111 lines
12 KiB
JSON
111 lines
12 KiB
JSON
{
|
|
"date": "2026-09-18",
|
|
"scope": "go-sip local development only",
|
|
"working_tree": "dirty-project-worktree",
|
|
"source_contract": {
|
|
"active_bundle": "contracts/upstream/v1",
|
|
"release_kind": "project-owned-development-baseline",
|
|
"external_authority": false,
|
|
"source_bundle": "2026-09-17-snapshot",
|
|
"source_head": "fa6925010ba47976d2e99893eac92140b3cb0d09",
|
|
"source_worktree": "dirty-inherited-only",
|
|
"manifest": "contracts/upstream/manifest.txt"
|
|
},
|
|
"implemented_local_scope": [
|
|
"Go 1.27.1 single module with Cobra agent and dispatcher subcommands",
|
|
"project-owned W01 contract release with strict envelope/event/AI/authorization/OSS/static-artifact/profile schemas and positive/negative fixtures",
|
|
"project-owned W02 agent.v1 Unary gRPC Proto, generated Go stubs, error/idempotency/fencing contract and deterministic Buf generation",
|
|
"SQLite inbox/tasks/quotas/reservations/controls/replays/outbox and durable scheduler_state persistence with transactional reservation finalization",
|
|
"RabbitMQ adapter bounded prefetch=1 and per-tenant dead-letter topology",
|
|
"tenant-key-preserving routing and durable command idempotency",
|
|
"file-backed Agent execution state, transcript/assets, crash-to-unknown recovery and corruption quarantine",
|
|
"immutable full-AI and ASR-only snapshot validation/cache with explicit mode matching",
|
|
"RabbitMQ transport adapter with versioned command/event exchanges, tenant queue declaration, publisher confirms, ACK/requeue/permanent-reject handling, and internal control/query/replay HTTP handler",
|
|
"single-active Dispatcher lease with renewal/expiry and dispatching-outbox restart recovery",
|
|
"Unary gRPC session generation fencing, admission/task CAS, execution permit/fact deduplication, upload metadata boundary, optional immutable AI authorization enforcement, static Cell artifact activation validation, and local RPC handler tests",
|
|
"TLS 1.3 mTLS server/client configuration with CA verification, SAN check and deployment-file loading",
|
|
"Agent CLI optional mTLS gRPC listener with graceful shutdown and mock-only upload policy",
|
|
"Agent direct grant-bound upload client with HTTPS/host/size/checksum/redirect guards",
|
|
"strict transcript.updated realtime/archive event writer and recording.ready verification guard",
|
|
"bounded/cancellable local full-AI and ASR-only mock pipeline",
|
|
"Pion RTP v1.10.5 bounded packet-policy adapter without a custom RTP parser",
|
|
"static Cell artifact schema/deployment-binding validator and Agent startup path for Cell/source/digest/revision/egress/trunk checks",
|
|
"Agent direct OSS upload grant expiry/object-key/HTTPS/host/size/checksum/redirect boundary",
|
|
"Rust loopback filesystem OSS mock with bounded object keys, optional upload token, atomic writes and SHA-256 ETag for local acceptance",
|
|
"SaaS contract/fixture Mock using versioned schemas, negative fixtures, immutable AI snapshots and RabbitMQ fixture flow; no live SaaS HTTP",
|
|
"gopsutil host/process resource sampling with media/AI dimensions explicit unknown",
|
|
"hardened non-root systemd templates and local acceptance script"
|
|
],
|
|
"checks": [
|
|
{"command": "buf lint && buf build && buf generate", "status": "passed"},
|
|
{"command": "go test ./...", "status": "passed"},
|
|
{"command": "go test -race ./...", "status": "passed"},
|
|
{"command": "go vet ./...", "status": "passed"},
|
|
{"command": "go build ./...", "status": "passed"},
|
|
{"command": "go mod verify", "status": "passed"},
|
|
{"command": "govulncheck@v1.7.0 ./... (built with Go 1.27.1)", "status": "passed", "result": "no vulnerabilities found"},
|
|
{"command": "make check", "status": "passed"},
|
|
{"command": "make release + SHA256SUMS verification", "status": "passed", "scope": "local-development manifest; source_dirty preserved"},
|
|
{"command": "make acceptance-local", "status": "passed"},
|
|
{"command": "mock Agent + Dispatcher binary smoke run", "status": "passed"},
|
|
{"command": "Dispatcher Cobra strict endpoint inventory + mTLS R01 Probe/R02 Activate loopback smoke", "status": "passed", "scope": "owner-authorized Debian ECS; current-tree mock binaries; not production"},
|
|
{"command": "Dispatcher Cobra two-Agent/two-Cell loopback inventory + session smoke", "status": "passed", "scope": "owner-authorized Debian ECS; same-host two loopback processes; not physical Cells or production"},
|
|
{"command": "RPC configured Agent/Cell identity binding rejects wrong endpoint metadata", "status": "passed", "scope": "local unit test plus current-tree same-host smoke"},
|
|
{"command": "Dispatcher restart-based CA root replacement rejects old client and accepts replacement client", "status": "passed", "scope": "owner-authorized Debian ECS; mock loopback; no live rotation claim"},
|
|
{"command": "Dispatcher wrong-inventory Agent/Cell misbinding is rejected with PermissionDenied", "status": "passed", "scope": "owner-authorized Debian ECS; mock loopback"},
|
|
{"command": "Dispatcher same-Agent-boot restart advances session generation 1 to 2", "status": "passed", "scope": "owner-authorized Debian ECS; mock loopback; no active-call migration claim"},
|
|
{"command": "Agent leaf certificate fingerprint allowlist accepts configured Dispatcher and rejects same-CA unauthorized client", "status": "passed", "scope": "owner-authorized Debian ECS; mock loopback"},
|
|
{"command": "Project AgentCoordinator ExecuteRaw over mTLS returns permit and accepted receipt in mock mode", "status": "passed", "scope": "owner-authorized Debian ECS; no SIP originate or real call"},
|
|
{"command": "Dispatcher ExecuteReserved SQLite quota/command/reservation over mTLS returns accepted receipt and task_status=running", "status": "passed", "scope": "owner-authorized Debian ECS; mock Agent; no SIP originate or MQ application receipt"},
|
|
{"command": "internal/rpc TLS/session/CAS/idempotency/persisted-generation tests", "status": "passed"},
|
|
{"command": "internal/rpc immutable AI authorization and static Cell artifact activation tests", "status": "passed"},
|
|
{"command": "real Agent configuration requires AGENT_STATIC_ARTIFACT", "status": "passed"},
|
|
{"command": "internal/health gopsutil sample freshness/unknown tests", "status": "passed"},
|
|
{"command": "internal/dispatcher AgentCoordinator, reservation-to-Agent integration, durable fair-cursor restart, two mock Cell tests, and contract-backed local flow", "status": "passed"},
|
|
{"command": "internal/store SQLite outbox dispatching close/reopen recovery and Dispatcher claimed-outbox replay", "status": "passed"},
|
|
{"command": "internal/dispatcher TestOutboxProcessCrashRecovery", "status": "passed", "scope": "isolated test subprocess exits after durable outbox claim; parent reopens and publishes recovered row"},
|
|
{"command": "targeted W06 RPC mTLS/session/activation and Agent spool/event recovery tests", "status": "passed", "scope": "isolated local"},
|
|
{"command": "R01 pre-activation GetAgentStatus probe, Dispatcher AgentCoordinator boot binding, and R02 activation tests", "status": "passed", "scope": "isolated local"},
|
|
{"command": "TLS trust-root rotation rejects the previous client CA and accepts the replacement", "status": "passed", "scope": "isolated local; full shared-certificate rotation/revocation remains open"},
|
|
{"command": "targeted W12 tenant replay/outbox retry/no-originate-retry tests", "status": "passed", "scope": "isolated local"},
|
|
{"command": "internal/mq and tenant bounded-prefetch/DLQ topology unit tests", "status": "passed", "scope": "adapter-only"},
|
|
{"command": "make mq-integration-local", "status": "passed", "scope": "disposable RabbitMQ 4.1.8 Docker broker; adapter plus Dispatcher consume/inbox/task/outbox/event flow; no production broker"},
|
|
{"command": "internal/agent direct upload and event-writer tests; successful upload retains source asset until verified handoff", "status": "passed"},
|
|
{"command": "AGENT_CALL_OSS_INTEGRATION=1 go test ./internal/oss ./internal/rpc -run 'TestAlibabaOSS(GrantPutHead|DispatcherUploadDurable)Integration' -count=1", "status": "passed", "scope": "authorized Alibaba OSS presigned PUT/HEAD plus Dispatcher durable completion and recording.ready outbox; no SaaS application receipt"},
|
|
{"command": "local SaaS contract/fixture Mock checks", "status": "passed", "scope": "check-contracts, internal contract/AI fixture tests, disposable MQ fixture flow; no live SaaS HTTP"},
|
|
{"command": "internal/agent expired/object-bound upload grant tests", "status": "passed"},
|
|
{"command": "Alibaba OSS source asset policy", "status": "passed", "scope": "upload-only test; source remains local until verified handoff; no OSS delete attempted"},
|
|
{"command": "internal/ai mock pipeline tests", "status": "passed"},
|
|
{"command": "internal/media Pion RTP packet-policy tests, including exact PCMA PT=8 payload preservation", "status": "passed"},
|
|
{"command": "isolated ari/v5.3.1 ExternalMedia/GetVariable API compile PoC", "status": "passed", "scope": "temporary module outside project"},
|
|
{"command": "isolated openai-go/v3.62.0 streaming parameter/retry protocol-mock PoC", "status": "passed", "scope": "temporary module outside project"},
|
|
{"command": "isolated dashscopego/v0.1.2 Paraformer API compile PoC", "status": "passed", "scope": "temporary module outside project", "note": "endpoint injection/real provider still blocked"},
|
|
{"command": "isolated doubao-speech-go pseudo-version ASR/TTS API compile PoC", "status": "passed", "scope": "temporary module outside project", "note": "TTS speed/volume/pitch reachability gate remains blocked"},
|
|
{"command": "owner-authorized ECS SIPp one-shot INVITE signaling to all three registered providers", "status": "passed", "scope": "15003164745 only; first window 数企=480, 中鼎=404, 百应=183 then timeout; later allowed window 数企=100/183, 中鼎=100, 百应=100/183/180, all without 200/connected call/media"},
|
|
{"command": "internal/contract static Cell artifact schema/binding tests", "status": "passed"}
|
|
],
|
|
"not_claimed": [
|
|
"G0/W04 is not passed",
|
|
"The W01 bundle is project-owned and explicitly not externally authoritative",
|
|
"No approved production RabbitMQ, OSS, SaaS, AI supplier, completed provider SIP call, Dispatcher/Agent production mTLS deployment, two-Cell, or P1 production acceptance was run; owner-authorized ECS did perform three one-shot provider INVITE signaling attempts plus one later user-confirmed provider-second direct-PJSIP probe, all without a verified connected call, while its Asterisk/PJSIP/ARI/PJSUA2 work remained isolated compatibility evidence; the latest temporary PCAP was deleted after sanitized analysis",
|
|
"No completed phone call, RTP/media, paid AI/OSS handoff, or provider-side billing result was verified; SIP credentials/From-PAI mapping remain unconfirmed. The first and later non-200/non-final-200 INVITE outcomes are recorded in docs/evidence/20260918-real-sip-provider-calls.md and docs/evidence/20260919-real-sip-provider-calls-retry.md, while the ECS test host and fixed EIP remain recorded in docs/evidence/20260918-cloud-host-bootstrap.md",
|
|
"RPC mock grants and mock:// upload IDs are not verified OSS assets or recording.ready events",
|
|
"The full W05-W16 integration, capacity, N+1, cutover and second-tenant acceptance remains incomplete"
|
|
],
|
|
"acceptance_matrix": "docs/evidence/20260918-acceptance-matrix.md",
|
|
"cloud_host_bootstrap": "docs/evidence/20260918-cloud-host-bootstrap.md",
|
|
"w06_mtls_cloud": "docs/evidence/20260918-w06-mtls-cloud.md",
|
|
"w09_ari_runtime": "docs/evidence/20260918-w09-ari-runtime.md",
|
|
"w09_sip_ari": "docs/evidence/20260918-w09-sip-ari.md",
|
|
"w09_sip_rtp_ari": "docs/evidence/20260918-w09-sip-rtp-ari.md",
|
|
"g0_status": "docs/evidence/20260918-g0-status.md",
|
|
"rabbitmq_integration": "docs/evidence/20260918-rabbitmq-integration.md",
|
|
"next_release_blockers": [
|
|
"External authority/role/real-budget sign-off for the project-owned W01 baseline",
|
|
"D10 remaining endpoint-injection, Asterisk/SIP/recording, Volcengine TTS parameter, OSS and broker integration evidence",
|
|
"Cross-Cell final permit/barrier, two-Cell/cross-host endpoint-role authorization, certificate lifecycle, health sampling, and fault-injection integration beyond the local Dispatcher-to-Agent seam",
|
|
"Real or separately authorized mock-broker/AI/media/OSS integration and production P1 two-Cell evidence",
|
|
"Management-approved static artifact, production Agent ARI/SIP/ExternalMedia/media implementation, and real integration credentials/authorization"
|
|
]
|
|
}
|