provider starts. AI unstarted. Mitigation evidence11:53Z: public272 = library270/downloads2, gallery PRESENT0, no removals since containment, sample attachment302; guard399eca4/full CI passed and deployed.300 blockers repaired,14 due retries explicitly resumed once,7 parents re-observed. Positive-only30s watch is restored without a topology credential; latest3 snapshots have no absence authority. Open IndexCore117 covers4 real same-hash/different-path conflicts. Do not describe this as full parity or full automatic root deletion acceptance. Product runtime unchanged in this incident. ### Earlier rollout notes (not current acceptance) User-authorized Issue132 is the current source-deletion hotfix. IndexCore Issue113 owns the opt-in coverage/removal gate and recurring Root watch; the product only reads Canonical and quietly reconciles complete temporary catalogs. No physical deletion or hand-edited canonical state. Validate both repositories and public API evidence before claiming deployment. AI Issue131 remains unstarted. This hotfix is now live verified: gallery10 REMOVED/Q8 events, four screenshot Q5 queries and authenticated public inventory contain no gallery PRESENT rows. Preserve .gitattributes LF SQL and follow docs/RELEASE-PACKAGING.md: never change DB migration checksums to repair Windows release line-ending corruption. ### Earlier AI preparation scope (unchanged) Issue129 / D-062 authorizes AI planning and read-only readiness checks only. Read docs/PRODUCT-AI-INTEGRATION.md before any implementation. Human identifies 192.168.178.50 (IndexCore development host) as the existing AI software/config execution host, distinct from public113.20.6.57. Software is the designated local CodeartsBridge c190fc8; private CSV seed contains three populated AK/SK profiles. Its registry maps bus-w02-dev to.50, not a verified account entitlement. Preserve the dirty Bridge checkout; do not proxy coding /api/tasks to product users. Select/validate/import only the designated profile during later deployment, not the whole account directory. Keep model credentials on.50 and out of prompts/Git; do not export them or reuse website/provider credentials. Historical Bridge is currently broken (missing working directory); presence of CodeArts components is not proof of a usable gateway. Proposed stage5.1 contracts/mock come first (prepared Issue131, not started); no live model call, AI feature enablement, migration or autonomous provider action is authorized by this planning document. AI stays outside the IndexCore kernel and behind a replaceable Agent Port; do not claim Gate5 complete. PR127/publicf1bceee with IndexCore PR112/publice03d14a9 fixes an actual delayed file incident: the old empty-list expectation is no longer current. Verified API counts2 cloud files/main283 and exact Q5 PRESENT. IndexCore owns bounded child scope discovery beneath /云下载; collector stays direct-child PARTIAL, one refresh per execution. No consumer-side OpenList scanner or new queue/schema. Quiet visible-page10s canonical GET refresh preserves preview and handles files arriving after an unchanged READY directory Copy. CI and merge CI passed in both repos. No new provider starts or historical reservation edits; original ISO smoke remains reference-known and has no READY acceptance. Any paired recovery uses accepted DB-time CAS, never direct SQL. See D-061 and latest PROJECT-STATE.md. PR125/D-060100-operation policy and silent library auth are accepted/public. Issue122 / D-059 accepted work: cloud files on /downloads/, exclude same Binding/canonical subtree from main library; share one file template/controller. Read docs/FILE-SURFACES.md. No move/delete/new download/state migration. Existing provider/session/Job/Copy and IndexCore boundaries unchanged. Canonical view scope may be returned to authenticated browser, never native scope/credentials or caller-selected target. Exact CI and separate same-agent review before rollout. Issue120 / PR121 / D-058 ACCEPTED/publicf8be03c/schema15. Exact c1ed10be, CI38992241383 and merge38992448685 all3 SUCCESS; separate same-agent review. Managed public submission and one serial Worker ACTIVE on113.20.6.57. Physical /CloudSite/云下载, canonical/Hint /云下载; native directory verified. Same CloudSite Root/Binding/mount identities retained; NEW native Connection attached using guarded CAS, old credential-free observation Connection preserved. Parent/child PARTIAL Hint and unique Q5 PRESENT directory verified; preflight passed. One ordinary ISO smoke POST201 has REFERENCE_KNOWN, destination matches; ACTIVE/RETRY_WAIT and native RUNNING/progress0 at01:58UTC. No READY acceptance yet. This smoke budget is CONSUMED: observe the same pair, never resubmit it. Preserve all8 historical unknown reservations. See docs/CLOUD-ACQUISITION-ACCEPTANCE.md. Website30-day policy and original283-file/delivery/preview/share capabilities pass. ### Historical execution snapshots Earlier zero-submission, NOT_CONFIGURED, managed-Worker-off,284-file alias feed and unconsumed-budget statements below are historical, superseded by the pointer above. Do not repeat old setup, login, directory creation or smoke submission. Issue118 / PR119 / D-057 ACCEPTED/publiccaabc0a0: human selects30-day WEBSITE login, not provider TTL. Exact CI38991088165 and merge38991282378 all3 SUCCESS; actual HTTPS Cookie/DB2592000s, old expiry unchanged and logout401 pass. New product sessions and cookies share fixed30 days, DB-time authorization, no sliding refresh or extension/backfill of existing sessions. Preserve logout, account/role checks, hashed tokens and all cookie/Host/Origin protections. No migration/provider runtime changes. Native115 QR on public server has now succeeded with same-account/root-read verification and protected new credential; old credential retained, no download and no managed runtime activation. Earlier 990001 describes the rejected OLD session, not this new one. Download still has read-verified native cloud-directory ID; Hint/Q5 path agreement remains. Unavailable reason is now NOT_CONFIGURED. This is synchronized operator state, not an implemented automatic provider health check or automatic Worker recovery. PR115/117 are accepted/public schema15;284-file observation and3 CI groups pass. These current facts supersede the historical snapshots below. Active Issue114 / D-056: explicit readonly cloud preview/unavailability UI. Native public session currently returns API990001/ErrNotLogin. Issue113 has no submission, Worker or StartDownload. The human changed the destination to the existing /云下载 and requests UI/testing while unavailable. Pure same-caller preview is permitted only by explicit readonly config; no admission/lookup/ usage/Worker/runtime routes are enabled by it. Preserve the one-start budget. The standard OpenList Alias exposes that directory beneath the existing app namespace, without moving files/copying OAuth/expanding the app account root. IndexCore still owns file visibility. No fabricated download/READY acceptance. Accepted: Issue111 / PR112 / D-055, opt-in managed product runtime and fixed-target consumer cloud-download/task UI. Reviewed0555d3b4, CI38907187975 all3 SUCCESS, separate same-agent acceptance, squash51211b553bac. Read PRODUCT-CLOUD-RUNTIME.md. Issue83/PR110/D-054 accepted at ec568ae1; exact-head and merge CI all3 SUCCESS. Readonly action must never construct Worker. Explicit cloud action requires protected bootstrap/target and enabled policy, listener before Run, join before Close. Source-free owner lookup reconciles uncertain commits; no automatic POST. Schema15 development only; public14/original12 and old dirty WIP preserved. Public native session restored/read-verified, zero download. Public activation is NEXT on113.20.6.57, needs backup,15-compatible disabled fallback and actual IndexCore writer/Hint deployment. Never infer it from controlled tests or use OpenList OAuth as cookie. No repeat login or historical reservation retry. Accepted preparation: Issue108 / PR109 / D-053 and [module/integration plan](docs/PRODUCT-CLOUD-DOWNLOAD.md). PrepareSource remains pure; D-054 now uses it only for NEW atomic product reservations. Existing ResolveSource and Manifest->Provider exact bytes stay unchanged; no old task normalization. The preserved old Issue83 draft14 is not applied; development uses append-only15. No live credential/provider action or public deployment. Issue105 / PR106 / D-052 is ACCEPTED and publicly deployed at0b29ecc88faff5f9. PR exact-head and merge CI all3 SUCCESS. Current Chrome confirms302->115 CDN206, play/seek/pause without media error; native click saved a15423-byte DOCX whose hash matches the source. The automated download event was NOT observed. See [direct-delivery contract](docs/PRODUCT-DIRECT-DELIVERY.md). Source URL hiding and same-origin-only byte proxy rules below are superseded ONLY for explicitly configured direct delivery. Private one-hour document preview/cache stays intact. No IndexCore truth/DB/schema/scan/Hint/Worker/provider-history changes. See [actual acceptance](docs/DIRECT-DELIVERY-ACCEPTANCE.md). One-hour private document previews remain server-side. Product-only cutover retains old image/config. Release closeout: PR99/100/102 accepted;6-character public registration/login verified. Public server root compose now runs OpenList v4.2.6 using protected local configuration/app credentials; AList container removed, its data/rollback retained. PR103 accepts container/identity-bound application-token renewal. Existing local OpenList native session is reused, no new115 login/download. Traefik/Portainer/ backup services unchanged. See latest alpha contract and release BUILD-MANIFEST. Issue #98 is the directly authorized release task. Repository ID1391307332 was renamed panta -> cloudsite after the human deleted the legacy CloudSite repo. Freeze [release contract](docs/CLOUDSITE-V1-ALPHA.md): public name cloudsite, version/tag cloudsiteV1.0.0alpha, preserve Go/config/cookie/schema compatibility. Replace only cloudsite1.0.yml workload at the verified target; new isolated databases, protected config and existing HTTPS route. Backups and rollback before cutover, exact-head CI and same-agent review required. PR99/100 accepted and deployed to https://cloud.netioi.com; original local account/password reused, USER-only registration and283 real files verified over public HTTPS. See the alpha contract for actual evidence and limits. Issue101 now applies the human's 6-character password minimum consistently, preserving existing hashes. Final release manifest identifies code; no fabricated full MVP acceptance. Latest reliability fix Issue #96 / PR #97 accepted/deployed. Reviewed HEAD `d5d056b0e1e2`, CI `38736852134` all3 SUCCESS, same-agent review `5533296802`, merge `57a9d626cd62`, merge CI `38737121369` all3 SUCCESS. Native real-link attachment actions replace async HEAD/synthetic click in consumer and guest. Explicit play/pause and accurate media event states added. Actual user Chrome had stale stopped8182; corrected to formal8180. Human confirmed download/save dialog; automated download event was NOT observed. Server full DOCX hash matches; actual video played beyond37s with advancing timeline/error=null, pause works. Only product restarted, schema14/config/source/catalog/original DB unchanged. Binary SHA256 `84b5c2cda9b5778433c87ec4a9b84e9d026d7b03828d1e5799a9185b3e19c194`. Old14 receipt/binary retained. All PR95 scope/count/code rules below remain. Previous accepted/deployed Issue #94 / PR #95, exact HEAD `e5961f8fe060`, CI `38733576527` all three SUCCESS, same-agent acceptance `5533047604`, merge `9c902a3650df`; merge CI `38734637547` all three SUCCESS. D-048 and [complete CloudSite contract](docs/PRODUCT-CLOUDSITE-LIBRARY.md): all283 actual files (software42/video188/document6/Other47) through one new isolated Q6 Root. 474 directories remain metadata, not consumer cards. One consumer Binding, four backend read Bindings so old shares survive. Observation-only mapping is DISABLED, no provider_scope/credential_ref. Old three root generations0/1/1 and original staging DB histories unchanged. One explicit initial scan, no daemon. New forms auto-fill crypto-random4 A-Z/a-z/0-9; clearing means no code. Legacy longer-code share from old binary/Binding verified against candidate AND formal. UI pagination120/120/43, all counts and both redemption modes verified. Test shares revoked; candidate stopped. Schema14 unchanged. Product-only cutover, query PID/unrelated services unchanged; rollback old14 receipt/config/binary. Deployed SHA256 `983e10735db46b94cfd5d404372e8e97c788bfd05ff8aa58d832e4348d287f67`. Three-subtree-only/six-file defaults below are historical, NOT current limits. Issue83 WIP unchanged. No native115 share/download/login or full MVP claim. Previous accepted/deployed Issue #92 / PR #93, exact HEAD `d98f79a2d39f`, CI `38702187329` all three SUCCESS, same-agent review `5529930361`, merge `49b98b21bff0`; merge CI `38702621096` SUCCESS. D-047 and [sharing contract](docs/PRODUCT-FILE-SHARING.md): cloudsite-hosted single-file links, expiry/code/grant/owner revoke and streamed download UX. Not native115 shares or public exposure. Real ordinary/guest downloads hash-match; anonymous grant, wrong-code rejection and revoke-denial verified. Temporary test shares revoked. Owned product DB14 only, protected13 backup, reviewed14 sharing-disabled fallback started and verified. Old13 binary is incompatible with14: do not use old receipt blindly. Binary SHA256 `38d8f0c5c75053b263c98c8cd0e0997f9c7be074b2eaa8584583d6e5f2eb951c`. Original staging12/query/generations/services unchanged; zero native provider calls/scan/Hint. Issue83 WIP preserved; unmerged draft14 needs later renumbering. Older no-v14/sharing-not-implemented pointers below are historical; native115 ShareProvider, admission/usage/current-DB Copy still remain. No full MVP claim. Previous accepted/deployed content is Issue #90 / PR #91, exact HEAD `34863813a53f`, CI `38699810879` all three SUCCESS, same-agent review `5529707246`, merge `e5783b5fcef27`. D-046 and [content contract](docs/PRODUCT-FILE-CONTENT.md) govern server-only known-file OpenList bytes AFTER IndexCore exact Q5 authorization, every cache hit included. One-hour private original-document cache -> server PDF PNG pages or Office/text; Office TEXT ONLY, not original layout. Range media and attachments verified with real files. Product binary SHA256 `3625b49c028962faacd492642385b6e760897946dced92d3ab3ad700c3116c2c`. Only owned product restarted; query/generations/original histories/services unchanged. No new source/Job/Manifest/ProviderTask/download/scan/Hint/migration. Sharing is NOT implemented; Issue #83 WIP and current-DB Copy remain separate. Older metadata-only statements below are historical and superseded for this bounded content slice. D-044 no deletion and dual UI remain in force. Previous accepted/deployed UI is Issue #88 / PR #89, exact HEAD `8b7d1c23feab`, CI `38673309830` all three SUCCESS, review `5529290784`, merge `963c66d9c0d7`. D-045 requires TWO UIs: file-first consumer `/`, ADMIN `/admin/` retaining the operational workspace. Frontend directly reads configured real IndexCore files, no per-file approval, directory controls or fake files. Six real file cards; backing sources are unchanged PR #87 scopes. No user role was escalated. Only owned product UI service restarted, original data/query/unrelated services unchanged. [Module contract](docs/PRODUCT-FILE-LIBRARY.md). No playback/content access or full MVP acceptance. D-044 no deletion; preserve isolated Issue #83 WIP. Previous accepted source/lifecycle slice is Issue #86 / PR #87: exact HEAD `d693878c7791`, CI `38669580171` all three successful, merge `ddecd51c19b7`, same-agent review `5527219011`. [Real catalog contract](docs/PRODUCT-REAL-CATALOG.md) governs the three new isolated observation-only DISABLED Bindings. Formal .50 loopback 8180 now shows five real document files/three directories, one MP4 and an empty software scope, superseding the old one-document default described below. Two owned readonly user-systemd services are enabled; controlled restart tested, full VM reboot untested. cloudsite uses IndexCore HTTP, never direct OpenList reads. D-044: DO NOT implement file-delete UI/API; users delete directly in their drive. No playback/content/access/Copy projection or full MVP acceptance is implied. Resume isolated Issue #83 admission/usage WIP without overwriting it; no v14 migration has been deployed. No acquisition, Hint or scheduled scan is enabled. Gate 0 through Gate 3 are ACCEPTED / CLOSED. Gate 3.18 real Phase B passed [Architect final acceptance](https://github.com/nathanxiangang-web/cloudsite/issues/62#issuecomment-6143267673): original KNOWN task -> Hint -> Q5/Q8 -> PRESENT Copy/cursor -> READY + same Job SUCCEEDED, with no additional StartDownload. Preserve the eight historical unknown reservations and protected evidence. No further live 115 validation is needed. Documentation Issue #75 / PR #76 is merged. Current task: auth Issue #77 / PR #78 merged. Current implementation: [Issue #79](https://github.com/nathanxiangang-web/cloudsite/issues/79) / PR #80 and Issue #81 / PR #82 are accepted and merged. Initial readonly UI used real MCP-Test data; PR #87's isolated catalog now supersedes that default scope. Next bounded [Issue #83](https://github.com/nathanxiangang-web/cloudsite/issues/83): freeze and implement exact-source admission and operation usage. [Read-only UI/runbook](docs/PRODUCT-READONLY-UI.md) remains governed by D-043. User-prioritized real resource presentation Issue #84 / PR #85 is accepted and deployed after exact-head CI `38575852403`. See [display module](docs/PRODUCT-RESOURCE-DISPLAY.md). That PR #85 baseline was metadata classification/list/cards/detail over the MCP-Test Root (one document), not whole-drive indexing, content preview/video playback or file access. Issue #83 WIP remains isolated on its own branch and unreviewed; no v14 migration has been deployed. Do not overwrite that work or mix it into readonly deployment. Resume admission/usage and subsequent actual Copy/access/share modules; MVP is still incomplete. Preserve restored readonly processes and historical data; no new provider download is needed for UI work. Current authority is D-042: the human delegates Architect and Developer roles to one agent through minimum usable core MVP delivery. Finish the documentation audit (complete), then execute [the staged plan](docs/GATE4-IMPLEMENTATION-PLAN.md). Each bounded slice follows written contracts, tests, exact-head CI and a separate same-agent review pass. Do not call it independent review. Issue #77 implements auth domain/store/handlers; [PRODUCT-AUTH](docs/PRODUCT-AUTH.md) records limits. Issue #79 adds owner-only task and allowlisted resource read handlers, with no provider mutation. Issue #81 implemented read-only UI/listener/provisioning; admission/usage/access/share is NOT implemented and full MVP is not accepted. Schema head v13 does not upgrade the existing Gate 3.18 v12 database/binary. Issue #74's vague old skeleton is superseded. Original MVP auth/access/share/usage remains required; new guidance is not implicit permission to replace it or move Agent implementation ahead of Gate 5. Gate-labelled constraints below describe the scope when each capability was introduced, not an instruction to reopen old Gates. The current Project State, AI Architecture Memory and newest accepted decision govern execution. ## Current non-negotiable boundaries ### Observation ```text Storage / 115 -> OpenList -> IndexCore Collector -> IndexCore Canonical + Journal -> cloudsite ``` IndexCore owns physical truth. **Do not add direct cloudsite -> OpenList acquisition visibility verification.** After provider completion, cloudsite sends a trusted IndexCore Mutation Hint: ```text root_id = StorageBinding.indexcore_root_id scope_key = Manifest.target_path reason = POSSIBLE_CHANGE ``` Then cloudsite waits for IndexCore canonical Query/Journal evidence. ### Control ```text cloudsite -> Job Engine -> Provider Contract -> Provider Adapter -> Storage ``` Provider success is never READY by itself. ## Coordinate separation Never derive these from each other: - `provider_scope` — provider mutation target; - `openlist_mount_path` — IndexCore/OpenList observation configuration; - `indexcore_root_id` — IndexCore canonical root; - `manifest.target_path` — scope inside the selected root/binding. ## Acquisition result identity Before provider success may advance automatically beyond the provider stage: ```text valid provider-observed TaskStatus.ResultName > Manifest.ExpectedName fallback ↓ Manifest.result_name ``` Canonical candidate identity is later formed from: ```text StorageBinding.indexcore_root_id + Manifest.target_path + Manifest.result_name ``` - `target_path` is the directory scope refreshed by IndexCore. - `expected_name` is request-time intent/fallback and must not be rewritten by provider execution. - `result_name` is the immutable durable provider-stage locator. - A valid provider result wins; blank/absent provider result may use ExpectedName fallback. - Invalid nonblank provider result fails closed; do not silently fall back. - Never use provider FileId/DirId, OpenList paths, Journal order, timing, newest-item, or only-item heuristics as a substitute. - This locator still does not prove canonical presence; IndexCore confirmation remains required. ## Canonical completion READY is not authorized by provider success or Hint acceptance. For Gate 3.10: ```text root_id + target_path + result_name -> exact Q5 PRESENT resource -> existing Q8 Journal Projector -> exact PRESENT Copy -> optional monotonic Variant binding -> result_copy_id + READY + Job SUCCEEDED ``` - zero Q5 matches is pending; - Q5 ambiguity/multiple matches fails closed; - acquisition must never create/upsert Copy directly; - reuse the existing projector in bounded one-page steps; - `result_copy_id` is the durable final acquisition result reference. ## One-claim acquisition dispatcher Current authorized Gate 3.11: Issue #46 / D-034. Dispatch exactly ONE stage per claimed ACQUISITION Job using persisted Manifest.State: ```text ACTIVE -> provider Execute + atomic ProviderOutcome AWAITING_VISIBILITY -> trusted IndexCore Mutation Hint step AWAITING_CANONICAL -> exact canonical confirmation step terminal pair -> committed no-op / replay ``` - Use Job owner and ClaimAttempts fencing, with PostgreSQL database-time check at every durable stage write. - After an accepted handoff return; never execute the next stage in the same claim. - Never convert provider uncertainty into blind StartDownload retry. - Normal pending status does not consume failure budget. - Do not implement a continuous worker daemon / automatic ClaimNext scheduler yet. ## Type-scoped claim and linked recovery Active Gate 3.12: Issue #48 / D-035. - A future acquisition worker must only claim ACQUISITION Jobs using a database-atomic type filter. Never claim arbitrary Jobs and then discard mismatched types. - Expired RUNNING ACQUISITION Jobs require a PostgreSQL-time-fenced atomic transition of both linked Manifest and Job to RECOVERY_REQUIRED. - Lock Manifest before Job, recheck exact idempotency/payload/reverse link under lock. - Generic Job-only expired-lease sweep must not mutate ACQUISITION Jobs independently. - Do not drop START_RESERVED / task references or automatically repeat 115 StartDownload. - Maintain ClaimAttempts generation and FailureCount semantics, no worker daemon or process runtime in Gate 3.12. ## One-shot runner Current Gate 3.13 / Issue #50 / D-036 allows a single explicit application RunOnce tick: ```text bounded expired-acquisition linked-pair recovery → if healthy: ClaimNextByType(ACQUISITION) at most once → StageDispatcher.Dispatch at most once → return a typed IDLE / RECOVERY / STAGE result ``` Recovery debt stops new claims in the tick. Stage errors must not be translated into generic Job-only Fail/Succeed/RetryAt writes; that would desynchronize the Manifest. Pass the actual claimed owner/ClaimAttempts. No autonomous worker daemon, timer, process startup wiring or live provider-credential integration yet. ## Opt-in acquisition worker lifecycle Active Gate 3.14 / Issue #52 / D-037: serial opt-in lifecycle around the accepted RunOnce. - Worker disabled by default; an enabled process with no real injected dependencies must fail closed at startup. - Use exactly one worker loop and one in-flight RunOnce per process; a slow tick cannot overlap another. - Owner stable for the process and unique across replicas; bounded interval, deadline, retry and lease safety margin; never busy spin. - Treat IDLE/recovery-only/completed tick as normal, pace transient errors, stop on corrupt linked-pair recovery debt. - Propagate cancellation, no detached task goroutines, no new claim after stop. - Do not mutate Jobs on runner errors, recreate provider tasks or claim canonical READY from a worker-level result. - Real 115 credential/IndexCore/PostgreSQL startup graph and deployment remain later authorized work. ## Runtime composition and secrets Active Gate 3.15 / Issue #54 / D-038. - Construct a single complete real-protocol graph from accepted cloudsite PostgreSQL stores, IndexCore Q5/Q8, separate trusted Mutation Hint, provider-session registry, Journal Projector, RunOnce and worker. - Worker-enabled startup must fail closed if any dependency, schema-v12 guard, trusted Hint configuration or exact provider/connection credential binding is absent. - Resolve 115 credentials through an externally injected SecretResolver; never put cookies, tokens or user magnets/URLs in Git, cloudsite DB, logs or diagnostic errors. - Never query IndexCore DB or inspect OpenList directly from cloudsite for acquisition visibility; Hint 202 is NOT canonical READY. - No new acquisition Copy writer; Q8 Projector owns Copy and D-033 canonical transaction owns READY. - Controlled PostgreSQL + HTTP fake E2E is authorized, live 115 account acceptance / deployment remains a later Gate. ## Protected operator bootstrap and preflight Current Gate 3.16 / Issue #56 / D-039. - Default `cmd/panta` mode must not resolve provider secrets, claim jobs, submit Hint, or make provider requests. - Provide distinct explicit read-only preflight and opt-in worker start using one accepted D-038 runtime graph. - Inject raw 115 cookies and trusted Hint tokens only via externally protected secret sources with strict file/path permission checks; never put secrets into CLI arguments, Git, logs, cloudsite tables or error messages. - Preflight must be verifiably read-only: schema v12/active session identities/config and secret availability, no DB migration, no ClaimNext, no external provider mutation. - Explicit start must fully validate all required exact sessions before claims, preserve one D-037 serial Worker, signal-based cancellation and owned pool Close-after-Run ordering. - Live 115 account downloads, production deployment, public API/UI and additional schedulers are not authorized in this Gate. ## Job safety - `claim_attempts` = monotonic claim-generation fence. - `attempt_count` / `FailureCount` = bounded failure retry budget. - stale claim generations fail closed. - provider StartDownload requires the durable START_RESERVED fence. - START_RESERVED with unknown provider reference must never auto-recreate. ## Provider safety Current 115 downloader: - `github.com/SheltonZhu/115driver v1.3.5`; - Source.Value passed unchanged; - Target.Scope is the 115 saveDirID; - task reference is `info_hash`; - cancel never deletes downloaded files. Secrets never enter Manifest, Job payload, provider-task persistence, logs, or Agent prompts. ## Team / scope One agent performs Architect and Developer roles in separate phases under D-042. No imaginary parallel Worker team. The Developer implements only the currently authorized bounded Gate. Validate and merge each bounded stage before advancing. Ordinary in-scope stages need no repeated user authorization; preserve D-042 risk limits. ## Conflict rule If old prose/Issue/PR/chat conflicts with a newer accepted Git decision: ```text newer accepted decision wins ``` Stop, identify the conflict, and synchronize project memory before continuing.