liderra/portal
1
0
Fork 0
Code Issues Pull Requests Actions 66 Packages Projects Releases Wiki Activity
1,859 Commits 9 Branches 3 Tags
cb32aa990797222f3e2dfbb87f11b862a2330fd2
Commit Graph

182 Commits

Author SHA1 Message Date
Дмитрий cb32aa9907 feat(gate): re-scope router-gate — allow local dev, keep prod+discipline blocks 
composer/npm moved from hard-blacklist to whitelist; git dev-allow (commit/add/branch/switch/checkout/stash/worktree) + push main-guard in shared shell-content-rules; read-only GitHub (get_*/actions_get/actions_list) in mcp-classifier. Prod-safety (deploy/prod-DB/secrets/workflow-triggers/MCP-write), discipline hooks, and main push/merge stay blocked. Spec+plan in docs/superpowers. tools regression 1991 GREEN.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-02 09:32:39 +03:00
Дмитрий f6421fd61c docs(router-gate-v4): calibration 5 plan - cosmetic-detector git-approval exemption 2026-05-31 11:39:20 +03:00
Дмитрий 417cfcbc37 docs(router-gate-v4): CLAUDE.md v2.44 — item 2b judge live + activated + readonly calibration 2026-05-31 09:04:09 +03:00
Дмитрий dfae9f760b feat(router-gate-v4): live main() for LLM-judge wrappers — flag-gated spend (item 2b) 2026-05-31 08:06:26 +03:00
Дмитрий 84dcf4aab3 docs(router-gate-v4): safe-baseline spec v4 + plan + handoff (item 1b) 2026-05-31 05:58:13 +03:00
Дмитрий 4686b36571 docs(region): lead-region-resolution spec v0.5 + 6-session plan 2026-05-30 15:38:54 +03:00
Дмитрий ffd70d6fa5 fix(router-gate-v4): lastTurnEntries skips harness-injected skill bodies (isMeta + sourceToolUseID) 
Sibling Claude session 2026-05-30 found that lastTurnEntries treats
harness-injected skill bodies as spurious turn boundaries, breaking both
enforce-memory-coverage (can't find user's coverage line) AND
enforce-normative-content-rules::detectLegitSkillActive (can't find the
Skill tool_use that lives in the assistant message BEFORE the body).

Refinement applied here: this session inspected 29 isMeta:true entries
across the live transcript (8f4ba767-...jsonl) via a debug helper and
found isMeta:true is ALSO used for "Continue from where you left off"
auto-resume, Stop hook feedback strings, and <local-command-caveat>
wrappers — those are real user-equivalent boundaries that must remain
visible. Sibling's blanket "skip isMeta" proposal would have broken them.

Discriminator: skip ONLY when isMeta === true AND typeof sourceToolUseID
=== 'string' (tool-spawned content). Skill bodies have the linking field;
the other isMeta sources do not. The sourceToolUseID field is harness-
controlled and not writable by controller from inside a tool call —
cannot be spoofed.

Behaviour after fix:
  * Skill body injection → skipped → walk continues back to find user's
    real prompt (with coverage line).
  * The assistant message containing the Skill tool_use is now inside the
    turn → detectLegitSkillActive finds it → normative writes pass when
    invoked under an active claude-md-management skill.
  * "Continue from where you left off." → still treated as turn boundary.
  * Stop hook feedback strings → still treated as turn boundary.

TDD:
  * 3 new tests in tools/enforce-hook-helpers.test.mjs under the
    "lastTurnEntries / lastUserPromptText / lastAssistantText / turnToolUses"
    describe block:
      - lastTurnEntries skips skill body injections (isMeta + sourceToolUseID)
      - lastTurnEntries does NOT skip "Continue from where you left off"
        (isMeta but no sourceToolUseID)
      - turnToolUses includes Skill tool_use spawned in same turn as the
        injected skill body
  * 2/3 RED→GREEN (the "Continue" negative test passed on baseline already
    since its string content satisfies the existing string-content branch).

Scope:
  * Fixes 2 of the 5 structural quirks documented in the Stream H
    completion log (enforce-memory-coverage gap, enforce-normative-
    content-rules detectLegitSkillActive gap).
  * Does NOT fix: enforce-read-path-deny LEGIT_SKILLS exemption gap
    (separate hook, no lastTurnEntries dependency); TDD-gate cross-actor
    blindness (different mechanism — actor session boundaries);
    detectFullTestRun regex narrowness (command-pattern matching).

Regression: vitest tools 1788/1788 GREEN (was 1785; +3 new tests).

Plan: docs/superpowers/plans/2026-05-30-lastturnentries-skill-body-skip.md
 2026-05-30 14:16:12 +03:00
Дмитрий 6973363c37 feat(router-gate-v4): Stream G — register 9 v4 hooks + git add whitelist fix + sub-plan 
settings.json hook registration changes:
- Removed 5 v3.9 hook registrations: enforce-chain-recommendation,
  enforce-classifier-match, enforce-graph-first, enforce-semgrep-security,
  enforce-override-limit
- Added 9 v4 deterministic hooks (no LLM-judge — Stream H follow-up):
  PreToolUse: router-gate (Bash), powershell-gate (PowerShell),
  normative-content-rules (Edit|Write|MultiEdit), tdd-real-test-verifier (Edit|Write),
  self-debrief-detector (Edit|Write|MultiEdit|Bash),
  askuser-cosmetic-detector (AskUserQuestion), mcp-classification (mcp__.*)
  PostToolUse Task: subagent-return-scanner
  Stop: todowrite-skill-verifier

shell-content-rules.mjs fix:
- Added 'add' to GIT_CONDITIONAL_SUB whitelist. Without it git add was default-deny
  by rule 5 even after approval — broke entire git workflow under v4 router-gate.

TODO Stream H (integration gaps discovered):
1. askuser-answer-parser needs PostToolUse(AskUserQuestion) wrapper
2. Schema mismatch Stream E vs Stream B approval records
3. llm-judge hooks need ROUTER_LLM_KEY config
4. decomposition-detector needs LLM-judge integration
5. parallel-session-lock pure module not implemented

Regression: 1707/1707 vitest tools GREEN.
 2026-05-30 06:56:35 +03:00
Дмитрий 6010443307 merge(router-gate-v4): Stream E — AskUser + subagent 
7 commits / 10 files / +2824 lines:
- askuser-answer-parser (S27/E33/E34 + parse + approval)
- punctuation-aware stop detection + review nits (BOM/JSDoc/??)
- cosmetic AskUser detector (v4.1 §4.5)
- subagent return scanner + G2 narrative + structured schema
- anchor 'всё ок' narrative pattern (no false-match inside 'всё окно')
- subagent-prompt-prefix inheritance (256-bit sentinel, restricted/ paths)

Stream tests pass.
 2026-05-30 05:09:07 +03:00
Дмитрий d27d8b6780 merge(router-gate-v4): Stream D — LLM-judge Layer 4 
13 commits / 10 files / +3017 lines:
- multiJudgeConsensus 3-judge any-YES + cache/budget
- per-tool LLM-judge pure decision + PreToolUse hook wiring
- response-scan deterministic layer + LLM layer + Stop hook
- normative-content path matcher + content extraction
- normative-content deterministic layers + multi-judge Layer 4
- normative-content PreToolUse hook wiring
- ProxyAPI live integration smoke

Stream tests pass.
 2026-05-30 05:08:41 +03:00
Дмитрий a15e95e79d merge(router-gate-v4): Stream C — static scan + MCP path-deny 
8 commits / 11 files / +3066 lines static-content-scanner / framework-boot-scanner / glob-restricted-filter / mcp-tool-classifier / commit-message-scanner.

Review fixes: browser_navigate host-boundary (SSRF spoof), boot-scan best-effort.
 2026-05-30 05:08:01 +03:00
Дмитрий fd9e755b6f merge(router-gate-v4): Stream B — Bash/PowerShell content rules 
16 commits / 11 files / +2849 lines:
- Bash hard-blacklist (v3.9+v4.0 C16/#4/#21/#22/#34 + v4.1 G7/G8 wget/nc)
- Bash whitelist + script-execution file-watcher
- classifyBashCommand integration + bashContentClassify export
- Bash gate main() + dynamic path-normalize fallback (fail-CLOSE)
- PowerShell tokenizer + hard-blacklist (keep + v4.1 G10 PS env)
- classifyPowerShellCommand (whitelist + path-deny + git route)
- PowerShell gate main() (fail-CLOSE)
- shared classifyGitCommand (readonly/conditional/hard incl G5/G6 gpgsign/--no-verify)
- Review fixes: 2>&1 fd-duplication allowed, git -c RCE closed, runtime-dir path-deny

Stream tests pass.
 2026-05-30 05:05:15 +03:00
Дмитрий 632882cace test(router-gate): ProxyAPI live integration smoke + stream D sub-plan (stream D task 13) 
Opt-in live smoke (ROUTER_LLM_LIVE_TEST=1 + ROUTER_LLM_KEY); auto-skips otherwise
so it never pollutes the unit regression in worktrees where undici is unresolved.
Checkpoint-1 live result on owner machine: PASS (2/2) — single Sonnet judge + 3-judge
consensus (Sonnet 4.6 + Haiku 4.5 + Opus 4.7) reach all models with real verdicts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-29 20:55:20 +03:00
Дмитрий 2e7f0c9ac7 docs(plans): router-gate v4 Stream E sub-plan (AskUser + subagent) 2026-05-29 20:21:43 +03:00
Дмитрий 6f438df18b docs(plans): sync Stream C plan with review fixes (browser_navigate boundary + base64 fixture) 2026-05-29 19:57:12 +03:00
Дмитрий 7ebe6c5bcc docs(plans): router-gate v4 Stream C sub-plan (static scan + MCP path-deny) 2026-05-29 19:30:21 +03:00
Дмитрий 5b8109ea55 docs(plans): router-gate v4 Stream B sub-plan (shell content parsing) 2026-05-29 19:29:17 +03:00
Дмитрий 4e15fa70ff docs(plans): router-gate v4 handoff instructions (5 prompts + merge + deploy) 
Handoff document for non-programmer user — how to launch 5 parallel
Claude sessions, monitor progress, merge results, and activate v4.0+v4.1+v4.2.

Contains:
- Ready-to-copy prompts for Streams A, B, C, D, E
- VM Sandbox hands-on guide pointer (Stream F)
- Checkpoint 1 merge instructions
- Stream G (cleanup + register) prompt
- User-run Smokes guide
- Stream H (brain-retro + docs sync) prompt
- Final verification + worktree cleanup

+ cspell vocab additions (промты, мониторьте) for Russian content.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-29 18:55:38 +03:00
Дмитрий c4c2afd111 docs(plans): router-gate v4 master coordination plan (9 streams, parallel sessions) 
Master plan orchestrates 9 streams (A-H + checkpoints) для параллельного
multi-session запуска. Каждый stream работает над disjoint set файлов
в tools/ или docs/ — 0 conflicts по конструкции.

Streams:
- A: Pure decision modules (8 файлов, ~250 unit tests) — independent
- B: Bash/PowerShell content rules — independent (stub path-norm)
- C: Static scan + framework boot + Glob F8 + MCP classifier — independent
- D: LLM-judge Layer 4 (multi-judge + per-tool + response scan) — independent
- E: AskUser parser + subagent return scanner — independent
- F: VM-sandbox setup (user hands-on) — independent
- G: Cleanup 5 v3.9 hooks + settings.json register — sequential after A-E
- Smokes 1-9 user-run — sequential after G
- H: Brain-retro Table 16-17 + recovery docs + Pravila/PSR/Tooling sync — sequential

Wall-clock: 16-23h parallel (vs 49-65h sequential).

User chose Subagent-Driven execution в параллельных сессиях.
Each parallel session invokes writing-plans для своего stream sub-plan'а,
затем subagent-driven-development для реализации.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-29 18:47:21 +03:00
Дмитрий e964d70c28 docs(plans): ADR-018 Stage 5 follow-up — AuditRebuildChain per-tenant fix 
8 TDD tasks (~день кода): extract shared AuditChainConfig, refactor VerifyAuditChains (regression-safe), failing tests для multi-tenant/BYPASSRLS/single-row, rewrite AuditRebuildChain через LAG OVER (partition_clause ORDER BY id) симметрично verify, активация ADR-018 enforcement rules, Pint/Larastan/Pest --parallel smoke, handoff для прод-cleanup activity_log_y2026_m05 через gh workflow run artisan-run.yml. Self-review GREEN на spec coverage / placeholders / типы. Execution mode: subagent-driven.
 2026-05-29 15:56:35 +03:00
Дмитрий 8b60a18298 plan(router-gate): 51-task implementation plan (audit-integrated) 
Master implementation plan covering:
- 6 phases per spec §8 Этапы (1 / 1.1-1.8 / 2 / 2.1.0 smoke / 2.1
  subagent inheritance / 2.2 constraints + block-file / 2.3
  branch-switch / 3 settings.json / 4 recovery / 6 brain-retro)
- 51 TDD tasks with bite-sized 3-5 steps each
- All 8 MUST critical inline fixes integrated (CRITICAL-1/3/4/5/6/8/9/10)
- All 5 SHOULD-FIX findings tasked (vitest globalSetup / git format-patch /
  approved_action_pattern / chain reset organic-only / chain-state
  malformed fail-CLOSE)
- 5 DOS findings tasked (D-1/2/3/8/9) + 2 deferred (D-7 subagent
  reader-writer lock, partial coverage; full split deferred to refinement)

Architecture: single PreToolUse hook tools/enforce-router-gate.mjs
+ PostToolUse handler tools/router-gate-post.mjs. Pure decision
functions in tools/router-gate-{decide,bash,askuser,path,state,
static-scan,quality,chain,coverage,cache,config,subagent}.mjs +
thin I/O wrapper. 10 state files at ~/.claude/runtime/*.

Execution: subagent-driven-development (recommended) или
executing-plans inline. Plan self-review verified all 63 spec
design decisions + 13 audit-driven decisions covered.

Source spec: 2026-05-29-router-gate-hard-wall-design-condensed.md
(commit 71b07e52, audit-integrated).
Audit report: 2026-05-29-router-gate-condensed-adversarial-audit.md

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-29 10:06:06 +03:00
Дмитрий 0067174154 docs(audit): mark Tasks 1-3 complete, add prod deploy instructions 
Tasks 1-3 DONE on branch worktree-agent-acf422b86772ab536:
- Task 1 (06fbb238): race condition test (pcntl skip + pg_locks advisory check)
- Task 2 (41fb0d94): migration — pg_advisory_xact_lock in audit_chain_hash
- Task 3 (7081f2a7): audit:rebuild-chain command + 4 GREEN tests

Task 4 updated with factual prod deploy steps:
- merge worktree branch to main + deploy.yml
- artisan-run whitelist needs audit:rebuild-chain in MUTATING_RE
- --force flag required (non-interactive CI mode)
- consecutive_failures reset after verified clean chains

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-29 09:20:57 +03:00
Дмитрий c454a3bedd docs(plan): update Task 4 with actual deployment commands (no migrations needed) 
Task 4 уточнён: нет миграций (только PHP), fast-fail активируется сразу после
деплоя. Добавлены конкретные gh workflow run команды для cleanup (Steps 3-4 из
sql-runner.yml) и верификации шторма + incidents алерта. Галочки [ ] оставлены
(задача контроллера, не агента).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-29 09:11:28 +03:00
Дмитрий bf181350ca docs: stage 5 day 1 handoff + 2 fix plans for findings 1 and 2 (audit-chain race + webhook storm) with PII masks 2026-05-29 07:02:14 +03:00
Дмитрий 5c02d33cce feat(stage5): daily monitor workflow + remove non-existent partitions:list from artisan-run whitelist + checklist refinement (GitHub-cron 06:00 UTC daily 29.05-04.06 runs scheduler:check-heartbeats + incidents:watch-failures + migrate:status + 4 SQL signals from incidents_log/project_routing_snapshots/failed_webhook_jobs/scheduler_heartbeats; window auto-stops after 2026-06-05; result to job summary + artifact) 2026-05-29 05:42:30 +03:00
Дмитрий c95445de47 plan(router-discipline): Level 1+2 implementation plan 
5-task plan to close 3 enforcement gaps surfaced by brain-retro #10:
 1. Narrow 'recovery' override scope (5→2 categories)
 2. Narrow 'ремонт инфраструктуры' override scope (11→3)
 3. Per-rate-window in enforce-override-limit (5/10min)
 4. Lower classifier-match threshold 0.8→0.6 + inline router-skip

Driver: 679 override events on 2026-05-28 vs 12 baseline on 25.05.
User selected option B (Level 1+2) after brain-retro #10 analysis.

All 4 implementation tasks completed via subagent-driven workflow
(commits 09f6e332, 029dbe50, 2b23a1f2, 726c2121).
Final regression 1179/1179 GREEN. Plan saved post-implementation.

Also: cspell-words.txt += 'суппрессить' (project term used in plan).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-28 17:55:58 +03:00
Дмитрий 98dc24b33f docs(plan): Phase 4 router-hooks — Semgrep-security hook + chain-hook measurement 2026-05-28 13:23:04 +03:00
Дмитрий 4d7e9e338b docs(session 2026-05-28): brain-retro 8/9, self-retrospect, sanity, Phase 1-3 plans 
Groups documentation produced during 2026-05-28 brain-retro session:
retro notes 8 (carryover) and 9, self-retrospect 1, sanity check JSON,
three Phase plans for router-hooks fixes. All implementation already
pushed in earlier commits — this commit groups artifact metadata.

Plus typo fixes in self-retrospect (agregatov, seryj) and cspell vocab
extensions for session-specific terms (PAMYATKA / procs / russian verbs).

Pure documentation. No code, no normative drift.
 2026-05-28 12:26:05 +03:00
Дмитрий 64b0a3d944 docs(billing-v2-c): спек C + план реализации (преfflight + VTB) 
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-26 20:38:50 +03:00
Дмитрий 9ca75a788a docs(slepok): spec v0.4 + plan + CLAUDE.md v2.29 + ПИЛОТ — design-only artefacts, прод не затронут (audit session 135a4adf) 2026-05-26 19:21:33 +03:00
Дмитрий 6f70cca90e docs: spec + plan for hard-rule enforcement (10 rules + override vocab) 2026-05-25 18:10:31 +03:00
Дмитрий da4ab729df docs(supplier): spec + 3 plans for webhook reliability (phases 1-3) 
Investigation 2026-05-25: for tenant client1 (tenant_id=2) on prod liderra.ru:
  - 205 leads at supplier (info@lkomega.ru, visit=rt) vs 160 deals on portal
  - 82 leads lost (76 via 302-redirect from ValidationException, mostly
    non-B-prefix projects: client.carmoney.ru, cashmotor.ru, etc.)
  - 37 duplicate deals (CSV-recovered SupplierLead vid=null + later
    webhook with real vid "create two Deals because supplier_lead_deliveries
    locks on supplier_lead_id, not phone+project)

Three independent fixes, three plans, three deploys:
  Phase 1 (low risk): Always JSON 422 for webhook ValidationException
  Phase 2 (med risk, billing): merge webhook-after-CSV-recovered into
    existing deal, no double-charge
  Phase 3 (high risk, migration): accept non-B projects as platform=DIRECT
    end-to-end (controller + 4 services + migration)

Phase 3 includes new LeadRouter fallback path: DIRECT-supplier_projects
match Liderra projects via signal_type+signal_identifier directly
(no project_supplier_links pivot required, since psl rows don't exist
for auto-created DIRECT supplier_projects).

Refs: docs/superpowers/specs/2026-05-25-supplier-webhook-reliability-design.md
 2026-05-25 16:25:22 +03:00
Дмитрий 26999ca597 chore: working tree cleanup pre-llm-first-router merge 
Три группы накопившихся auto-правок (НЕ ручные):

1. markdownlint --fix auto-format (~25 .md в docs/superpowers/, docs/security/marketing-vet.md, docs/adr/015, docs/deploy/lkomega-runbook): MD031/MD032 (blank lines around fence/list) + MD004 (bullet markers `+`→`-`). Содержательных текстовых правок 3: ADR-015 bullet, sprint5d-cleanup bullet, router-discipline trailing space.

2. lefthook 2.1.6 → 2.1.8 (package.json + lock): patch-bump, авто-резолвил npm.

3. Observer runtime (docs/observer/): episodes-2026-05.jsonl +420 строк (текущая активность мозга), STATUS.md regen, .pii-counters / .read-counter тики, +2026-05-24-brain-retro.md note.

Цель — разблокировать merge feat/llm-first-router → main (этап 0 плана постановки в боевой). Содержание ветки не трогает.
 2026-05-25 14:23:11 +03:00
Дмитрий b2cbc57533 docs(brain): spec v2.3 + plan v1.2 — coverage announcement (§4.9) + decision confirmed 
Coverage announcement — новая фича прозрачности (brainstorm 2026-05-25):
заказчик всегда видит чем покрыта задача (skill/node/hook/direct) в прозе
+ TodoWrite. Источник — classifier_output. Enforcement через economy-mode
reminder (economy сохраняется). Flag coverage-annotation-mode (10-й).
Тайминг — в составе overhaul Phase 3.

spec v2.2 → v2.3:
- §4.9 (новое) Coverage announcement — 2 поверхности, формат пометки,
  источник, enforcement, flag, тайминг, откат.
- §10 flags table +coverage-annotation-mode (9→10 флагов).
- §11.3 Phase 3 +task coverage announcement.
- §23 (новое) changelog v2.2→v2.3.

plan v1.1 → v1.2:
- DECISION POINT ✅ ПОДТВЕРЖДЁН: economy keep / §12 remove.
- Task 19 +step 8 coverage announcement (economy-mode reminder + Pravila §17
  подпункт + memory feedback_coverage_announcement + flag).

brainstorm Q&A: Q1 поверхности=проза+TodoWrite; Q2 состав=skill+node+hook+direct;
Q3 enforcement=convention+reminder; Q4 тайминг=в составе overhaul.

НЕ исполняется (per user — план).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-25 07:31:33 +03:00
Дмитрий 7d31d0be39 docs(brain): plan v1.1 — откат мозга первым + 9 пробелов 0%-аудита 
v1.0 → v1.1 после полного 0%-аудита плана.

ГЛАВНОЕ: Task 1 = «Откат мозга» — полная инфра + snapshot user-level
(~/.claude/settings.json + hooks/*.py + runtime flags) + dry-run +
END-TO-END SMOKE (тривиальная правка → откат → verify) ДО любой
деструкции. Если откат не зелёный — дальше не идём.

9 закрытых пробелов:
- G3 (КРИТИЧЕСКОЕ): user-level hooks смешивают economy-mode (0%/5%/100%,
  СОХРАНИТЬ) и §12 skill-discipline (СНЯТЬ). Task 2 разделяет: snimaet
  skill-marker.py+skill-check.py, оставляет economy-*.py, чистит §12 из
  economy-state-guard.py + economy-mode.py. DECISION POINT для заказчика.
- G16: brain-retro-opus-reviewer.mjs НЕ существует → Task 18 CREATE
  (не «keep from v2.0» как было в v1.0/spec).
- G11: router-accuracy-runner.mjs:11 import classifyByRegex сломается →
  Task 10 чинит на regex-fallback модуль.
- G14: registry-to-classification-map.mjs нейтрализуется (Task 4).
- G8/G9: C1/C2 адаптируются рано (Task 6), чтобы lefthook не блокировал
  коммиты Task 7-15.
- G5: parser forward-compat к v4 эпизодам после отката (Task 15).
- user-level rollback + episodes preservation в test-rollback.mjs/ROLLBACK.md.

Прочее: test-rollback.mjs использует execFileSync (не execSync — без shell,
без инъекции). 21 задача (было 22 в v1.0, консолидация rollback в Task 1).

Self-review: spec coverage + 16 находок v2.2 + 9 находок аудита плана,
type consistency, 0 placeholders.

НЕ исполняется сейчас (per user «только план»).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-25 06:31:11 +03:00
Дмитрий 2b7a71c5b6 docs(brain): implementation plan фазы 1+2+3 LLM-first router overhaul 
План из spec v2.2 — 22 задачи (Task 0 pre-flight + 8 phase-1 + 8 phase-2
+ 6 phase-3) в bite-sized TDD-формате.

Phase 1 (foundation+archive): tag + archive scaffold + inventory hooks +
discipline-metrics decision + test-rollback.mjs (TDD) + archive §12/routing-
docs/memory + §17+ADR-016 + cross-refs §12→§17 + flags+ROLLBACK.md.

Phase 2 (classifier): router-config + nodes.yaml capabilities + prefilter
3 группы/manual-override/anchor (TDD) + Sonnet 4.6 classifier+памятка (TDD)
+ missed-activations на nodes.yaml (TDD) + embedding (TDD) + §17 gate (TDD,
D1 continuation-not-exempt) + prehook inheritance+cost (TDD) + parser v4.0
+ C1/C2 adapters + warmup hook + flags flip.

Phase 3 (evidence loop): Stop-hook execution_trace+chain_gaps+inheritance-
copy (TDD) + self_assessment (TDD) + reviewer subagent verify + direct-API
fallback handler + sanity-generator + brain-retro v2 procedure + self-
retrospect skill + analyzer v4 + status-md cost sections + schema v4.3 +
final flags + rollback dry-run verification.

Self-review: spec coverage (8 слоёв + §17 + 16 находок v2.2), 0 placeholders
(кроме намеренного model-ID резолва Task 0/9), type consistency проверена.

Реализация — после Биллинга v2 Спек C. Фаза 4 (distillation) — отдельный
план через ~6 месяцев. НЕ исполняется сейчас (per user).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-25 06:08:08 +03:00
Дмитрий af6c328933 docs(billing-v2-c): спек C + план реализации (preflight + VTB) 
Спек: preflight баланса на cut-off 18:00 MSK (защита от заказа лидов
клиентам без денег) + VTB-эквайринг через TopupGateway-интерфейс
(безнал полный, СБП/карты dev-заглушки до Б-1).

План: 6 фаз TDD-разбивкой, ~30 задач, subagent-driven-development
с git-verify-протоколом per Pravila §15.1.

Брейнсторм 24.05.2026, реализация стартует 25.05.

Lint: гибрид «Преfflight»→«Префлайт» (опечатка предыдущей сессии),
+6 терминов в cspell (Atol/uniqid/ОФД/брейнсторме/префлайт/Префлайт).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-25 03:09:07 +03:00
Дмитрий 352354e30b docs(billing): plan — sync after Phase 1 impact-checks (RED FLAG: webhook_dedup_keys жив) 
Phase 1 impact-check выявил что webhook_dedup_keys использует HistoricalImportService
(CSV-канал) для идемпотентности — таблицу и модель НЕ удаляем.

Изменения в плане:
- Task 1.8: заполнена финальная таблица (13 удалить, 2 оставить).
- Task 3.0 NEW: чистка tenants.webhook_token из 7 тест-файлов + фабрики + Tenant model.
- Task 3.3 CANCELLED: WebhookDedupKey.php остаётся.
- Task 4.1: миграция БЕЗ DROP webhook_dedup_keys; verify-команды скорректированы.
- Task 4.2: db/schema.sql baseline сохраняет CREATE TABLE webhook_dedup_keys.
 2026-05-24 15:30:38 +03:00
Дмитрий 136bad4db2 docs(router-stage3): план — 3 follow-up фикса с TDD-шагами 
Декомпозиция: Task 1 (UTF-8 helper + 3 хука), Task 2 (state-enricher),
Task 3 (parser enrichment), Task 4 (smoke + continuity + push).

Subagent-driven последовательно: Task 1-3 Sonnet, Task 4 controller Opus.
Worktree от свежего origin/main + junction'ы. Финал — push на main FF.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-24 15:20:23 +03:00
Дмитрий 36ada767f4 docs(plan): implementation plan for controller-offload agents (3 tasks) 
3-task TDD-ish plan to create two new project agents:
- Task 1: .claude/agents/normative-sync.md (full Sonnet 4.6 system prompt)
- Task 2: .claude/agents/prod-deploy-validator.md (8 SSH checks + quirks 104-108)
- Task 3: First dry-run smoke test for both + capture lessons in memory

Spec: docs/superpowers/specs/2026-05-24-controller-offload-agents-design.md (71a5dd6).
Also: +2 cspell-words (маппинге, dogfooded).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-24 15:19:01 +03:00
Дмитрий 4dbf78b204 docs(billing): plan — legacy ProcessWebhookJob removal implementation 
7 фаз: Phase 0 worktree → Phase 1 impact-checks (8 grep'ов) →
Phase 2 удаление core (job + 1 dedicated test) →
Phase 3 удаление обвязки (controller + route + model + conditional
NotificationService методы + Mailable) →
Phase 4 DROP-миграция БД (3 таблицы + 2 колонки tenants) →
Phase 5 регрессия + code review →
Phase 6 merge + deploy + 7д наблюдение.

Все conditional-блоки гейтятся на impact-checks Phase 1
(финальный список — Task 1.8 inline).

Spec: 2026-05-24-legacy-direct-webhook-removal-design.md

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-24 15:05:19 +03:00
Дмитрий a68ea3964c Merge remote-tracking branch 'origin/feat/router-overhaul-stage-2-measurements' into worktree-router-stage3-enforcement 2026-05-24 09:17:18 +03:00
Дмитрий 688da5d38b docs(stage3): spec amendment (Task 0a/0b + chain governance) + implementation plan 
Spec amendment 2026-05-24:
- Task 0a — доменная разметка реестра (keyword-триггеры на 30+ узлах)
- Task 0b — цепочки L1-L16 в рекомендациях classifier'а
- Chain governance — правила создания/изменения цепочек (без auto-правок Claude)

Plan этапа 3: 10 тасков, 2 checkpoint'а (Phase A accuracy review,
24h warn-only window перед enforce). Phase A — classifier без блокировок.
Phase B — enforcement. Phase C — continuity + push.

Triggered by заказчик 2026-05-24 после закрытия этапа 2:
«есть скилы для биллинга/маркетинга/безопасности — но не используются»
+ «как создаются и меняются цепочки».

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-24 09:06:37 +03:00
Дмитрий b8adeeb9fd docs(stage2): commit plan + observer evidence from this session 
План этапа 2 (8 тасков subagent-driven) + эпизоды наблюдателя
текущей сессии разработки + PII-counters file.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-24 07:50:05 +03:00
Дмитрий 3fdfd92c9e docs(billing-v2): спек B — план реализации (политика дублей) 
8 задач: baseline → таблица-замок supplier_lead_deliveries → раздача
по клиентам (LeadRouter DISTINCT ON) → удаление DuplicateDetector из
обоих джобов → замок insertOrIgnore → тесты (model-agnostic) → регрессия.
Вариант B. Заякорено на always-rub LedgerService (Спек A в origin/main).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-23 20:44:51 +03:00
Дмитрий 9bbc653640 docs(plan): admin tenant balance edit implementation plan 2026-05-23 20:02:37 +03:00
Дмитрий 6c6939a473 feat(audit): hole #2 partitioning APPLIED on prod — rewrite SQL + docs (Phase B/C) 
Партиционирование 7 audit-таблиц применено на боевой liderra.ru 23.05.2026.
Закрывает ПОСЛЕДНЮЮ (7-ю) дыру аудита журналирования — эпик завершён.

* `db/migrations/2026_05_23_hole2_partition_audit_tables.sql` — фактический
  rewrite-SQL применённый на проде (источник истины = pg_dump прода, НЕ schema.sql):
  - 7 таблиц → PARTITION BY RANGE (created_at|received_at), PK→(id, partition_key)
  - 6 месячных партиций _yYYYY_mMM (m02..m07) + DEFAULT на таблицу
  - FK на webhook_log удалены (W1)
  - SET session_replication_role=replica при копировании → исходные log_hash
    сохранены as-is (НЕ пересчёт): иначе триггер под postgres BYPASSRLS построил
    бы global-within-partition chain ≠ per-tenant chain прода → false breach
  - RLS tenant_isolation + оба триггера (audit_chain_hash + audit_block_mutation)
    + sequences + GRANT'ы воспроизведены из реального pg_dump прода
  - retention seeds в формате команды: partition_retention_months_<table>

* Метод деплоя (max-safety, клиент info@lkomega.ru не пострадал):
  - РЕПЕТИЦИЯ на liderra_rehearsal (restore прод-dump) ДО боя — counts/lkomega-t2/
    chain-fingerprints совпали байт-в-байт, audit:verify-chains intact
  - На боевом: backup pre-partitioning-20260523-162357.dump → apply в транзакции →
    verify (counts 414/275/34/9/4, lkomega t2 414/275 цел, 7×7 партиций) →
    partitions renamed _YYYY_MM→_yYYYY_mMM → retention keys → verify-chains intact
    rc=0 → portal HTTPS 200

* ПИЛОТ.md §6 п.11 — #2 ✅ + известные нюансы (create-months под app-роль / schema.sql drift)
* tracker — все 7 дыр ✅, эпик завершён

NB: db/schema.sql разошёлся с реальным продом по колонкам 4 таблиц
(activity_log/webhook_log/balance_transactions/pd_processing_log) — прод-rewrite
построен из pg_dump прода. Ресинхронизация schema.sql↔prod — отдельная задача.

Phase A (tooling: VerifyAuditChains per-partition + PartitionsDropExpired +
MonthlyPartitionManager whitelist + schema.sql v8.31) уже на main (60ab5be3).
 2026-05-23 19:30:32 +03:00
Дмитрий 60ab5be3eb feat(audit): partitioning 7 audit-таблиц по месяцам (hole #2 Phase A) 
Закрывает последнюю дыру #2 аудита журналирования. Phase A (dev) — миграция
схемы + retention tooling. Phase B (прод-rewrite через SQL под postgres) —
отдельным шагом с явным approve.

Решения заказчика:
* Scope: все 7 таблиц (auth_log, activity_log, tenant_operations_log,
  webhook_log, balance_transactions, pd_processing_log, saas_admin_audit_log)
* FK на webhook_log: W1 — удалить FK от failed_webhook_jobs+rejected_deals_log
* Retention defaults: auth:24м, activity:36м, tenant_ops:24м, webhook:3м,
  balance:84м, pd:36м, saas_admin:84м. Cron Sundays 03:00 МСК
* Hash-chain: per-partition (audit_chain_hash трг через TG_TABLE_NAME уже
  работает per-partition; совместимо с hole #1 per-RLS-scope fix)

Phase A:
* db/schema.sql v8.30→v8.31: 7 audit-таблиц на PARTITION BY RANGE,
  PK→(id, partition_key), +7 retention seeds в system_settings,
  FK от failed_webhook_jobs/rejected_deals_log удалены
* MonthlyPartitionManager: PARTITIONED_TABLES → ассоциативный array
  (name => partition_key), 2 → 9 таблиц
* PartitionsCreateMonths: автоматически покрывает все 9
* load_initial_schema: после schema.sql вызывает Artisan
  partitions:create-months --ahead=2 (без этого первый INSERT падает)
* 2026_05_22_000001_tenant_operations_log: idempotency guard
* VerifyAuditChains: per-partition scan через pg_inherits;
  fallback на single-scope для не-партиционированной таблицы;
  per-RLS-scope partition_clause сохранён внутри каждой партиции
* AuditChainBreachMail: +partitionName param (NULL=fallback на tableName)
* PartitionsDropExpired (новая): cron Sundays 03:00 МСК, retention из
  system_settings, dry-run mode, safety guard retention=0
* SchedulerHeartbeatTracker +partitions:drop-expired (10080 мин)

Без Laravel-миграции для прода — она оставляла БД пустой при migrate:fresh.
Подход: schema.sql декларирует партиционированные + ad-hoc SQL под postgres
для прод-rewrite (отдельный commit + ручной деплой + pg_dump backup).

Тесты: 1219/1231 (35/35 hole #2 specs, 88 assertions). 3 fail —
pre-existing AdminPdSubjectRequestsControllerTest::executeErasure_*
(FK actor_admin_user_id после partitioning pd_processing_log, отдельная
задача для hole #4 follow-up, не блокирует).

cspell +2 слова (партиционировать, дёшева). Pint --fix чистый.

Spec: docs/superpowers/specs/2026-05-23-hole-2-audit-partitioning-design.md
Plan: docs/superpowers/plans/2026-05-23-hole-2-audit-partitioning-plan.md
 2026-05-23 15:50:37 +03:00
Дмитрий aad48de6f6 docs(plan): router overhaul этап 1 — машиночитаемый реестр (13 tasks) 
Plan для этапа 1 (Справочник) router discipline overhaul. 13 атомарных задач,
TDD-стиль, экзотические шаги (как парсить Tooling) — ручные с верификацией.

Структура:
- Pre-flight (PF-1..3): sync + npm deps + tools/ структура.
- Phase A (Task 1-4): JSON Schema + 3 пилотных узла + registry-load.mjs
  + 11 unit-тестов.
- Phase B (Task 5-7): registry-render.mjs + auto-region маркеры
  + snapshot-тесты.
- Phase C (Task 8-10): 83 узла + L1-L16 chains + diff-check совместимости.
- Phase D (Task 11-13): lefthook job warn-only + полный README + STATUS.md
  continuity + memory tracker + PR.

Поведение Claude не меняется — реестр пока ничего не enforce ит.
Это фундамент для этапов 2-4.

cspell: +валидируется, +рендериться.

Spec: docs/superpowers/specs/2026-05-23-router-discipline-overhaul-design.md
Self-review встроен в конец плана.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-23 13:54:27 +03:00
Дмитрий 705608b5ad docs(plan): observer parser skill/hook expand — 5-task TDD plan 
Spec terminology aligned with codebase: recommended_skill →
recommended_node (classification-map хранит Tooling IDs `#NN`, не имена
skill'ов). Test runner — vitest (npm run test:tools), не node --test.
Missed-activations filter тоже поднимается до >=2.

5 atomic TDD commits: hook-resolver, recommended-node, parser+smoke,
analyzer factor-axis, brain-retro template.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-23 13:10:06 +03:00