Introduce Draft → Confirm → Commit flow for WeChat schedule intents behind
feature flags, plus h5_tasks dual-write/read aggregation and rollout scripts
so reminders and automations get explicit user confirmation before persisting.
Co-authored-by: Cursor <cursoragent@cursor.com>
The read_image poisoning fix had no end-to-end guard because scenarios could
only send text. Add an upload_images step that renders and uploads visually
distinct images, let chat steps attach them the same way the WeChat channel
does, and assert the generated page actually embeds every upload.
Co-authored-by: Cursor <cursoragent@cursor.com>
Image turns already get a vision-model description injected into the prompt,
but the agent kept calling read_image to "confirm" the pictures. Those tool
results carry base64 image parts that Goose persists, so every later turn
against the text-only chat provider failed with `unknown variant image_url`
before the agent could write the page. WeChat page requests therefore fell
through to the fail-closed delivery message.
Drop read_image for the turn whenever a vision model handles the images, say
so explicitly in the injected prompt, and teach the poison scan to recognise
tool image parts so already-polluted sessions rotate instead of failing again.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register branch disposition after 103 deploy/repair, and add a lightweight
103 repair script that avoids heavy runtime module imports.
Co-authored-by: Cursor <cursoragent@cursor.com>
Formalize fast release as --mode fast so verified changes can skip canary promotion and full Gate reruns while keeping backups and health checks.
Co-authored-by: Cursor <cursoragent@cursor.com>
Shared paths like db.mjs were pulling PAGE/DATA live agent suites into every
hotfix. Keep those cases for actual page-data changes, resume passed suites on
the same artifact, and fail fast on Docker/port issues instead of rerunning 100+
scenarios.
Co-authored-by: Cursor <cursoragent@cursor.com>
DATA-01 told the agent not to stop at 方案确认, then failed because the first
reply no longer contains those words. Assert 问卷/后台 delivery instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expired paid users were rebuilt as free with period_images_limit=0, which the quota system treats as unlimited. Write the catalog quota on rebuild and repair existing finite plans on schema ensure.
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop the user_confirmed_at gate so public, online, unexpired pages can enter sitemap/llms and receive SEO/GEO tags. Defaults now enable all discovery switches; stored all-off config is still preserved until admin saves.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cross-repo publish order for memind-analytics, Portal, and memind_adm;
update platform and 105 operations docs for systemd artifact deploy.
Co-authored-by: Cursor <cursoragent@cursor.com>
Document Umami as the sole analytics platform, remove Rybbit proxy and
tracker code, and classify public page traffic with discovery_channel for
adm SEO/GEO dashboards.
Co-authored-by: Cursor <cursoragent@cursor.com>
Scheduled automations were saved but never executed because the worker
required an explicit env flag. Follow H5_REMINDER_WORKER_ENABLED when unset,
add WeChat preflight to write tasks deterministically, and surface worker
warnings on create.
Co-authored-by: Cursor <cursoragent@cursor.com>
Allow margin/FX/cost-mode knobs to be overridden via h5_billing_admin_config so memind_adm can adjust DeepSeek billing without editing env.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record closure of feature/billing-session-cost-priority after merge to main
and 103 release 20260805-095542-44121df.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record that the branch core LLM router work is already on main and production,
and mark the stale branch as read-only to prevent merge or release reuse.
Co-authored-by: Cursor <cursoragent@cursor.com>
Bundle vendored imgproxy with Mach-O dylibs for 103 launchd, fix install to exec the binary directly with launchctl enable, and document the live native release in the runtime topology.
Co-authored-by: Cursor <cursoragent@cursor.com>
Document the completed Docker-to-native goosed pool cutover on 103, add the production migrate script with backup/rollback paths, and extend local native pool soak/metrics helpers used as migration gates.
Co-authored-by: Cursor <cursoragent@cursor.com>
Centralize page HTML quota checks with grace-write semantics across page
services and workspace tools, keep localhost MindSpace links clickable in
chat display, and expand Page Data/static-page skill plus local dev docs
for quota, delivery URLs, and native Aider/OpenHands tooling.
Co-authored-by: Cursor <cursoragent@cursor.com>
Normal Portal releases should not block when commit status stays pending
after the candidate is already pushed to origin/main.
Co-authored-by: Cursor <cursoragent@cursor.com>
Ignore local .runtime build output in REL-01, accept missing Gitea CI when
origin/main matches HEAD, and compare two clean runtime rebuilds for REL-03.
Co-authored-by: Cursor <cursoragent@cursor.com>
Publication routes and share shells were missing the Rybbit tracker, and
bootstrap now reuses the stored MindSpace analytics secret when Rybbit env
secret is absent.
Co-authored-by: Cursor <cursoragent@cursor.com>
john