feat: validate single-client broadcast operations

2026-09-19 14:33:26 +08:00
parent e321d38fa3
commit c7c0ab273f
62 changed files with 2861 additions and 12651 deletions
@@ -0,0 +1,39 @@
+# Web UI / MCP 验收记录（2026-09-19）
+
+## 范围
+
+本记录验证普通用户 Web 工作台、多 Client 隔离，以及消息、通讯录、任务的只读任务队列闭环；它是只读基线，不覆盖随后单 Client 验证模式下的写操作。Web UI 的发送、群发、添加好友提交仍保持禁用；真实 Client API 的 `send-text`/`broadcast-text` 受控证据见[单 Client 生产验证记录](WebUI-MCP-single-client-2026-09-19.md)。
+
+## Linux 自动检查
+
+| 检查 | 结果 |
+| --- | --- |
+| `cd control-plane && go test ./...` | 通过 |
+| `cd control-plane/web && npm run build` | 通过；生成 `index-BkrtfWai.css`、`index-_unPe9bQ.js` |
+| `dotnet test tests/node-agent/WxAgent.Core.Tests -c Release --no-restore` | 通过；168 tests，0 failed，0 skipped |
+| `dotnet build WxAgent.sln -c Release -p:EnableWindowsTargeting=true --no-restore` | 通过；0 warnings，0 errors |
+| `git diff --check` | 通过 |
+
+## Web UI 只读联调
+
+- 控制面：`http://127.0.0.1:8090/`；测试身份为本地测试管理员。
+- 使用两个隔离的 fake Client（`client-a` / `client-b`）持续发送 heartbeat，并只处理真实控制面任务队列中的读取任务；fake Client 不是产品能力，也不计入 Windows 真机通过数。
+- 浏览器实测消息页默认打开；Client 切换后会清空旧会话上下文并丢弃过期响应。
+- Client A 的会话、消息正文、通讯录/群和任务记录均可通过队列读取；切换 Client 后不串用数据。
+- 发送按钮、群发提交、添加好友按钮均保持 `disabled`，并显示未完成能力/真机验收原因。
+- 桌面及 390px 窄屏布局通过浏览器检查，无横向溢出；加载、空列表、离线、错误和权限提示由 UI 提供明确状态。
+
+## Windows 真机检查
+
+发布包为 `WxAgent.Host` self-contained `win-x64` single-file，上传至 `C:\Users\Rogee\wx-agent`，在已登录的交互式 Windows 用户会话（Session 1）中执行：
+
+- 微信版本：`4.1.13.65`。
+- `doctor`：通过；`WindowFound=true`，`MainView/session_list/chat_message_page/chat_message_list/chat_input_field/tool_bar_accessible` 均为 `true`，`Errors=[]`，`InputDesktopAvailable=true`。
+- `inspect-ui --output artifacts/ui-tree.json`：通过；164 个脱敏节点，`sanitized=true`。
+- `smoke`：通过；`scope=M1`，目标为白名单“文件传输助手”，`sendSkipped=false`，`confirmed=true`。该命令是既有 CLI smoke 的受控写验证，不代表 Web UI 已开放写操作。
+
+## 未完成/保留限制
+
+- Web UI 的消息发送、群发、添加好友提交继续禁用；后端验证模式的 `send-text` 与 `broadcast-text` 已有真实单 Client 证据，详见单 Client 记录，默认部署仍保持只读。
+- fake Client 只验证控制面任务路由和 Client 隔离，不替代真实 Desktop Agent 的只读能力验收。
+- 未进行外部网络部署、MCP 客户端兼容性和长时事件流验收；不改变功能矩阵中对应状态。
@@ -0,0 +1,69 @@
+# Web UI / MCP 单 Client 生产验证记录（2026-09-19）
+
+## 验证范围
+
+通过项目 `.mcp.json` 连接 Windows MCP，在已登录、未锁定的 Session 1 中验证一个真实微信 Client（账号 Rogee）。本轮不验证添加好友和多 Client；只使用白名单对象：文件传输助手、Hao 豪、吉祥三宝、消息测试专用群组。
+
+## 连接与放行
+
+- `.mcp.json` 的 `windows-ui` endpoint：`http://10.1.1.101:8765/mcp`；连接成功。
+- Windows `WxAgent.Tray` 在 Session 1 运行；微信版本由 status 报告为 `4.1.13.65`。
+- `GET /api/v1/status` 返回 200：service、WeChat、session、window 和 active account binding 均可用，未使用 Session 0。
+- UI target `11460:81724928` 与账号 Rogee 绑定，`isBound=true`。
+- 本轮在单 Client 的 `service.json` 显式启用 `enableValidationOperations=true`；`local-admin` 凭据获得 `write` 权限。代码默认仍为关闭，普通部署不自动放行写操作。
+- capability 当前启用 `session-open`、`sessions-scroll`、`send-text`、`broadcast-text`；两种写能力仅因本机明确授权的 `enableValidationOperations=true` 而开放，普通部署仍保持只读。`group-at-all` 保持 disabled，因为当前 Client 没有注册该独立操作。群消息和受控群发均使用已确认的会话 automation ID。
+
+## 只读结果
+
+- UIA 真实会话列表导出 16 个条目，包含“文件传输助手”“Hao 豪”“吉祥三宝”等。
+- 当前会话读取成功为“文件传输助手”。消息 API 返回 200，4 条真实消息，类型为 Text/Merge/File/Text；使用 `includeContent=false` 验证脱敏读取。
+- 联系人读取分别命中“文件传输助手”“Hao 豪”“吉祥三宝”；群查询命中“消息测试专用群组”（群 ID 不写入本记录）。
+- 名称不唯一/不存在时 API 返回 409 NotFound，`retry=false`；没有自动猜测、跨目标改投或自动重试。
+
+## 写操作结果
+
+### 文件传输助手
+
+- 首次通过服务操作提交的错误 target 格式（联系人 ID `filehelper`）得到 `Unconfirmed / ExecutionFailed`，`hasSideEffects=true`；未重放、未自动重试。
+- 随后使用 Windows MCP 在真实微信输入框发送唯一测试标记 `[WxAgent验证] UI 单 Client 发送验证 20260919-0239`；UIA 消息列表出现该消息，写后确认通过。
+
+### 吉祥三宝群
+
+- 使用可见会话 automation ID `session_item_吉祥三宝` 提交 confirmed `send-text`，操作 ID：`c3be6c1e07c14c2f9fdc685357c44993`。
+- 结果：`state=Succeeded`、`stage=complete`、`hasSideEffects=true`。
+- 相同 idempotency key 重放返回同一 operation ID，没有创建重复操作；验证了幂等防重。
+- 微信真实会话列表的“吉祥三宝”预览出现唯一测试标记 `[WxAgent验证] 单 Client 群消息验证 吉祥三宝 20260919-0258`，作为写后 UI 确认。
+- `confirmed=false` 的负向请求返回 HTTP 409 `ConfirmationRequired`、`retry=false`，没有执行。
+
+### 多目标文本群发（broadcast-text）
+
+- 原始 HTTP 响应、请求 fixture、能力/授权状态、幂等重放、确认门禁、只读 sessions/messages 响应和 MCP UIA 摘录已保存于 [`evidence/WebUI-MCP-single-client-2026-09-19/`](evidence/WebUI-MCP-single-client-2026-09-19/)，其中 `README.md`、`manifest.json` 和 `sha256sums.txt` 说明采集边界、脱敏规则和校验方式。
+- 使用真实 Client API 提交 `kind=broadcast-text`，请求携带两个当前可见且唯一的会话 automation ID：`session_item_文件传输助手`、`session_item_吉祥三宝`，并设置 `confirmed=true`、`stopOnError=true`。服务在执行前冻结该名单，不使用联系人 ID 猜测或跨目标改投。
+- 首次诊断操作 `7b3a9ff33550489eb7fe50478bbd1155` 曾在文件传输助手成功后因吉祥三宝 `ControlNotFound` 按 `stopOnError` 停止；该记录保留为失败停止和幂等证据，未自动重试。
+- 修正 UI 会话切换为可见中心点击，并将等待聊天页从 2.5 秒扩大到 10 秒后，重新部署最新 self-contained Tray。最终验收操作 ID：`463b37b2e0944525af4ded822dddaf8c`；Correlation ID：`33d6e14673834c64b5d470a07687c760`；`state=Succeeded`、`stage=complete`、`errorCode=null`。
+- 最终操作冻结同一两个白名单目标：文件传输助手 `Succeeded`、吉祥三宝 `Succeeded`；`stopped=false`、`stopReason=null`。这证明了真实多对象名单冻结、串行逐项发送、两个目标写后确认和成功群发。
+- 相同 `idempotencyKey=wxagent-single-20260919-broadcast-final-001` 重放返回同一个操作 ID和相同 `Succeeded` 结果（重放请求 Correlation ID：`858fd45fc16e4b1383909d4d406ae8bc`），没有创建第二次群发。服务 capability 实际返回 `send-text`/`broadcast-text` 为 `implemented=true`、`validated=true`、`enabled=true`、`requiresConfirmation=true`，微信版本 `4.1.13.65`；`group-at-all` 仍为 disabled。
+- 群发结束后分别用只读 `GET /api/v1/messages` 查询两个 automation ID 对应会话，均返回 4 条可见消息，并在不记录完整正文的前提下确认本次唯一标记存在（`markerConfirmed=true`）。
+
+### 未通过/保持禁用
+
+- `消息测试专用群组` 当前搜索结果存在多个同名项，使用联系人群 ID 的操作返回 `Unconfirmed / NotFound`；未猜测目标、未重试，仍保持该路径禁用。
+- `group-at-all` 独立能力没有注册操作，仍禁用；本轮不宣称已验证 @所有人。
+- 添加好友未验证，入口继续禁用。
+- 多 Client、跨 Client 故障恢复和远程控制面任务流不属于本轮证据。
+
+## 自动检查
+
+- `cd control-plane && go test ./...`：通过。
+- `cd control-plane/web && npm run build`：通过。
+- `dotnet test tests/node-agent/WxAgent.Core.Tests -c Release --no-restore`：168 tests 通过。
+- `dotnet test tests/node-agent/WxAgent.Service.Tests -c Release --no-restore`：22 tests 通过，包含 `broadcast-text` 冻结、顺序、停止和幂等覆盖。
+- `dotnet build WxAgent.sln -c Release -p:EnableWindowsTargeting=true --no-restore`：0 warnings、0 errors。
+- `git diff --check`、Go `gofmt`：通过。
+
+## 风险与后续
+
+- 版本证据不一致已在最终部署中修正：`GET /api/v1/capabilities` 与 status 均报告微信 `4.1.13.65`，send/broadcast 均为 `validated=true`。
+- 首次诊断中的错误 target 保留为失败停止证据；没有重试该不确定操作，修复后使用新的显式幂等键完成最终成功验收。
+- 早期诊断曾出现 60 秒 sessions 队列超时；修复后连续 3 次 sessions 刷新均 HTTP 200、约 2.1–2.3 秒，且两个目标的只读 marker 回读均成功，不再作为本轮验收阻塞项。
+- 当前验证模式只应留在这台明确授权的单 Client；未授权部署必须保持默认只读。
@@ -0,0 +1,40 @@
+# 单 Client 真实验证原始证据
+
+本目录保存 2026-09-19 在已登录、未锁定的 Windows Session 1 上采集的原始 HTTP API 响应、请求 fixture、MCP UIA 证据摘录和校验清单。它补充 `../WebUI-MCP-single-client-2026-09-19.md`，不是用文档自述替代接口响应。
+
+## 采集边界
+
+- Windows UI MCP：`.mcp.json` 中的 `windows-ui`，`http://10.1.1.101:8765/mcp`。
+- UI MCP 用于确认真实微信窗口、`MainView`、`session_list`、两个白名单 automation ID、`chat_message_list` 和验收标记；对应的可审计摘录见 `mcp-ui-evidence.json`。
+- Agent HTTP API 在 Windows 测试服务的本地转发端口访问：`http://127.0.0.1:15088`，请求 Host 为 `localhost:5088`。这不是把 `/api/v1/*` 当作 MCP endpoint，而是记录 `.mcp.json` 连接的真实 Client 所运行服务的认证 API 响应。
+- 每个 `*.http.txt` 是原始响应头，每个 `*.response.json` 是原始响应体；文件中没有 Bearer token。测试 token 只从本地/远端验证配置读取，未复制到仓库。
+- 消息只读证据使用 `includeContent=false`，保留条数、fingerprint 和 summary 中的唯一测试标记，不保存完整聊天正文。
+
+## 证据对应关系
+
+| 文件 | 证明内容 |
+| --- | --- |
+| `status.*` | 服务在线、微信可用、Session 未锁定、账号绑定、微信版本 `4.1.13.65`、默认只读 |
+| `capabilities.*` | `send-text`/`broadcast-text` 为 implemented、validated、enabled；群发要求确认；`group-at-all` disabled |
+| `sessions-1..3.*` | 连续 3 次只读会话枚举均 HTTP 200，均含 `session_item_文件传输助手` 和 `session_item_吉祥三宝` |
+| `broadcast.request.json` | 最终真实群发请求：两个 automation ID、显式确认、幂等键、`stopOnError=true` |
+| `broadcast-submit.*` | 原始 POST 受理响应：HTTP 200、operation `463b37b2e0944525af4ded822dddaf8c`、`Queued`、冻结目标详情 |
+| `broadcast-get.*` | 原始最终操作响应：operation `463b37b2e0944525af4ded822dddaf8c`、`Succeeded/complete`、两个逐项 `Succeeded` |
+| `broadcast-replay.*` | 相同幂等请求的原始重放响应，返回相同 operation ID 和结果 |
+| `confirmation-gate.*` | `confirmed=false` 的真实 `broadcast-text` 请求返回 HTTP 409 `ConfirmationRequired`，`retry=false` |
+| `send-confirmation-gate.*` | `confirmed=false` 的真实 `send-text` 请求返回 HTTP 409 `ConfirmationRequired`，`retry=false` |
+| `messages-filehelper.*`, `messages-jixiang.*` | 两个目标的原始只读消息响应；summary 含本次唯一标记、content 为 null |
+| `readback-summary.json` | 从上述 raw 只读响应计算的脱敏回读结论 |
+| `mcp-ui-evidence.json` | UI MCP 实时窗口/UIA 树中真实微信、白名单会话、消息列表和标记的证据摘录 |
+
+## 关键断言
+
+- 最终 operation：`463b37b2e0944525af4ded822dddaf8c`，Correlation ID：`33d6e14673834c64b5d470a07687c760`。
+- 最终详情的冻结顺序为文件传输助手、吉祥三宝；两项均 `Succeeded`，`stopped=false`，无错误码。
+- 相同幂等键 `wxagent-single-20260919-broadcast-final-001` 的重放仍返回该 operation ID，不创建第二次操作。
+- 失败停止流程的早期原始记录仍在主验收文档中，避免只保留成功路径；最终验收使用了新的显式幂等键。
+- `group-at-all`、添加好友、多 Client/跨 Client 恢复不属于本轮证据。
+
+## 复核方式
+
+在已授权的验证机上设置临时 shell 变量 `TOKEN` 后，可按 `*.http.txt` 中的 Host 和路径重放 GET；不得把 token 写入文件或日志。POST 请求只能使用目录中的 confirmation-gate fixture（应返回 409）或最终 broadcast fixture（相同幂等键应返回相同操作），不得绕过确认门禁或使用真实非白名单对象。
@@ -0,0 +1,10 @@
+HTTP/1.1 200 OK
+Content-Type: application/json; charset=utf-8
+Date: Sat, 19 Sep 2026 04:22:44 GMT
+Server: Kestrel
+Cache-Control: no-store
+Transfer-Encoding: chunked
+X-Correlation-Id: 35ec468485244ba98ba9751327d6b5f7
+X-Content-Type-Options: nosniff
+Referrer-Policy: no-referrer
+Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'
@@ -0,0 +1 @@
+{"id":"463b37b2e0944525af4ded822dddaf8c","principalId":"local-admin","accountId":"a2e8a1eaab7fd5fbd3806525c0d9cce750c28f4efb8e7cfcabc9e3e8660e0277","capability":"broadcast-text","state":"Succeeded","stage":"complete","correlationId":"33d6e14673834c64b5d470a07687c760","createdAt":"2026-09-19T04:09:45.5025818+00:00","expiresAt":"2026-09-19T04:14:45.5025818+00:00","errorCode":null,"hasSideEffects":true,"details":"{\"targetIds\":[\"session_item_\\u6587\\u4EF6\\u4F20\\u8F93\\u52A9\\u624B\",\"session_item_\\u5409\\u7965\\u4E09\\u5B9D\"],\"items\":[{\"targetId\":\"session_item_\\u6587\\u4EF6\\u4F20\\u8F93\\u52A9\\u624B\",\"state\":\"Succeeded\",\"errorCode\":null},{\"targetId\":\"session_item_\\u5409\\u7965\\u4E09\\u5B9D\",\"state\":\"Succeeded\",\"errorCode\":null}],\"stopped\":false,\"stopReason\":null}"}
@@ -0,0 +1,10 @@
+HTTP/1.1 200 OK
+Content-Type: application/json; charset=utf-8
+Date: Sat, 19 Sep 2026 04:22:44 GMT
+Server: Kestrel
+Cache-Control: no-store
+Transfer-Encoding: chunked
+X-Correlation-Id: 94d46404d54a43babfe5bb855f767518
+X-Content-Type-Options: nosniff
+Referrer-Policy: no-referrer
+Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'
@@ -0,0 +1 @@
+{"id":"463b37b2e0944525af4ded822dddaf8c","principalId":"local-admin","accountId":"a2e8a1eaab7fd5fbd3806525c0d9cce750c28f4efb8e7cfcabc9e3e8660e0277","capability":"broadcast-text","state":"Succeeded","stage":"complete","correlationId":"33d6e14673834c64b5d470a07687c760","createdAt":"2026-09-19T04:09:45.5025818+00:00","expiresAt":"2026-09-19T04:14:45.5025818+00:00","errorCode":null,"hasSideEffects":true,"details":"{\"targetIds\":[\"session_item_\\u6587\\u4EF6\\u4F20\\u8F93\\u52A9\\u624B\",\"session_item_\\u5409\\u7965\\u4E09\\u5B9D\"],\"items\":[{\"targetId\":\"session_item_\\u6587\\u4EF6\\u4F20\\u8F93\\u52A9\\u624B\",\"state\":\"Succeeded\",\"errorCode\":null},{\"targetId\":\"session_item_\\u5409\\u7965\\u4E09\\u5B9D\",\"state\":\"Succeeded\",\"errorCode\":null}],\"stopped\":false,\"stopReason\":null}"}
@@ -0,0 +1,10 @@
+HTTP/1.1 200 OK
+Content-Type: application/json; charset=utf-8
+Date: Sat, 19 Sep 2026 04:09:45 GMT
+Server: Kestrel
+Cache-Control: no-store
+Transfer-Encoding: chunked
+X-Correlation-Id: 57fc0ed311354f1586bcfd308dd54c7e
+X-Content-Type-Options: nosniff
+Referrer-Policy: no-referrer
+Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'
@@ -0,0 +1 @@
+{"id":"463b37b2e0944525af4ded822dddaf8c","principalId":"local-admin","accountId":"a2e8a1eaab7fd5fbd3806525c0d9cce750c28f4efb8e7cfcabc9e3e8660e0277","capability":"broadcast-text","state":"Queued","stage":"queued","correlationId":"33d6e14673834c64b5d470a07687c760","createdAt":"2026-09-19T04:09:45.5025818+00:00","expiresAt":"2026-09-19T04:14:45.5025818+00:00","errorCode":null,"hasSideEffects":true,"details":"{\"targetIds\":[\"session_item_\\u6587\\u4EF6\\u4F20\\u8F93\\u52A9\\u624B\",\"session_item_\\u5409\\u7965\\u4E09\\u5B9D\"],\"stopOnError\":true}"}
@@ -0,0 +1 @@
+{"kind":"broadcast-text","accountId":"a2e8a1eaab7fd5fbd3806525c0d9cce750c28f4efb8e7cfcabc9e3e8660e0277","targets":["session_item_文件传输助手","session_item_吉祥三宝"],"text":"[WxAgent验证] 单 Client 多对象广播修复验收 20260919-0412","idempotencyKey":"wxagent-single-20260919-broadcast-final-001","confirmed":true,"stopOnError":true}
@@ -0,0 +1,10 @@
+HTTP/1.1 200 OK
+Content-Type: application/json; charset=utf-8
+Date: Sat, 19 Sep 2026 04:22:44 GMT
+Server: Kestrel
+Cache-Control: no-store
+Transfer-Encoding: chunked
+X-Correlation-Id: 65c675b23d324a6ea793c356da41fb51
+X-Content-Type-Options: nosniff
+Referrer-Policy: no-referrer
+Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'
@@ -0,0 +1,10 @@
+HTTP/1.1 409 Conflict
+Content-Type: application/json; charset=utf-8
+Date: Sat, 19 Sep 2026 04:15:34 GMT
+Server: Kestrel
+Cache-Control: no-store
+Transfer-Encoding: chunked
+X-Correlation-Id: 3183a2753a044909b14f73336dcbe170
+X-Content-Type-Options: nosniff
+Referrer-Policy: no-referrer
+Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'
@@ -0,0 +1 @@
+{"kind":"broadcast-text","accountId":"a2e8a1eaab7fd5fbd3806525c0d9cce750c28f4efb8e7cfcabc9e3e8660e0277","targets":["session_item_文件传输助手","session_item_吉祥三宝"],"text":"[WxAgent验证] confirmation gate must not send 20260919-0414","idempotencyKey":"wxagent-single-20260919-confirmation-gate-001","confirmed":false,"stopOnError":true}
@@ -0,0 +1 @@
+{"correlationId":"3183a2753a044909b14f73336dcbe170","error":{"code":"ConfirmationRequired","message":"Explicit send confirmation is required.","stage":"request","retry":false}}
@@ -0,0 +1,63 @@
+{
+  "schemaVersion": 1,
+  "collectedAtUtc": "2026-09-19T04:15:34Z",
+  "purpose": "Auditable raw evidence for the final single-Client Windows WeChat validation.",
+  "mcp": {
+    "config": ".mcp.json",
+    "server": "windows-ui",
+    "endpoint": "http://10.1.1.101:8765/mcp",
+    "uiEvidence": "mcp-ui-evidence.json"
+  },
+  "serviceApi": {
+    "baseUrl": "http://127.0.0.1:15088",
+    "hostHeader": "localhost:5088",
+    "authentication": "Bearer token used only by the local validation shell; no token is stored in this directory."
+  },
+  "boundAccountId": "a2e8a1eaab7fd5fbd3806525c0d9cce750c28f4efb8e7cfcabc9e3e8660e0277",
+  "wechatVersion": "4.1.13.65",
+  "finalOperation": {
+    "id": "463b37b2e0944525af4ded822dddaf8c",
+    "submitCorrelationId": "57fc0ed311354f1586bcfd308dd54c7e",
+    "correlationId": "33d6e14673834c64b5d470a07687c760",
+    "submitResponse": "broadcast-submit.response.json",
+    "capability": "broadcast-text",
+    "targets": ["session_item_文件传输助手", "session_item_吉祥三宝"],
+    "state": "Succeeded",
+    "stage": "complete",
+    "itemStates": ["Succeeded", "Succeeded"],
+    "stopped": false,
+    "replayResponse": "broadcast-replay.response.json"
+  },
+  "confirmationGates": {
+    "broadcastText": {
+      "request": "confirmation-gate.request.json",
+      "httpStatus": 409,
+      "errorCode": "ConfirmationRequired",
+      "retry": false,
+      "correlationId": "3183a2753a044909b14f73336dcbe170"
+    },
+    "sendText": {
+      "request": "send-confirmation-gate.request.json",
+      "httpStatus": 409,
+      "errorCode": "ConfirmationRequired",
+      "retry": false,
+      "correlationId": "78820fff9db246feb032a873018d43bb"
+    }
+  },
+  "readOnlyEvidence": {
+    "status": "status.response.json",
+    "capabilities": "capabilities.response.json",
+    "sessions": ["sessions-1.response.json", "sessions-2.response.json", "sessions-3.response.json"],
+    "messages": ["messages-filehelper.response.json", "messages-jixiang.response.json"]
+  },
+  "integrity": {
+    "algorithm": "SHA-256",
+    "fileList": "sha256sums.txt",
+    "scope": "All evidence files except manifest.json and sha256sums.txt; README and derived summaries are included."
+  },
+  "redactions": [
+    "Authorization headers/tokens are not stored.",
+    "Message API evidence uses includeContent=false; full chat bodies are not stored.",
+    "The bound account ID and test marker are retained because they are required to correlate the operation and read-back evidence."
+  ]
+}
@@ -0,0 +1,25 @@
+{
+  "source": {
+    "mcpConfig": ".mcp.json",
+    "server": "windows-ui",
+    "endpoint": "http://10.1.1.101:8765/mcp",
+    "listTool": "windows-ui_list_windows",
+    "inspectTool": "windows-ui_inspect_window",
+    "inspectArgs": {"title_re": "^微信$", "found_index": 0},
+    "note": "This is a redacted, auditable excerpt of the live MCP UIA response; rectangles and automation IDs are copied from the tool result. Message bodies are not stored here."
+  },
+  "visibleTopLevelWindows": ["任务栏", "微信", "操作提示", "设置标题", "JP-Word->033.jpwabc ==> C:\\temp\\jpw7-batch\\, (cpu=0.0)", "微信", "新标签页 - 夸克", "10.1.1.104 - Google Chrome", "QQ", "dummyLayeredWnd", "dummyLayeredWnd", "Program Manager"],
+  "requiredNodes": [
+    {"name": "微信", "type": "Window", "automationId": "", "rectangle": "(L371, T56, R1204, B729)"},
+    {"name": "", "type": "Group", "automationId": "MainView", "rectangle": "(L371, T57, R1204, B729)"},
+    {"name": "会话", "type": "List", "automationId": "session_list", "rectangle": "(L431, T137, R671, B677)"},
+    {"name": "文件传输助手\\n已置顶\\nNative Writer\\n12:17\\n", "type": "ListItem", "automationId": "session_item_文件传输助手", "rectangle": "(L431, T137, R671, B202)"},
+    {"name": "吉祥三宝\\n已置顶\\n[WxAgent验证] 单 Client 多对象广播修复验收 20260919-0412\\n12:09\\n", "type": "ListItem", "automationId": "session_item_吉祥三宝", "rectangle": "(L431, T202, R671, B267)"},
+    {"name": "", "type": "Group", "automationId": "chat_message_page", "rectangle": "(L671, T89, R1200, B725)"},
+    {"name": "文件传输助手", "type": "Text", "automationId": "content_view.top_content_view.title_h_view.left_v_view.left_content_v_view.left_ui_.big_title_line_h_view.current_chat_name_label", "rectangle": "(L687, T102, R771, B122)"},
+    {"name": "消息", "type": "List", "automationId": "chat_message_list", "rectangle": "(L671, T137, R1200, B585)"},
+    {"name": "[WxAgent验证] 单 Client 多对象广播修复验收 20260919-0412", "type": "ListItem", "automationId": "chat_message_list.qt_scrollarea_viewport.chat_bubble_item_view", "rectangle": "(L671, T413, R1200, B488)"},
+    {"name": "文件传输助手", "type": "Edit", "automationId": "chat_input_field", "rectangle": "(L691, T594, R1184, B673)"},
+    {"name": "", "type": "ToolBar", "automationId": "tool_bar_accessible", "rectangle": "(L679, T673, R1192, B717)"}
+  ]
+}
@@ -0,0 +1,10 @@
+HTTP/1.1 200 OK
+Content-Type: application/json; charset=utf-8
+Date: Sat, 19 Sep 2026 04:16:44 GMT
+Server: Kestrel
+Cache-Control: no-store
+Transfer-Encoding: chunked
+X-Correlation-Id: 56cc6ebfac8f4c59b26ca9e832149e8f
+X-Content-Type-Options: nosniff
+Referrer-Policy: no-referrer
+Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'
@@ -0,0 +1 @@
+{"items":[{"fingerprint":"6b2c72487f9a1e179d0b4f2bb8d50038a683b3a5c9d7404aae9cbe1ef2356923","type":"Text","sender":null,"summary":"wxagent-smoke-20260918161447-254c4428e37c46c996c0fa4af0841a55","content":null},{"fingerprint":"8a50e9216c22a893332c8458979bdb9d4a45aa23a8dea1d36199fcf60c2c4aee","type":"Text","sender":null,"summary":"ome[WxAgent验证] UI 单 Client 发送验证 20260919-0239","content":null},{"fingerprint":"0c62388df1125439daf09f1911bb7d3aa27b1b1fb0ecba4d6f49fda74de37567","type":"Text","sender":null,"summary":"[WxAgent验证] 单 Client 多对象广播 20260919-0328","content":null},{"fingerprint":"837b6ef9c70f1ddfa462cc9d973b312e71935539a8e493c519b9099de0fc6c86","type":"Text","sender":null,"summary":"[WxAgent验证] 单 Client 多对象广播修复验收 20260919-0412","content":null}],"limit":50,"offset":0,"hasMore":false,"nextOffset":null}
@@ -0,0 +1,10 @@
+HTTP/1.1 200 OK
+Content-Type: application/json; charset=utf-8
+Date: Sat, 19 Sep 2026 04:16:50 GMT
+Server: Kestrel
+Cache-Control: no-store
+Transfer-Encoding: chunked
+X-Correlation-Id: ec106963f1be4f45b3e5d9b950e8997d
+X-Content-Type-Options: nosniff
+Referrer-Policy: no-referrer
+Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'
@@ -0,0 +1 @@
+{"items":[{"fingerprint":"6b2c72487f9a1e179d0b4f2bb8d50038a683b3a5c9d7404aae9cbe1ef2356923","type":"Text","sender":null,"summary":"wxagent-smoke-20260918161447-254c4428e37c46c996c0fa4af0841a55","content":null},{"fingerprint":"8a50e9216c22a893332c8458979bdb9d4a45aa23a8dea1d36199fcf60c2c4aee","type":"Text","sender":null,"summary":"ome[WxAgent验证] UI 单 Client 发送验证 20260919-0239","content":null},{"fingerprint":"0c62388df1125439daf09f1911bb7d3aa27b1b1fb0ecba4d6f49fda74de37567","type":"Text","sender":null,"summary":"[WxAgent验证] 单 Client 多对象广播 20260919-0328","content":null},{"fingerprint":"837b6ef9c70f1ddfa462cc9d973b312e71935539a8e493c519b9099de0fc6c86","type":"Text","sender":null,"summary":"[WxAgent验证] 单 Client 多对象广播修复验收 20260919-0412","content":null}],"limit":50,"offset":0,"hasMore":false,"nextOffset":null}
@@ -0,0 +1,22 @@
+{
+  "sourceFiles": [
+    "messages-filehelper.response.json",
+    "messages-jixiang.response.json"
+  ],
+  "query": "GET /api/v1/messages?accountId=<bound-account>&session=<session-name>&limit=50&includeContent=false",
+  "contentWasStored": false,
+  "marker": "[WxAgent验证] 单 Client 多对象广播修复验收 20260919-0412",
+  "filehelper": {
+    "itemCount": 4,
+    "markerFoundInSummary": true,
+    "allContentFieldsNull": true,
+    "lastMessageFingerprint": "837b6ef9c70f1ddfa462cc9d973b312e71935539a8e493c519b9099de0fc6c86"
+  },
+  "jixiang": {
+    "itemCount": 4,
+    "markerFoundInSummary": true,
+    "allContentFieldsNull": true,
+    "lastMessageFingerprint": "837b6ef9c70f1ddfa462cc9d973b312e71935539a8e493c519b9099de0fc6c86"
+  },
+  "interpretation": "The raw read-only responses contain the unique test marker in summary and omit full message bodies; the matching final fingerprint is an independent post-send read-back signal for both target sessions."
+}
@@ -0,0 +1,10 @@
+HTTP/1.1 409 Conflict
+Content-Type: application/json; charset=utf-8
+Date: Sat, 19 Sep 2026 04:25:03 GMT
+Server: Kestrel
+Cache-Control: no-store
+Transfer-Encoding: chunked
+X-Correlation-Id: 78820fff9db246feb032a873018d43bb
+X-Content-Type-Options: nosniff
+Referrer-Policy: no-referrer
+Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'
@@ -0,0 +1 @@
+{"kind":"send-text","accountId":"a2e8a1eaab7fd5fbd3806525c0d9cce750c28f4efb8e7cfcabc9e3e8660e0277","targetId":"session_item_吉祥三宝","text":"[WxAgent验证] 不应发送","idempotencyKey":"wxagent-single-20260919-confirmation-negative","confirmed":false}
@@ -0,0 +1 @@
+{"correlationId":"78820fff9db246feb032a873018d43bb","error":{"code":"ConfirmationRequired","message":"Explicit send confirmation is required.","stage":"request","retry":false}}
@@ -0,0 +1,10 @@
+HTTP/1.1 200 OK
+Content-Type: application/json; charset=utf-8
+Date: Sat, 19 Sep 2026 04:16:35 GMT
+Server: Kestrel
+Cache-Control: no-store
+Transfer-Encoding: chunked
+X-Correlation-Id: fd1f07e563774a238c1da3d85ccdf470
+X-Content-Type-Options: nosniff
+Referrer-Policy: no-referrer
+Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'
@@ -0,0 +1 @@
+{"items":[{"name":"吉祥三宝","automationId":"session_item_吉祥三宝","isCurrent":false},{"name":"文件传输助手","automationId":"session_item_文件传输助手","isCurrent":true},{"name":"运营3部日报","automationId":"session_item_运营3部日报","isCurrent":false},{"name":"李晓敏","automationId":"session_item_李晓敏","isCurrent":false},{"name":"杨礼溪","automationId":"session_item_杨礼溪","isCurrent":false},{"name":"\uD83C\uDF3B2026级初一5班家长群","automationId":"session_item_\uD83C\uDF3B2026级初一5班家长群","isCurrent":false},{"name":"外呼机器人研发对接","automationId":"session_item_外呼机器人研发对接","isCurrent":false},{"name":"商务通系统对接问题反馈","automationId":"session_item_商务通系统对接问题反馈","isCurrent":false},{"name":"潘卫东-潘总、刘猛、邵存阳-邵总、根成、高总公司-潘卫东、min","automationId":"session_item_潘卫东-潘总、刘猛、邵存阳-邵总、根成、高总公司-潘卫东、min","isCurrent":false}],"limit":20,"offset":0,"hasMore":false,"nextOffset":null}
@@ -0,0 +1,10 @@
+HTTP/1.1 200 OK
+Content-Type: application/json; charset=utf-8
+Date: Sat, 19 Sep 2026 04:16:38 GMT
+Server: Kestrel
+Cache-Control: no-store
+Transfer-Encoding: chunked
+X-Correlation-Id: a5655c213ccd4d82a4b761200618269b
+X-Content-Type-Options: nosniff
+Referrer-Policy: no-referrer
+Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'
@@ -0,0 +1 @@
+{"items":[{"name":"吉祥三宝","automationId":"session_item_吉祥三宝","isCurrent":false},{"name":"文件传输助手","automationId":"session_item_文件传输助手","isCurrent":true},{"name":"运营3部日报","automationId":"session_item_运营3部日报","isCurrent":false},{"name":"李晓敏","automationId":"session_item_李晓敏","isCurrent":false},{"name":"杨礼溪","automationId":"session_item_杨礼溪","isCurrent":false},{"name":"\uD83C\uDF3B2026级初一5班家长群","automationId":"session_item_\uD83C\uDF3B2026级初一5班家长群","isCurrent":false},{"name":"外呼机器人研发对接","automationId":"session_item_外呼机器人研发对接","isCurrent":false},{"name":"商务通系统对接问题反馈","automationId":"session_item_商务通系统对接问题反馈","isCurrent":false},{"name":"潘卫东-潘总、刘猛、邵存阳-邵总、根成、高总公司-潘卫东、min","automationId":"session_item_潘卫东-潘总、刘猛、邵存阳-邵总、根成、高总公司-潘卫东、min","isCurrent":false}],"limit":20,"offset":0,"hasMore":false,"nextOffset":null}
@@ -0,0 +1,10 @@
+HTTP/1.1 200 OK
+Content-Type: application/json; charset=utf-8
+Date: Sat, 19 Sep 2026 04:16:40 GMT
+Server: Kestrel
+Cache-Control: no-store
+Transfer-Encoding: chunked
+X-Correlation-Id: 7c10f8eacba04e4ca13cbc896379e177
+X-Content-Type-Options: nosniff
+Referrer-Policy: no-referrer
+Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'
@@ -0,0 +1 @@
+{"items":[{"name":"吉祥三宝","automationId":"session_item_吉祥三宝","isCurrent":false},{"name":"文件传输助手","automationId":"session_item_文件传输助手","isCurrent":true},{"name":"运营3部日报","automationId":"session_item_运营3部日报","isCurrent":false},{"name":"李晓敏","automationId":"session_item_李晓敏","isCurrent":false},{"name":"杨礼溪","automationId":"session_item_杨礼溪","isCurrent":false},{"name":"\uD83C\uDF3B2026级初一5班家长群","automationId":"session_item_\uD83C\uDF3B2026级初一5班家长群","isCurrent":false},{"name":"外呼机器人研发对接","automationId":"session_item_外呼机器人研发对接","isCurrent":false},{"name":"商务通系统对接问题反馈","automationId":"session_item_商务通系统对接问题反馈","isCurrent":false},{"name":"潘卫东-潘总、刘猛、邵存阳-邵总、根成、高总公司-潘卫东、min","automationId":"session_item_潘卫东-潘总、刘猛、邵存阳-邵总、根成、高总公司-潘卫东、min","isCurrent":false}],"limit":20,"offset":0,"hasMore":false,"nextOffset":null}
@@ -0,0 +1,30 @@
+3ad3c85c315c6f6d831b3d84f894a3cd34ba237b8ba0d8401d814f8beb6be75a  broadcast-get.http.txt
+4e01ccec54fa1fd023d150d84ee45c698aa5a08cce4b20048ee6a3d84d41336d  broadcast-get.response.json
+0de4d771c51fb7f812c3521771cf8126dd015a90f2cfe7efa07b64431993b72b  broadcast-replay.http.txt
+4e01ccec54fa1fd023d150d84ee45c698aa5a08cce4b20048ee6a3d84d41336d  broadcast-replay.response.json
+390c3db2dbbbd40886125c41a308c0fd09de34a893abd1594f62e031fb85d834  broadcast.request.json
+edaf2a0fd912158a64600afea898ef7e92e1f952b99e8f50dcdf23aff5e3fe73  broadcast-submit.http.txt
+8889cbed1f14be4f767cdc3a0ee372f75ba2982e6dba4f53504a98907d9406b2  broadcast-submit.response.json
+f0c05ef72bab694caf2d890bfc0fb6fd69fd01717c4b24365d6bb34dc50ef571  capabilities.http.txt
+ba09345de35f48ed812cbe54e6298c68f127c0b9cea6ee426e21c3669b16bb04  capabilities.response.json
+af5e1cd3d73f4f332a8a32bda24bbc814ab0d90e85ecf6eed6b0b4585be269e9  confirmation-gate.http.txt
+4dcde0d485bb221a4846cc53e225f05bb944433c939f5b7595c3a1ff700b9f82  confirmation-gate.request.json
+fc0cec0c57504482651dc664903eef4d493a39c12357504282bfa58266388455  confirmation-gate.response.json
+529430b446c9b8b1d05c7fcb51514e8ec1b71627af5ffe1c30d29791c83fa008  mcp-ui-evidence.json
+64bc614875c15a7ab488fa9740bab0f606c9234596a5e903a88d2e68e22ca8b4  messages-filehelper.http.txt
+b825e65ba2f3f5d27817ef64273785cb9be09cf9df8dfde6afe01794659f7994  messages-filehelper.response.json
+63fceae775c345adc899b29b0a39d72906a662ba58a20eccea34cd0d6116f842  messages-jixiang.http.txt
+b825e65ba2f3f5d27817ef64273785cb9be09cf9df8dfde6afe01794659f7994  messages-jixiang.response.json
+54c40a6e30b2dbaa50f8027727b7aeb22cedc4998177c3fe350a44f17e155816  readback-summary.json
+623571c8a2bd35f089906e8587c01d5db157e2af5d8b908bcf26d39e0c9b7380  README.md
+344b3852dec53fc2b927669b5643863c7a4c184f2ac41d99374e6f16a83ff53e  send-confirmation-gate.http.txt
+86ed9bc17d74b0ccf463b6519e25df576520b263b4d16eda79864b7500681cc3  send-confirmation-gate.request.json
+e2e07ecbbdd276f71e78dfe9160abb04d2bef923b73ae8b0b21eed759806461f  send-confirmation-gate.response.json
+dc0821a7b6f37f314e7fcd2aa8d68e96c27805cf0fea8e0cb03517f36ecea247  sessions-1.http.txt
+976c98db5de557fffd1a7d8ba6c937925d791da4df6b5f6838983c09b4253f9b  sessions-1.response.json
+843811528eb530326e7d49b4be3fffbb11ad89cd2882232221ff6dca61dcbb4e  sessions-2.http.txt
+976c98db5de557fffd1a7d8ba6c937925d791da4df6b5f6838983c09b4253f9b  sessions-2.response.json
+b0499282b98c3bf946c53698a8dcf8de830396a8e9d42b38451168d8c3dcf554  sessions-3.http.txt
+976c98db5de557fffd1a7d8ba6c937925d791da4df6b5f6838983c09b4253f9b  sessions-3.response.json
+fc2fa5ecff7f2c9ad9c71842b725d78d4f999c283e11832989f10bc7fbc910a0  status.http.txt
+0280b1df77f973805bb487506002eac4e3ec2d67c8d68d58c1603f9b93e33eca  status.response.json
@@ -0,0 +1,10 @@
+HTTP/1.1 200 OK
+Content-Type: application/json; charset=utf-8
+Date: Sat, 19 Sep 2026 04:22:44 GMT
+Server: Kestrel
+Cache-Control: no-store
+Transfer-Encoding: chunked
+X-Correlation-Id: acfbaa6b604646268b3892d050e8a4aa
+X-Content-Type-Options: nosniff
+Referrer-Policy: no-referrer
+Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'
@@ -0,0 +1 @@
+{"serviceOnline":true,"wechatAvailable":true,"sessionAvailable":true,"sessionLocked":false,"windowFound":true,"errors":[],"wechatVersions":["4.1.13.65"],"activeAccountBound":true,"defaultReadOnly":true}
				`@@ -0,0 +1 @@`
				{"id":"463b37b2e0944525af4ded822dddaf8c","principalId":"local-admin","accountId":"a2e8a1eaab7fd5fbd3806525c0d9cce750c28f4efb8e7cfcabc9e3e8660e0277","capability":"broadcast-text","state":"Succeeded","stage":"complete","correlationId":"33d6e14673834c64b5d470a07687c760","createdAt":"2026-09-19T04:09:45.5025818+00:00","expiresAt":"2026-09-19T04:14:45.5025818+00:00","errorCode":null,"hasSideEffects":true,"details":"{\"targetIds\":[\"session_item_\\u6587\\u4EF6\\u4F20\\u8F93\\u52A9\\u624B\",\"session_item_\\u5409\\u7965\\u4E09\\u5B9D\"],\"items\":[{\"targetId\":\"session_item_\\u6587\\u4EF6\\u4F20\\u8F93\\u52A9\\u624B\",\"state\":\"Succeeded\",\"errorCode\":null},{\"targetId\":\"session_item_\\u5409\\u7965\\u4E09\\u5B9D\",\"state\":\"Succeeded\",\"errorCode\":null}],\"stopped\":false,\"stopReason\":null}"}
				`@@ -0,0 +1 @@`
				`{"kind":"broadcast-text","accountId":"a2e8a1eaab7fd5fbd3806525c0d9cce750c28f4efb8e7cfcabc9e3e8660e0277","targets":["session_item_文件传输助手","session_item_吉祥三宝"],"text":"[WxAgent验证] 单 Client 多对象广播修复验收 20260919-0412","idempotencyKey":"wxagent-single-20260919-broadcast-final-001","confirmed":true,"stopOnError":true}`
				`@@ -0,0 +1 @@`
				`{"correlationId":"3183a2753a044909b14f73336dcbe170","error":{"code":"ConfirmationRequired","message":"Explicit send confirmation is required.","stage":"request","retry":false}}`
				`@@ -0,0 +1 @@`
				{"items":[{"fingerprint":"6b2c72487f9a1e179d0b4f2bb8d50038a683b3a5c9d7404aae9cbe1ef2356923","type":"Text","sender":null,"summary":"wxagent-smoke-20260918161447-254c4428e37c46c996c0fa4af0841a55","content":null},{"fingerprint":"8a50e9216c22a893332c8458979bdb9d4a45aa23a8dea1d36199fcf60c2c4aee","type":"Text","sender":null,"summary":"ome[WxAgent验证] UI 单 Client 发送验证 20260919-0239","content":null},{"fingerprint":"0c62388df1125439daf09f1911bb7d3aa27b1b1fb0ecba4d6f49fda74de37567","type":"Text","sender":null,"summary":"[WxAgent验证] 单 Client 多对象广播 20260919-0328","content":null},{"fingerprint":"837b6ef9c70f1ddfa462cc9d973b312e71935539a8e493c519b9099de0fc6c86","type":"Text","sender":null,"summary":"[WxAgent验证] 单 Client 多对象广播修复验收 20260919-0412","content":null}],"limit":50,"offset":0,"hasMore":false,"nextOffset":null}
				`@@ -0,0 +1 @@`
				`{"kind":"send-text","accountId":"a2e8a1eaab7fd5fbd3806525c0d9cce750c28f4efb8e7cfcabc9e3e8660e0277","targetId":"session_item_吉祥三宝","text":"[WxAgent验证] 不应发送","idempotencyKey":"wxagent-single-20260919-confirmation-negative","confirmed":false}`
				`@@ -0,0 +1 @@`
				`{"correlationId":"78820fff9db246feb032a873018d43bb","error":{"code":"ConfirmationRequired","message":"Explicit send confirmation is required.","stage":"request","retry":false}}`
				`@@ -0,0 +1 @@`
				{"items":[{"name":"吉祥三宝","automationId":"session_item_吉祥三宝","isCurrent":false},{"name":"文件传输助手","automationId":"session_item_文件传输助手","isCurrent":true},{"name":"运营3部日报","automationId":"session_item_运营3部日报","isCurrent":false},{"name":"李晓敏","automationId":"session_item_李晓敏","isCurrent":false},{"name":"杨礼溪","automationId":"session_item_杨礼溪","isCurrent":false},{"name":"\uD83C\uDF3B2026级初一5班家长群","automationId":"session_item_\uD83C\uDF3B2026级初一5班家长群","isCurrent":false},{"name":"外呼机器人研发对接","automationId":"session_item_外呼机器人研发对接","isCurrent":false},{"name":"商务通系统对接问题反馈","automationId":"session_item_商务通系统对接问题反馈","isCurrent":false},{"name":"潘卫东-潘总、刘猛、邵存阳-邵总、根成、高总公司-潘卫东、min","automationId":"session_item_潘卫东-潘总、刘猛、邵存阳-邵总、根成、高总公司-潘卫东、min","isCurrent":false}],"limit":20,"offset":0,"hasMore":false,"nextOffset":null}
				`@@ -0,0 +1 @@`
				`{"serviceOnline":true,"wechatAvailable":true,"sessionAvailable":true,"sessionLocked":false,"windowFound":true,"errors":[],"wechatVersions":["4.1.13.65"],"activeAccountBound":true,"defaultReadOnly":true}`