docs: accept partial send sandbox evidence
This commit is contained in:
zhaoyilun
@@ -0,0 +1,133 @@
|
||||
# Returned Send Sandbox Analysis
|
||||
|
||||
Date: 2026-07-10
|
||||
Node: R6d returned sandbox evidence intake
|
||||
Returned package: `C:\Users\zhaoy\Downloads\1631.zip`
|
||||
Local intake copy: `runs/returned-send-sandbox/1631/`
|
||||
|
||||
## Decision
|
||||
|
||||
Use this return package as **partial R6d evidence** only.
|
||||
|
||||
Business interpretation:
|
||||
|
||||
- It is enough to continue the next engineering loop with a sandbox-only send connector shell, idempotency/audit hardening, and stricter returned-package validation.
|
||||
- It is not enough to enable production `isphere_send_message`.
|
||||
- It is not enough to start `isphere_send_file` production work.
|
||||
|
||||
Repository behavior remains:
|
||||
|
||||
```text
|
||||
production_send_enabled=false
|
||||
```
|
||||
|
||||
## Validator
|
||||
|
||||
Repeatable validation command:
|
||||
|
||||
```powershell
|
||||
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\validate-returned-send-sandbox-package.ps1 -PackagePath C:\Users\zhaoy\Downloads\1631.zip
|
||||
```
|
||||
|
||||
Fixture test:
|
||||
|
||||
```powershell
|
||||
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\test-validate-returned-send-sandbox-package.ps1
|
||||
```
|
||||
|
||||
Observed validator result:
|
||||
|
||||
```json
|
||||
{
|
||||
"partial_evidence_usable": true,
|
||||
"r6d_gate_pass": false,
|
||||
"capability_test_ok": true,
|
||||
"capability_tool_count": 9,
|
||||
"production_send_enabled": false,
|
||||
"content_hash_matches": true,
|
||||
"operator_observed_success": true,
|
||||
"do_not_send_second_time_confirmed": true,
|
||||
"has_before_probe": true,
|
||||
"has_after_probe": false,
|
||||
"missing_for_full_gate": [
|
||||
"manual_send_started_at_local",
|
||||
"manual_send_finished_at_local",
|
||||
"after_recorder_output"
|
||||
],
|
||||
"decision": "partial_use_only"
|
||||
}
|
||||
```
|
||||
|
||||
## Evidence received
|
||||
|
||||
The returned zip contains:
|
||||
|
||||
```text
|
||||
isphere-live-probe-20260710-162555.zip
|
||||
RUN-RECORDING-SUITE.txt
|
||||
SANDBOX-SEND-INPUTS..json
|
||||
send-capability-test-package.txt
|
||||
```
|
||||
|
||||
Notes:
|
||||
|
||||
- `SANDBOX-SEND-INPUTS..json` has a double dot in the filename, but the validator accepts this pattern.
|
||||
- The target id is present but should stay redacted in committed docs.
|
||||
- The raw message body is not needed in committed docs; the validator checks the supplied SHA256 against the local returned JSON.
|
||||
- The capability-test transcript proves the offline-safe 9-tool package ran successfully and kept production send disabled.
|
||||
|
||||
## Evidence that is usable now
|
||||
|
||||
Usable for next engineering loop:
|
||||
|
||||
- explicit sandbox target fields are present;
|
||||
- content SHA256 matches the supplied test content;
|
||||
- idempotency key is present;
|
||||
- operator recorded observed success/sent-record text;
|
||||
- operator confirmed no second send;
|
||||
- one read-only live probe package was returned;
|
||||
- capability smoke passed with 9 tools and `production_send_enabled=false`.
|
||||
|
||||
This is enough to justify moving from "waiting for any returned send evidence" to:
|
||||
|
||||
1. returned-package validator hardening;
|
||||
2. sandbox-only connector shell design;
|
||||
3. idempotency/audit persistence design;
|
||||
4. fake/sandbox connector tests.
|
||||
|
||||
## Missing for full R6d pass
|
||||
|
||||
Missing:
|
||||
|
||||
- `manual_send_started_at_local`;
|
||||
- `manual_send_finished_at_local`;
|
||||
- after-send recorder output;
|
||||
- standard `return-evidence/before` and `return-evidence/after` shape from `make-return-zip.ps1`.
|
||||
|
||||
Because these are missing, the full gate does **not** pass.
|
||||
|
||||
## Current route decision
|
||||
|
||||
Proceed with "partial use" only:
|
||||
|
||||
```text
|
||||
R6d partial_use_only -> R6e sandbox-only send connector shell and idempotency audit hardening
|
||||
```
|
||||
|
||||
Do not change the current MCP production-send response:
|
||||
|
||||
```text
|
||||
execution_mode="production" -> send_status="blocked"
|
||||
```
|
||||
|
||||
## What would make it full pass later
|
||||
|
||||
Ask the operator to return a corrected package only when convenient:
|
||||
|
||||
1. run `02-run-after-recorder.bat`;
|
||||
2. fill `manual_send_started_at_local`;
|
||||
3. fill `manual_send_finished_at_local`;
|
||||
4. run `03-make-return-zip.bat`;
|
||||
5. return the generated `isphere-send-sandbox-return-*.zip`.
|
||||
|
||||
The current partial package can still be used for the next local development loop.
|
||||
@@ -7,6 +7,7 @@ Schema notes: `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md`
|
||||
Returned live probe: `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md`
|
||||
Send connector preflight: `docs/source-discovery/2026-07-10-send-connector-preflight.md`
|
||||
Send sandbox gate: `docs/source-discovery/2026-07-10-send-sandbox-gate.md`
|
||||
Returned send sandbox analysis: `docs/source-discovery/2026-07-10-returned-send-sandbox-analysis.md`
|
||||
|
||||
## Source priority
|
||||
|
||||
@@ -25,7 +26,7 @@ Send sandbox gate: `docs/source-discovery/2026-07-10-send-sandbox-gate.md`
|
||||
| `isphere_search_contacts` | bare sender/receiver JIDs extracted from normalized log-backed messages loaded from configured PacketReader file or directory source | validated copied `MsgLib.db` tables: `TD_Roster`, `TD_CustomEffigy`, `tblRecent`, `tblChatLevel`, `tblPersonMsg`; decrypted roster/contact stanzas from `Smark.SendReceive`; UIA helper source if display names are still missing | `docs/source-discovery/2026-07-10-msglib-readonly-schema-extraction.md`; `internal/isphere/contacts_test.go`; `internal/tools/isphere_contacts_test.go` | C34 documents optional MsgLib contact display enrichment; R2 adds deterministic exact-match-first ranking, case-insensitive de-duplication across log/MsgLib candidates, and preserves `source`/`raw_ref` | core contact search complete; optional richer fields later |
|
||||
| `isphere_search_groups` | decrypted `PacketReader.ProcessPacket` `type="groupchat"` stanzas and conference/MUC JIDs loaded from configured PacketReader file or directory source | validated copied `MsgLib.db` tables: `tblMsgGroupPersonMsg`, `TD_WorkGroupAuth`, `tblRecent`; UIA helper source if group display names are still missing | `docs/source-discovery/2026-07-10-msglib-readonly-schema-extraction.md`; `internal/isphere/groups_test.go`; `internal/tools/isphere_groups_test.go`; C9 ignored-log scan: PacketReader 86 groupchat/86 conference hits; Smark 24 groupchat/658 conference/631 muc hits | C34 documents optional MsgLib group display enrichment; R2 adds deterministic exact-match-first ranking, case-insensitive de-duplication across log/MsgLib candidates, and preserves `source`/`raw_ref` | core group search complete; optional member/owner hierarchy later |
|
||||
| `isphere_receive_files` | decrypted `PacketReader.ProcessPacket` file-transfer message stanzas via `internal/isphere.ListFilesFromMessages` and `isphere_receive_files` list mode; configured PacketReader file or directory source; `zyl\importal\<hash>` cache entries remain unlinked | MsgLib `TD_ReceiveFileRecord` safe metadata through explicit copied-DB path; decrypted `Smark.SendReceive` and `SaveToDB` traces for file-reference reconciliation; future UIA/client connector for download | `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md#c12-file-transfer-evidence-precheck`; `docs/source-discovery/2026-07-10-file-download-mapping-precheck.md`; `docs/source-discovery/2026-07-10-file-cache-mapping-diagnostic.md` | C22 verifies safe file-list contract args; R3 confirms list metadata is available; R3b diagnostic finds 0 current cache/archive matches, so R4 remains blocked | blocked pending better cache evidence or UI/client download connector |
|
||||
| `isphere_send_message` | B-route selected: running-client sidecar / in-process connector, preferring `AppContextManager.SendTxtMessageByJid(...)` or `MessageScheduling.SendChatMessage(...)` over the unimplemented `SendP2PMessage(...)` interface path; current MCP tool exposes preview/dry-run only | A-route fallback: constrained UI/RPA wrapper only if B cannot pass runtime probe, entrypoint availability, dynamic observation, and idempotent dry-run gates; network/protocol replay remains deferred | `docs/source-discovery/2026-07-10-send-message-source-precheck.md`; `docs/source-discovery/2026-07-10-send-message-connector-selection.md`; `docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md`; `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md`; `docs/source-discovery/2026-07-10-send-connector-preflight.md`; `docs/source-discovery/2026-07-10-send-sandbox-gate.md`; `internal/tools/isphere_send_message_test.go`; `cmd/isphere-capability-smoke/main.go` | R6c prepares the online sandbox evidence package because local login is unavailable. `runs/send-sandbox-gate-package.zip` now contains a consolidated recording suite for one manual sandbox send; `runs/send-capability-test-package.zip` separately verifies the offline-safe 9-tool surface, fixture-backed receive/search/file-list behavior, send preview, and `production_send_enabled=false`. No returned online send evidence has been analyzed yet. Production remains blocked. | next: R6d returned sandbox evidence intake after user returns the package |
|
||||
| `isphere_send_message` | B-route selected: running-client sidecar / in-process connector, preferring `AppContextManager.SendTxtMessageByJid(...)` or `MessageScheduling.SendChatMessage(...)` over the unimplemented `SendP2PMessage(...)` interface path; current MCP tool exposes preview/dry-run only | A-route fallback: constrained UI/RPA wrapper only if B cannot pass runtime probe, entrypoint availability, dynamic observation, and idempotent dry-run gates; network/protocol replay remains deferred | `docs/source-discovery/2026-07-10-send-message-source-precheck.md`; `docs/source-discovery/2026-07-10-send-message-connector-selection.md`; `docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md`; `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md`; `docs/source-discovery/2026-07-10-send-connector-preflight.md`; `docs/source-discovery/2026-07-10-send-sandbox-gate.md`; `docs/source-discovery/2026-07-10-returned-send-sandbox-analysis.md`; `internal/tools/isphere_send_message_test.go`; `cmd/isphere-capability-smoke/main.go` | R6d validates `C:\Users\zhaoy\Downloads\1631.zip` as partial evidence only: `partial_evidence_usable=true`, `r6d_gate_pass=false`, capability smoke passed, content hash matched, operator success/no-second-send fields were present, but after-recorder output and send timestamps were missing. This is enough for sandbox-only connector-shell/idempotency work, not enough for production send. | next: R6e sandbox-only connector shell and idempotency audit hardening |
|
||||
| `isphere_send_file` | B-route selected after send-message probe: managed offline-file path through `OffLineFileSend.sendFile()`, `IMPP.Service*.dll` `IFileTransfer.FileUpload(...)`, and `Chat.sendFileMessage(...)` | A-route fallback: constrained UI/RPA upload/send-file flow; native `TcpFileTransfer.dll` is a later candidate only after managed path is rejected | `docs/source-discovery/2026-07-10-send-message-source-precheck.md`; `docs/source-discovery/2026-07-10-send-message-connector-selection.md`; `docs/source-discovery/2026-07-10-send-sidecar-b-first-plan.md`; `docs/source-discovery/2026-07-10-returned-live-probe-analysis.md`; `docs/source-discovery/2026-07-10-send-connector-preflight.md`; `docs/source-discovery/2026-07-10-send-sandbox-gate.md` | R6a/C31 metadata confirms `FileTransfer.FileUpload`, `FileTransfer.AsynFileUpload`, `OffLineFileSend.sendFile`, and `Chat.sendFileMessage` candidates. File-send remains blocked behind returned message-send sandbox evidence plus later upload/file-message dry-run evidence. | next: wait for R6d, then file-send upload preflight |
|
||||
|
||||
## Stage C entry rule
|
||||
@@ -43,4 +44,4 @@ Start Stage C with a narrow log-backed `isphere_receive_messages` source abstrac
|
||||
|
||||
## Deferred source work
|
||||
|
||||
`MsgLib.db` has a validated copied read-only open path through the bundled 32-bit `System.Data.SQLite.dll` and password `123`. C27 adds `MsgLibReadSidecar` as the bounded x86 .NET reader boundary, C28 adds the Go `internal/msglib` process client, C29 adds bounded `display_entities` extraction, C30 wires it as optional contact/group MCP enrichment, C31 proves real copied-DB MCP enrichment with sanitized output, C32 reuses it for receive-message display fields, C33 proves that receive display path through a real copied-DB MCP smoke without printing entity values, C34 documents the operator setup/verification path, C35 maps MsgLib message tables to receive-message contract fields without reading row values, C36 adds metadata-only `message_sources` readiness, C37 defines the bounded DB-backed receive-source design, C38 implements sidecar/Go-wrapper `list_messages` with sanitized verification, C39 adds a Go adapter from MsgLib list results to the receive-message domain model, C40 adds explicit tool-level `msglib_readonly` source selection, C41 wires env-configured explicit MsgLib receive with optional sanitized smoke, R1 documents source reconciliation keys, and R2 hardens contact/group search ranking and de-duplication. R6c now has both the consolidated online recording package and the offline capability-test package. The active roadmap is `docs/superpowers/plans/2026-07-10-core-business-capabilities-roadmap.md`; next step is R6d returned sandbox evidence intake after the online package is returned.
|
||||
`MsgLib.db` has a validated copied read-only open path through the bundled 32-bit `System.Data.SQLite.dll` and password `123`. C27 adds `MsgLibReadSidecar` as the bounded x86 .NET reader boundary, C28 adds the Go `internal/msglib` process client, C29 adds bounded `display_entities` extraction, C30 wires it as optional contact/group MCP enrichment, C31 proves real copied-DB MCP enrichment with sanitized output, C32 reuses it for receive-message display fields, C33 proves that receive display path through a real copied-DB MCP smoke without printing entity values, C34 documents the operator setup/verification path, C35 maps MsgLib message tables to receive-message contract fields without reading row values, C36 adds metadata-only `message_sources` readiness, C37 defines the bounded DB-backed receive-source design, C38 implements sidecar/Go-wrapper `list_messages` with sanitized verification, C39 adds a Go adapter from MsgLib list results to the receive-message domain model, C40 adds explicit tool-level `msglib_readonly` source selection, C41 wires env-configured explicit MsgLib receive with optional sanitized smoke, R1 documents source reconciliation keys, and R2 hardens contact/group search ranking and de-duplication. R6d partial evidence is now usable only for sandbox-only send connector shell and idempotency/audit hardening. The active roadmap is `docs/superpowers/plans/2026-07-10-core-business-capabilities-roadmap.md`; next step is R6e.
|
||||
|
||||
Reference in New Issue
Block a user