# cloudsite — Project State ## Current maintenance - Issue185 unlimited cloud downloads (2026-11-10) The human requests investigation/fix of CONCURRENCY_LIMIT and removal of download count restrictions, with a GitHub patch and production update. v1.0.2 removes website lifetime and per-account submission caps, including legacy customized rows, while retaining atomic owner serialization, idempotent operation replay, authentication, serial Worker execution and uncertain provider-start protection. See `docs/releases/v1.0.2.md`. Schema20 stays unchanged. Do not mutate/replay historical recovery tasks or unrelated IndexCore/storage services. Validate exact head/main CI, publish immutable artifacts, and use backup/isolated restore, health and preservation checks for the product-only deployment. This explicit maintenance request supersedes historical candidate-only integration pointers. ## Maintenance request - simple permanent account deletion (2026-11-02) The human explicitly requested a simpler account-delete flow and rejected soft-disable/restore semantics. Implement v1.0.1 as specified in `docs/releases/v1.0.1.md`: one confirmation, physical website-account cleanup, terminal-download/concurrency/authorization guards, retained task and audit history, no native storage deletion or migration. Existing production accounts are not test fixtures; validate destructive commands only on isolated data. The project remains in maintenance after this bounded fix. ## Release 1.0.0 closeout - 2026-10-30 The human explicitly requested the final 1.0 release and the end of this feature-development phase. This supersedes older candidate-only handoff pointers for this release integration/publication/deployment. Integrate the completed PR181 admin UI cleanup and PR182 magnet compatibility fix, freeze VERSION1.0.0, require exact merged-main CI success, then publish immutable v1.0.0 artifacts and perform the separately verified production cutover. No new business feature, migration, provider command, AI131 or paused private139 work is included. Project mode after release: MAINTENANCE. Retain existing state and capability; no further feature work without a new human request. Source, release artifacts and production must have distinct receipts. Production is not accepted merely because this documentation or a tag exists. See docs/releases/v1.0.0.md. ## Current delivery - Issue180 admin information architecture (2026-10-28) PR179 merged as750f5281217d92bc2ed48b71bb28256bd0101e82. Exact merged-main CI40652403381 completed SUCCESS3/3: quality/race/vet/build, PostgreSQL16 and PostgreSQL18. Issue180 now owns one bounded UI-only cleanup PR. Capture desktop 1440px and mobile390px before editing presentation code; identify evidence-backed noise, then preserve the existing shell, APIs, audit/CAS/UNKNOWN recovery and accessibility while simplifying navigation and progressively disclosing internals. Implementation is complete on the review branch:201 frontend tests and the producthttp Go package pass. Chrome before/after evidence includes12 pairs plus4 interaction captures, all isolated synthetic fixtures. See docs/admin-ui-180/README.md. Review-branch CI and merge remain separate; do not claim production deployment. No backend, schema, provider or IndexCore changes and no production deployment under180. Parent155 remains open; production153 verifies the real host separately. Do not self-merge; retain review. Earlier delivery pointers are history, not current unfinished work. ## Current delivery - Issue176 complete resource editor (2026-10-28) PR177 merged as1611d37bd443e01b82c1eb66381bb91ecc3ee0d2; main CI40549771841 completed SUCCESS3/3. Issue176 accelerated instruction supersedes backend-only pointers: deliver the actual row/detail editor, strict capability/exact GET, confirmation and single audited PUT with scoped GET-only UNKNOWN recovery in ONE complete PR. Read docs/ADMIN-RESOURCE-EDITOR-UI.md. No new migration, provider, IndexCore or consumer/share access change. Stop for one independent review; no self-merge. Parent155 OPEN; completed170/172/174 are not reopened. AI131/private139 excluded. Production153 prep may overlap; live16->20 mutation requires a separate scoped release decision and actual backup/restore gates. Earlier pointers are history. ## Historical bounded task - Issue 176 Copy presentation backend (2026-10-28) PR 175 is merged at f868da264255ddf93457c8f8f67117bb8bb33349. Exact main CI 40532208171 completed SUCCESS in all three jobs before this implementation. Issue 176 Stage 1 adds a CopyID-keyed product-owned alias/category/presentation-only hidden overlay, protected exact read and specific audited CAS action. Read `docs/ADMIN-COPY-PRESENTATION.md`. Append-only schema20; old 0001-0019 unchanged. One backend draft PR for independent review; no self-merge or editor UI. No provider/IndexCore mutation or access/share policy change. Parent155 remains OPEN; production153 owns the separate upgrade/backup/rollback; AI131/private139 excluded. Earlier pointers below are historical, not current unfinished work. > This file is the current execution pointer. Update it at every accepted gate. ## Current phase ### Historical bounded implementation - Issue174 audit reads (2026-10-27) PR173 merged atbb603f7e1dbe and exact main CI40465107546 completed SUCCESS in all three jobs. Backend170/UI172 are integrated, not production activation. Issue174 adds only the current ADMIN's persisted product action ledger, strict filters/keyset paging and safe evidence detail. Read docs/ADMIN-AUDIT-HISTORY.md. One draft PR for independent review; no self-merge, new commands, migration, provider/IndexCore calls or production changes. Parent155/production153 remain OPEN; AI131/private139 remain paused. Earlier candidate pointers are historical. ### Historical bounded implementation - Issue172 UI (2026-10-27) Backend PR171 merged at4b1329a47ee2; exact main CI40457606174 is SUCCESS in all three jobs. Issue172 adds strict no-Job CANCELED compatibility and a fresh exact-read, capability-gated confirmation with one audited POST and GET-only UNKNOWN reconciliation. Read docs/ADMIN-PENDING-CANCEL-UI.md and its fixture QA. One candidate PR for independent Architect review; no self-merge or production activation/migration. Parent155/170/153 stay OPEN; AI131/private139 remain paused. ### Historical bounded implementation - Issue170 backend (2026-10-27) PR169 is merged at9903279e4ee7; exact main CI40342381266 completed SUCCESS in all three jobs, and Issue168 is CLOSED. Issue170 adds only audited conditional cancellation of a persisted PENDING intent with no Job/provider/admission evidence. Read docs/ADMIN-PENDING-CANCELLATION.md for ports, lock order, schema19 and tests. Backend candidate only: one PR for independent Architect review, no self-merge, UI button, production migration/deployment, provider action or IndexCore changes. Parent155/production153 remain OPEN. AI131 and private139 remain paused. ### Historical bounded implementation - Issue168 (2026-10-26) Homepage167 is merged at8094ff36704f; exact main CI40329349106 succeeded. This branch adds read-only ADMIN exact task diagnosis and server Manifest-state/owner filters, reusing current linkage checks and preserving overview and consumer nav. See [module/route/evidence contract](docs/ADMIN-DOWNLOAD-DIAGNOSTICS.md). Candidate awaits Architect review; no merge, deployment, migration or task action is claimed. Parent155 remains OPEN; AI131/private139 and production153 are separate. ### Historical bounded implementation - Issue166 (2026-10-26) Backend PR164 is merged at025813ca; consumer navigation PR165 is merged in main a8acd3479198, whose CI39969748311 succeeded. This branch implements the separate operator homepage using existing protected GET ports, not new counts or commands. Users, Manifest intents and linked Job execution remain separate, with validated database read times and fail-closed unavailable states. Candidate awaits Architect review; no acceptance or deployment is claimed. Parent155 remains OPEN; AI131, private139 and production153 migration/rollout are outside this slice. See [module and validation contract](docs/ADMIN-OVERVIEW.md). ### Historical code integration - Issue155 / Admin UI-3B (2026-10-23) - Merged:156 USER lifecycle/schema17;157 lifecycle UI;158 server-side search; 159 DTO-backed explicit user details (`bf931b18417b`, exact-head CI39921303732, merged-main CI39921715814 SUCCESS);160 server-aggregated user total (`1a86e5c4d458`, exact-head CI39921850373, merged-main CI39922283505 SUCCESS). - PR161 share-list/audited-revoke backend/schema18 merged205c28e6619e; exact-head CI39922782277 and merged-main CI39923298349 SUCCESS. The separate PR-D2 shares UI is implemented in this tree for review, consuming existing list/revoke/action-status ports; no new schema/backend command. See the [module contract](docs/ADMIN-SHARE-MANAGEMENT.md). Verify its actual PR/head CI and review for acceptance; implementation does not mean production delivery. - Remaining Issue155 work includes richer overview aggregates, bounded task/resource/storage management and audit/settings. The full program is NOT complete. Unknown metrics remain unknown, not fabricated zero/healthy. - These are code integration facts, NOT a production migration or deployment. Production153 and IndexCore stability retain separate live evidence gates. AI131/private139 remain paused. Current work does not investigate cloud-download incidents or mutate provider reservations/unrelated services. ### Historical development - Issue155 / PR-A candidate (2026-10-22) 2026-10-22: Issue155 authorizes an isolated USER lifecycle backend slice from `c26678a87ca4`. Added rename/reset/soft-delete/restore, bounded search/detail and append-only schema17. See [module contract](docs/ADMIN-USER-LIFECYCLE.md). PR-A is implementation for review, not acceptance, merge or production migration. UI/homepage aggregation is PR-B; task/share/storage management follows separately. Private139 remains PAUSED. IndexCore130/D2 and production153 remain independent. The Issue155 report of live UI-3A/schema16 is not independently reverified by this development run; the older preflight below is a dated observation, not live truth. ### Historical execution — Issue #153 preflight snapshot (NO-GO at that observation) 2026-10-22: UI-3A PR150 merged as `c43408bb61722fb3d575063b8da79c04d736abdc`. PR151/152 archive isolated forward/reverse drills; main `fe6ec170126c` CI39728366064 all3 SUCCESS independently checked. The human approved the NOW window. Password SSH now works; the previous BatchMode authentication failure was not a failed password login. Fresh production reads confirm old `deleted-preview-bf89f5a`, schema15/15, acquisition mode, five READY/SUCCEEDED and five RECOVERY_REQUIRED pairs. Candidate image/binary/migrator hashes match the reviewed artifacts. IndexCore has repeated `incremental_runtime_fatal` cycle/executor exits and restart count61; last observed failure followed a reconcile error. Underlying cause and sustained stability are NOT verified. This dependency gate is NO-GO, not a newly observed SSH/host-safety rejection. No stop was attempted this pass; frozen backup/restore, migration, cutover and live canaries remain NOT_RUN. See [fresh preflight](docs/operations/ui3a-rollout/07-live-preflight.md). Private139 remains PAUSED; no historical task replay or IndexCore repair. ### Historical UI-3A implementation handoff (merged; not deployment evidence) 2026-10-22: UI-2B PR148 verified merged at authorized baseline `97cb94fee932e231147c25c74bcbf773f27538fe`; merged-main CI39701070318 all3 SUCCESS checked. Issue149 authorizes real protected115 GetInfo and audited USER create/enable/disable commands in one PR. Separate adminops/PG/provider/ composition/HTTP/UI modules implement durable intent/result, no blind replay, DB-time per-connection cooldown, USER CAS and coherent session revocation. Append-only migration16 is development-only; no production migration/deployment, live canary or real user mutation. Runtime is actual PG/protected configured sessions; synthetic data is tests only. See [handoff](docs/PRODUCT-ADMIN-LIVE-OPERATIONS-ACCEPTANCE.md). Architect review/merge pending. Private139 PAUSED; no personal GB quota, native file/download mutation, IndexCore changes or UI-3B/4 work. ### Historical UI-2B implementation handoff (now merged; not deployment evidence) 2026-10-22 (Asia/Shanghai): UI-2A PR146 is verified MERGED at authorized baseline `a645e90229b71209f9a6036f25583113df9f1281`; merged-main CI39639475953 all3 SUCCESS checked. Issue145 is closed per Architect closeout. Issue147 authorizes one UI-2B PR: provider-neutral configuration projections for configured Bindings and Connections, plus manual single-root Q9 evidence. ACTIVE means configured, not online; native115 session/capacity and OpenList/Q8 freshness stay unchecked. See [UI-2B handoff](docs/PRODUCT-ADMIN-UI2B-ACCEPTANCE.md) for contracts and evidence. Candidate is not Architect acceptance, merge or deployment. UI-3/4 and private UserSpace139 remain unauthorized/PAUSED. Schema15, consumer controllers, UI-2A owner boundaries, auth TTL, quota, providers and IndexCore implementation are unchanged. Historical live records below are not new production verification. ### Historical planning priority — Admin Console D-066 / Issue #141 (DESIGN ONLY at creation) 2026-10-20: Human deferred private-user-space Stage A implementation. Issue #139 is now **PAUSED / execution authorization suspended**; keep D-065 and parent Issue #138 as backlog, not underway. Current requested priority is a Chinese management UI and functional product blueprint ([Issue #141](https://github.com/nathanxiangang-web/cloudsite/issues/141), [admin specification](docs/PRODUCT-ADMIN-CONSOLE-BLUEPRINT.md), [offline mock UI](docs/design/CLOUDSITE-ADMIN-UI-PROTOTYPE.html)). D-066 is **proposed**, no admin code, schema/API/provider/IndexCore change or deployment. Existing `/admin` is ADMIN-only for workspace info but still reads only the caller's tasks and ordinary canonical resources; no admin-wide user/job/health/audit/mutation APIs. Existing operation count/concurrency remains; no per-user GB capacity. D-064 production verified snapshot below is unchanged by this new design request. ### New proposed private-cloud-space blueprint — Issue #138 (DESIGN ONLY) 2026-10-20: User requests real native 115 folders per verified CloudSite user with private-only reads and controlled single-file deletion; **explicitly NO per-user storage capacity/quota/usage meter**. Earlier 520G is an unverified **global account reference only**, not a per-user entitlement or V1 hard cap. The pinned `115driver v1.3.5` source provides `Pan115Client.GetInfo()` for actual account total/used/remain; not executed with a live credential in this plan. Proposed [D-065](docs/DECISIONS.md) / [blueprint](docs/PRODUCT-PRIVATE-CLOUD-SPACES.md) tracks stage A mock/schema groundwork, B server-side ACL before private provider starts, C native directory + frozen target, D independently authorized physical deletion, E controlled acceptance. Planning branch changes no product code, migrations, provider files, production service or IndexCore. Existing current D-064 live pointer below remains authoritative until a later separately accepted PR changes it. **2026-10-20 Issue136 / D-064 live verified at02:15Z.** Product runtimebf89f5a (image cloudsite:deleted-preview-bf89f5a), exact CI39261559684 SUCCESS,60 Node tests PASS; served library.js bytes match reviewed source. A complete successful refresh now closes deleted/replaced selected identity; failed/partial/late reads and surviving playback are preserved. Browser interaction was not independently replayed; live evidence is authenticated API/asset plus DOM regressions. IndexCore115/PR119 runtime2d9068e is deployed: root work VERIFIED/failures0 and three fresh trusted observations. Six real absence records converged by normal Q8; the legacy file and previously deleted gallery have zero public/Q5 matches. Two additional cloud files were independently source-confirmed deleted. Public 274=library274/downloads0, all other canonical identities preserved including4 copy-conflict regressions; sample download302. Only an empty legacy Alias was disabled; retained metadata/history, eight reservations, unrelated mounts/services and source credentials unchanged. Protected backups retained. Schema15 unchanged; zero new acquisitions/provider starts, physical writes, migrations or AI activation. IndexCore117/PR118 is accepted/merged5d4ee56. Real recheck Oct19 13:24Z confirms all4 former copy-conflict paths PRESENT with fresh IDs/Q8 additions and unchanged tombstones. Public277 = library275/downloads2 before deletion recovery. That identity acceptance was not automatic deletion acceptance. ### Prior incident snapshots (historical) REGRESSION MITIGATED: IndexCore Issue115 / PR116; open parity issue117. The user's library dropped to1 file after the initial acceptance below. At08:06Z OpenList returned success with only a virtual alias while the real backend list failed; mirror incorrectly tombstoned749 unrelated records. Source folders/files still exist. The current UI honestly reflected the bad canonical inventory; this is not a frontend category/filter problem. Native root watch/mirror were disabled. A whole-root additive scan timed out300s without positive commit. Existing root-scoped RepairBlocked CAS+MergeSignal now restore valid PRESENT directories through the existing single writer;300 INVALID_SCOPE blockers are being repaired. No SQL resurrection or physical file deletion. Initial actual recovery proof was53 files, library51/downloads2 (historical, not acceptance). At11:53Z actual public API:272 total, library270/downloads2; gallery PRESENT0, no removals after containment, sample attachment302 without CDN follow, product healthy, unrelated service IDs preserved. All300 invalid-scope blockers repaired, 14 due INTERNAL retries explicitly resumed once and7 parents re-observed. Guard 399eca4 has full CI39123818119 SUCCESS and is deployed. Product runtime unchanged. 4 source-present same-hash/different-path files remain unresolved: IndexCore117. Do not claim full source parity or full automatic deletion restored. IndexCore PR116 adds independent bounded before/after storage-topology evidence. Nested virtual mounts/unknown or Alias covering drivers/missing credential mean additive-only, not deletion. Old unsafe proofs are rejected. No topology secret has been configured live; unsafe root deletion remains disabled. Native30s watch is restored in positive-only mode: mirror_presence requests existing child discovery but new snapshots carry no deletion authority, verified over3 cycles. Verify library AND download partitions, surviving sibling subtrees and later cycles, not only gallery absence or a single total. AI remains unstarted. ### Earlier one-time rollout evidence, not current acceptance Issue132 / PR133 initial rollout2026-10-18. IndexCore Issue113 owns explicit opt-in direct-child presence coverage and deleted-directory subtree tombstones/Journal; ordinary PARTIAL remains safe. CloudSite reuses GET-only quiet catalog refresh for the visible library as well as downloads. No direct provider crawl, physical deletion or canonical SQL patch. Runtime code d337ebf75bc088fd303ef878ce3cdf6cb8a081cd, CI39098778407 all3 SUCCESS, 57 local UI regressions passed. Public image cloudsite:source-sync-lf-d337ebf is healthy, readonly preflight passed, and public library.js is no-store with quiet refresh. Actual authenticated resource API has zero gallery rows and276 surviving files. IndexCore efd3cdca8d64 tombstoned10 gallery records in one generation with 10 Q8 removals; four screenshot image Q5 queries have zero PRESENT matches. No physical deletion, manual canonical SQL, migration or operator download start. Other service container identities unchanged. The first product package was rejected because Windows archive converted embedded SQL to CRLF; the old image was restored, then an explicit LF package matched all15 DB history checksums and passed preflight/health/public API checks. See [packaging guard](docs/RELEASE-PACKAGING.md). The final acceptance commit adds only attributes, packaging tests and evidence; runtime Go/JS bytes remain those of the tested code heads. AI remains unstarted. ### AI planning status (unchanged; not the active hotfix) Issue129 / D-062: AI INTEGRATION PLANNING, NOT IMPLEMENTED/ENABLED. Human requests blueprint-aligned AI and identifies.50 alongside IndexCore as the execution host. Authoritative software is the user-designated local CodeartsBridge at c190fc8; its private CSV directory has three structurally populated AK/SK profiles. The registry maps bus-w02-dev to.50, but the matching account and live entitlement are unverified. No CSV was imported or disclosed. Read [modular staged plan](docs/PRODUCT-AI-INTEGRATION.md). Prioritize evidence-backed real-file metadata suggestions; no auto-download, file mutation or IndexCore/DB access by the agent. Model credentials remain on.50; public113.20.6.57 uses a separately authenticated private gateway only after readiness is verified. On.50 CodeArts components exist, but the old Bridge unit targets a missing directory; historical8080/8765 endpoints are unreachable and checked CLI profiles are absent. No proof of current callable model credentials. Do not infer absence of credentials: the local seed is located. Bind a verified profile during staged deployment; do not provision another account or expose coding /api/tasks to product users. Preserve the dirty local Bridge worktree. Next staged scope is [Issue131](https://github.com/nathanxiangang-web/cloudsite/issues/131): 5.1 contracts/strict validation/mock, not model execution; prepared, not started. Current product schema15 and all services/credentials/tasks stay unchanged; this planning run made zero model requests, migrations, starts or service restarts. ### Current runtime evidence (not AI acceptance) 2026-10-18 VERIFIED: IndexCore issue111 / PR112 merged e03d14a9e1bbf6e022fc67000ae2034c165d7845 and deployed to the owned public catalog process. Exact-head CI38996188340 and merge CI38996436652 SUCCESS. CloudSite issue126 / PR127 merged and deployed f1bceeea8cbc5dff20cb19cb0c4481a35224ed14; exact CI38996296258 and merge CI38996449893 all3 SUCCESS. Same-agent review, not independent approval. The incident was real: READY directory Copies existed while child files had not been indexed, and unchanged READY polling did not refresh file inventory. Bounded IndexCore-owned child work now expands /云下载 via the existing single writer and PARTIAL observations; the consumer quietly re-reads canonical files every visible-page10s, preserving preview. No Panta provider scanner, full scan, schema change or new download. Current authenticated canonical API evidence: 2 cloud files, main283; child scopes VERIFIED, no blocked/retry child scopes; exact Q5 PRESENT. OpenList transient TLS failures occurred before convergence. Browser automation was unavailable for this final verification; API/static asset verification is not a claim of an independent visual playback test. See D-061. Separately, the original sealed ISO smoke pair remains RECOVERY_REQUIRED with a known reference and exhausted5/5 failure budget. The accepted recovery CLI refused resume; its reservation/log are retained. No reset, extra source or provider start. This is not an original ISO READY acceptance or a claim that every task completed. Issue124 / PR125 / D-060 ACCEPTED and deployed0877e133124ba3193943622a3990e93f26165c76, now included in PR127:100-operation policy, no UI in-flight counter, backend concurrency2 and usage retained; silent library auth bootstrap and30-day website session unchanged. Exact CI38995121532 and merge38995326826 all3 SUCCESS. ### Earlier accepted snapshots (superseded where the current pointer differs) ACCEPTED/public Issue122 / PR123 / D-059 at e2576dc9c6c7641b2a98ef5b49133bc1da4dde79: exact6b48e78af64d0a73f13b170cd686202818ad3811, CI38994379661 and merge38994534211 all3 SUCCESS, separate same-agent review. At that checkpoint the human confirmed an empty cloud list was expected; the later actual missing-file incident is fixed by PR112/PR127 above. Main283-file count and shared controller render verified; no extra scan/provider download performed. Original service identities/config/schema15 preserved; no recovery debt. The human requests cloud files directly on /downloads/, excluded from the main library. Shared file template/controller retains preview, playback, native attachment and sharing; pure exact Binding/canonical-subtree partition applies before search/count/pagination. Authenticated workspace exposes canonical view coordinates only, not native scope/ref/credentials or selectable submission target. IndexCore remains read authority; no migration/provider call/ file move/delete/task rewrite. See docs/FILE-SURFACES.md. Tests pass locally; full CI/review and product-only deployment passed, no new download smoke budget. Issue120 / PR121 / D-058 ACCEPTED and deployed at f8be03ccf1d798898b52618f3fd773a5a9094699. Exact reviewed c1ed10be896ff6f1e6011c8c86ef979c382f6be4, CI38992241383 and merge CI38992448685 all3 SUCCESS; separate same-agent review, not independent review. Public managed submission and one serial Worker are ACTIVE on113.20.6.57. Physical destination /CloudSite/云下载; Manifest/Hint/Q5 path /云下载. The native save-directory ID is privately verified. Existing CloudSite Root/Binding/mount identities are preserved; a fresh115 Connection is attached through guarded CAS, old observation Connection/credential preserved. No migration beyond schema15. Parent and child PARTIAL Hint accepted; Q5 resolves exactly one PRESENT directory. One sealed ordinary ISO submission returned HTTP201 on2026-10-17 at01:54UTC. Provider reference is durably REFERENCE_KNOWN; native readonly status reports RUNNING, destination matches the new child, progress0 at01:58UTC. Manifest ACTIVE / Job RETRY_WAIT, zero recorded failures. Download/Copy/READY are NOT yet accepted. The one-start smoke budget is CONSUMED: observe this pair only, no repeat POST. Public form/quota, strict400 and auth/ownership verified; original283-file library, DOCX preview/hash,302 CDN download,206 video and both guest-share modes pass. Temporary shares revoked. Original edge/OpenList/catalog/database service IDs, images and PIDs unchanged. Product and new catalog healthy. Root-level /云下载 and its old files are untouched, excluded only from the active CloudSite feed. See [runtime evidence and rollback](docs/CLOUD-ACQUISITION-ACCEPTANCE.md). ## Historical snapshots (superseded where the current phase differs) The unavailable banners,284-file alias feed, zero submissions, disabled managed runtime and unconsumed budget below describe earlier deployments, NOT current status. Existing website30-day policy and safety constraints still apply. ACCEPTED Issue118 / PR119 / D-057: human confirms WEBSITE login30 days, not115 TTL. One shared fixed30-day policy for new cookies and DB-time sessions; no sliding refresh or retroactive extension. Logout/revocation/security boundaries unchanged. No migration. Domain/HTTP and real owned PostgreSQL auth regressions pass. Reviewed2bee9a6b5ff57d205c485e09662f7884025003a2, exact CI38991088165 all3 SUCCESS, separate same-agent review; mergecaabc0a0cf1eaa67b05dd68a69b287dc82987501, merge CI38991282378 all3 SUCCESS. Public image cloudsite:session30-caabc0a. Actual HTTPS proves Max-Age2592000, same DB duration/absolute expiry, secure flags, existing session expiry unchanged and immediate logout401. Original services/ catalog generations preserved; no schema change or native download. Native115 login recovery2026-10-17: explicit human QR confirmation succeeded, same-account and native root GetFiles verified; new cookie protected0600 in a new attempt directory. Old cookie retained, no native download/Worker/submission. Prior990001 below belongs to the OLD session and is retained as historical evidence. New credentials alone do not make managed acquisition ready. The new session also verified /云下载 parent/native ID using read-only GetFiles; protected ID receipt saved, no cookie/ID output. Hint/Q5 path agreement and managed execution still remain. Preview remains readonly; public reason is now NOT_CONFIGURED. Browser refreshed and confirms the stale LOGIN_REQUIRED banner is gone. This is explicit operator state synchronization, NOT an implemented automatic provider health monitor or automatic Worker recovery. Issue114 / PR115 / D-056 ACCEPTED, publicly deployed on2026-10-17. Reviewed bbb38ae1e00271b1c7c8454594755f55bfce9f80; exact-head CI38967538356 and merge CI38967953503 all3 SUCCESS, squash894962f6bb5a, separate same-agent review (not independent). Public schema14 -> 15 after backup and tested 15-compatible readonly fallback. Old strict14 binary is NOT a valid fallback. See [public evidence and recovery](docs/CLOUD-DIRECTORY-ACCEPTANCE.md). Human target is existing /云下载, not MCP-Test. Standard OpenList Alias exposes it inside the existing application scope; no file move, native/OAuth credential change or account-root expansion. Separate IndexCore DB preserves old root and resource IDs/generations. Accepted bounded cloud scan: generation1,2 resources, 1 file. Persistent single writer uses7ef47217; Hint remains loopback-only. Old283 files plus1 cloud file accessible:284 total. New observation Connection/ Binding remain DISABLED, without native scope/credential. This is NOT yet an acquisition-ready Hint/canonical namespace. Original catalog remains unchanged. Historical Issue113 blocker before QR recovery: native GET returned HTTP200/API990001/ErrNotLogin. Zero new submissions/Worker/StartDownload; one-start budget remains unconsumed. UI explicitly shows LOGIN_REQUIRED and allows pure preparation, not admission. Native session is now restored as above; target-ID/path verification is still required before managed execution. Preserve8 historical unknown reservations. Issue116 / PR117 ACCEPTED: exact HEADf0807cc014231b36e24c16e07e28c844a7d5d51a, CI38970141986 all3 SUCCESS, separate same-agent review; merge987adb3af3910ff3, merge CI38970604155 all3 SUCCESS. Public product image cloud-scope-987adb3 supersedes894962f for folder-neutral footer only, with44 Node cases. Browser verifies new scope wording and download entry;1440/390 layouts have no horizontal overflow. Post-switch audit/284-file/login/prepare/admission404 pass. Product and new catalog healthy; original services/PIDs/root generations unchanged; owned temporary processes stopped. No new schema, credential or provider change. Cloud-download composition ACCEPTED: Issue111 / PR112 / D-055. Reviewed exact HEAD0555d3b464f9faf1c92a8772fddb216457b34748, CI38907187975 all3 SUCCESS, separate same-agent acceptance (not independent review), squash51211b553bac. Explicit managed product runtime, fixed-target consumer submission, own tasks/ usage and source-free operation reconciliation.42 Node tests and full Go/actual isolated PostgreSQL/controlled runtime tests passed. Merge CI is separate from the accepted exact-head CI. [Module contract](docs/PRODUCT-CLOUD-RUNTIME.md). Issue83/PR110 admission is ACCEPTED: revieweda630dafa, exact-head CI38901805468 all3 SUCCESS, same-agent review5547872267, mergeec568ae1; merge CI38902038377 SUCCESS. Public schema15 supersedes the former public14 snapshot; original staging12 stays unchanged. Historical login success is superseded by990001 above. Pure preview UI is public; managed acquisition/Worker stay off. Finish Issue113 only after valid native session and fixed native/canonical coordinates. Original dirty Issue83 WIP is preserved. Accepted cloud acquisition preparation: Issue108 / PR109 / D-053. Pure input policy keeps BTIH/optional dn. D-054 now implements its new-reservation durable boundary; future work composes actual dependencies and consumer UI. The example magnet has NOT been downloaded. Former public schema14, delivery and historical provider evidence stay unchanged. [Integration plan](docs/PRODUCT-CLOUD-DOWNLOAD.md). Issue105 / PR106 / D-052 ACCEPTED and publicly deployed at0b29ecc88faff5f9. Exact-head CI38762045631, review5535806545 (same-agent), merge CI38762378328 all3 SUCCESS. Both former local/public builds proxied bytes; the public fix now issues authorized302 after IndexCore checks. Actual Chrome302->115 CDN206, play/seek/pause and15423-byte native DOCX download/hash verified. Automated download event NOT observed; fresh filesystem file is the download evidence. Private one-hour document preview,283 canonical files and guest grants/revoke still pass. Product-only cutover; no source/catalog/provider-history mutation. See [acceptance and rollback](docs/DIRECT-DELIVERY-ACCEPTANCE.md). **cloudsiteV1.0.0alpha is deployed at https://cloud.netioi.com. Open registration with6-character minimum is verified. Public storage is now OpenList v4.2.6 at https://pan.netioi.com, reusing local config/login; AList container removed.** Issue101 / PR102 reviewed22705d031adc, CI38748673995 all3 SUCCESS, same-agent review5534538189, merge68d945793b8f; merge CI38749342436 SUCCESS. Actual public 6-character signup/login and5-character rejection pass; existing passwords unchanged. PR103 reviewedcfc283178bb5, CI38754182448 all3 SUCCESS, review5535047887, merge7bfe63d7af4c: token renewal binds the actual migrated OpenList identity. Direct human follow-up supersedes the initial instruction to preserve running AList: replace ONLY that root-compose service, using local OpenList credentials instead of migrating incompatible server AList credentials. OpenList is pinned to digestc555c6e1c8af2aead38ed12ec761ac077fdf046d19cf033414be8e056aec6b64. Root compose has openlist/traefik/portainer/rclone-backup. Other three container IDs/images/PIDs unchanged; old AList data/image/exact YAML backups preserved. Actual post-switch HTTPS regression passes:283 files, original account login, USER registration/admin denial, real DOCX preview/download, video Range, code/no-code guest downloads; test shares revoked. No native115 download/scan. Read [final evidence and rollback](docs/CLOUDSITE-V1-ALPHA.md). Final release BUILD-MANIFEST identifies the deployed build; alpha is not completed full MVP. Initial deployed code `841c4d14fb54882856267e2359c20f5075075a24`; merge CI `38746768026` all3 SUCCESS. PR99 reviewed HEAD `93606e67ccf2`, CI `38745269165`, same-agent review `5534142444`, merge `7368671aa0af`. PR100 reviewed HEAD `7a8ab8fe1694`, CI `38746403395`, same-agent review `5534272835`, merge `841c4d14fb54`. Reviews are separate same-agent passes, not independent review. Public HTTPS acceptance: original local product USER/password preserved; open registration creates USER, duplicate rejected, login succeeds, admin API denied. 283 canonical files, real15423-byte DOCX download/text preview, video206 Range, code/no-code guest downloads verified. Test shares revoked. No native115 acquisition/Worker/Hint/scanner. A protected application-token timer renews only the existing restricted storage user. See [deployment evidence](docs/CLOUDSITE-V1-ALPHA.md). The initial deployment facts below are historical; PR102 and the OpenList replacement above are the current superseding runtime state. The human deleted legacy CloudSite. This repository ID1391307332 is the former panta repository, now cloudsite; accepted history is preserved. Website/docs use cloudsite, exact alpha label cloudsiteV1.0.0alpha. Internal import/config/cookie/ schema identifiers remain compatible. See [contract](docs/CLOUDSITE-V1-ALPHA.md). Only the legacy CloudSite workload is replaced; existing service/data/rollback protection remains. Alpha deployment does not mean full MVP acceptance. **Gate 3 CLOSED; auth/read/readonly UI accepted; real canonical reads connected; minimum MVP still incomplete** Gate 0 through Gate 3 are accepted and closed. D-042 delegates Architect and Developer roles through minimum usable core MVP. Docs/auth/reads/UI, real catalog, file content and cloudsite-hosted single-file sharing are merged. Owned product UI runs on staging host .50 through a loopback SSH forward, reading the isolated real IndexCore catalog introduced by PR #87 and expanded to complete CloudSite by PR #95. PR #89 separates consumer and admin UI; PR #91 adds content/server previews; PR #93 adds product shares/download UX; PR #95 adds random4-character codes and full CloudSite file inventory. Admission/usage, current-database Copy synchronization and native115 ShareProvider remain incomplete; this is not full MVP acceptance. ### Current download/playback reliability fix - 2026-10-15 Issue #96 / PR #97 accepted/deployed. Exact HEAD `d5d056b0e1e2e3e58302e9c67e96bed7b42844ca`, CI `38736852134` all3 SUCCESS, separate same-agent review `5533296802` (not independent), merge `57a9d626cd623fb910d78ca1daf1f8ac28023d4d`, merge CI `38737121369` all3 SUCCESS. Native real-link attachment navigation replaces HEAD then synthetic click for consumer/guest; server disposition controls filename, library remains open. Explicit media play/pause and event-based states added. No backend/auth/Range, schema14, provider, source or catalog change. Whole CloudSite283/counts and four-character optional codes remain.28 Node tests plus full existing CI pass. Real Chrome incident first traced to stopped candidate8182; user tab corrected to formal8180. Human explicitly confirmed download started/save dialog appeared; automation did not observe a download event, so do NOT claim automated completion. Formal full DOCX15423-byte download hash matches prior evidence, HEAD200 and Range206 for real document and two videos. Reported MP4 and MKV metadata decode normally. Reference video played beyond37s with readyState4/error=null and advancing currentTime; pause verified. No universal codec compatibility claim. Only owned product restarted; original table hashes, unrelated services, catalog PID/all generations unchanged. Old14 receipt/binary retained for rollback. Deployed binary SHA256 `84b5c2cda9b5778433c87ec4a9b84e9d026d7b03828d1e5799a9185b3e19c194`. ### Previous complete CloudSite acceptance and deployment - 2026-10-15 Issue #94 / PR #95 ACCEPTED, merged and deployed. Reviewed exact HEAD `e5961f8fe0603eb8e2ee0c862abfbdd68d79c6b2`, CI `38733576527` all three SUCCESS; separate same-agent review `5533047604` (not independent review), squash merge `9c902a3650df17c8202e3d04985a20c562389087`, merge CI `38734637547` all three SUCCESS. D-048 and [contract](docs/PRODUCT-CLOUDSITE-LIBRARY.md) supersede old subtree and code-length defaults. Existing OpenList user's logical root is CloudSite only, not the whole115 drive. One new isolated Root, one existing-CLI full scan at refresh=false: generation1,283 files plus474 directories. No source mutation. Software42, video188, document6, Other47. Actual Q5/Q8 evidence private. One selected consumer Binding uses authenticated Q6; all four backend read Bindings remain so old shares keep working. All16 API pages matched IndexCore IDs; UI loads all283 then renders120/120/43 cards, directories never shown. Other includes image/audio/archive/unrecognized extensions; no format dropped. Candidate and formal API passed real DOCX four-character/empty-code downloads, wrong-code/revoke rejection and a legacy eight-character share created with the old deployed binary/Binding. Browser verified random-code autofill, clear -> no-code redemption, protected redemption and copied original code. All temporary shares revoked; candidate stopped. Formal doc text preview also verified. 27 Node,11 Python, fullGo/unit/architecture/race/vet/build and isolated real PG sharing regression pass. Product schema14 unchanged, original staging12 table hashes unchanged. New Connection/Binding DISABLED, no provider_scope/credential_ref. Only product restarted; query PID, all root generations and unrelated containers unchanged during cutover. Eight historical unknown reservations preserved by original whole-table hash checks. Deployed binary SHA256 `983e10735db46b94cfd5d404372e8e97c788bfd05ff8aa58d832e4348d287f67`. Old v14 binary/config/launcher retained for rollback; no new migration. Zero native115 provider/share/download/login calls, no scheduled scanner/Hint. Issue83 WIP remains untouched; no full MVP claim. ### Previous sharing acceptance and deployment - 2026-10-15 Issue #92 / PR #93 ACCEPTED and deployed. Reviewed HEAD `d98f79a2d39f6add0e6d7d4bb98126516623bfa7`, exact-head CI `38702187329` all three SUCCESS, same-agent review `5529930361`, merge `49b98b21bff0c6be3e11f05a6292ba6c383da3af`; merge CI `38702621096` SUCCESS. D-047 and [module contract](docs/PRODUCT-FILE-SHARING.md): cloudsite-hosted file links, 5m/1h/6h/24h/7d expiry, optional code, separate guest grant cookie, copy link, owner list/revoke; exact canonical file authorization before create/download. This is NOT native115 sharing, directory sharing or public internet exposure. Current localhost URLs require reachable cloudsite. Source scopes unchanged. Browser ordinary and guest DOCX downloads both15423 bytes, SHA256 `2bc8090eca36718b3c682ba66f9b3f1a97b88be0d850a1f7c55f1ffedf298925`. Wrong code denied; owner UI revoke then guest download denied. Separate formal guest CookieJar has NO product session; correct-code download/HEAD/206 Range, revocation and repeated redemption denial pass. Temporary test shares revoked. Existing five downloads, server PDF pages/Office/text and video Range/HEAD pass. Go/architecture/race/vet/build, 24 Node, ten Python and real isolated PG share expiry/current-owner/hash/concurrent-limit tests pass, plus exact-head PG16/18 CI. Only owned product DB explicitly migrated13 ->14 (two new sharing tables). Protected v13 backup retained. Reviewed v14 binary in sharing-disabled content-only mode was started and verified BEFORE enabling sharing; that config is the service fallback. Old strict-v13 binary cannot run against v14, so do NOT blindly reuse old rollback receipt. Deployed binary SHA256 `38d8f0c5c75053b263c98c8cd0e0997f9c7be074b2eaa8584583d6e5f2eb951c`. Original staging v12 table hashes, query PID/generations0/1/1 and unrelated services unchanged. No native provider/share/download calls, scan/Hint/login or role change. Issue83 WIP untouched; its unmerged draft14 must be rebased and renumbered later, NOT applied on this product DB. No full MVP acceptance. ### Previous content acceptance and deployment - 2026-10-15 Issue #90 / PR #91 ACCEPTED, merged and deployed. Reviewed exact HEAD `34863813a53f8b1be187bfb9ceaecafbab4cb886`, CI `38699810879` all three jobs SUCCESS, separate same-agent review `5529707246` (not independent review), merge `e5783b5fcef27f3a6f520b08d5773819d3f6aea5`; merge CI `38700142744` SUCCESS. D-046 and the [content module contract](docs/PRODUCT-FILE-CONTENT.md) supersede prior metadata-only content restrictions, not IndexCore's ownership of physical truth. Formal .50 loopback 8180 now serves authenticated same-origin downloads/media. Document originals are cached privately for one hour, server-rendered PDF PNG pages or safe Office/text content returned to the browser. Cache hit revalidates Q5 identity/presence; TTL does not slide. Max128MiB/file, 1GiB total; expired owned cache cleanup every minute, never drive originals. Office remains TEXT ONLY, not original-layout rendering. Video uses Range streaming, not a full-file cache. Five real full-file downloads, DOCX/XLSX/PPTX/Markdown previews and PDF pages 1 -> 2 -> 1 were successful on formal8180. Three-page PDF PNG signatures/stable page1 and unchanged cache mtimes verified. Actual browser PDF image 990x1400, browser original PDF download, real MP4 playback/seek and Range/HEAD verified. Local Go/race/architecture/vet/build, 20 Node and nine Python tests pass. Only owned product service restarted. Clean reviewed binary `panta-content-34863813a53f`, SHA-256 `3625b49c028962faacd492642385b6e760897946dced92d3ab3ad700c3116c2c`. Old binary/config/launcher receipt retained for rollback. Query PID, generations 0/1/1, original staging table hashes and unrelated containers unchanged. Schema13, zero new provider starts/native login/scan/Hint/migration/role changes. Issue #83 WIP untouched. CloudSite sharing reviewed as reference only; not built. Source scope is still three configured real read scopes, NOT whole-drive access. ### Previous file-library acceptance - 2026-10-15 Issue #88 / PR #89 ACCEPTED and deployed. Reviewed HEAD `8b7d1c23feabc0a76100d975b1ae9ebe1b4ec16b`, exact-head CI `38673309830` all three jobs SUCCESS, same-agent review `5529290784`, squash merge `963c66d9c0d7735fbf8ae0a8ab0c7a4000d6bb1d`; merge CI `38695548823` SUCCESS. D-045 and [file-library contract](docs/PRODUCT-FILE-LIBRARY.md) freeze TWO UIs: `/` consumer file library, `/admin/` retained administrator directory/diagnostic workspace. Frontend directly composes configured real IndexCore files without per-file approval; folders are traversal details, never user file cards. ADMIN workspace configuration is enforced server-side; no user was escalated. Formal 8180 browser login and six actual file cards verified: five documents and one MP4, no folder/Binding/Copy/schema controls. Category/search/list/detail and USER backend denial verified. Product binary is now accepted `8b7d1c23feab`, SHA-256 `2c7265bb482e763d084243e20886822fdbe31e46133e308a7c420092ae0e6e2c`. Only the owned product UI service restarted; query PID, catalog generations 0/1/1, original staging table hashes and unrelated services unchanged. Rollback receipt/binary retained. Schema13, no provider start, scan, migration, native login or role change. Playback/content/download/share remain unfinished. Resume preserved Issue #83 and subsequent content/access modules; no full MVP claim. ### Previous catalog/lifecycle acceptance - 2026-10-15 Real catalog configuration and owned readonly lifecycle Issue #86 / PR #87 are ACCEPTED: reviewed HEAD `d693878c7791b592fa21668a920abd322df9aa37`, CI `38669580171` all three jobs successful, same-agent review `5527219011`, squash merge `ddecd51c19b7431d9ca3611add3304eea725240a`. See [source/lifecycle contract and actual evidence](docs/PRODUCT-REAL-CATALOG.md). The formal .50 loopback 8180 UI now selects three NEW observation-only DISABLED Bindings over an isolated IndexCore catalog: documents/tutorials (five real files and three directories), one video directory (one real MP4), software (confirmed empty). Browser category/cards/video detail verified on 2026-10-15. These replace the previous one-document default scope; this is not whole-drive coverage. cloudsite queries IndexCore HTTP only, not OpenList or its DB. D-044 excludes file delete UI/API: users delete in their drive, conservative IndexCore rules unchanged. Two enabled user-systemd readonly services survived a controlled graceful restart; full VM reboot recovery has NOT been tested. Pinned original database hashes and unrelated services remain unchanged. Product binary is still reviewed PR #85 `af23cf2746a0`, schema v13; deployment adds reviewed process management and configuration, not new playback/content/access or Copy projection. No provider download, Hint or scheduled scanning is enabled. Admission Issue #83 WIP remains separate and unreviewed; resume that slice before Copy/access/share implementation. ### Previous presentation acceptance - 2026-10-14 User-prioritized readonly resource presentation Issue #84 / PR #85 is ACCEPTED and merged at `0ddf314554cd5b252969e9e1d82a06f9b36469c8`, reviewed HEAD `af23cf2746a0fa3f2266a8d7c95f4a0be550ec6d`; CI `38575852403` all three jobs successful. [Same-agent review](https://github.com/nathanxiangang-web/cloudsite/pull/85#pullrequestreview-5519125136), [display contract](docs/PRODUCT-RESOURCE-DISPLAY.md). The owned .50 readonly UI is updated, schema stays v13. Real Markdown Q4/Q5/card/detail, category/search empty states, logout/relogin and responsive layout were verified. Software/video classification exists; actual current scope has only one document, not the full drive. Content preview/playback/download/share remain unavailable. The VM reboot stopped the prior processes. Only required databases and reviewed readonly query/UI processes were restored; original database hashes and other service states verified unchanged, no real StartDownload/scan/Hint. Old UI binary and configuration remain available for rollback. Admission/usage Issue #83 has unfinished contract/code on a separate branch; it has NOT passed review or been deployed, and its draft v14 migration has not touched any real database. Resume that bounded slice, then Copy projection and authorized real content access; metadata presentation must not replace the remaining minimum MVP capabilities. Issue #81 / PR #82 ACCEPTED and merged at `8b86ae336b8b88b00bb0a9b6ab787695126eb060`; exact HEAD `e82d2fed1fa92ac68702a4189a336f2134f8f61c`, CI `38537678423` all three groups successful. [Acceptance record](https://github.com/nathanxiangang-web/cloudsite/pull/82#issuecomment-6164669005), [readonly module/runbook](docs/PRODUCT-READONLY-UI.md). Browser login, real browse/Q5, owner-only empty tasks and logout/relogin are verified. Next bounded [Issue #83](https://github.com/nathanxiangang-web/cloudsite/issues/83): freeze and implement exact-source admission and zero-price operation usage. It is not implemented yet; download controls remain unavailable. Prior acceptance: auth Issue #77 / PR #78 merged at `eeedd3af242353822c0541cd1e74e48475fe596d`, exact HEAD `95ca01a6cf450b20f4f2e357587cbeb31b84b78a`, CI `38506025321` successful; reads Issue #79 / PR #80 at `574124aa997464eb3305fcc6ce2d5ddcb9ff28f7`, exact HEAD `f8c0607c73cbe640aeec06be0d39c11cd9296bd1`, CI `38507300691` successful. All are bounded module acceptances, not full MVP completion. [Documentation audit](docs/DOCUMENTATION-AUDIT.md) identifies actual defects and recoverable deletions. [Domain ownership](docs/CONTROL-PLANE-DOMAIN.md) and [execution plan](docs/GATE4-IMPLEMENTATION-PLAN.md) distinguish current source from approved future design. Original Gate 4 auth/access/share/usage remains the target. Issues #75/#77/#79/#81/#84 are completed; Issue #83 remains unfinished. Accepted product migration head is v13; original Gate 3.18 cloudsite DB/binary remains v12. On explicit human request for real data, the stopped staging PostgreSQL container was restored and an owned IndexCore read-only component entrypoint started. Original table/provider-history hashes are unchanged, with no writer/scan/Hint/provider start; unrelated services unchanged. No automatic migration or real download occurred. D-042 authorizes later bounded implementation without another user approval; tests/review/CI remain mandatory. Historical data/runtime invariants are preserved. ### Current final acceptance — 2026-10-13 The [Architect final acceptance](https://github.com/nathanxiangang-web/cloudsite/issues/62#issuecomment-6143267673) supersedes all historical C2-B/C3 NO-GO, polling-repair and OPEN pointers below. PR #71 merged at `74e9e69e1dd89944901e1b6a7b2b42c661b897d7`; reviewed exact HEAD `3e61483bae28a96a43faacbf9353e2bad7fb82d6`, CI `38374274046` all three groups SUCCESS. The same original KNOWN task reached **Manifest READY + same Job SUCCEEDED** through the reviewed paired recovery, poll-only provider stage, trusted Hint, exact Q5/Q8 and existing Journal Projector. `result_copy_id` identifies the PRESENT Copy, and its cursor equals Q8 resource-added sequence 1. One resume and one scoped Worker completed under GO `6142455770`; no new source, Manifest, Job, ProviderTask or StartDownload. Claim generation 22 -> 25; failure budget remains 0/max1 and the reference is unchanged. Worker joined, runnable 0, C3 Binding DISABLED and collector permission 0. Eight older unknown reservations stay frozen and other Roots/services are unchanged. Schema v12. See [redacted completion evidence](docs/GATE3.18-COMPLETION.md). No old-task 115 replay or new download is required by the auth slice. D-042 supersedes the former documentation-only handoff; Issue #83 is next. Older sections below are retained chronological evidence, not current authority. ## Accepted baseline - Project name: cloudsite - MVP-first: functionality before UI polish - Team model: one agent performs Architect, Developer and a separate same-agent review pass under D-042; not independent review - OpenList remains inside the primary observation path as an IndexCore-owned collector dependency - cloudsite acquisition does not directly query OpenList for visibility/canonical truth - IndexCore remains an independent canonical physical-resource kernel - cloudsite introduces a separate logical Catalog - Resource identity model: Asset → Release → Variant → Copy - Browse/known-path access must work without search - 115 is the first provider, not the product architecture - 115 cloud download is an MVP core capability - Cloud download/share require product login - Cloud-download result must be handed to the IndexCore-owned OpenList observation pipeline through a trusted scoped Mutation Hint, then canonically confirmed by IndexCore Query/Journal; no cloudsite direct OpenList verification and no full scan - CodeArts CLI is the initial replaceable Agent Runtime - Initial backend implementation baseline: Go 1.27.1 - MVP deployment shape: single-process modular monolith - Product DB: PostgreSQL, kept separate from IndexCore DB - Product schema uses append-only SQL migrations and fail-closed schema compatibility - Applied migration history must be an ordered prefix; history gaps/out-of-order states fail closed - Provider-changing side effects must be represented by a durable Job before execution - Expired RUNNING job leases become RECOVERY_REQUIRED, never blind automatic retry - `docs/AI-ARCHITECTURE-MEMORY.md` is the mandatory compact preflight for AI/Architect sessions; newer accepted Git decisions override old Issue/PR/chat context ## Active gate ### Gate 0 — Skeleton & contracts Status: **ACCEPTED / CLOSED** Goal: Create the smallest compilable/runnable cloudsite skeleton with module boundaries and ports before implementing real 115 behavior. Required outputs: - module/package skeleton; - configuration boundary; - product DB migration mechanism; - provider contracts; - IndexCore integration port; - OpenList integration port; - Job Engine minimum state model; - minimal Asset/Release/Variant/Copy schema; - mock provider; - unit/contract test harness. Acceptance: - core domain compiles/runs without importing the 115 adapter; - mock provider passes provider contract tests; - direct-path flow can be represented without Search; - product DB can be recreated from migrations; - no code writes to IndexCore DB; - architecture docs match actual package dependencies. ## Completed bounded tasks ### Gate 0.1 — Bootstrap Go skeleton and freeze core ports Status: **ACCEPTED** Tracking: GitHub Issue #1 / PR #2 Merged: - squash commit `f1cb51fcd8546002bf05d0b5e7f50dff38365d3c` Accepted scope: - Go module and runnable binary; - initial module/package boundaries; - provider-neutral provider ports; - IndexCore/OpenList ports; - in-memory test doubles and build/test harness; - provider registry identity/capability validation. ### Gate 0.2 — PostgreSQL migrations and minimum Catalog persistence Status: **ACCEPTED** Tracking: GitHub Issue #3 / PR #4 Merged: - squash commit `8d16b9a3692f1f2fb3cab48be6ccbcbacce0646c` Accepted scope: - independent cloudsite PostgreSQL configuration/connection boundary; - pgx/v5 persistence adapter boundary; - ordered embedded append-only SQL migrations; - schema migration checksum/history compatibility; - fail-closed future/modified/gapped/out-of-order migration detection; - minimum Asset / Release / Variant / Copy persistence; - nullable unresolved Copy; - real PostgreSQL round-trip and constraint tests. Known follow-up: - repository CI is not yet present; add before Gate 0 closeout. ## Completed bounded tasks ### Gate 0.3 — Durable Job Engine minimum state and recovery semantics Status: **ACCEPTED** Tracking: GitHub Issue #5 / PR #6 Merged: - squash commit `ebc01317ef3c2b7796e612fb4ae938cf6f18dd66` Accepted scope: - append-only jobs migration; - provider-neutral jobs domain; - durable PostgreSQL job repository/state transitions; - atomic claim and lease ownership; - explicit RETRY_WAIT; - RECOVERY_REQUIRED for expired running leases; - optional product-level idempotency key; - crash/restart persistence evidence. Explicitly deferred: - real worker loop/scheduler; - provider execution; - 115/MCP; - Acquisition Manifest; - provider-specific retry/backoff/recovery; - real IndexCore/OpenList integrations; - auth/usage/search/agent/UI; - job DAG/event/audit system. ### Gate 0.4 — Mock provider conformance, CI, and Gate 0 closeout Status: **ACCEPTED** Tracking: GitHub Issue #7 / PR #8 Merged: - squash commit `e8a9af1b2344a68450de995886e1ebc55347e87c` Accepted scope: - reusable provider-neutral mock provider; - reusable provider contract/conformance suite; - bounded Gate 0 integration acceptance; - automated architecture/import guard; - GitHub CI with PostgreSQL 16; - Gate 0 closeout evidence and documentation. Gate 0 closeout evidence: - GitHub Actions run `36427876203` succeeded; - unit/contract/race/vet/build checks succeeded; - PostgreSQL 16 integration/migration checks succeeded; - no concrete 115 implementation is required by the core runtime/tests. ## Current bounded task ### Gate 1.1 — Storage connection/binding persistence and root mapping Status: **ACCEPTED** Tracking: GitHub Issue #9 / PR #10 Merged: - squash commit `84dd7223c2f12dcd50f7da32f698218c9df7cfa3` Accepted scope: - append-only StorageConnection / StorageBinding migration; - provider-neutral storage mapping domain; - PostgreSQL persistence; - OpenList mount-path normalization; - unique canonical IndexCore-root mapping; - real PostgreSQL constraint/round-trip tests. ## Current bounded task ### Gate 1.2 — Typed IndexCore HTTP read client and query contract alignment Status: **ACCEPTED** Tracking: GitHub Issue #11 / PR #12 Merged: - squash commit `0cd355a7917e522c24ccee62be949406d955c492` Scope: - refine cloudsite-owned IndexCore query contracts to match Q4/Q5/Q8/Q9 semantics; - typed server-side HTTP client; - Q4 parent hierarchy + opaque cursor; - Q5 all matches + ambiguity; - Q8 exact per-root after_seq Journal reads; - Q9 root status; - typed remote/transport/malformed-response errors; - httptest contract coverage. Explicitly deferred: - Journal cursor persistence; - Catalog Projector / Copy projection; - real OpenList client; - Mutation Hint/scoped refresh; - 115/MCP; - auth/search/agent/UI. ## Current bounded task ### Gate 1.3 — Durable Journal cursor and idempotent unresolved Copy projector Status: **ACCEPTED** Tracking: GitHub Issue #13 / PR #14 Merged: - squash commit `5bcffae7ab24ec8a7fd42d48cdd6ee11e4876e87` Scope: - per-StorageBinding durable Journal cursor; - one-shot ProjectOnce application service; - resource Journal events -> unresolved Copy PRESENT/REMOVED state; - atomic Copy mutations + cursor advancement; - cursor concurrency/fencing; - copies.storage_binding_id FK hardening; - restart/idempotency/rollback PostgreSQL evidence. Explicitly deferred: - continuous polling/daemon; - OpenList HTTP client/visibility verification; - Mutation Hint/scoped refresh; - Asset/Release/Variant classification; - 115/MCP; - auth/search/agent/API/UI. ## Current bounded task ### Gate 1.4 — Controlled OpenList → IndexCore → cloudsite observation E2E and Gate 1 closeout Status: **ACCEPTED** Tracking: GitHub Issue #15 / PR #16 Merged: - squash commit `607debaacc417ac6a71bf7f72c12676b1a3c47ce` Pinned external integration: - IndexCore v0.4.0-alpha.1 - commit `6f0eec85c59bd8cbe55011b0d9e512e0cafd6615` Scope: - test-only OpenList-compatible controlled fixture; - real external IndexCore OpenList Collector / Canonical / Journal path; - real cloudsite Q4/Q5/Q8 client and PostgreSQL projector; - direct known-path acceptance without Search; - repeat-idempotency and additive-change evidence; - GitHub Actions observation E2E; - Gate 1 documentation/CI closeout. Explicitly deferred: - production cloudsite OpenList scanner; - post-download visibility verifier; - Mutation Hint/scoped refresh; - continuous Journal polling; - 115/MCP/acquisition; - classification/search/auth/share/agent/API/UI. Gate 1 closeout evidence: - PR #16 architect review: ACCEPTED; - GitHub Actions run `36518514268` fully green; - PostgreSQL 18 controlled OpenList observation E2E passed; - pinned IndexCore commit `6f0eec85c59bd8cbe55011b0d9e512e0cafd6615`; - initial observation, identical NOOP repeat, and additive change all passed; - direct Q5 known-path flow requires no Search; - IndexCore and cloudsite databases remain separate. ## Current bounded task ### Gate 2.1 — Logical Catalog hierarchy read model and explicit absence semantics Status: **ACCEPTED** Tracking: GitHub Issue #17 / PR #18 Merged: - squash commit `fe4342d2252689c665008801259fd081eaabe533` Acceptance evidence: - GitHub Actions run `36526195429` fully green; - deterministic Asset → Release → Variant → Copy hierarchy reads; - explicit missing-entity and ownership-mismatch semantics; - unresolved Copies remain outside the logical hierarchy; - Gate 1 controlled observation E2E remains green. Scope: - Catalog hierarchy reads for Asset → Release → Variant → Copy; - deterministic child listing; - resourceview logical composition service; - explicit Asset/Release/Variant absence and ownership mismatch semantics; - derived PRESENT-Copy availability; - unresolved Copy remains unresolved and outside logical hierarchy; - no Search dependency. Explicitly deferred: - unresolved Copy classification/binding writes; - IndexCore Q3 physical enrichment; - Search/FTS; - public API/UI; - 115 acquisition / Mutation Hint; - auth/quota/share; - Agent. ## Current bounded task ### Gate 2.2 — Physical resource view with optional Catalog attachment Status: **ACCEPTED** Tracking: GitHub Issue #19 / PR #20 Merged: - squash commit `60467b113dab6e54e321cfd4b09173e6395c5017` Acceptance evidence: - GitHub Actions run `36542613715` fully green; - physical-only resources remain usable without Catalog Copy; - unresolved Copy remains usable without forced classification; - classified lineage is attached only when complete and consistent; - Q5 ambiguity and candidate ordering are preserved; - IndexCore presence and Copy availability remain independent facts. Scope: - known root/path resolves through IndexCore Q5; - preserve zero/one/multiple matches and Q5 ambiguity; - optional Copy lookup by canonical physical identity; - explicit PHYSICAL_ONLY / UNRESOLVED_COPY / CLASSIFIED states; - classified lineage validation through Variant → Release → Asset; - IndexCore presence remains canonical and separate from Copy availability; - no Search dependency. Explicitly deferred: - unresolved Copy classification/binding writes; - identity creation from physical resources; - Agent classification; - Search/FTS; - OpenList/provider access; - public API/UI; - acquisition / Mutation Hint / scoped refresh; - reconciliation worker. ## Current bounded task ### Gate 2.3 — Explicit unresolved Copy → Variant binding with concurrency-safe monotonic semantics Status: **ACCEPTED** Tracking: GitHub Issue #21 / PR #22 Merged: - squash commit `2aa7469f4f40fe274e715541d8b36961b917b068` Acceptance evidence: - GitHub Actions run `36545963720` fully green; - real PostgreSQL row-lock serialization proves one winner for different-target competition; - same-target concurrent replay is idempotent; - CopyID / physical identity / StorageBinding / availability / created_at are preserved; - ProjectionStore availability updates preserve classification. Scope: - bind an existing unresolved Copy to an existing Variant; - same-target replay is idempotent; - different-target rebind fails closed; - concurrency-safe one-winner semantics; - preserve CopyID, physical identity, StorageBinding, availability and created_at; - projector availability updates preserve VariantID. Explicitly deferred: - automatic/Agent classification; - reclassification/correction workflow; - bulk classification; - Search/FTS; - Q3 enrichment; - public API/UI; - acquisition / 115 / Mutation Hint; - auth/quota/share. ## Gate 2 closeout Status: **ACCEPTED / CLOSED** Gate 2 acceptance is satisfied without a synthetic Gate 2.4: - one Asset can have multiple Releases; - one Release can have multiple Variants; - one Variant can have multiple Copies; - logical hierarchy reads are deterministic and ownership-safe; - known-path physical resources remain usable without classification; - Q5 ambiguity is preserved; - unresolved Copy classification is explicit, monotonic, idempotent and concurrency-safe; - Search remains optional and is not required for direct-path or Catalog identity flows. ## Current bounded task ### Gate 3.1 — Durable Acquisition Manifest and validated target intent Status: **ACCEPTED** Tracking: GitHub Issue #23 / PR #24 Merged: - squash commit `6637b695386ecd9976921242ff60c8983b0e6dad` Acceptance evidence: - GitHub Actions run `36549876927` fully green; - migration history compatible at version 5; - real PostgreSQL Manifest round-trip and FK/constraint evidence passed; - source intent remains opaque and provider-neutral; - active StorageBinding and optional logical lineage are validated; - no provider/OpenList/IndexCore/Job execution side effect was introduced. Scope: - append-only Acquisition Manifest persistence; - provider-neutral source intent; - validated active StorageBinding target; - normalized target path; - optional existing Asset / Release / Variant association; - nullable future user linkage and Job linkage; - creation starts at PENDING only; - no provider execution. Explicitly deferred: - real 115 adapter; - DownloaderProvider execution; - Source Resolver / magnet parsing; - durable Job submission / worker loop; - provider task references; - OpenList visibility verifier; - Mutation Hint / scoped refresh; - canonical READY orchestration; - auth enforcement / usage / API/UI. ## Current bounded task ### Gate 3.2 — Atomic Manifest activation and durable Acquisition Job linkage Status: **ACCEPTED** Tracking: GitHub Issue #25 / PR #26 Merged: - squash commit `aaa1b0f90dfc6bf4c616ad396321dbf1694a7aab` Acceptance evidence: - Round 2 closed the pre-linked PENDING Manifest bypass; - CreateManifest always produces PENDING + job_id NULL; - append-only migration 0006 enforces PENDING/ACTIVE Job-link invariants; - atomic activation creates exactly one QUEUED ACQUISITION Job and ACTIVE linkage; - replay/concurrency converge to one durable Job; - forced post-Job-insert failure rolls back both records; - GitHub Actions run `36555568078` fully green; - migration history compatible at version 6. Scope: - one atomic PostgreSQL activation transaction; - PENDING Manifest → ACTIVE; - create/link exactly one generic QUEUED ACQUISITION Job; - minimal versioned Job payload references manifest_id only; - deterministic Manifest-scoped Job idempotency; - replay returns existing durable linkage; - concurrent activation cannot create orphan/duplicate Jobs; - forced transaction failure rolls back both Manifest activation and Job creation. Explicitly deferred: - Job worker/provider execution; - 115 adapter / DownloaderProvider calls; - provider task references; - Source Resolver / magnet parsing; - OpenList visibility verification; - Mutation Hint / scoped refresh; - canonical confirmation and later Manifest transitions; - auth/quota/API/UI. ## Current bounded task ### Gate 3.3 — Provider target mapping and side-effect-free acquisition execution input Status: **ACCEPTED** Tracking: GitHub Issue #27 / PR #28 Merged: - squash commit `592596acca7ab7b7916de51bad0bc6689d9b0733` Acceptance evidence: - explicit provider_scope is independent from OpenList mount and IndexCore root; - observation-only bindings remain valid with provider_scope NULL; - acquisition requires ACTIVE binding + ACTIVE connection + explicit provider scope; - ACTIVE Manifest resolves exactly to provider-neutral DownloadRequest; - source_ref/provider_scope remain opaque and unchanged; - no provider registry lookup/provider call/OpenList/IndexCore side effect; - GitHub Actions run `36598697218` fully green; - migration history compatible at version 7. Scope: - append-only nullable StorageBinding.provider_scope; - preserve observation-only bindings without provider scope; - acquisition targets require explicit provider scope; - active StorageBinding + active StorageConnection validation; - StorageConnection.provider_type is the future ProviderID; - side-effect-free ACTIVE Manifest → provider-neutral DownloadRequest resolution; - source_ref remains opaque and unchanged; - no provider registry lookup or provider call. Explicitly deferred: - provider registry selection; - DownloaderProvider execution; - provider task persistence; - real 115 adapter; - Source Resolver / magnet normalization; - Job worker loop; - OpenList visibility verifier; - Mutation Hint / scoped refresh; - canonical confirmation / READY; - auth/quota/API/UI. ## Current bounded task ### Gate 3.4 — Durable provider-task linkage and restart-safe downloader execution step Status: **ACCEPTED** Tracking: GitHub Issue #29 / PR #30 Merged: - squash commit `1f99a6e2123e48be28ea387d2fe4fc69cf8e14f7` Acceptance evidence: - provider-task linkage is durable and provider-neutral; - START_RESERVED side-effect fence is persisted before StartDownload; - retry/restart/concurrent execution cannot create a second provider task; - REFERENCE_KNOWN replay polls the exact durable reference; - provider task lifecycle remains provider-owned; - provider success is not READY; - real registry.Registry satisfies the acquisition provider lookup contract; - real registry + testprovider + ExecutionStepService composition is proven; - GitHub Actions run `36606009751` fully green; - migration history compatible at version 9. Scope: - durable provider-neutral provider-task linkage; - provider registry lookup at the application boundary; - one-shot DownloaderProvider StartDownload / DownloadStatus execution step; - existing durable task is always polled, never recreated; - provider task state maps to provider-neutral execution outcomes only; - provider success is not READY; - uncertain side effect after successful StartDownload but failed persistence fails closed; - restart/replay must not duplicate external provider tasks. Explicitly deferred: - real 115 adapter; - Source Resolver / magnet normalization; - worker polling loop; - Manifest transition to AWAITING_VISIBILITY; - OpenList visibility verifier; - Mutation Hint / scoped refresh; - canonical confirmation / READY; - auth/quota/API/UI. ## Current bounded task ### Gate 3.5 — Connection-scoped downloader session and credential boundary Status: **ACCEPTED** Tracking: GitHub Issue #31 / PR #32 Merged: - squash commit `54a5df99fa5d81df4661d0b8c56888fbe03cac6e` Acceptance evidence: - provider execution resolves by ProviderID + ConnectionID + opaque CredentialRef; - the same ProviderID can back multiple StorageConnections with distinct downloader sessions; - connection/credential mismatch fails closed before provider calls; - contracts.SecretResolver freezes the opaque secret lookup boundary; - secret contents remain outside Manifest, Job payload, and provider-task persistence; - provider adapters do not query cloudsite persistence for credentials; - all Gate 3.4 side-effect fencing remains intact; - GitHub Actions run `36608071506` fully green; - no migration change; schema remains version 9. Scope: - distinguish ProviderID from StorageConnection session identity; - resolve downloader by ProviderID + ConnectionID + opaque CredentialRef; - allow multiple StorageConnections for the same provider implementation; - fail closed on connection/credential mismatch; - keep secret contents outside Manifest/Job/provider-task persistence; - freeze a narrow secret-resolution port for later concrete provider composition; - preserve all Gate 3.4 side-effect fencing semantics. Explicitly deferred: - real 115 adapter / 115driver dependency; - real secret backend; - Source Resolver normalization; - worker loop; - AWAITING_VISIBILITY transition; - OpenList visibility verifier; - Mutation Hint / scoped refresh; - canonical confirmation / READY; - auth/quota/API/UI. ## Current bounded task ### Gate 3.6 — Concrete 115 Downloader adapter on pinned 115driver Status: **ACCEPTED** Tracking: GitHub Issue #33 / PR #34 Merged: - squash commit `a8d9bf806bd12a8299b9974dfdcc4535be7046f6` Acceptance evidence: - concrete provider isolated in `internal/providers/115`; - `github.com/SheltonZhu/115driver` pinned to `v1.3.5`; - exact URI + Target.Scope(saveDirID) + info_hash mapping; - Source.Value is not normalized/truncated; - bounded exact-hash status polling; - 115 status 0/1/2/-1 maps to provider Pending/Running/Succeeded/Failed only; - cancel deletes task only with `deleteFiles=false`; - provider success remains distinct from cloudsite READY; - GitHub Actions run `36610303120` fully green; - no migration change; schema remains version 9. Scope: - add isolated concrete `internal/providers/115` DownloaderProvider; - pin `github.com/SheltonZhu/115driver v1.3.5`; - cookie secret bytes -> 115driver credential/client construction without network login check; - StartDownload maps exact URI + Target.Scope saveDirID to one 115 offline task; - TaskReference is exact 115 info_hash; - DownloadStatus performs bounded info_hash lookup and maps 115 status 0/1/2/-1; - CancelDownload removes task only with deleteFiles=false; - preserve exact source bytes; no source normalization/truncation; - adapter remains isolated from acquisition/jobs/store/OpenList/IndexCore/session implementation. Explicitly deferred: - Source Resolver normalization / magnet rewriting; - worker loop; - AWAITING_VISIBILITY transition; - OpenList visibility verifier; - Mutation Hint / scoped refresh; - canonical confirmation / READY; - live 115 credentials as a CI requirement; - 115 ShareProvider; - auth/quota/API/UI. ## Current bounded task ### Gate 3.7 — Atomic provider-stage outcome handoff to Manifest + Job Status: **ACCEPTED** Tracking: GitHub Issue #35 / PR #36 Merged: - squash commit `19121d5b3312cad9ee97155fe5204556a662c89d` Acceptance evidence: - provider-stage outcome commits Manifest + linked Job in one PostgreSQL transaction; - PROVIDER_IN_PROGRESS -> ACTIVE + RETRY_WAIT; - PROVIDER_SUCCEEDED -> AWAITING_VISIBILITY + RETRY_WAIT on the same ACQUISITION Job; - provider failure/cancel/recovery mappings are atomic and replay-safe; - provider success never marks Job SUCCEEDED or Manifest READY; - exact replay returns Changed=false, including PROVIDER_IN_PROGRESS; - claim generation and failure retry budget are separate; - repeated stage polling does not consume failure budget; - stale claim generations remain fenced; - v9 -> v10 migration preserves legacy claim generation and resets the new failure counter; - GitHub Actions run `36657549476` fully green; - migration history compatible at version 10. Scope: - atomic provider-stage Manifest + Job outcome persistence; - database-time lease fencing; - idempotent exact replay and fail-closed conflicting replay; - one ACQUISITION Job spans provider and later visibility/canonical stages; - claim generation separated from bounded failure retry budget. Explicitly deferred: - worker/claim loop; - polling cadence policy; - Source Resolver; - OpenList visibility verifier; - Mutation Hint / scoped refresh; - AWAITING_CANONICAL / READY; - API/UI. ## Current bounded task ### Gate 3.8 — IndexCore trusted Mutation Hint and observation handoff Status: **ACCEPTED** Tracking: GitHub Issue #39 / PR #40 Merged: - squash commit `9de14ab89ce3f7822fae927d68e09711adc24eb7` Acceptance evidence: - production `internal/app.HintPort` composes the real IndexCore Hint client into the acquisition-owned port; - Hint transport remains literal-loopback-only and never follows redirects; - exact D-029 root/scope/reason mapping; - no production cloudsite -> OpenList acquisition verification path; - 202 Accepted remains non-canonical and never READY; - accepted Hint atomically commits AWAITING_CANONICAL + RETRY_WAIT on the same Job; - at-least-once Hint resend is safe before cloudsite commit and stops after durable handoff; - GitHub Actions run `36665857635` fully green; - no migration change; schema remains version 10. Correction: - Issue #37 was closed NOT PLANNED because direct cloudsite -> OpenList acquisition verification violates D-018/D-015. - D-029 supersedes D-028 for acquisition verification. - cloudsite does not directly inspect OpenList in the acquisition path. - This correction is also frozen in `docs/AI-ARCHITECTURE-MEMORY.md`, `PROJECT-CONTEXT.md`, and `docs/MVP-BLUEPRINT.md`. Scope: - implement the cloudsite-owned typed client for IndexCore's accepted trusted Mutation Hint transport; - exact Hint mapping: root_id = StorageBinding.indexcore_root_id, scope_key = Manifest.target_path, reason = POSSIBLE_CHANGE; - preserve IndexCore's loopback-only Bearer-authenticated Hint trust boundary; - require AWAITING_VISIBILITY Manifest + exact linked fenced ACQUISITION Job; - accepted Hint atomically hands the same Job to Manifest AWAITING_CANONICAL + Job RETRY_WAIT; - Hint acceptance remains non-canonical and never READY; - duplicate Hint after a lost cloudsite commit is allowed under IndexCore's at-least-once/coalescing semantics; - no direct cloudsite OpenList HTTP/API/database access. Explicitly deferred: - acquisition result locator capture; - Q5/Journal canonical confirmation; - Copy/Projector completion orchestration; - READY transition; - acquisition worker loop; - public API/UI. ## Current bounded task ### Gate 3.9 — Durable acquisition result locator before canonical confirmation Status: **ACCEPTED** Tracking: GitHub Issue #42 / PR #43 Merged: - squash commit `784435d855c3c038131c94d3bebf59e3a9a97f15` Acceptance evidence: - separate immutable Manifest.result_name added via migration v11; - expected_name remains request intent/fallback and is never rewritten by provider execution; - valid provider ResultName takes precedence over ExpectedName; - blank provider name permits only a promotable direct-child ExpectedName fallback; - malformed nonblank provider name fails closed; - result_name + AWAITING_VISIBILITY + RETRY_WAIT commit atomically; - same result_name replay is idempotent and different-value replay fails closed; - 115 FileId/DirId remain provider-private; - Gate 3.8 root/scope-only Hint semantics remain unchanged; - GitHub Actions run `36675499153` fully green; - migration history compatible at version 11. Scope: - extend provider-neutral TaskStatus with optional ResultName; - map pinned 115 OfflineTask.Name only, without fabricating from provider IDs/paths; - carry result name through the bounded ExecutionStep result; - add durable immutable Manifest.result_name via migration v11; - provider success resolves result_name from provider-observed name first, ExpectedName fallback second; - missing result identity blocks automatic AWAITING_VISIBILITY progression and requires recovery; - provider success atomically persists result_name + AWAITING_VISIBILITY + RETRY_WAIT; - no Q5/Journal/OpenList/READY work in this Gate. Explicitly deferred: - exact IndexCore canonical confirmation; - Copy/Projector completion + optional Variant binding; - READY / Job SUCCEEDED finalization; - acquisition worker loop; - public API/UI. ## Planned Gate 0 task sequence - Gate 0.1 — Skeleton + first ports — **ACCEPTED** - Gate 0.2 — Product DB migrations + Asset/Release/Variant/Copy minimum persistence — **ACCEPTED** - Gate 0.3 — Job Engine minimum durable state model — **ACCEPTED** - Gate 0.4 — Mock provider + contract test completion + Gate 0 integration acceptance — **ACCEPTED** The sequence may be refined by an architect decision, but later tasks must not be pulled into an earlier PR without updating project state. ## Gate 1 bounded task sequence - Gate 1.1 — StorageConnection / StorageBinding persistence — **ACCEPTED** - Gate 1.2 — Typed IndexCore HTTP read client (Q4/Q5/Q8/Q9) — **ACCEPTED** - Gate 1.3 — Journal cursor persistence + idempotent unresolved Copy projector — **ACCEPTED** - Gate 1.4 — Controlled OpenList → IndexCore → cloudsite observation integration + Gate 1 closeout — **ACCEPTED** ## Planned project sequence - Gate 0 — Skeleton & contracts — **ACCEPTED** - Gate 1 — Observation plane: OpenList → IndexCore → Catalog — **ACCEPTED / CLOSED** - Gate 2 — Resource semantics & direct-path/catalog read flows — **ACCEPTED / CLOSED** - Gate 3 — 115 acquisition + fast IndexCore synchronization — **ACCEPTED / CLOSED** - Gate 4 — Login + share/access + usage accounting - Gate 5 — Constrained CodeArts agent integration - Gate 6 — Provider-replacement proof + MVP closeout ## Not authorized yet Until the relevant gate is accepted, do not implement: - complex UI; - payment; - recommendation system; - Elasticsearch; - vector database; - Kafka / distributed queues; - microservice split; - multi-tenant enterprise permissions; - generalized workflow editor; - autonomous agent control plane. ## Next architect action Finish the documentation audit and validated merge, then implement the frozen Stage 1 auth/session contract under D-042. Record later bounded choices and actual evidence before advancing; preserve historical uncertain reservations. ## Current bounded task ### Gate 3.10 — Canonical confirmation, projected Copy, and READY finalization Status: **ACCEPTED** Tracking: GitHub Issue #44 / PR #45 Merged: - reviewed head `2f8f862eb17ffd1ea5238cba292873e77662c276`; - squash commit `d211323e7dc30922d9796f57fad611f44b825fe2`. Acceptance evidence: - exact IndexCore Q5 candidate + ambiguity fail closed; - existing Q8 Journal Projector owns Copy creation/availability, one bounded page per invocation; - exact PRESENT Copy by canonical root/resource/binding; - optional monotonic Variant binding joins the same PostgreSQL DB-time lease-fenced finalization transaction; - locked Manifest/Job/Copy cross-check prevents replay-only plans from advancing fresh READY and prevents mismatched Binding/Variant; - immutable result_copy_id + Manifest READY + same Job SUCCEEDED commit atomically; - READY exact replay independent of later Binding state, no external calls; - schema v12, nullable result_copy_id, no default/backfill, historical upgrade-compatible; - Architect Round 3 ACCEPTED (review `5364884446`); - exact-head CI `36701499525` all three groups SUCCESS. Scope: - build exact canonical candidate path from target_path + result_name; - use IndexCore Q5 with default PRESENT visibility and preserve ambiguity; - treat zero matches / not-yet-projected Copy as normal pending RETRY_WAIT; - advance the existing Q8 Journal Projector by at most one bounded page; - require the exact PRESENT Copy by root/resource/binding; - optionally bind the exact Copy to Manifest.variant_id using existing monotonic classification; - add durable Manifest.result_copy_id via migration v12; - atomically finalize result_copy_id + Manifest READY + same Job SUCCEEDED; - no direct Copy creation from acquisition. Explicitly deferred: - continuous acquisition worker/scheduler; - Source Resolver normalization; - auth/quota/share/access; - Agent; - public API/UI. ## Current bounded task ### Gate 3.11 — One-claim acquisition stage dispatcher and controlled end-to-end orchestration Status: **ACCEPTED** Tracking: GitHub Issue #46 / PR #47 Merged: - reviewed exact head `dab48f476afe2e382bad7dddbb4c0f113b7789a9`; - squash commit `e20d6813970c61951b10dc841fd1b020880e93f5`. Acceptance evidence: - one persisted Manifest-selected stage per claimed ACQUISITION Job; - closed provider outcome translation, exact result_name propagation and D-026 durable handoff; - trusted IndexCore Hint and canonical Q5/Projector/Copy/READY boundaries preserved; - same Job across independently claimed provider, visibility, canonical pending and READY stages, generation increases while FailureCount remains stable; - provider START_RESERVED→StartDownload error/invalid reference is marked uncertain on the first real execution and atomically enters RECOVERY_REQUIRED; - PostgreSQL multi-claim and real ExecutionStep side-effect uncertainty tests confirm terminal replay and no duplicate StartDownload; - Architect Round 2 ACCEPTED (review `5365521883`); - exact-head CI run `36708061685` all three jobs SUCCESS; - schema unchanged at version 12. Governing decision: D-034. Scope: - one already-claimed ACQUISITION Job + current claim generation; - choose exactly one step from persisted Manifest: ACTIVE provider/outcome, AWAITING_VISIBILITY Hint, AWAITING_CANONICAL canonical confirmation; - retain existing DB-time-fenced stores, START_RESERVED provider side-effect boundary, IndexCore-owned OpenList observation, D-017 Projector ownership, D-033 READY rules; - no same-claim chaining to the next stage; - explicit terminal/recovery and inconsistent-state fail-closed results; - controlled PostgreSQL multi-claim/restart tests prove the same Job progresses across the stages without duplicate StartDownload or failure-budget consumption; - no new schema migration planned. Explicitly deferred: - automatic ClaimNext loop / worker daemon / process deployment; - Source Resolver normalization, auth/quota/share/access; - public API/UI, Agent and Search-dependent behavior. ## Current bounded task ### Gate 3.12 — Acquisition-only Job claim and atomic expired-lease recovery Status: **ACCEPTED** Tracking: GitHub Issue #48 / PR #49 Merged: - exact reviewed head `1740567391fbeb746520053446a3915897a8bf1c`; - squash commit `2df41b8edfcacc606d8403130bba2ac4657378f3`. Acceptance evidence: - ClaimNextByType atomically restricts to ACQUISITION; mixed-type and concurrent one-winner claims verified; - PostgreSQL DB-time expired RUNNING lease recovery locks Manifest before Job and rechecks exact versioned payload/link/states; - Manifest + Job both atomically become RECOVERY_REQUIRED or remain unchanged; - corrupted links return typed recovery debt and do not fabricate states; - provider START_RESERVED/REFERENCE_KNOWN, result locator, ClaimAttempts and FailureCount unchanged; - generic expired lease sweep explicitly excludes ACQUISITION; - PostgreSQL concurrency/rollback/replay/malformed-link tests all green; - Architect review `5366250277` ACCEPTED; - exact-head CI `36712927240` all three groups SUCCESS; - schema unchanged at v12. Governing decision: D-035. Scope: - acquire only ACQUISITION jobs through an atomic type-filtered ClaimNext capability; - atomically recover an expired RUNNING linked Acquisition Manifest + Job, using database time and accepted Manifest→Job lock order; - prevent the generic Job recovery sweep from creating an inconsistent acquisition pair; - preserve side-effect reservation, result identity, ClaimAttempts and FailureCount; - use PostgreSQL concurrency/rollback/restart evidence and full existing regression; - no new schema version expected. Explicitly deferred: - continuous worker / ClaimNext scheduler / process wiring; - real provider credentials/deployment/periodic cadence; - Source Resolver, auth/quota/share/access, Agent, public API/UI. ## Current bounded task ### Gate 3.13 — Bounded one-shot acquisition runner and recovery integration Status: **ACCEPTED** Tracking: GitHub Issue #50 / PR #51 Merged: - exact reviewed head `23b6098f8c8a59d55ba7834ad41b96ee6724aeaa`; - squash commit `115146c2163d218c968e72b9741bb46ec24202c3`. Acceptance evidence: - RunOnce performs bounded D-035 linked recovery before type-scoped ClaimNextByType(ACQUISITION) and at most one D-034 StageDispatcher; - returns typed IDLE, RECOVERY_ONLY, STAGE_COMPLETED and typed recovery/claim/lease/stage/cancel errors; - recovery debt blocks claiming and surfaces partial recovered count; - passes actual JobID/LeaseOwner/ClaimAttempts, normal pending does not consume FailureCount; - Stage errors never cause Job-only Fail/Succeed/RetryAt mutations; - real PostgreSQL evidence for two separate one-stage ticks, post-reservation provider recovery, corrupt-linked debt, and stage-error→expired linked recovery; - Architect review `5366932699` ACCEPTED; - exact-head CI run `36720788572` all three jobs SUCCESS; - schema unchanged at v12. Governing decision: D-036. Scope: - one explicit RunOnce invocation: bounded acquisition pair recovery → at most one ClaimNextByType(ACQUISITION) → at most one D-034 StageDispatcher invocation; - stop claiming on corrupt-link recovery debt or recovery store error; - exact owner/ClaimAttempts handoff, truthful IDLE / RECOVERY / STAGE results, no blind Job-only error transitions; - real PostgreSQL controlled integration with terminal replay, pending and recovery cases; - no new migrations planned (schema remains v12). Explicitly deferred: - autonomous worker loop/timers/process wiring/deployment; - credential config and live 115/IndexCore runtime; - Source Resolver, auth/quota/share/access, Agent, public API/UI. ## Current bounded task ### Gate 3.14 — Opt-in serial acquisition worker lifecycle and bounded scheduling Status: **ACCEPTED** Tracking: GitHub Issue #52 / PR #53 Merge evidence: - reviewed HEAD `89e3d202703dbd082600a1f48157feb69c19562b`; - squash commit `f2759f37cb8fc8a96508aa36e604ac0eaf6a5bf8`; - Architect Review `5367757918` ACCEPTED; - exact-head CI `36729766059`: unit/architecture/race/vet/build, PG16 migrations/integration, PG18 controlled observation all SUCCESS. Accepted boundaries: disabled-by-default worker, enabled-unwired startup fails closed, stable unique random worker owner, serial immediate RunOnce + interruptible bounded interval, timeout/lease margin, paced transient error, fatal recovery debt, safe cancellation, post-cancel START_RESERVED plus paired recovery. No live 115/IndexCore/PG runtime composition yet; no new migrations, schema v12. Governing decision: D-037. Scope: - run D-036 RunOnce repeatedly through one sequential, controlled lifecycle without overlapping ticks; - worker disabled by default; opt-in startup fails closed if dependencies are missing; - validate worker owner uniqueness, bounded tick interval and deadline/lease safety policy; - observable transient errors with paced retries; fatal recovery-debt stop; - graceful cancellation and no extra claims after shutdown; - controlled PostgreSQL and regression tests; no new migration expected. Explicitly deferred: - real production PostgreSQL/IndexCore/115 secret session composition and deployment; - public API/UI, Source Resolver, share/auth/quota/access, Agent; - distributed scheduling or multiple worker concurrency. ## Current bounded task ### Gate 3.15 — Fail-closed runtime composition and controlled real-protocol acquisition E2E Status: **ACCEPTED** Tracking: GitHub Issue #54 / PR #55 Merge evidence: - reviewed HEAD `55442628d3b95f19cbaa48125f9ec37ea76ecde4`; - squash commit `d1351ccba8cfd03a33e3175ad38462f2f12cb4b6`; - Architect Review `5368761583` ACCEPTED; - exact-head CI `36739873694` all three jobs SUCCESS, including explicit PostgreSQL 16 controlled runtime E2E. Acceptance: one fail-closed cloudsite PostgreSQL v12/IndexCore read+trusted Hint/115 session registry/Journal Projector/RunOnce/Worker graph; external injected CredentialRef-bound credentials, redacted startup failures; ACTIVE session inventory before any claim; controlled HTTP protocol E2E provider→Hint→Q5/Q8→exact Copy→READY and failure/cancellation tests. No real 115 account contact and no deployment. Governing decision: D-038. Scope: - compose and validate one complete cloudsite product DB/repository/IndexCore read and trusted Hint/provider-session/Projector/RunOnce/Worker runtime graph; - secrets injected through external port, exact provider/connection/credential binding; no credential persistence or logs; - startup checks cloudsite schema v12 and fails closed on missing dependencies; owned resources close on cancellation; - controlled PostgreSQL + HTTP-fake E2E shows provider → Hint → canonical Q5/Journal/Copy → READY; - no new schema migration planned. Deferred: real 115 account login, production deployment, Source Resolver, public API/UI and distributed scheduling. ## Current bounded task ### Gate 3.16 — Protected operator bootstrap, read-only preflight and explicit acquisition worker startup Status: **ACCEPTED** Tracking: GitHub Issue #56 / PR #57 Merged: - reviewed exact HEAD `6a5406d4f937528f4b363035764864c1d1b07812`; - squash commit `88a413513a38b1fd08dbfc2755887b6fc22010eb`; - Architect acceptance comment `5918865491`; - exact-head CI run `36745763304` all three jobs SUCCESS; - schema unchanged at v12. Acceptance evidence: - ordinary CLI remains side-effect-free; operator modes reject raw credential/token CLI arguments; - protected Linux secret/config mount validates owner, permissions, traversal/symlink/race-sensitive file identity and bounded content; - read-only preflight constructs/closes the D-038 graph without Run, ClaimNext, Hint, IndexCore read or provider mutation; - explicit start reuses the D-037 serial worker, blocks in-process double start, handles SIGINT/SIGTERM and closes owned DB resources after Run returns; - controlled PG16/local HTTP E2E proves provider → Hint → Q5/Q8 Projector → exact Copy → READY only in explicit start; PG18 observation regression remains green; - no real 115 account action, direct OpenList acquisition verifier, schema migration, API/UI or deployment was introduced. Governing decision: D-039. Deferred: real 115 account download/external acceptance, deployment/image/HA, Source Resolver, API/UI, auth/quota/share, and Agent. ## Current bounded task ### Gate 3.17 — Deterministic Source Resolver and acquisition submission boundary Status: **ACCEPTED** Tracking: GitHub Issue #58 / PR #59 Merged: - reviewed exact HEAD `6bf5e823a4035a36fa2d994a4e161ce5675529f7`; - squash commit `f567b9061e07cd2750acc429a5f9d08e3d0459e7`; - Architect acceptance comment `5919442131`; - exact-head CI run `36774601575` all three jobs SUCCESS; - post-merge main run `36775002649` SUCCESS; - schema unchanged at v12. Acceptance evidence: - deterministic magnet/http/https/ed2k classification with exact source-value preservation and no network IO; - HTTP(S) userinfo/malformed source rejection and no provider-specific source rewriting; - bounded SubmissionService reuses Manifest creation + ActivationService with stable IDs and linked ACQUISITION idempotency; - activation rollback leaves visible PENDING intent and zero half-created Jobs; retry/replay is deterministic; - PostgreSQL integration proves Manifest.source_ref reaches ExecutionInput unchanged; - protected-file CLI is enqueue-only, does not load provider credentials/start the worker, and redacts source values; - no schema migration, API/UI, real provider/OpenList/IndexCore mutation, Agent or deployment change. Governing decision: D-040. ## Current bounded task ### Gate 3.18 — Human-authorized real 115 + OpenList + IndexCore staging E2E Status: **ACCEPTED / CLOSED — REAL PHASE B COMPLETE, 2026-10-13** Tracking: GitHub Issue #60 / diagnostic and staging Issue #62 / docs synchronization Issue #66 Current checkpoint: the [real execution report](https://github.com/nathanxiangang-web/cloudsite/issues/62#issuecomment-6143257082) and [Architect final acceptance](https://github.com/nathanxiangang-web/cloudsite/issues/62#issuecomment-6143267673) prove original provider task SUCCESS -> Hint -> Q5 PRESENT -> Q8 sequence 1 -> PRESENT Copy/cursor 1 -> `result_copy_id` + READY + same Job SUCCEEDED. PR #71 supplies reviewed paired recovery and poll-only continuation; no new download was created. Eight historical unknown reservations remain frozen. Final Worker/runnable counts are 0, Binding DISABLED, collector permission 0. Gate 4/5/6 remain blueprint plans, not implementation permission. No Gate 3.19. The following Phase A and preparation/diagnostic snapshots are historical. Their old STOP/NO-GO/next-action prose is superseded by the final acceptance above. Phase A evidence: - reviewed exact HEAD `7424e5322fbb061fd14472dc0becde03b9fa6272`; - Architect Review `5465144212` ACCEPTED Phase A only; - squash commit `7a507a2411a26f8e36b0abf70271b3a8417942d7`; - exact-head CI run `37874559508` all three jobs SUCCESS; - `cmd/panta-staging` provides read-only baseline/inspect/watch evidence only; - protected human runbook merged; no real 115/OpenList/Hint credentials or mutation were used by CI/AI; - schema unchanged at v12. Historical Phase A acceptance condition: real Phase B evidence was still required. It is now satisfied by the 2026-10-13 final report and acceptance linked above. Live staging operator report (2026-10-09): preflight succeeded, worker claimed one Job, first 115 StartDownload ended without a durable task reference; Manifest+Job RECOVERY_REQUIRED with provider START_RESERVED. Original upstream cause and presence of a remote 115 task are not yet established. Architect opened Issue #62 for narrowly scoped read-only remote-task inspection, error classification, minimal patch if evidenced, and a separately human-started fresh test only after understanding the cause. The old reservation must not be cleared/retried. Do not start Gate 3.19 or close Issue #60 on partial progress. Tracking: GitHub Issue #60 Governing decision: D-041. Diagnostic PR #63 (accepted/merged, not acquisition acceptance): - reviewed exact HEAD `39a3e02751f1fdcb9384c8fef04fc00085f22f1a`; - Architect Review `5477994000` ACCEPTED for diagnostics only; - squash commit `b0b91701e15409e7ff5cd573def5883e14b29052`; - exact-head CI `38031086983` all three jobs SUCCESS; - 115 StartDownload now reports allowlisted category, elapsed milliseconds, HTTP status and Go cause type after durable RECOVERY_REQUIRED commit; SDK User-Agent initialization order fixed; - actual live result still FAIL: separate new-ID attempts HTTP 200 + `json.SyntaxError` at ~484 ms and ~397 ms (the latter after User-Agent fix); original first error unknown; - 115 read-only task search NOT_FOUND_WITH_LIMITATIONS; original and diagnostic START_RESERVED rows remain unchanged; - next: inspect pinned 115driver response/decryption contract and identify parser failure location with synthetic tests before any new real source submission. No Gate 3.19. ### Subsequent accepted checkpoints (earlier evidence above retained) - [PR #64](https://github.com/nathanxiangang-web/cloudsite/pull/64): parser-boundary diagnostics accepted; reviewed HEAD `a140486f9ff7626a6a322764ba4b880c2e969583`, squash `9e2e2e5cdaf140e97c030b0678e1418660d1b48c`. Synthetic diagnostics do not identify an unretained historical HTTP response or prove real download success. - [PR #65](https://github.com/nathanxiangang-web/cloudsite/pull/65): single-attempt operator plan merged at `f28f3a05759a6e4a9c7f01895e58df8db9829f33`; exact source_ref SHA-256 definition corrected. A plan is not live-test authorization. - C1: isolated clean cloudsite candidate built from that accepted main; prepared Hint address remains inactive. [Report](https://github.com/nathanxiangang-web/cloudsite/issues/62#issuecomment-6096649587), [acceptance](https://github.com/nathanxiangang-web/cloudsite/issues/62#issuecomment-6096681761). - C1.5: configuration-first restricted virtual-root proposal accepted; the existing non-root collector yields a Hint/Q5 coordinate incompatibility. Do not prepend guessed prefixes or modify accepted protocols. [Report](https://github.com/nathanxiangang-web/cloudsite/issues/62#issuecomment-6097019507), [acceptance](https://github.com/nathanxiangang-web/cloudsite/issues/62#issuecomment-6097060575). - C2-A: independent OpenList v4.2.6 synthetic Local instance actually running on host loopback, restart=no, fresh private state and no real 115 mount or credentials. [Report](https://github.com/nathanxiangang-web/cloudsite/issues/62#issuecomment-6097687709), [acceptance](https://github.com/nathanxiangang-web/cloudsite/issues/62#issuecomment-6098683022). Synthetic PASS is **not** real 115 isolation, Hint/Q5/Q8 or E2E acceptance. - Historical [C2-B0 work order](https://github.com/nathanxiangang-web/cloudsite/issues/62#issuecomment-6098855717) is completed: [actual report](https://github.com/nathanxiangang-web/cloudsite/issues/62#issuecomment-6098957134) and [architect acceptance](https://github.com/nathanxiangang-web/cloudsite/issues/62#issuecomment-6099065863). **READ-ONLY EVIDENCE ACCEPTED / C2-B ADMISSION NO-GO**. In the measured scope, the synthetic instance at `127.0.0.1:5248`, original nine containers, pinned single IndexCore writer, schema v12 and five historical recovery/reservation pairs stayed unchanged. The old native directory still contains its marker; new provider scope/view/Root/Binding identities remain UNSET. No real mount, Hint or new-root Q5/Q8/acquisition validation was performed. Next: the environment owner privately selects a NEW independently empty named native 115 destination, completes privileged root/other-user service/drop-in/timer/cron/restart-controller audit and identifies the exact IndexCore launcher, then explicitly approves each C2-B resource/change, operator, outage/freeze/rollback and fixture/Hint write. Privileged audit remains UNKNOWN; real credentials and destination are not owner-approved. Do not repeat C2-B0 or infer authority from its acceptance. C2-B requires concrete resource/change/outage approval before mount, new Root/Binding, existing single-writer restart, controlled baseline or diagnostic Hint. Sentinel creation/removal needs explicit scope. C3 separately requires protected source digest, fresh IDs, verified empty destination/four coordinates and bounded single-worker human-start window. External baseline: - IndexCore `v0.4.0-alpha.1`; - IndexCore commit `6f0eec85c59bd8cbe55011b0d9e512e0cafd6615`; - accepted OpenList collector + P9 loopback Hint + opt-in P10/P11 hybrid incremental runtime. Scope: - prepare a redacted staging harness/runbook without changing accepted production semantics; - run cloudsite and IndexCore in the same host/network namespace for the literal-loopback Hint trust boundary; - use one dedicated real 115 staging destination and real OpenList-backed IndexCore root; - cloudsite preflight remains non-mutating; submission enqueues exactly one durable pair; explicit operator start performs the real provider mutation; - prove provider -> Hint -> IndexCore OpenList observation -> Q5/Q8 -> cloudsite Projector -> READY/result_copy_id/Job SUCCEEDED; - retain durable failure/recovery evidence; never bypass IndexCore or clear START_RESERVED to force a retry; - no new schema expected. Deferred: production deployment/image/HA, Gate 4 auth/access/share/usage, public API/UI, Agent, load/soak, multi-provider live acceptance and destructive cleanup.