WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

2026-09-22 16:19:06 +08:00
commit f7fc992f57
3929 changed files with 1006607 additions and 0 deletions
@@ -0,0 +1,111 @@
+# Native memory API smoke fixture
+
+This script verifies the actual deployed HTTP API, workbench job leases/worker,
+database persistence, memory review and the prompt sent to a deterministic local
+fake model. It does not benchmark AI quality or invoke any existing model.
+
+## Automatic disposable workspace
+
+Use the wrapper to provision and clean up the required fixture:
+
+```sh
+node scripts/native_memory_fixture.cjs --run
+```
+
+It reads the existing private admin login file at
+`/Volumes/Extreme SSD/yawan-storage/weknora/acceptance/super-admin-login.json`.
+Override that path with `MEMORY_SMOKE_ADMIN_AUTH`. The file must have no group or
+other read permissions. The wrapper creates two uniquely named disposable users
+and an empty workspace, enables explicit-only memory with vector recall disabled,
+and gives only the fixture owner a disposable balance. The owner has workspace
+owner privileges to create the local fake model; the outsider remains an ordinary
+contributor. Neither user is a system administrator.
+
+Credentials are written only into mode-0600 files within a mode-0700 run directory.
+The manifest is credential-free and is saved at each setup stage. The wrapper runs
+the smoke script, then checks no fixture workbench job remains active and removes
+only the new workspace, fixture users, auth tokens, balance, model, Agent, memory
+and workbench rows. It validates both workspace name/business marker and exact
+user identities before cleanup. A surviving smoke process, unexpected tables or foreign memberships stop
+cleanup for inspection. Administrator audit entries in the original workspace
+remain as evidence. There is no database reset, and no real provider is called.
+
+If interrupted, rerun just the exact fixture cleanup:
+
+```sh
+node scripts/native_memory_fixture.cjs --cleanup /absolute/path/memory-smoke-RUN/fixture.json
+```
+
+The wrapper defaults to Docker context `colima-yawan`, container
+`WeKnora-postgres`, database `yawan_native_acceptance_20260915` and source tenant
+`10059`. This database is production despite its historical name. Connection
+overrides are `MEMORY_SMOKE_DOCKER`, `MEMORY_SMOKE_DOCKER_CONTEXT`,
+`MEMORY_SMOKE_DB_CONTAINER`, `MEMORY_SMOKE_DB_NAME` and
+`MEMORY_SMOKE_SOURCE_TENANT`. Cleanup requires the same recorded connection.
+`MEMORY_SMOKE_DIRECTORY` changes the parent directory for fixture reports.
+The wrapper is intended to be run after deployment by the release operator.
+
+The wrapper also seeds one synthetic accepted legacy history row through a
+private child-process channel, after checking the new Agent's exact owner,
+workspace, name and memory setting. This is a new fixture record, never a real
+user's imported history. After migration 217, the actual API must require owner
+scope consent, preserve the original text/source, create exactly one linked native
+preference, include it in the next real generation request to the local stub, and
+reject access from the other user. Deleting that native preference then repeating
+confirmation must not restore it. The dedicated workspace cleanup removes this
+synthetic history too. Provenance matching during migration is tested separately
+with an isolated PostgreSQL database. Standalone existing-fixture mode does not
+seed or claim coverage of legacy reconfirmation.
+
+## Existing fixture mode
+
+Requirements:
+
+- Node 20+ and the local backend origin after deployment.
+- A dedicated empty workspace whose name starts with `memory-smoke-`, with memory enabled.
+- Two disposable users whose usernames start with `memory-smoke-`. The owner must be able to create a model, Agent, flow and content task. The outsider must not be a system administrator. The outsider may share the fixture workspace or use another empty fixture workspace.
+- Two local mode-0600 JSON auth files with `{"token":"..."}`. Optional `tenantID` selects the active workspace through `X-Tenant-ID`. Do not put tokens in commands, source control or the result report.
+
+```sh
+MEMORY_SMOKE_OWNER_AUTH=/absolute/path/owner-auth.json \
+MEMORY_SMOKE_OUTSIDER_AUTH=/absolute/path/outsider-auth.json \
+MEMORY_SMOKE_MANIFEST=/absolute/path/memory-smoke-result.json \
+node scripts/native_memory_api_smoke.cjs --run
+```
+
+The default origin is `http://127.0.0.1:18080/api/v1`; override with
+`MEMORY_SMOKE_BASE`. Public hostnames are refused. The model stub listens on a
+random local host port so the backend container can reach it through
+`host.docker.internal`. Set `MEMORY_SMOKE_MODEL_HOST=127.0.0.1` for a backend
+running directly on the host. The stub receives only fixture content.
+
+The script checks 135-minute task creation, 90-minute update, persistence, and
+rejection of negative/fractional/over-1440 durations without mutating saved state.
+It also checks that draft content does not become memory, adopting human
+advice creates one pending candidate, repeated adoption deduplicates it,
+another account cannot approve or delete it, explicit review writes an active
+memory, the next generation actually recalls that preference, and skip/source
+deletion invalidate only pending candidates. It also runs quality review and
+exact ordered composition, changes the duration to 225 minutes, verifies the
+original prose is retained while old review/composition results are cleared,
+and checks that composition is blocked until renewed confirmation and review.
+Reacceptance restores invalidated pending feedback without resetting explicitly
+approved memories. It refuses nonempty owner memory
+or content fixtures and does not alter workspace settings.
+
+Cleanup uses exact created resource/memory IDs through APIs. It waits for every
+recorded job to be terminal first. On job timeout it deliberately retains the
+fixture and reports the IDs instead of deleting beneath a running worker. The
+manifest is written after every created object, contains no token, and supports
+manual recovery. API deletion leaves workbench review/history records and
+memory tombstones; the companion `.cleanup.sql` removes only this run's exact
+candidate/resource IDs within its tenant/owner scope. It refuses active jobs.
+Run that SQL against the matching database after reviewing the manifest. Audit
+and usage logs and the disposable accounts/workspace remain as test evidence;
+remove the dedicated fixture identities through the normal administration
+workflow when the evidence is no longer needed. No broad database reset is used.
+
+This fixture tests native content feedback and recall. Chat extraction retry,
+timestamp pagination, per-session checkpoints and pending conflict rollback
+are covered by the offline Go integration suites; this script does not claim
+to simulate those asynchronous chat failures.