-
…p+CAS, tenant enforcement Audit findings 1-5 confirmed real; root causes were (a) identity self-reported by the client, (b) every failure path defaulting open. - ERP /ai/whoami (saas-8s+ @c8e0057 follow-up) resolves token → real user/tenant/type; AuthzService.resolveIdentity is now the single identity entry point. Client-supplied userid/brandsid/usertype removed from all request bodies and from chat.html. - dev-login is a real switch (erp.dev-login.enabled, default false) and its ERP creds no longer have built-in admin/666666 defaults; blank token in production → 401, never a silent fall back to the dev (sysadmin) account. - conversations/op/form endpoints require login; conversation ids are namespaced by user id and ownership-checked (403 otherwise); /op/pending no longer returns sPayload. - op confirm/cancel check the proposer, and confirm claims the draft via CAS so concurrent/repeat confirms cannot execute twice; bill numbers are regenerated at execution time instead of replaying the propose-time snapshot. - FK options take the tenant from the introspected identity and return empty rather than dropping the sBrandsId predicate. - secrets moved to env vars (DB_URL/DB_USERNAME/DB_PASSWORD/REDIS_*/LLM_*/ERP_BASEURL); allowMultiQueries=false. NOTE: the previously committed credentials must be rotated. - ids interpolated into ERP URLs are validated (safeId) to stop query/path injection. - update path rejects system columns, resolves FK names, and coerces by column type; numeric coercion now rejects unparseable input instead of writing 0/truncating, and proposal summaries show the value that will actually be written. - ResponseStatusException keeps its 401/403 status instead of being wrapped as 200. - anti-fabrication guard stays on when the intent gate itself fails.
-
…ction, anti-fabrication guards - LedgerService: append-only chat
{conv} events incl. deterministic-path
form/clarify/proposal/confirm-outcome; history replays from ledger
- StateService: chat:state:{conv} slots (上轮意图/最近实体/在办单据) written by code,
fed to intent gate + write-slot extraction and appended to agent user text
- ProjectedChatMemory replaces MessageWindowChatMemory: full store + char-budget
projection, old tool results collapsed to one line, current turn kept intact
- RedisChatMemoryStore.appendTurn patches memory holes on deterministic paths;
op confirm/cancel outcomes recorded to ledger/state/memory
- anti-fabrication (tool_choice=required NOT enforced by Ollama 0.32.3, retested):
query turn zero-tools+digits → one forced retry then flag; write claim without
proposeWrite → corrective notice
-
P4 retirement + code slim-down (~18.5k lines deleted), on top of the intent-gate WIP (docs §17/§18 + agent/tool refinements): - Delete old 8-scene multi-agent stack: XlyErpService, SceneSelector/ Chati/ErpAi/DynamicTableNl2Sql agents, DynamicToolProvider (62 meta tools), Scene/ToolMeta/ParamRule entities+mappers+startup caches - Delete whole milvus/tts/ocr packages, /api/tts + /api/ocr endpoints, tts.html, python stream_server.py; strip dead TTS JS from chat.html (playByIndex/handleNormalResponse had no callers) - Three-pass orphan sweep: 17 dead utils, 16 dead entities, dead constants/exceptions, RedisService+RedisConfig, duplicate JacksonConfig, OperableChatMemoryProvider, old prompt generators; fold PageController into MvcConfig; trim OkHttpUtil 495→39 lines - pom: ~35→13 deps (drop mybatis/JPA/webflux/tika/pdfbox/poi/jieba/ jsoup/gson/fastjson2/springdoc/mapstruct/pagehelper/pinyin4j/ spring-retry/jnr-ffi/hutool/ocr/milvus/embeddings; add starter-jdbc); war 200M+→48M - application.yml: drop milvus/tts/ocr/tesseract/mybatis blocks; GlobalExceptionHandler returns plain {code,message} JSON - docs: mark P4 retirement done in agent-architecture §13/§18 Verified: mvn clean package OK; boot smoke on :8199 (Started 0.9s, /chat 200, health db UP). Old /api/tts & /api/ocr now 404 by design.
-
Add a deterministic §5 intent stage before ReAct: extract {intent, form, entities, missing slots} via constrained JSON, then expose only the 3-5 tools relevant to that intent instead of all 12. New: - agent/Intent, agent/ToolScope: intent + visible-tool-set model - service/IntentService: constrained-JSON intent/entity extraction - service/OllamaJsonClient: JSON-mode Ollama calls - service/SlotFillService: slot extraction/prefill of known values Wire through AgentFactory, SystemPromptService, QueryTool, ProposeWriteTool, ErpClient, AgentChatController, OpController, chat.html.
-
User: chat form showed only 7 fields vs ERP's full 报价单. Root cause: 报价 is a cross-table master-detail form; 印刷/颜色/单双面/部件/单价/系数/材料备注/多数量 live in slave tables, not the master. - FormResolverService.curatedFields(quote): 17 fields tagged by target table (master/slave/note/manyqtys); 印刷/颜色/单双面 have no column -> written as note into slave sMaterialsMemo. - ProposeWriteTool.proposeQuote: routes fields to quoquotationmaster + quoquotationslave(印刷/部件, sParentId cascade) + quoquotationmanyqtys(多数量, one row per qty); FK name->id, type-coerce; emits __tables__ structured payload. - ErpClient.createMulti + OpController: multi-table addUpdateDelBusinessData (master + slaves in one call). - Pricing (核价) intentionally left to ERP (control/materials/process rows are engine-generated). Verified via agent (real write): collectForm shows all 17 fields; created BJD202607084 = master(Little Antelope/妇科三醇乳膏/1.8mm双灰板/5000/12x8x5/3.5) + slave(只/部件30x20/系数1/材料备注含印刷=胶印;颜色=彩色;单双面=单面) + manyqtys(1000/3000/5000).
-
Root cause of the reported failure: - collectForm sourced fields from gdsconfigformslave -> quote master's form config only exposes 3 system/header fields (失效时间/制单人/单据日期); user filled 单据日期(tCreateDate,datetime)='12' -> ERP type mismatch. - proposeCreate never coerced by column type, never FK-resolved names, used addBusinessData (no billNo). Fixes: - FormResolverService: businessFields() curated authoritative label->{col,fk} for quoquotationmaster (客户名称/产品名称/数量/长/宽/高/单价 -> real writable cols sCustomerId/sProductId(FK)/dQty/dLength/dWidth/dHeight/dPrice), field-dict fallback for other tables; columnTypes/coerce/typeDefault/resolveFk/nextBillNo(BJD+YYYYMM+seq); isSystemColumn excludes reserve/money/rate/discount/person/date/bool/tenant/maker; resolveMasterForm excludes param/slave/control/config/color secondary tables. - collectForm: fields from businessFields (excludes system/header); gdsconfigformslave fallback. - proposeCreate: label->{col,fk} via businessFields; FK name->id; type-coerce; skip system cols; auto sId/sFormId + generated sBillNo; type-correct required defaults. - ErpClient.createForm: addUpdateDelBusinessData(handleType=add)+moduleId (was addBusinessData). - ProposeWriteTool.resolveForm unified to FormResolverService. Verified via agent end-to-end (real write): collectForm shows correct fields; created quoquotationmaster BJD202607082 = Little Antelope / 妇科三醇乳膏 / qty5000 / dims / price, tenant+maker+date auto-injected. -
- ErpClient.execStaging(token, opId): POST /ai/execStaging/{opId} (user-token身份) - OpController: erp.exec-staging.enabled -> delegate confirm to ERP executor; default false keeps tested direct path - application-saaslocal.yml: erp.exec-staging.enabled=false (documented) -
…ormCollect + Skills + KgSearch - AgentIdentity + AgentFactory: build agent per request with token+form-allowlist carried in tool instances (per-call context; robust vs LC4j callback threading) - ErpClient: token-aware read/write/examine; user-token expiry does NOT silently re-login as dev-admin (no privilege escalation) - AuthzService: devIdentity()/userIdentity() resolve granted-form set (sAuthsId) - proposeExamine tool + OpController examine dispatch + forward user Authorization on confirm - InteractionTool.askUser (structured options), FormCollectTool.collectForm (real gdsconfigformslave schema) - SkillService + SkillTool.loadSkill + ai_skill digest in system prompt - KgQueryTool.kgSearch: L2 neighbors/flow + L3 field->table - tools ErpReadTool/ProposeWriteTool/QueryTool/FormCollectTool now per-request (not @Component)
-
…i_op_queue staging cols + ai_skill registry - proposeCreate tool -> ai_op_queue draft(payload) -> confirm executes addBusinessData - ai_op_queue: add sPayload/sSourceRef/bAutoExecute/sResultBillId/sErrorMsg/tExecutedDate/tExpireAt (create/examine/auto-flow ready) - ai_skill registry table + seed playbooks (Skills §6) - QueryTool: self-repair retry (feed SQL error back to model, up to 3x) - TracingChatModelListener: per-call LLM latency/token/error trace (Langfuse hook point)
-
- AuthzService: form-level allowlist ported from backend getsAuthsIdNew (sysjurisdiction sKey set); sysadmin=all; wired into Read/lookupRecord/proposeUpdate/proposeDelete (admin dev-login => all-access; enforces per-user once prod passes through user token) - proposeDelete + ErpClient.deleteForm (handleType=del) + OpController branches op type; HITL-gated like update - docs/security-findings.md: report of the 5 current-system vulns (backend form-perm off, read-API-can-write, NL2SQL no-tenant/over-privilege/partial-SQL-safety/cache-skips-validation) for the business - Verified end-to-end: read after authz = 93; propose-delete card -> confirm -> row actually deleted; audit rows written.
-
- FormResolverService: shared KG resolution (entity->master table excl. viw_*, field 中文->column, name field, labels) - ErpReadTool.lookupRecord(entity, record): reliably resolves the master table + returns a single record's full labelled fields — fixes the 'specific field of a specific record' case (e.g. 必胜客的销售员 -> 马艺祖) - AuditService + ai_audit_log: immutable audit of propose/confirm/cancel/query (who/when/action/target/result) - QueryTool.queryData(question): read-only SQL escape hatch — coder-model NL2SQL grounded on 字段字典, jsqlparser single-SELECT guard, blocks OUTFILE/LOAD_FILE/information_schema/SLEEP, forced LIMIT, audited. SAFE by construction; NL2SQL table/join accuracy for complex questions is limited (architecture-flagged, deferred). Verified: lookupRecord works; audit rows written; Query guards + LIMIT + audit work (NL2SQL grounding still mis-picks entity master on multi-table questions).
-
- ai_op_queue: staging table for AI write ops (draft|confirmed|executed|failed|cancelled) - ProposeWriteTool.proposeUpdate(entity, record, field, newValue): self-resolves the entity master table (excludes viw_* report views), resolves field via 字段字典, locates the unique record + old value, stages a DRAFT to ai_op_queue — DOES NOT execute; returns a proposal - ErpClient.updateForm: executes via ERP addUpdateDelBusinessData with the frontend-compatible payload {data:[{sTable,name:master,column:[{handleType:update,sId,field:value}]}]} - OpController: deterministic (non-LLM) POST /op/{id}/confirm (executes + writes back status) / cancel / GET pending - AgentChatController.onToolExecuted: on proposeUpdate, attach conversation + push write_proposal SSE - chat.html: confirm/cancel card + result echo - system prompt: proposeUpdate flow; never claim a write is done before confirm Verified end-to-end: '把必胜客简称改成必胜客中国' -> proposal card -> confirm -> ERP update -> DB changed; cancel -> DB unchanged. Nothing executes without explicit user confirm.