Compare commits
6
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Codex
|
8af40af629 | ||
|
Codex
|
1d334b1cca | ||
|
Codex
|
a1f933e500 | ||
|
aiman
|
74e603c0c9 | ||
|
chatgpt-gitops-bot
|
d5b51e1342 | ||
|
OpenClaw Design
|
d74229927b |
+397
@@ -0,0 +1,397 @@
|
||||
# Personal-Weixin B3/B4 Owner Evidence Authorization
|
||||
|
||||
```yaml
|
||||
authorization_id: AUTH-CODEX-V2R1-PERSONAL-WEIXIN-B3-B4-EVIDENCE-20260716
|
||||
owner_approved: true
|
||||
executor: Codex isolated runner
|
||||
|
||||
foundation_implementation_commit: 2fcab6f5833a405a9a26683811600b6e5f1aa7b1
|
||||
foundation_result_commit: 64a71b6199a8e2bd609ba145349e67b874888505
|
||||
r10_lineage_commit: 74e603c0c943501110577dbe3c7f6a0b18b8ec7d
|
||||
evidence_gate_commit: 62a4067cf7a462ebe7cf29524238bc5d0a70b813
|
||||
upstream_audit_commit: b2f5f531019a70801444987dbb97dc1f69cf47de
|
||||
|
||||
production_baseline: V1R4C6
|
||||
production_changed: false
|
||||
release_status: paused
|
||||
force_push_authorized: false
|
||||
```
|
||||
|
||||
## 1. 授权结论
|
||||
|
||||
Owner 明确授权 Codex：
|
||||
|
||||
1. 完成 B3 owner evidence packet；
|
||||
2. 在 vendor `client_id → authoritative message_id` 证据缺失时，采用 B4 quote-authority-disabled amendment；
|
||||
3. B3、B4 均 PASS 后，按已有 exact allowlist 继续 B5–B7；
|
||||
4. B3–B7 全部 PASS 后才能开始 Release Preflight；
|
||||
5. Release Preflight PASS 后才允许 Canary；
|
||||
6. Codex 不得直接修改生产。
|
||||
|
||||
该授权不允许 Codex编造 raw-wire、credential、vendor 或 reviewer 证据。
|
||||
|
||||
## 2. B3 owner evidence 必须包含
|
||||
|
||||
B3 evidence manifest 必须引用上述五个权威提交，并包含以下五类证据。
|
||||
|
||||
### A. Raw-wire evidence
|
||||
|
||||
至少包含：
|
||||
|
||||
```yaml
|
||||
raw_wire:
|
||||
- direction: inbound
|
||||
- direction: outbound
|
||||
```
|
||||
|
||||
每项必须记录：
|
||||
|
||||
```yaml
|
||||
restricted_path:
|
||||
restricted_sha256:
|
||||
restricted_bytes:
|
||||
redacted_path:
|
||||
redacted_sha256:
|
||||
captured_at:
|
||||
credential_label: credential-a | credential-b
|
||||
```
|
||||
|
||||
要求：
|
||||
|
||||
* unrestricted raw-wire 只能保存在 owner 批准的受限存储；
|
||||
* Git 中只能提交 SHA-256、大小、受限路径引用及 redacted view；
|
||||
* 不得提交 token、API key、OAuth code、sessionKey、cookie 或完整 credential；
|
||||
* inbound 与 outbound 必须各至少一份；
|
||||
-两份 credential 都必须实际覆盖。
|
||||
|
||||
### B. Authority map
|
||||
|
||||
必须提供 commit-safe authority map，明确：
|
||||
|
||||
```yaml
|
||||
vendor_message_id_field:
|
||||
client_id_field:
|
||||
client_id_authoritative: false
|
||||
mapping_verified: true
|
||||
```
|
||||
|
||||
Authority map 必须区分：
|
||||
|
||||
```yaml
|
||||
authoritative:
|
||||
- verified inbound vendor message_id
|
||||
|
||||
non_authoritative:
|
||||
- local client_id
|
||||
- outbound correlation ID
|
||||
- local sequence
|
||||
- timestamp
|
||||
- content hash
|
||||
- outbound receipt ID
|
||||
```
|
||||
|
||||
禁止把任一非权威值提升为 message authority。
|
||||
|
||||
### C. 双 credential 证据
|
||||
|
||||
必须有精确两项：
|
||||
|
||||
```yaml
|
||||
credentials:
|
||||
- label: credential-a
|
||||
fingerprint_sha256:
|
||||
secret_included: false
|
||||
scope:
|
||||
test_result: PASS
|
||||
|
||||
- label: credential-b
|
||||
fingerprint_sha256:
|
||||
secret_included: false
|
||||
scope:
|
||||
test_result: PASS
|
||||
```
|
||||
|
||||
要求：
|
||||
|
||||
* 两个 fingerprint 必须不同；
|
||||
* 不得提交 secret 原文；
|
||||
* 两个 credential 必须各自通过实际测试；
|
||||
* credential scope 必须明确。
|
||||
|
||||
### D. Mode evidence
|
||||
|
||||
必须明确处于下列模式之一：
|
||||
|
||||
```yaml
|
||||
mode:
|
||||
name: sandbox | shadow | restricted-capture
|
||||
production_traffic: false
|
||||
writes_production: false
|
||||
capture_only: true
|
||||
```
|
||||
|
||||
不得使用生产流量或写生产数据来补证据。
|
||||
|
||||
### E. Reviewer evidence
|
||||
|
||||
必须由独立 reviewer 签署：
|
||||
|
||||
```yaml
|
||||
review:
|
||||
reviewer:
|
||||
independent_from_executor: true
|
||||
decision: PASS
|
||||
reviewed_manifest_sha256:
|
||||
reviewed_at:
|
||||
```
|
||||
|
||||
Reviewer 必须核对：
|
||||
|
||||
* raw-wire 哈希；
|
||||
* redacted view；
|
||||
* authority map；
|
||||
-两个 credential fingerprint；
|
||||
* mode；
|
||||
* manifest 完整 SHA-256。
|
||||
|
||||
## 3. B3 PASS 条件
|
||||
|
||||
只有以下全部成立才允许 B3 `status: PASS`：
|
||||
|
||||
```yaml
|
||||
raw_wire_inbound: PASS
|
||||
raw_wire_outbound: PASS
|
||||
dual_credential: PASS
|
||||
authority_map: PASS
|
||||
client_id_authoritative: false
|
||||
mode_non_production: PASS
|
||||
reviewer_independent: PASS
|
||||
reviewer_decision: PASS
|
||||
secrets_committed: false
|
||||
production_changed: false
|
||||
baseline_after: V1R4C6
|
||||
release_status: paused
|
||||
```
|
||||
|
||||
真实证据缺失时必须继续：
|
||||
|
||||
```yaml
|
||||
status: BLOCKED_EVIDENCE_REQUIRED
|
||||
```
|
||||
|
||||
不得生成模拟证据代替 owner/vendor 证据。
|
||||
|
||||
## 4. B4 Owner Amendment
|
||||
|
||||
Owner 明确批准以下 B4 amendment：
|
||||
|
||||
```json
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"contract": "personal-weixin-b4-outbound-quote-authority-amendment",
|
||||
"ownerApproved": true,
|
||||
"lineage": {
|
||||
"foundationImplementationCommit": "2fcab6f5833a405a9a26683811600b6e5f1aa7b1",
|
||||
"foundationResultCommit": "64a71b6199a8e2bd609ba145349e67b874888505",
|
||||
"r10LineageCommit": "74e603c0c943501110577dbe3c7f6a0b18b8ec7d",
|
||||
"evidenceGateCommit": "62a4067cf7a462ebe7cf29524238bc5d0a70b813",
|
||||
"upstreamAuditCommit": "b2f5f531019a70801444987dbb97dc1f69cf47de"
|
||||
},
|
||||
"vendorClientIdMessageIdEvidence": {
|
||||
"status": "absent",
|
||||
"clientIdPromotable": false
|
||||
},
|
||||
"authorityPolicy": {
|
||||
"outboundQuoteAuthority": "disabled",
|
||||
"clientIdRole": "non-authoritative-correlation-only",
|
||||
"authoritativeMessageIdSources": [
|
||||
"validated-inbound-raw-wire.vendor_message_id"
|
||||
],
|
||||
"quotedSendWithoutAuthoritativeMessageId": "fail-closed",
|
||||
"plainOutboundWithoutQuoteAuthority": "allowed-only-by-existing-b4-allowlist",
|
||||
"syntheticMapping": false,
|
||||
"timestampFallback": false,
|
||||
"localSequenceFallback": false,
|
||||
"contentHashFallback": false,
|
||||
"outboundReceiptFallback": false
|
||||
},
|
||||
"implementationConstraints": {
|
||||
"scopeExpansion": false,
|
||||
"exactAllowlistRequired": true,
|
||||
"missingAllowlistStatus": "BLOCKED_SCOPE",
|
||||
"productionChangeAuthorized": false,
|
||||
"canaryAuthorized": false,
|
||||
"tagAuthorized": false,
|
||||
"forcePushAuthorized": false
|
||||
},
|
||||
"production": {
|
||||
"baseline": "V1R4C6",
|
||||
"changed": false,
|
||||
"releaseStatus": "paused"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
该 JSON 必须作为独立 control-plane amendment 提交。
|
||||
|
||||
## 5. B4 强制语义
|
||||
|
||||
B4 实现必须遵守：
|
||||
|
||||
```yaml
|
||||
client_id:
|
||||
role: correlation-only
|
||||
authoritative: false
|
||||
|
||||
vendor_message_id:
|
||||
authoritative_only_when:
|
||||
- observed in validated inbound raw-wire
|
||||
- present in committed authority map
|
||||
|
||||
quoted_send:
|
||||
without_authoritative_vendor_message_id: fail-closed
|
||||
|
||||
plain_outbound:
|
||||
allowed_only_when:
|
||||
- existing B4 exact allowlist permits it
|
||||
- no quote/reply authority field is emitted
|
||||
```
|
||||
|
||||
禁止：
|
||||
|
||||
* `client_id` → `message_id` alias；
|
||||
* client ID hash fallback；
|
||||
* timestamp fallback；
|
||||
* local sequence fallback；
|
||||
* content hash fallback；
|
||||
* outbound receipt fallback；
|
||||
* synthetic message ID；
|
||||
-“先发送后补 authority”。
|
||||
|
||||
## 6. B4 路径授权
|
||||
|
||||
该 amendment 不增加任何实现路径。
|
||||
|
||||
Codex必须先找到已有 B4 exact allowlist。
|
||||
|
||||
若不存在或不完整：
|
||||
|
||||
```yaml
|
||||
status: BLOCKED_SCOPE
|
||||
```
|
||||
|
||||
不得由 Codex自行发明路径。
|
||||
|
||||
## 7. B5–B7 条件
|
||||
|
||||
只有 B3 和 B4 均有 qualifying PASS RESULT 后，才可继续 B5–B7。
|
||||
|
||||
每个阶段必须：
|
||||
|
||||
* 独立 branch；
|
||||
* 独立 worktree；
|
||||
* 已提交 exact allowlist；
|
||||
* 一个非 merge implementation commit；
|
||||
* 独立 RESULT；
|
||||
* 依赖实际 F0 commit 与 immutable image digest；
|
||||
* 不修改生产；
|
||||
* 不 force push。
|
||||
|
||||
任一阶段缺少 exact allowlist：
|
||||
|
||||
```yaml
|
||||
status: BLOCKED_SCOPE
|
||||
```
|
||||
|
||||
## 8. Release Preflight
|
||||
|
||||
只有以下全部 PASS 后才能开始：
|
||||
|
||||
```yaml
|
||||
F0: PASS
|
||||
B3: PASS
|
||||
B4: PASS
|
||||
B5: PASS
|
||||
B6: PASS
|
||||
B7: PASS
|
||||
R10_lineage: PASS
|
||||
immutable_image_digest: present
|
||||
gitleaks: PASS
|
||||
rollback_contract: present
|
||||
```
|
||||
|
||||
Preflight 不得创建 tag 或部署生产。
|
||||
|
||||
## 9. Canary
|
||||
|
||||
仅在 Release Preflight PASS 后授权一次 Canary。
|
||||
|
||||
Canary 必须：
|
||||
|
||||
* 使用固定 immutable image digest；
|
||||
* 使用已验证 rollback target；
|
||||
* 不修改生产 schema；
|
||||
* 不暴露 secrets；
|
||||
* 有明确成功指标；
|
||||
* 有自动/立即 rollback 条件。
|
||||
|
||||
Canary 失败：
|
||||
|
||||
```yaml
|
||||
rollback: required
|
||||
release_status: paused
|
||||
production_baseline: V1R4C6
|
||||
```
|
||||
|
||||
不得继续 production promotion。
|
||||
|
||||
## 10. Production 边界
|
||||
|
||||
Codex不得直接执行生产部署。
|
||||
|
||||
只有以下全部提交并核验后，Codex才可创建 deployment request：
|
||||
|
||||
```yaml
|
||||
F0_and_B3_B7: PASS
|
||||
release_preflight: PASS
|
||||
canary: PASS
|
||||
immutable_release_digest: present
|
||||
rollback_target: verified
|
||||
rollback_procedure: verified
|
||||
go_live_evidence: committed
|
||||
```
|
||||
|
||||
实际 V2R1C0 部署只能由：
|
||||
|
||||
```text
|
||||
owner/admin GitOps release action
|
||||
```
|
||||
|
||||
执行。
|
||||
|
||||
在该动作前：
|
||||
|
||||
```yaml
|
||||
production: V1R4C6
|
||||
production_changed: false
|
||||
release: paused
|
||||
V2R1C0_tag: absent
|
||||
```
|
||||
|
||||
必须保持不变。
|
||||
|
||||
## 11. Codex 下一步
|
||||
|
||||
立即执行顺序：
|
||||
|
||||
1. 在现有 control branch 提交本授权文件；
|
||||
2. 提交 byte-exact B4 amendment；
|
||||
3. 检查 B3 packet 中是否已有真实 owner raw-wire、双 credential、authority map、mode 和 reviewer evidence；
|
||||
4. 有真实证据则完成 B3 manifest 与审核；
|
||||
5. 无真实证据则继续 `BLOCKED_EVIDENCE_REQUIRED`，明确缺失项；
|
||||
6. B3 PASS 后按已有 exact allowlist执行 B3；
|
||||
7. B4 按 quote-authority-disabled 模式执行；
|
||||
8. B3/B4 PASS 后再检查 B5–B7；
|
||||
9. 不得跳到 Release Preflight、Canary 或生产。
|
||||
|
||||
本授权已解除 B4 vendor mapping 阻塞，但没有伪造或豁免 B3 owner evidence。
|
||||
+144
@@ -0,0 +1,144 @@
|
||||
# Personal-Weixin B3/B4 Owner Authorization Result
|
||||
|
||||
```yaml
|
||||
status: BLOCKED_EVIDENCE_REQUIRED
|
||||
decision: STOP_BEFORE_B3_B4_IMPLEMENTATION
|
||||
task: Personal-Weixin B3/B4 owner authorization intake
|
||||
timestamp_utc8: 20260716T120210UTC8
|
||||
|
||||
control:
|
||||
base_commit: 1d334b1ccaac54c3c3ec4dd84693ab68fc67cef3
|
||||
branch: control/codex/v2r1-personal-weixin-r10-lineage-amendment-20260716T095245UTC8
|
||||
authorization:
|
||||
commit: a1f933e500151dc8afc1b25b30448a31899a8f64
|
||||
path: .agent/authorizations/codex/AUTH-CODEX-V2R1-PERSONAL-WEIXIN-B3-B4-EVIDENCE-20260716.md
|
||||
blob_oid: ba2ad7fffa4ad3393f1a6c19b15b1501c64db9cb
|
||||
sha256: 8649aa212eda2f9c62da8bfef6149f3f2f9d0926dd5b37c4992ad745c38647c4
|
||||
bytes: 9370
|
||||
attachment_byte_exact: PASS
|
||||
owner_approved: true
|
||||
b4_amendment:
|
||||
commit: 1d334b1ccaac54c3c3ec4dd84693ab68fc67cef3
|
||||
path: release/v2r1c0-rc1/personal-weixin-b4-outbound-quote-authority-amendment.json
|
||||
blob_oid: df8b31c684ea744685e37dd677141106cbc8ffa8
|
||||
sha256: 7c5cb1e83b8009235f5b14046c21f5e571a655f42828c57d5c4280f65eefa02f
|
||||
bytes: 1575
|
||||
json_parse: PASS
|
||||
owner_approved: true
|
||||
vendor_client_id_message_id_evidence: absent
|
||||
client_id_promotable: false
|
||||
outbound_quote_authority: disabled
|
||||
client_id_role: non-authoritative-correlation-only
|
||||
quoted_send_without_authoritative_message_id: fail-closed
|
||||
synthetic_mapping: false
|
||||
status: PASS
|
||||
|
||||
lineage:
|
||||
foundation_implementation_commit: 2fcab6f5833a405a9a26683811600b6e5f1aa7b1
|
||||
foundation_result_commit: 64a71b6199a8e2bd609ba145349e67b874888505
|
||||
r10_lineage_commit: 74e603c0c943501110577dbe3c7f6a0b18b8ec7d
|
||||
evidence_gate_commit: 62a4067cf7a462ebe7cf29524238bc5d0a70b813
|
||||
upstream_audit_commit: b2f5f531019a70801444987dbb97dc1f69cf47de
|
||||
|
||||
b3:
|
||||
status: BLOCKED_EVIDENCE_REQUIRED
|
||||
request_packet_present: true
|
||||
request_packet_is_evidence: false
|
||||
implementation_started: false
|
||||
qualifying_result_present: false
|
||||
missing:
|
||||
raw_wire_inbound:
|
||||
- restricted_path
|
||||
- restricted_sha256
|
||||
- restricted_bytes
|
||||
- redacted_path
|
||||
- redacted_sha256
|
||||
- captured_at
|
||||
- credential_label
|
||||
raw_wire_outbound:
|
||||
- restricted_path
|
||||
- restricted_sha256
|
||||
- restricted_bytes
|
||||
- redacted_path
|
||||
- redacted_sha256
|
||||
- captured_at
|
||||
- credential_label
|
||||
dual_credentials:
|
||||
- credential-a distinct fingerprint_sha256, explicit scope, and actual PASS test
|
||||
- credential-b distinct fingerprint_sha256, explicit scope, and actual PASS test
|
||||
authority_map:
|
||||
- vendor_message_id_field
|
||||
- client_id_field
|
||||
- client_id_authoritative false
|
||||
- mapping_verified true
|
||||
- authoritative and non_authoritative classifications
|
||||
mode:
|
||||
- sandbox, shadow, or restricted-capture
|
||||
- production_traffic false
|
||||
- writes_production false
|
||||
- capture_only true
|
||||
independent_review:
|
||||
- reviewer identity
|
||||
- independent_from_executor true
|
||||
- decision PASS
|
||||
- reviewed_manifest_sha256
|
||||
- reviewed_at
|
||||
secrets_committed: false
|
||||
action: stop_without_implementation_commit
|
||||
|
||||
b4:
|
||||
prior_vendor_mapping_blocker: REPLACED_BY_OWNER_AMENDMENT
|
||||
contract_gate: PASS
|
||||
implementation_status: NOT_STARTED
|
||||
qualifying_result_present: false
|
||||
execution_condition: B3 qualifying PASS result
|
||||
enforced_semantics:
|
||||
client_id_authoritative: false
|
||||
outbound_quote_authority: disabled
|
||||
quoted_send_without_authoritative_vendor_message_id: fail-closed
|
||||
plain_outbound: existing_exact_allowlist_only
|
||||
fallback_identifiers: forbidden
|
||||
|
||||
later_stages:
|
||||
B5: NOT_STARTED
|
||||
B6: NOT_STARTED
|
||||
B7: NOT_STARTED
|
||||
release_preflight: NOT_STARTED
|
||||
canary: NOT_STARTED
|
||||
production_promotion: NOT_STARTED
|
||||
|
||||
production:
|
||||
baseline: V1R4C6
|
||||
changed: false
|
||||
release_status: paused
|
||||
v2r1c0_tag: absent
|
||||
|
||||
safety:
|
||||
implementation_branch_modified: false
|
||||
control_branch_modified_by_result: false
|
||||
production_mutated: false
|
||||
secret_values_read: false
|
||||
secret_values_recorded: false
|
||||
force_push: false
|
||||
|
||||
execution_counters:
|
||||
permission_denied_count: 0
|
||||
checkout_collision_count: 0
|
||||
git_lock_collision_count: 0
|
||||
```
|
||||
|
||||
## Decision
|
||||
|
||||
The owner authorization and the byte-exact B4 control-plane amendment are
|
||||
present and valid. The amendment replaces the missing vendor
|
||||
`client_id -> authoritative message_id` mapping requirement by permanently
|
||||
disabling outbound quote authority. It does not create or waive B3 evidence.
|
||||
|
||||
The only discovered B3 packet is an unfilled request/template archive. No
|
||||
restricted raw-wire references, commit-safe redacted views, two tested
|
||||
credential fingerprints, verified authority map, non-production capture-mode
|
||||
record, or independent reviewer signature was found. Therefore B3 remains
|
||||
`BLOCKED_EVIDENCE_REQUIRED`, and neither B3 nor B4 implementation was started.
|
||||
|
||||
No secret value was inspected or committed. Production remains unchanged at
|
||||
the declared `V1R4C6` baseline and the release remains paused.
|
||||
@@ -0,0 +1,39 @@
|
||||
# Personal Weixin v1 security contract
|
||||
|
||||
Status: normative design contract for R10 B6/B7. It authorizes no runtime or production change.
|
||||
|
||||
## Trust boundaries and ownership
|
||||
|
||||
The browser is untrusted. The Portal authenticates the human user and resolves tenant identity from the server session. The Portal adapter is least-privileged: it may request account-scoped operations but must not store provider credentials, tokens, raw iLink state, or OpenClaw protocol state. OpenClaw owns provider credentials and protocol state. The Gateway transport authenticator, not an event-body boolean or identity field, establishes whether an inbound event is authentic.
|
||||
|
||||
Every operation is keyed by server-resolved `(tenantId, accountId)`. Entitlements are allow-only, server-owned records. A default account is display preference, never authorization. The browser-visible `accountId` is an untrusted reference to a server-preallocated account slot: the server MUST resolve it through the authenticated user's tenant and current entitlement on list, readiness, login start, login wait, status, inbound challenge, canary, and rollback checks. Start and every wait poll re-run that resolution. Missing, arbitrary, stale, cross-tenant, or no-longer-entitled values fail closed before account existence or state is disclosed; there is no default/first/configured-account fallback.
|
||||
|
||||
## Login state and secret handling
|
||||
|
||||
`sessionKey` is a required, nonempty opaque value returned by OpenClaw. The adapter MUST forward its exact bytes unchanged. It MUST NOT trim, normalize, case-fold, derive, regenerate, alias, or substitute the value. A missing or empty `sessionKey` fails closed and MUST NOT fall back to `accountId` or any identifier. Durable state stores only a one-way session-key digest where correlation is required; raw `sessionKey` is not persisted.
|
||||
|
||||
`verifyCode` is accepted only as an authenticated, CSRF-protected wait POST test/input field, matches 4-8 decimal digits, is forwarded once, and is discarded. `challengeCode` is accepted only as an authenticated Gateway event test/input field, is compared through a one-way digest, and is discarded. Neither secret may be persisted in raw form or appear in URLs, responses, logs, traces, metrics labels, analytics, audit payloads, exceptions, or background-job arguments. Golden fixtures containing these values are synthetic test vectors only and MUST NOT be copied into production telemetry or responses.
|
||||
|
||||
QR data URLs are transient no-store response data with a 1 MiB bound and MUST NOT be logged or persisted. Canonical login outcomes are `qr_pending`, `need_verifycode`, `invalid_verifycode`, `expired`, `failed`, `already_connected`, and `confirmed`. Any unknown upstream status maps fail-closed to canonical `failed` with `errorCode=unknown_upstream_status`; raw unknown status is bounded evidence only. Upstream `binded_redirect` maps only to `already_connected` with `connected=false`, `alreadyConnected=true`, and `terminal=true`, never to `confirmed`.
|
||||
|
||||
## Canonical readiness
|
||||
|
||||
Readiness is one live, authenticated snapshot from the Gateway/OpenClaw boundary with one unified response shape for `ready`, `not_ready`, and `error`. It MUST include Gateway reachability/error, exact plugin id/version/digest, selected account identity, configured/enabled/running/last-error state, current tenant/account entitlement, reasons, observation time, and freshness deadline. `ready=true` is legal only when every required field is present, the snapshot is still fresh, expected plugin version/digest match, the selected account is entitled/configured/enabled/running with null error, and the Gateway is reachable. Missing fields, an old snapshot, digest mismatch, no entitlement, not-running state, unauthenticated evidence, or any contradiction returns `ready=false` with `code=not_ready` or `code=error` and at least one stable reason. Cached, synthetic, file-only, default-account, or service-up-only evidence cannot produce ready.
|
||||
|
||||
## Authenticated inbound-event challenge
|
||||
|
||||
The event body contains exactly `eventId`, `accountId`, `senderId`, `chatId`, `challengeCode`, and `observedAt`. It does not and cannot assert authentication, tenant id, Portal user id, or session key. Those values are absent by contract. Transport authentication MUST cover HTTP method, path, timestamp header, nonce header, and raw body digest; enforce a bounded clock window; durably reserve nonce/event replay keys for at least that window; compare signatures in constant time; and complete before body values reach logs or mutable business state.
|
||||
|
||||
After transport authentication, the server hashes the ephemeral `challengeCode` and resolves the pending durable challenge. That server-created record already owns tenant id, Portal user id, entitled account id, session-key digest, issued/expiry/consumed times, and state (`issued`, `consumed`, or `expired`). The body `accountId` must exactly match the record and current entitlement; it never supplies tenant/user/session authority. The first valid authenticated event atomically binds its provider `senderId` and `chatId`.
|
||||
|
||||
Issuance and consumption MUST run in a database transaction with row locking or an equivalent compare-and-swap primitive. `issued -> consumed` is single-use and atomic. An exact replay of the same authenticated event is idempotent. A changed event payload, sender, chat, account, durable tenant/user/account/session binding, expired or already-consumed record, duplicate event with different payload, missing entitlement, or unauthenticated transport fails closed with zero mutation. Raw challenge codes and raw session keys are never stored.
|
||||
|
||||
## Unsupported unbind
|
||||
|
||||
End-to-end unbind is unsupported in R10. Every public or internal unbind entry point MUST return the exact schema response with HTTP 501, `ok=false`, `supported=false`, `code=unbind_not_supported`, and `mutationCount=0`. The 501 decision occurs before token deletion, account update, session or challenge mutation, Gateway/OpenClaw call, business-state audit mutation, or background-job enqueue.
|
||||
|
||||
## Web, canary, and rollback controls
|
||||
|
||||
Only exact B6/B7 allowlisted paths in the R10 amendment may change. Portal endpoints require authenticated Django sessions, CSRF protection for mutations, server-scoped object lookup, IDOR tests, rate limits, request-size limits, `Cache-Control: no-store`, and structured redaction of session keys, verification codes, challenge codes, QR data, tokens, and provider payloads. Stable public errors never expose upstream bodies or cross-tenant existence.
|
||||
|
||||
The canary uses one explicitly entitled tenant/account pair and proves restart, concurrent waits, atomic challenge consumption, exact replay, altered replay denial, cross-tenant denial, all canonical statuses/readiness shapes, and zero-mutation 501 behavior. Promotion requires byte-identical artifacts and digests from the verified canary. Rollback restores the immediately preceding byte-identical artifacts/configuration and re-runs canonical readiness; database rollback is forbidden unless an explicitly approved manifest proves backward incompatibility and supplies a separate recovery plan.
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"tenant.account.entitlement","tenantId":"tenant-canary","accountId":"account-canary","effect":"allow","policyVersion":"policy-v1","issuedAtMs":1784068000000}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"personal.weixin.readiness","tenantId":"tenant-canary","selectedAccountId":"account-canary","gateway":{"reachable":true,"errorCode":null},"plugin":{"id":"openclaw-weixin","loaded":true,"version":"2.4.6","digestSha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"},"accounts":[{"accountId":"account-canary","name":"Canary Personal Weixin","configured":true,"enabled":true,"running":true,"lastError":null,"isDefault":false,"entitled":true}],"ready":true,"code":"ready","reasons":[],"observedAtMs":1784068060000,"freshUntilMs":1784068120000}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"personal.weixin.readiness","tenantId":"tenant-canary","selectedAccountId":"account-canary","gateway":{"reachable":true,"errorCode":null},"plugin":{"id":"openclaw-weixin","loaded":true,"version":"2.4.6","digestSha256":null},"accounts":[{"accountId":"account-canary","name":"Canary Personal Weixin","configured":true,"enabled":true,"running":true,"lastError":null,"isDefault":false,"entitled":true}],"ready":false,"code":"not_ready","reasons":[{"code":"field_missing","field":"plugin.digestSha256"}],"observedAtMs":1784068060000,"freshUntilMs":1784068120000}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"personal.weixin.readiness","tenantId":"tenant-canary","selectedAccountId":"account-canary","gateway":{"reachable":true,"errorCode":null},"plugin":{"id":"openclaw-weixin","loaded":true,"version":"2.4.6","digestSha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"},"accounts":[{"accountId":"account-canary","name":"Canary Personal Weixin","configured":true,"enabled":true,"running":true,"lastError":null,"isDefault":false,"entitled":true}],"ready":false,"code":"not_ready","reasons":[{"code":"snapshot_stale","field":"freshUntilMs"}],"observedAtMs":1784060000000,"freshUntilMs":1784060060000}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"personal.weixin.readiness","tenantId":"tenant-canary","selectedAccountId":"account-canary","gateway":{"reachable":true,"errorCode":null},"plugin":{"id":"openclaw-weixin","loaded":true,"version":"2.4.6","digestSha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"},"accounts":[{"accountId":"account-canary","name":"Canary Personal Weixin","configured":true,"enabled":true,"running":true,"lastError":null,"isDefault":false,"entitled":true}],"ready":false,"code":"not_ready","reasons":[{"code":"plugin_digest_mismatch","field":"plugin.digestSha256"}],"observedAtMs":1784068060000,"freshUntilMs":1784068120000}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"personal.weixin.readiness","tenantId":"tenant-canary","selectedAccountId":"account-canary","gateway":{"reachable":true,"errorCode":null},"plugin":{"id":"openclaw-weixin","loaded":true,"version":"2.4.6","digestSha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"},"accounts":[{"accountId":"account-canary","name":"Canary Personal Weixin","configured":true,"enabled":true,"running":true,"lastError":null,"isDefault":false,"entitled":false}],"ready":false,"code":"not_ready","reasons":[{"code":"account_not_entitled","field":"accounts[0].entitled"}],"observedAtMs":1784068060000,"freshUntilMs":1784068120000}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"personal.weixin.readiness","tenantId":"tenant-canary","selectedAccountId":"account-canary","gateway":{"reachable":true,"errorCode":null},"plugin":{"id":"openclaw-weixin","loaded":true,"version":"2.4.6","digestSha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"},"accounts":[{"accountId":"account-canary","name":"Canary Personal Weixin","configured":true,"enabled":true,"running":false,"lastError":"plugin_not_running","isDefault":false,"entitled":true}],"ready":false,"code":"not_ready","reasons":[{"code":"account_not_running","field":"accounts[0].running"}],"observedAtMs":1784068060000,"freshUntilMs":1784068120000}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"personal.weixin.readiness","tenantId":"tenant-canary","selectedAccountId":"account-canary","gateway":{"reachable":false,"errorCode":"gateway_unreachable"},"plugin":{"id":"openclaw-weixin","loaded":false,"version":null,"digestSha256":null},"accounts":[{"accountId":"account-canary","name":"Canary Personal Weixin","configured":true,"enabled":true,"running":false,"lastError":"gateway_unreachable","isDefault":false,"entitled":true}],"ready":false,"code":"error","reasons":[{"code":"gateway_error","field":"gateway.reachable"}],"observedAtMs":1784068060000,"freshUntilMs":1784068060000}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"web.login.start.request","accountId":"account-canary","force":false,"timeoutMs":30000}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"web.login.wait.request","accountId":"account-canary","sessionKey":"weixin-session-20260715-A1","verifyCode":"4321","currentQrDataUrl":"data:image/png;base64,iVBORw0KGgo=","timeoutMs":30000}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"web.login.result","status":"qr_pending","accountId":"account-canary","sessionKey":"weixin-session-20260715-A1","connected":false,"alreadyConnected":false,"terminal":false,"needsVerifyCode":false,"qrDataUrl":"data:image/png;base64,iVBORw0KGgo="}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"web.login.result","status":"need_verifycode","accountId":"account-canary","sessionKey":"weixin-session-20260715-A1","connected":false,"alreadyConnected":false,"terminal":false,"needsVerifyCode":true}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"web.login.result","status":"invalid_verifycode","accountId":"account-canary","sessionKey":"weixin-session-20260715-A1","connected":false,"alreadyConnected":false,"terminal":false,"needsVerifyCode":true,"errorCode":"invalid_verifycode"}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"web.login.result","status":"expired","accountId":"account-canary","sessionKey":"weixin-session-20260715-A1","connected":false,"alreadyConnected":false,"terminal":true,"needsVerifyCode":false,"errorCode":"login_expired"}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"web.login.result","status":"failed","accountId":"account-canary","sessionKey":"weixin-session-20260715-A1","connected":false,"alreadyConnected":false,"terminal":true,"needsVerifyCode":false,"errorCode":"upstream_failed"}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"web.login.result","status":"already_connected","upstreamStatus":"binded_redirect","accountId":"account-canary","sessionKey":"weixin-session-20260715-A1","connected":false,"alreadyConnected":true,"terminal":true,"needsVerifyCode":false}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"web.login.result","status":"confirmed","accountId":"account-canary","sessionKey":"weixin-session-20260715-A1","connected":true,"alreadyConnected":false,"terminal":true,"needsVerifyCode":false,"userId":"sender-canary"}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"web.login.result","status":"failed","upstreamStatus":"future_unknown_state","accountId":"account-canary","sessionKey":"weixin-session-20260715-A1","connected":false,"alreadyConnected":false,"terminal":true,"needsVerifyCode":false,"errorCode":"unknown_upstream_status"}
|
||||
@@ -0,0 +1 @@
|
||||
{"eventId":"event-20260715-A1","accountId":"account-canary","senderId":"sender-canary","chatId":"chat-canary","challengeCode":"A1B2C3D4","observedAt":1784068120000}
|
||||
@@ -0,0 +1 @@
|
||||
{"schemaVersion":"aios.personal-weixin.golden.v1","kind":"web.unbind.result","httpStatus":501,"ok":false,"supported":false,"code":"unbind_not_supported","mutationCount":0}
|
||||
@@ -0,0 +1,986 @@
|
||||
{
|
||||
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||
"$id": "https://aios.imruyi.top/contracts/personal-weixin/v1/golden-contract.schema.json",
|
||||
"title": "AIOS Personal Weixin Golden Contract v1",
|
||||
"oneOf": [
|
||||
{
|
||||
"$ref": "#/$defs/entitlement"
|
||||
},
|
||||
{
|
||||
"$ref": "#/$defs/readiness"
|
||||
},
|
||||
{
|
||||
"$ref": "#/$defs/startRequest"
|
||||
},
|
||||
{
|
||||
"$ref": "#/$defs/waitRequest"
|
||||
},
|
||||
{
|
||||
"$ref": "#/$defs/loginResult"
|
||||
},
|
||||
{
|
||||
"$ref": "#/$defs/inboundEvent"
|
||||
},
|
||||
{
|
||||
"$ref": "#/$defs/unbindResult"
|
||||
}
|
||||
],
|
||||
"$defs": {
|
||||
"identifier": {
|
||||
"type": "string",
|
||||
"minLength": 1,
|
||||
"maxLength": 128,
|
||||
"pattern": "^[A-Za-z0-9._~:@-]+$"
|
||||
},
|
||||
"sessionKey": {
|
||||
"type": "string",
|
||||
"minLength": 1,
|
||||
"maxLength": 256,
|
||||
"pattern": "^[A-Za-z0-9._~:-]+$"
|
||||
},
|
||||
"schemaVersion": {
|
||||
"const": "aios.personal-weixin.golden.v1"
|
||||
},
|
||||
"entitlement": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": [
|
||||
"schemaVersion",
|
||||
"kind",
|
||||
"tenantId",
|
||||
"accountId",
|
||||
"effect",
|
||||
"policyVersion",
|
||||
"issuedAtMs"
|
||||
],
|
||||
"properties": {
|
||||
"schemaVersion": {
|
||||
"$ref": "#/$defs/schemaVersion"
|
||||
},
|
||||
"kind": {
|
||||
"const": "tenant.account.entitlement"
|
||||
},
|
||||
"tenantId": {
|
||||
"$ref": "#/$defs/identifier"
|
||||
},
|
||||
"accountId": {
|
||||
"$ref": "#/$defs/identifier"
|
||||
},
|
||||
"effect": {
|
||||
"const": "allow"
|
||||
},
|
||||
"policyVersion": {
|
||||
"$ref": "#/$defs/identifier"
|
||||
},
|
||||
"issuedAtMs": {
|
||||
"type": "integer",
|
||||
"minimum": 0
|
||||
}
|
||||
}
|
||||
},
|
||||
"readinessReason": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": [
|
||||
"code",
|
||||
"field"
|
||||
],
|
||||
"properties": {
|
||||
"code": {
|
||||
"enum": [
|
||||
"field_missing",
|
||||
"snapshot_stale",
|
||||
"plugin_digest_mismatch",
|
||||
"account_not_entitled",
|
||||
"account_not_running",
|
||||
"gateway_error"
|
||||
]
|
||||
},
|
||||
"field": {
|
||||
"type": "string",
|
||||
"minLength": 1,
|
||||
"maxLength": 128
|
||||
}
|
||||
}
|
||||
},
|
||||
"readiness": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": [
|
||||
"schemaVersion",
|
||||
"kind",
|
||||
"tenantId",
|
||||
"selectedAccountId",
|
||||
"gateway",
|
||||
"plugin",
|
||||
"accounts",
|
||||
"ready",
|
||||
"code",
|
||||
"reasons",
|
||||
"observedAtMs",
|
||||
"freshUntilMs"
|
||||
],
|
||||
"properties": {
|
||||
"schemaVersion": {
|
||||
"$ref": "#/$defs/schemaVersion"
|
||||
},
|
||||
"kind": {
|
||||
"const": "personal.weixin.readiness"
|
||||
},
|
||||
"tenantId": {
|
||||
"$ref": "#/$defs/identifier"
|
||||
},
|
||||
"selectedAccountId": {
|
||||
"$ref": "#/$defs/identifier"
|
||||
},
|
||||
"gateway": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": [
|
||||
"reachable",
|
||||
"errorCode"
|
||||
],
|
||||
"properties": {
|
||||
"reachable": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"errorCode": {
|
||||
"type": [
|
||||
"string",
|
||||
"null"
|
||||
],
|
||||
"minLength": 1,
|
||||
"maxLength": 128
|
||||
}
|
||||
}
|
||||
},
|
||||
"plugin": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": [
|
||||
"id",
|
||||
"loaded",
|
||||
"version",
|
||||
"digestSha256"
|
||||
],
|
||||
"properties": {
|
||||
"id": {
|
||||
"const": "openclaw-weixin"
|
||||
},
|
||||
"loaded": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"version": {
|
||||
"type": [
|
||||
"string",
|
||||
"null"
|
||||
],
|
||||
"minLength": 1,
|
||||
"maxLength": 64
|
||||
},
|
||||
"digestSha256": {
|
||||
"anyOf": [
|
||||
{
|
||||
"type": "string",
|
||||
"pattern": "^[a-f0-9]{64}$"
|
||||
},
|
||||
{
|
||||
"type": "null"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"accounts": {
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"maxItems": 100,
|
||||
"items": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": [
|
||||
"accountId",
|
||||
"name",
|
||||
"configured",
|
||||
"enabled",
|
||||
"running",
|
||||
"lastError",
|
||||
"isDefault",
|
||||
"entitled"
|
||||
],
|
||||
"properties": {
|
||||
"accountId": {
|
||||
"$ref": "#/$defs/identifier"
|
||||
},
|
||||
"name": {
|
||||
"type": "string",
|
||||
"minLength": 1,
|
||||
"maxLength": 128
|
||||
},
|
||||
"configured": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"running": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"lastError": {
|
||||
"type": [
|
||||
"string",
|
||||
"null"
|
||||
],
|
||||
"minLength": 1,
|
||||
"maxLength": 256
|
||||
},
|
||||
"isDefault": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"entitled": {
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"ready": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"code": {
|
||||
"enum": [
|
||||
"ready",
|
||||
"not_ready",
|
||||
"error"
|
||||
]
|
||||
},
|
||||
"reasons": {
|
||||
"type": "array",
|
||||
"maxItems": 32,
|
||||
"items": {
|
||||
"$ref": "#/$defs/readinessReason"
|
||||
}
|
||||
},
|
||||
"observedAtMs": {
|
||||
"type": "integer",
|
||||
"minimum": 0
|
||||
},
|
||||
"freshUntilMs": {
|
||||
"type": "integer",
|
||||
"minimum": 0
|
||||
}
|
||||
},
|
||||
"allOf": [
|
||||
{
|
||||
"if": {
|
||||
"properties": {
|
||||
"ready": {
|
||||
"const": true
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"ready"
|
||||
]
|
||||
},
|
||||
"then": {
|
||||
"properties": {
|
||||
"code": {
|
||||
"const": "ready"
|
||||
},
|
||||
"reasons": {
|
||||
"maxItems": 0
|
||||
},
|
||||
"gateway": {
|
||||
"properties": {
|
||||
"reachable": {
|
||||
"const": true
|
||||
},
|
||||
"errorCode": {
|
||||
"const": null
|
||||
}
|
||||
}
|
||||
},
|
||||
"plugin": {
|
||||
"properties": {
|
||||
"loaded": {
|
||||
"const": true
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
},
|
||||
"digestSha256": {
|
||||
"type": "string",
|
||||
"pattern": "^[a-f0-9]{64}$"
|
||||
}
|
||||
}
|
||||
},
|
||||
"accounts": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"configured": {
|
||||
"const": true
|
||||
},
|
||||
"enabled": {
|
||||
"const": true
|
||||
},
|
||||
"running": {
|
||||
"const": true
|
||||
},
|
||||
"lastError": {
|
||||
"const": null
|
||||
},
|
||||
"entitled": {
|
||||
"const": true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"else": {
|
||||
"properties": {
|
||||
"code": {
|
||||
"enum": [
|
||||
"not_ready",
|
||||
"error"
|
||||
]
|
||||
},
|
||||
"reasons": {
|
||||
"minItems": 1
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"startRequest": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": [
|
||||
"schemaVersion",
|
||||
"kind",
|
||||
"accountId",
|
||||
"force",
|
||||
"timeoutMs"
|
||||
],
|
||||
"properties": {
|
||||
"schemaVersion": {
|
||||
"$ref": "#/$defs/schemaVersion"
|
||||
},
|
||||
"kind": {
|
||||
"const": "web.login.start.request"
|
||||
},
|
||||
"accountId": {
|
||||
"$ref": "#/$defs/identifier"
|
||||
},
|
||||
"force": {
|
||||
"const": false
|
||||
},
|
||||
"timeoutMs": {
|
||||
"type": "integer",
|
||||
"minimum": 1000,
|
||||
"maximum": 120000
|
||||
}
|
||||
}
|
||||
},
|
||||
"waitRequest": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": [
|
||||
"schemaVersion",
|
||||
"kind",
|
||||
"accountId",
|
||||
"sessionKey",
|
||||
"timeoutMs"
|
||||
],
|
||||
"properties": {
|
||||
"schemaVersion": {
|
||||
"$ref": "#/$defs/schemaVersion"
|
||||
},
|
||||
"kind": {
|
||||
"const": "web.login.wait.request"
|
||||
},
|
||||
"accountId": {
|
||||
"$ref": "#/$defs/identifier"
|
||||
},
|
||||
"sessionKey": {
|
||||
"$ref": "#/$defs/sessionKey"
|
||||
},
|
||||
"verifyCode": {
|
||||
"type": "string",
|
||||
"pattern": "^[0-9]{4,8}$"
|
||||
},
|
||||
"currentQrDataUrl": {
|
||||
"type": "string",
|
||||
"minLength": 1,
|
||||
"maxLength": 1048576,
|
||||
"pattern": "^data:image/png;base64,"
|
||||
},
|
||||
"timeoutMs": {
|
||||
"type": "integer",
|
||||
"minimum": 1000,
|
||||
"maximum": 120000
|
||||
}
|
||||
}
|
||||
},
|
||||
"loginResult": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": [
|
||||
"schemaVersion",
|
||||
"kind",
|
||||
"status",
|
||||
"accountId",
|
||||
"sessionKey",
|
||||
"connected",
|
||||
"alreadyConnected",
|
||||
"terminal",
|
||||
"needsVerifyCode"
|
||||
],
|
||||
"properties": {
|
||||
"schemaVersion": {
|
||||
"$ref": "#/$defs/schemaVersion"
|
||||
},
|
||||
"kind": {
|
||||
"const": "web.login.result"
|
||||
},
|
||||
"status": {
|
||||
"enum": [
|
||||
"qr_pending",
|
||||
"need_verifycode",
|
||||
"invalid_verifycode",
|
||||
"expired",
|
||||
"failed",
|
||||
"already_connected",
|
||||
"confirmed"
|
||||
]
|
||||
},
|
||||
"accountId": {
|
||||
"$ref": "#/$defs/identifier"
|
||||
},
|
||||
"sessionKey": {
|
||||
"$ref": "#/$defs/sessionKey"
|
||||
},
|
||||
"connected": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"alreadyConnected": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"terminal": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"needsVerifyCode": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"qrDataUrl": {
|
||||
"type": "string",
|
||||
"minLength": 1,
|
||||
"maxLength": 1048576,
|
||||
"pattern": "^data:image/png;base64,"
|
||||
},
|
||||
"userId": {
|
||||
"$ref": "#/$defs/identifier"
|
||||
},
|
||||
"errorCode": {
|
||||
"enum": [
|
||||
"invalid_verifycode",
|
||||
"login_expired",
|
||||
"upstream_failed",
|
||||
"unknown_upstream_status"
|
||||
]
|
||||
},
|
||||
"upstreamStatus": {
|
||||
"type": "string",
|
||||
"minLength": 1,
|
||||
"maxLength": 128
|
||||
}
|
||||
},
|
||||
"allOf": [
|
||||
{
|
||||
"if": {
|
||||
"properties": {
|
||||
"status": {
|
||||
"const": "qr_pending"
|
||||
}
|
||||
}
|
||||
},
|
||||
"then": {
|
||||
"required": [
|
||||
"qrDataUrl"
|
||||
],
|
||||
"properties": {
|
||||
"connected": {
|
||||
"const": false
|
||||
},
|
||||
"alreadyConnected": {
|
||||
"const": false
|
||||
},
|
||||
"terminal": {
|
||||
"const": false
|
||||
},
|
||||
"needsVerifyCode": {
|
||||
"const": false
|
||||
}
|
||||
},
|
||||
"not": {
|
||||
"anyOf": [
|
||||
{
|
||||
"required": [
|
||||
"userId"
|
||||
]
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"errorCode"
|
||||
]
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"upstreamStatus"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {
|
||||
"properties": {
|
||||
"status": {
|
||||
"const": "need_verifycode"
|
||||
}
|
||||
}
|
||||
},
|
||||
"then": {
|
||||
"properties": {
|
||||
"connected": {
|
||||
"const": false
|
||||
},
|
||||
"alreadyConnected": {
|
||||
"const": false
|
||||
},
|
||||
"terminal": {
|
||||
"const": false
|
||||
},
|
||||
"needsVerifyCode": {
|
||||
"const": true
|
||||
}
|
||||
},
|
||||
"not": {
|
||||
"anyOf": [
|
||||
{
|
||||
"required": [
|
||||
"qrDataUrl"
|
||||
]
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"userId"
|
||||
]
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"errorCode"
|
||||
]
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"upstreamStatus"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {
|
||||
"properties": {
|
||||
"status": {
|
||||
"const": "invalid_verifycode"
|
||||
}
|
||||
}
|
||||
},
|
||||
"then": {
|
||||
"required": [
|
||||
"errorCode"
|
||||
],
|
||||
"properties": {
|
||||
"errorCode": {
|
||||
"const": "invalid_verifycode"
|
||||
},
|
||||
"connected": {
|
||||
"const": false
|
||||
},
|
||||
"alreadyConnected": {
|
||||
"const": false
|
||||
},
|
||||
"terminal": {
|
||||
"const": false
|
||||
},
|
||||
"needsVerifyCode": {
|
||||
"const": true
|
||||
}
|
||||
},
|
||||
"not": {
|
||||
"anyOf": [
|
||||
{
|
||||
"required": [
|
||||
"qrDataUrl"
|
||||
]
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"userId"
|
||||
]
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"upstreamStatus"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {
|
||||
"properties": {
|
||||
"status": {
|
||||
"const": "expired"
|
||||
}
|
||||
}
|
||||
},
|
||||
"then": {
|
||||
"required": [
|
||||
"errorCode"
|
||||
],
|
||||
"properties": {
|
||||
"errorCode": {
|
||||
"const": "login_expired"
|
||||
},
|
||||
"connected": {
|
||||
"const": false
|
||||
},
|
||||
"alreadyConnected": {
|
||||
"const": false
|
||||
},
|
||||
"terminal": {
|
||||
"const": true
|
||||
},
|
||||
"needsVerifyCode": {
|
||||
"const": false
|
||||
}
|
||||
},
|
||||
"not": {
|
||||
"anyOf": [
|
||||
{
|
||||
"required": [
|
||||
"qrDataUrl"
|
||||
]
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"userId"
|
||||
]
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"upstreamStatus"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {
|
||||
"properties": {
|
||||
"status": {
|
||||
"const": "failed"
|
||||
}
|
||||
}
|
||||
},
|
||||
"then": {
|
||||
"required": [
|
||||
"errorCode"
|
||||
],
|
||||
"properties": {
|
||||
"connected": {
|
||||
"const": false
|
||||
},
|
||||
"alreadyConnected": {
|
||||
"const": false
|
||||
},
|
||||
"terminal": {
|
||||
"const": true
|
||||
},
|
||||
"needsVerifyCode": {
|
||||
"const": false
|
||||
}
|
||||
},
|
||||
"not": {
|
||||
"anyOf": [
|
||||
{
|
||||
"required": [
|
||||
"qrDataUrl"
|
||||
]
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"userId"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {
|
||||
"required": [
|
||||
"upstreamStatus"
|
||||
],
|
||||
"properties": {
|
||||
"status": {
|
||||
"const": "failed"
|
||||
}
|
||||
}
|
||||
},
|
||||
"then": {
|
||||
"properties": {
|
||||
"errorCode": {
|
||||
"const": "unknown_upstream_status"
|
||||
}
|
||||
},
|
||||
"not": {
|
||||
"anyOf": [
|
||||
{
|
||||
"required": [
|
||||
"qrDataUrl"
|
||||
]
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"userId"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {
|
||||
"required": [
|
||||
"status",
|
||||
"errorCode"
|
||||
],
|
||||
"properties": {
|
||||
"status": {
|
||||
"const": "failed"
|
||||
},
|
||||
"errorCode": {
|
||||
"const": "unknown_upstream_status"
|
||||
}
|
||||
}
|
||||
},
|
||||
"then": {
|
||||
"required": [
|
||||
"upstreamStatus"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {
|
||||
"required": [
|
||||
"status",
|
||||
"errorCode"
|
||||
],
|
||||
"properties": {
|
||||
"status": {
|
||||
"const": "failed"
|
||||
},
|
||||
"errorCode": {
|
||||
"const": "upstream_failed"
|
||||
}
|
||||
}
|
||||
},
|
||||
"then": {
|
||||
"not": {
|
||||
"required": [
|
||||
"upstreamStatus"
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {
|
||||
"properties": {
|
||||
"status": {
|
||||
"const": "already_connected"
|
||||
}
|
||||
}
|
||||
},
|
||||
"then": {
|
||||
"required": [
|
||||
"upstreamStatus"
|
||||
],
|
||||
"properties": {
|
||||
"upstreamStatus": {
|
||||
"const": "binded_redirect"
|
||||
},
|
||||
"connected": {
|
||||
"const": false
|
||||
},
|
||||
"alreadyConnected": {
|
||||
"const": true
|
||||
},
|
||||
"terminal": {
|
||||
"const": true
|
||||
},
|
||||
"needsVerifyCode": {
|
||||
"const": false
|
||||
}
|
||||
},
|
||||
"not": {
|
||||
"anyOf": [
|
||||
{
|
||||
"required": [
|
||||
"qrDataUrl"
|
||||
]
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"userId"
|
||||
]
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"errorCode"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {
|
||||
"properties": {
|
||||
"status": {
|
||||
"const": "confirmed"
|
||||
}
|
||||
}
|
||||
},
|
||||
"then": {
|
||||
"required": [
|
||||
"userId"
|
||||
],
|
||||
"properties": {
|
||||
"connected": {
|
||||
"const": true
|
||||
},
|
||||
"alreadyConnected": {
|
||||
"const": false
|
||||
},
|
||||
"terminal": {
|
||||
"const": true
|
||||
},
|
||||
"needsVerifyCode": {
|
||||
"const": false
|
||||
}
|
||||
},
|
||||
"not": {
|
||||
"anyOf": [
|
||||
{
|
||||
"required": [
|
||||
"qrDataUrl"
|
||||
]
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"errorCode"
|
||||
]
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"upstreamStatus"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"inboundEvent": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": [
|
||||
"eventId",
|
||||
"accountId",
|
||||
"senderId",
|
||||
"chatId",
|
||||
"challengeCode",
|
||||
"observedAt"
|
||||
],
|
||||
"properties": {
|
||||
"eventId": {
|
||||
"$ref": "#/$defs/identifier"
|
||||
},
|
||||
"accountId": {
|
||||
"$ref": "#/$defs/identifier"
|
||||
},
|
||||
"senderId": {
|
||||
"$ref": "#/$defs/identifier"
|
||||
},
|
||||
"chatId": {
|
||||
"$ref": "#/$defs/identifier"
|
||||
},
|
||||
"challengeCode": {
|
||||
"type": "string",
|
||||
"minLength": 6,
|
||||
"maxLength": 64,
|
||||
"pattern": "^[A-Z0-9]+$"
|
||||
},
|
||||
"observedAt": {
|
||||
"type": "integer",
|
||||
"minimum": 0
|
||||
}
|
||||
}
|
||||
},
|
||||
"unbindResult": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": [
|
||||
"schemaVersion",
|
||||
"kind",
|
||||
"httpStatus",
|
||||
"ok",
|
||||
"supported",
|
||||
"code",
|
||||
"mutationCount"
|
||||
],
|
||||
"properties": {
|
||||
"schemaVersion": {
|
||||
"$ref": "#/$defs/schemaVersion"
|
||||
},
|
||||
"kind": {
|
||||
"const": "web.unbind.result"
|
||||
},
|
||||
"httpStatus": {
|
||||
"const": 501
|
||||
},
|
||||
"ok": {
|
||||
"const": false
|
||||
},
|
||||
"supported": {
|
||||
"const": false
|
||||
},
|
||||
"code": {
|
||||
"const": "unbind_not_supported"
|
||||
},
|
||||
"mutationCount": {
|
||||
"const": 0
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,188 @@
|
||||
# V2R1 R10 personal Weixin release-plan amendment
|
||||
|
||||
Status: reviewed design-only amendment. It adds D1, B6, and B7 to the R9 linear release plan. It does not authorize runtime, candidate, production, baseline, tag, or Fleet mutation.
|
||||
|
||||
Authority remains `docs/superpowers/plans/2026-07-14-v2r1-runtime-release-plan.md` at B2 tip `68d27879103990aac692207a8512b3725c6d0d41`. R9 `START` is `a9a0b4ae396e33c9bfc35a5f5694e5e354c3a47c`; accepted B1 is `57103c11d21192a50febe846d30cee6fc5da4ac1`; accepted B2 is `68d27879103990aac692207a8512b3725c6d0d41`. Their trees and path sets are immutable. This amendment does not relabel, squash, reorder, or absorb any of the original five blockers.
|
||||
|
||||
## Exact linear ledger
|
||||
|
||||
The only valid ancestry is:
|
||||
|
||||
```text
|
||||
START -> B1 -> B2 -> D1 -> B3 -> B4 -> B5 -> B6 -> B7
|
||||
```
|
||||
|
||||
`D1` is a non-blocker design dependency whose parent is exactly B2. `B3` parent is D1; every later blocker parent is the immediately preceding row. `START..B7` contains exactly eight non-merge commits: B1, B2, D1, B3, B4, B5, B6, B7. B1-B5 remain five distinct original blocker commits; B6 and B7 are distinct new blocker commits. No cherry-pick collapse, squash, fixup, merge commit, history rewrite, or force push is allowed.
|
||||
|
||||
B3/B4 retain every R9 evidence gate. In particular, unresolved `EVIDENCE_REQUIRED` for the exact provider `client_id -> message_id` binding stops B4 with no implementation, commit, or ledger append. B5 can land only after accepted B4. Even after B5 lands, every forward `stage`, `verify-stage`, or `promote` operation remains blocked until accepted B6 and B7 commits exist and all gates below pass.
|
||||
|
||||
## D1 design-only commit
|
||||
|
||||
D1 changes exactly these 23 paths and no others:
|
||||
|
||||
```text
|
||||
docs/superpowers/plans/2026-07-15-v2r1-personal-weixin-r10-release-plan-amendment.md
|
||||
contracts/personal-weixin/v1/SECURITY.md
|
||||
contracts/personal-weixin/v1/golden-contract.schema.json
|
||||
contracts/personal-weixin/v1/fixtures/01-tenant-account-entitlement.json
|
||||
contracts/personal-weixin/v1/fixtures/02-readiness-ready.json
|
||||
contracts/personal-weixin/v1/fixtures/03-readiness-field-missing.json
|
||||
contracts/personal-weixin/v1/fixtures/04-readiness-stale.json
|
||||
contracts/personal-weixin/v1/fixtures/05-readiness-plugin-digest-mismatch.json
|
||||
contracts/personal-weixin/v1/fixtures/06-readiness-account-not-entitled.json
|
||||
contracts/personal-weixin/v1/fixtures/07-readiness-account-not-running.json
|
||||
contracts/personal-weixin/v1/fixtures/08-readiness-error.json
|
||||
contracts/personal-weixin/v1/fixtures/09-web-login-start-request.json
|
||||
contracts/personal-weixin/v1/fixtures/10-web-login-wait-request.json
|
||||
contracts/personal-weixin/v1/fixtures/11-qr-pending.json
|
||||
contracts/personal-weixin/v1/fixtures/12-need-verify-code.json
|
||||
contracts/personal-weixin/v1/fixtures/13-invalid-verify-code.json
|
||||
contracts/personal-weixin/v1/fixtures/14-expired.json
|
||||
contracts/personal-weixin/v1/fixtures/15-failed.json
|
||||
contracts/personal-weixin/v1/fixtures/16-already-connected.json
|
||||
contracts/personal-weixin/v1/fixtures/17-confirmed.json
|
||||
contracts/personal-weixin/v1/fixtures/18-unknown-upstream-fail-closed.json
|
||||
contracts/personal-weixin/v1/fixtures/19-authenticated-inbound-event.json
|
||||
contracts/personal-weixin/v1/fixtures/20-unbind-unsupported.json
|
||||
```
|
||||
|
||||
D1 validation requires JSON parse, Draft 2020-12 schema validation of every fixture, negative mutation tests, exact 23-path comparison, `git diff --check`, placeholder/secret scan, and confirmation that no runtime/deploy/release-active path changed.
|
||||
|
||||
## Preserved R9 blocker allowlists
|
||||
|
||||
B1 and B2 are already accepted at the immutable SHAs above. Their actual commit path sets, parent SHAs, and trees are the allowlists; compare with `git diff-tree --no-commit-id --name-only -r <sha>` and reject any mismatch. B1 has six actual paths under `openclaw/plugins/aios-tenant-boundary/`; B2 has exactly 43 actual package/import/matrix paths. No later blocker may amend them.
|
||||
|
||||
B3 changes exactly these 15 R9 paths:
|
||||
|
||||
```text
|
||||
active-runtime/app/aios_v2r1/identity.py
|
||||
active-runtime/app/aios_v2r1/tenant_context.py
|
||||
active-runtime/app/aios_v2r1/ingress_service.py
|
||||
active-runtime/app/aios_v2r1/bridge_auth.py
|
||||
active-runtime/app/aios_v2r1/weixin_projection.py
|
||||
fixes/patch_openclaw_weixin_v2r1_ingress.py
|
||||
tests/v2r1/test_bridge_auth.py
|
||||
tests/v2r1/test_weixin_projection.py
|
||||
tests/integration/test_v2r1_bridge_transport.py
|
||||
tests/test_weixin_v2r1_ingress_bridge.py
|
||||
tests/fixtures/weixin_v2r1/text.json
|
||||
tests/fixtures/weixin_v2r1/quoted-text.json
|
||||
tests/fixtures/weixin_v2r1/image-with-text.json
|
||||
tests/fixtures/weixin_v2r1/unresolved-reference.json
|
||||
release/v2r1c0-rc1/weixin-bridge-evidence.json
|
||||
```
|
||||
|
||||
B4 changes exactly these 19 R9 paths and remains evidence-stopped until both R9 evidence files are accepted:
|
||||
|
||||
```text
|
||||
active-runtime/app/aios_v2r1/outbox.py
|
||||
active-runtime/app/aios_v2r1/hermes_http.py
|
||||
active-runtime/app/aios_v2r1/hermes_worker.py
|
||||
active-runtime/app/aios_v2r1/outbound_receipt.py
|
||||
active-runtime/app/aios_v2r1/ingress_service.py
|
||||
active-runtime/app/aios_v2r1/message_ledger.py
|
||||
tests/v2r1/test_outbox.py
|
||||
tests/v2r1/test_hermes_http.py
|
||||
tests/v2r1/test_outbound_receipt.py
|
||||
tests/integration/test_v2r1_delivery_flow.py
|
||||
fixes/patch_openclaw_weixin_outbound_quotes.py
|
||||
fixes/patch_openclaw_weixin_outbound_receipts.py
|
||||
openclaw/plugins/aios-tenant-boundary/dist/receipt-client.js
|
||||
openclaw/plugins/aios-tenant-boundary/dist/outbound-receipt-journal.js
|
||||
openclaw/plugins/aios-tenant-boundary/test/receipt-client.test.js
|
||||
tests/test_weixin_outbound_quote_timestamp.py
|
||||
tests/test_weixin_outbound_receipt_boundary.py
|
||||
release/v2r1c0-rc1/hermes-http-contract-evidence.json
|
||||
release/v2r1c0-rc1/weixin-outbound-binding-evidence.json
|
||||
```
|
||||
|
||||
B5 changes exactly these 14 R9 paths:
|
||||
|
||||
```text
|
||||
deploy/v2r1/release_ctl.py
|
||||
deploy/v2r1/capture_live_preflight.py
|
||||
deploy/v2r1/install.sh
|
||||
deploy/v2r1/validate.sh
|
||||
deploy/v2r1/healthcheck.sh
|
||||
deploy/v2r1/rollback.sh
|
||||
deploy/v2r1/aios-v2r1-candidate-gateway.service
|
||||
deploy/v2r1/aios-v2r1-production-gateway.service
|
||||
deploy/v2r1/aios-v2r1-ingress.service
|
||||
deploy/v2r1/aios-v2r1-hermes-worker.service
|
||||
deploy/v2r1/openclaw-candidate.json5
|
||||
release/v2r1c0-rc1/FLEET_UNSUPPORTED
|
||||
tests/deploy/test_v2r1_release_contract.py
|
||||
release/v2r1c0-rc1/RELEASE.md
|
||||
```
|
||||
|
||||
## B6: evidence-bound OpenClaw personal-Weixin candidate
|
||||
|
||||
B6 changes exactly these 13 paths:
|
||||
|
||||
```text
|
||||
openclaw/candidates/personal-weixin-r10/README.md
|
||||
openclaw/candidates/personal-weixin-r10/manifest.json
|
||||
openclaw/candidates/personal-weixin-r10/src/golden-contract.js
|
||||
openclaw/candidates/personal-weixin-r10/src/gateway-inbound-auth.js
|
||||
openclaw/candidates/personal-weixin-r10/plugin/openclaw.plugin.json
|
||||
openclaw/candidates/personal-weixin-r10/plugin/index.js
|
||||
fixes/patch_openclaw_personal_weixin_login.py
|
||||
fixes/patch_openclaw_personal_weixin_gateway_auth.py
|
||||
openclaw/candidates/personal-weixin-r10/test/golden-contract.test.js
|
||||
openclaw/candidates/personal-weixin-r10/test/gateway-auth.test.js
|
||||
tests/personal_weixin/test_golden_fixtures.py
|
||||
tests/integration/test_personal_weixin_gateway_contract.py
|
||||
release/v2r1c0-rc1/personal-weixin-b6-evidence.json
|
||||
```
|
||||
|
||||
Before B6 code, evidence records exact installed upstream source commit, every patch target path/digest, plugin loader version/digest, Gateway auth owner, credential files, and candidate-only state/config. Stop on inference or drift. Tests are RED before implementation and prove: required nonempty opaque `sessionKey`; no account fallback; exact canonical statuses and readiness shapes; unknown status fail-closed; 4-8 digit one-shot `verifyCode` with no persistence/log/response; exact event body with no authentication/tenant/user/session assertions; transport signature/skew/nonce/replay checks; exact 501 zero mutation; byte-idempotent patches; build/runtime inspect in isolated candidate state. The B6 evidence JSON is produced only after these gates pass.
|
||||
|
||||
## B7: tenant-scoped Portal adapter and durable challenge
|
||||
|
||||
B7 changes exactly these 13 paths:
|
||||
|
||||
```text
|
||||
active-runtime/app/aios_v2r1/personal_weixin/official_login.py
|
||||
active-runtime/app/aios_v2r1/personal_weixin/adapter.py
|
||||
portal/personal_weixin/views.py
|
||||
portal/personal_weixin/urls.py
|
||||
portal/personal_weixin/services.py
|
||||
portal/personal_weixin/templates/personal_weixin/bind.html
|
||||
tests/personal_weixin/test_adapter.py
|
||||
tests/personal_weixin/test_portal_views.py
|
||||
tests/integration/test_personal_weixin_golden_flow.py
|
||||
release/v2r1c0-rc1/personal-weixin-source-baseline.json
|
||||
release/v2r1c0-rc1/personal-weixin-source-baseline.sha256
|
||||
release/v2r1c0-rc1/personal-weixin-canary-contract.json
|
||||
release/v2r1c0-rc1/personal-weixin-rollback-contract.json
|
||||
```
|
||||
|
||||
Tests are RED before B7 implementation and prove: Django authentication/CSRF; server-session tenant resolution; browser `accountId` treated only as a preallocated-slot reference and current entitlement rechecked on every list/readiness/start/wait/status; exact `sessionKey` forwarding without fallback; live canonical readiness; authenticated Gateway transport context separate from the six-field event body; durable challenge record owning tenant/user/account/session digest; hash-only secret storage; transactional/CAS single consumption; exact replay idempotence; altered replay/concurrency/expiry/cross-tenant denial with zero mutation; no provider token/raw iLink/verify code/challenge code persistence or leakage; size/rate/no-store controls; restart; and unbind 501 before all mutations/calls/jobs.
|
||||
|
||||
## Canonical contract gates
|
||||
|
||||
`sessionKey` is nonempty and exact. Canonical results are:
|
||||
|
||||
```text
|
||||
qr_pending connected=false alreadyConnected=false terminal=false needsVerifyCode=false
|
||||
need_verifycode connected=false alreadyConnected=false terminal=false needsVerifyCode=true
|
||||
invalid_verifycode connected=false alreadyConnected=false terminal=false needsVerifyCode=true
|
||||
expired connected=false alreadyConnected=false terminal=true needsVerifyCode=false
|
||||
failed connected=false alreadyConnected=false terminal=true needsVerifyCode=false
|
||||
already_connected connected=false alreadyConnected=true terminal=true needsVerifyCode=false
|
||||
confirmed connected=true alreadyConnected=false terminal=true needsVerifyCode=false
|
||||
```
|
||||
|
||||
`binded_redirect` maps to `already_connected`. An unknown upstream status maps to canonical `failed/errorCode=unknown_upstream_status`. Readiness always uses the same complete shape: missing fields, stale evidence, plugin digest mismatch, absent entitlement, not-running account, and Gateway error all produce `ready=false`; only a live authenticated all-green snapshot produces `ready=true/code=ready`.
|
||||
|
||||
The inbound event body is exactly `eventId/accountId/senderId/chatId/challengeCode/observedAt`; transport authentication and server-resolved tenant/user/session context are not body fields. Fixture secrets are test inputs only. Raw `verifyCode` and `challengeCode` never enter persistence, logs, responses, URLs, analytics, traces, metrics labels, or job arguments. Raw `sessionKey` appears only where the golden login request/result contract requires it; it is never persisted or logged and is forwarded byte-exact without fallback.
|
||||
|
||||
## Merge, canary, promotion, and rollback gates
|
||||
|
||||
For each D1/B3-B7 row: require the exact parent row SHA, one non-merge commit, exact sorted path allowlist, clean `diff --check`, focused and carried tests, reviewer acceptance, then append `label/SHA/parent/tree` to the worktree-local ledger. No row may start from an unaccepted predecessor.
|
||||
|
||||
After B7, rebuild once from the accepted B7 tree. Stage one isolated candidate using B5 controls and no active configuration. Canary exactly one explicitly entitled `(tenant-canary, account-canary)` pair. Before traffic, require live Gateway/plugin/account readiness with expected digests and freshness. Exercise all golden outcomes, invalid and unknown fail-closed paths, restart, concurrent waits, atomic challenge consumption, exact replay, altered replay, expiry, unauthenticated event, tenant/account mismatch, cross-tenant IDOR, secret redaction, and exact end-to-end unbind 501 with zero durable/runtime/upstream/job mutation. Any missing evidence, extra account, digest drift, stale snapshot, noncanonical status, secret observation, or mutation fails the canary and blocks promotion.
|
||||
|
||||
Promotion accepts only the exact artifact/config/plugin/source digests verified by canary; it never rebuilds, repatches, switches branches, edits `VERSION`/`baseline/current.json`, creates a tag, invokes Fleet, or changes unrelated services. Candidate and production artifacts must be byte-identical. B5 live preflight is recaptured and reconciled immediately before `verify-stage` and `promote`.
|
||||
|
||||
Rollback is armed before canary with the immediately preceding production artifact/config/plugin digests, units, credentials metadata, and health contract. On any gate failure, STOP blocks forward actions; invoke only B5's recorded rollback-only path. Restore byte-identical prior artifacts/config, never the candidate rebuild; do not delete STOP automatically; do not roll back the database absent a separately approved incompatibility plan. Verify previous digests, listeners, units, secret paths/modes, canonical readiness, and tenant/account isolation. If verification fails, record `ROLLBACK_FAILED`, keep STOP, and escalate without forward mutation.
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"task_id": "TASK-CODEX-V2R1-PERSONAL-WEIXIN-B6B7-BOOTSTRAP-AND-CANARY-20260715T120000UTC8",
|
||||
"phase": "A",
|
||||
"type": "branch",
|
||||
"branch": "patch/v2r1-personal-weixin-b6b7-impl-20260715T115309UTC8",
|
||||
"base_ref": "design/v2r1-personal-weixin-golden-contract-20260715",
|
||||
"base_commit": "d74229927b2dadca7719455984aea10d010c5123",
|
||||
"created_by": "aiman",
|
||||
"created_at": "2026-07-15T03:53:09Z",
|
||||
"direct_main_push": false,
|
||||
"owner_approval_required": false,
|
||||
"owner_approved": true,
|
||||
"owner_approval_scope": "Phase A bootstrap for owner-approved B6/B7 personal-Weixin implementation; no production, runtime, database, secret, tag, baseline, or controller/ChatGPT worktree changes.",
|
||||
"production_change": false,
|
||||
"user_action_required": false
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"contract": "personal-weixin-b4-outbound-quote-authority-amendment",
|
||||
"ownerApproved": true,
|
||||
"lineage": {
|
||||
"foundationImplementationCommit": "2fcab6f5833a405a9a26683811600b6e5f1aa7b1",
|
||||
"foundationResultCommit": "64a71b6199a8e2bd609ba145349e67b874888505",
|
||||
"r10LineageCommit": "74e603c0c943501110577dbe3c7f6a0b18b8ec7d",
|
||||
"evidenceGateCommit": "62a4067cf7a462ebe7cf29524238bc5d0a70b813",
|
||||
"upstreamAuditCommit": "b2f5f531019a70801444987dbb97dc1f69cf47de"
|
||||
},
|
||||
"vendorClientIdMessageIdEvidence": {
|
||||
"status": "absent",
|
||||
"clientIdPromotable": false
|
||||
},
|
||||
"authorityPolicy": {
|
||||
"outboundQuoteAuthority": "disabled",
|
||||
"clientIdRole": "non-authoritative-correlation-only",
|
||||
"authoritativeMessageIdSources": [
|
||||
"validated-inbound-raw-wire.vendor_message_id"
|
||||
],
|
||||
"quotedSendWithoutAuthoritativeMessageId": "fail-closed",
|
||||
"plainOutboundWithoutQuoteAuthority": "allowed-only-by-existing-b4-allowlist",
|
||||
"syntheticMapping": false,
|
||||
"timestampFallback": false,
|
||||
"localSequenceFallback": false,
|
||||
"contentHashFallback": false,
|
||||
"outboundReceiptFallback": false
|
||||
},
|
||||
"implementationConstraints": {
|
||||
"scopeExpansion": false,
|
||||
"exactAllowlistRequired": true,
|
||||
"missingAllowlistStatus": "BLOCKED_SCOPE",
|
||||
"productionChangeAuthorized": false,
|
||||
"canaryAuthorized": false,
|
||||
"tagAuthorized": false,
|
||||
"forcePushAuthorized": false
|
||||
},
|
||||
"production": {
|
||||
"baseline": "V1R4C6",
|
||||
"changed": false,
|
||||
"releaseStatus": "paused"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"contract": "personal-weixin-r10-lineage-amendment",
|
||||
"foundation": {
|
||||
"node": "F0_PERSONAL_WEIXIN_FOUNDATION",
|
||||
"implementationCommit": "2fcab6f5833a405a9a26683811600b6e5f1aa7b1",
|
||||
"resultCommit": "64a71b6199a8e2bd609ba145349e67b874888505",
|
||||
"imageDigest": "sha256:ed741d1f028c4bd507c6eda71fb1dcc11e0815c0107afcbfcbaaaaa23d5a11bb",
|
||||
"status": "PASS"
|
||||
},
|
||||
"precedes": [
|
||||
"B3",
|
||||
"B4",
|
||||
"B5",
|
||||
"B6",
|
||||
"B7"
|
||||
],
|
||||
"production": {
|
||||
"baseline": "V1R4C6",
|
||||
"changed": false,
|
||||
"releaseStatus": "paused"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user