朱子纯 / xlyNewAi

…100/101, 200/201, 4xx/5xx error taxonomy); xlyAi writes pending+100 only; legacy values read-compat; migration maps existing rows

… + token-budget projection, skills-in-DB, security audit fixes)

resolveFk had no sBrandsId predicate, so a staged create/update could bind another
tenant's customer/product sId into this tenant's document (and doubled as a
cross-tenant existence oracle). Tables without a tenant column stay global.

docs/audit-agent-main-20260728.md is the external audit this and the previous
commit answer.

P4 retirement + code slim-down (~18.5k lines deleted), on top of the
intent-gate WIP (docs §17/§18 + agent/tool refinements):

- Delete old 8-scene multi-agent stack: XlyErpService, SceneSelector/
  Chati/ErpAi/DynamicTableNl2Sql agents, DynamicToolProvider (62 meta
  tools), Scene/ToolMeta/ParamRule entities+mappers+startup caches
- Delete whole milvus/tts/ocr packages, /api/tts + /api/ocr endpoints,
  tts.html, python stream_server.py; strip dead TTS JS from chat.html
  (playByIndex/handleNormalResponse had no callers)
- Three-pass orphan sweep: 17 dead utils, 16 dead entities, dead
  constants/exceptions, RedisService+RedisConfig, duplicate
  JacksonConfig, OperableChatMemoryProvider, old prompt generators;
  fold PageController into MvcConfig; trim OkHttpUtil 495→39 lines
- pom: ~35→13 deps (drop mybatis/JPA/webflux/tika/pdfbox/poi/jieba/
  jsoup/gson/fastjson2/springdoc/mapstruct/pagehelper/pinyin4j/
  spring-retry/jnr-ffi/hutool/ocr/milvus/embeddings; add starter-jdbc);
  war 200M+→48M
- application.yml: drop milvus/tts/ocr/tesseract/mybatis blocks;
  GlobalExceptionHandler returns plain {code,message} JSON
- docs: mark P4 retirement done in agent-architecture §13/§18

Verified: mvn clean package OK; boot smoke on :8199 (Started 0.9s,
/chat 200, health db UP). Old /api/tts & /api/ocr now 404 by design.

…en, prod injects live token)

- AuthzService: form-level allowlist ported from backend getsAuthsIdNew (sysjurisdiction sKey set); sysadmin=all; wired into Read/lookupRecord/proposeUpdate/proposeDelete (admin dev-login => all-access; enforces per-user once prod passes through user token)
- proposeDelete + ErpClient.deleteForm (handleType=del) + OpController branches op type; HITL-gated like update
- docs/security-findings.md: report of the 5 current-system vulns (backend form-perm off, read-API-can-write, NL2SQL no-tenant/over-privilege/partial-SQL-safety/cache-skips-validation) for the business
- Verified end-to-end: read after authz = 93; propose-delete card -> confirm -> row actually deleted; audit rows written.

…nce) vs deferred (authz/create-delete-审核/FormCollect/staging-executor/Langfuse/NL2SQL)

…tions, standalone chat page, always user-present, designated model cloud/local, shared-DB multi-brand); backups recorded; formId deferred; refresh open-items

…rminal + reconcile on reconnect; manual stays sync

… terminal (no chaining), validate-only

…oposeWrite ends turn on draft

…nistic /op/{id}/confirm endpoint (not a tool)

…lt); ERP real-time exec via /ai/execStaging + two link modes

…on dropped, form-level only via sAuthsId; Query security simplified

…Ai authorization layer; Read not permission-safe + param whitelist; invoke not backend-safe

…oseWrite covers mutating button-actions

… ERP procs, Query = ad-hoc-only

…; NL2SQL security pending investigation