Commit Graph
11 Commits
Author SHA1 Message Date
zhanghongyu_0626 2945108f66 feat(kb): Enhance knowledge base with new collections and search functionality
- Added new configuration for knowledge base root directory in `.env.example` and `settings.py`.
- Implemented `find_products` method in `CoreReadOnlyRepository` for fuzzy product search based on user queries.
- Introduced `search_cs_knowledge` function in `rag_service.py` to facilitate semantic search across new `fin_*` collections.
- Updated document parsing to support Markdown and YAML front-matter for knowledge base entries.
- Created multiple new FAQ and policy documents in the `data/kb_collections` directory to enrich the knowledge base.

This update significantly improves the knowledge retrieval capabilities for customer service interactions, ensuring more relevant and accurate responses.
2026-09-09 20:00:06 +08:00
zhanghongyu_0626 b841f68295 feat(visitor): Implement visitor chat functionality and enhance customer service interactions
- Added a new visitor chat API endpoint (`/api/chat/visitor`) to allow unauthenticated users to engage in conversations without requiring customer data.
- Introduced a visitor context dependency to manage visitor interactions seamlessly.
- Enhanced the chat API to support explicit session termination and improved response handling for customer service interactions.
- Updated the database configuration to include Redis client support for caching visitor data.
- Added a new customer note repository to persist user notes independently of the L1 profile slots.

This update significantly improves the customer service experience by enabling visitor interactions and ensuring efficient data handling for both registered and unregistered users.
2026-09-09 18:32:00 +08:00
zhanghongyu_0626 6d780d45c3 feat(auth): Enhance JWT handling and error management in authentication flow
- Updated the login endpoint to utilize shared JWT issuer/audience settings, improving consistency across modules.
- Introduced error handling for unknown accounts during token issuance, raising an UnauthorizedError when necessary.
- Enhanced traceability by adding trace and request IDs to responses, ensuring better tracking of requests.
- Refactored exception handling in middleware to properly bubble up application-specific errors, preventing them from being swallowed.
- Added new utility functions for generating trace headers to improve debugging capabilities.

This update strengthens the authentication process and enhances error visibility, contributing to a more robust and maintainable codebase.
2026-09-08 19:55:08 +08:00
zhanghongyu_0626andCursor 452b427365 merge: 合并远程 risk-control-agent 到 merger
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-08 17:56:12 +08:00
GaoYiYuan_0626 66ec7eba08 feat: C6 FR-10 代理人行为链 RISK-008
代理人异常行为链识别(RISK-008)落地:
- 新增 agent_behavior_service:三条件证据聚合(A 诱导调仓/B AUTH_403_SCOPE 越权试探/C AUTH_403_NOT_OWNER|NOT_ASSIGNED 越权查询),按代理人维度独立出 pattern 单,payload.actor_id 指向代理人,审计仅 INSERT event_type=agent_behavior_detected。
- risk_repository 新增 list_audit_events / find_agent_behavior_alert / merge_agent_behavior_payload(同日同代理人一张单,证据并集)。
- trade_gateway.submit_trade 补 actor_id 透传(代理人发起交易归属发起人,缺省 SYSTEM);simulate 路由传入 auth.actor_id。
- chat_tools 新增 query_agent_behavior 只读 Tool(agent_id 过滤 + 客户脱敏),tool_service 补意图词与摘要。
- scripts/cron/agent_behavior_scan.py 定时扫描脚本。
- 修复 append_alert_event 序列化缺 default=str(C6 evidence 含 datetime 字段)。
- 单测 12 例(_count_induce 边界 / 三条件 / 出单去重 / payload 归属 / Tool 过滤脱敏)。
全量 pytest 482 passed 0 failed(470 基线 + 12 C6)。
2026-09-07 19:53:39 +08:00
GaoYiYuan_0626 90d0660b44 feat: C5 FR-9 预警处置时效升级(RISK-007,P0)
- 仓储:新增 list_pending_alerts_all / update_alert_escalation(统一读改写 payload,
  升级标记独占写入,status/handler_* 列不碰;_parse_alert 补 created_at/handled_at
  字符串→datetime 解析,兼容 sqlite 原生 DDL)
- escalation_service.scan_and_escalate:扫描判级(普通 4h/24h、AML 1h/4h 短通道)、
  幂等闸门(仅升不降)、先持久化再推送、按 (customer_id,level) 降噪合并一次推送、
  通知链累积(L1 含 risk_manager / L2 含 compliance)、逐单+任务级审计
- scripts/cron/escalation_scan.py:15min 定时扫描壳(sys.path 引导 + new_trace + JSON 摘要)
- 对话线 query_overdue_alerts Tool + 注册表 + 意图词(置于 alert_query 之前)+ summarize 分支
- C5 前置:seed STAFF-31001/31002(risk_manager) + deps 矩阵放行 + chat.py 显式 deny +
  risk.py 台账全量只读分支;JWT 手册 §5.3/§5.4/§6.1 增补 risk_manager
- 测试:conftest 回拨 fixture + test_escalation_service(9) + risk_api/manager(5) +
  chat deny(1) + chat_tools overdue(2);全量 470 绿(453+17)
2026-09-07 19:28:04 +08:00
GaoYiYuan_0626 fe4801bc0a feat: C4 FR-8 持仓集中度预警(RISK-006)
依据《实现方案-风控追加需求v1.1-C4C6.md》§2;不改表结构(alert_type/status
复用 payload 承载,audit_log.event_type 为 VARCHAR 可直接扩)。

1. settings.py + .env.example:一次性加齐风控追加 v1.1 共 11 项配置(C4~C6 共用)。
2. core_ro.concentration_profile(customer_id, limit=500):一次 SQL 取明细
   (LIMIT limit+1 探测截断)+ Python 端按 min_risk_code in (R4,R5) 聚合;
   收口挂账 #1(PRD 字面为 list_holdings,改聚合封装,docstring 注明偏离)。
3. rules.py:RULE_SCORES/RULE_ALERT_TYPES 加 RISK-006=60/pattern;RuleHit 加
   alert_subtype;RiskThresholds 加 concentration_threshold 且 from_settings
   必须补读(评审 P1-2:漏读会让 conftest monkeypatch 失效打穿现有断言);
   新增纯函数 rule_concentration——空仓不触发、截断视同达标(保守告警)、
   阈值边界 79.9% 不触发 / 80% 触发、R4+R5 为 0 不触发。
4. engine.process_trade_event:run_rules 之后、record_trade_alerts 之前并入
   集中度命中(不动 run_rules 签名);命中后 L3 打 high_risk_concentration
   标签 + 写 risk_concentration 审计(金额只落合计与前 5 条摘要)。
5. risk_repository:find_pending_event_alert 改候选 LIMIT 50 + Python 过滤掉
   payload.alert_subtype 含 agent_behavior 的单(评审 P0-1:代理人维度行为链单
   不得充当客户维度事件单的聚合锚点);append_alert_event 加 extra_subtypes
   合并进 payload.alert_subtype(不传时行为与原先一致,向后兼容)。
6. alert_service:subtypes 集合维护(空集不注入 payload,评审 P2-3);
   追加时 alert_type 按「老单规则 ∪ 本批规则」重算(评审 P1-3,修掉既有
   large_amount 单被本批仅 RISK-006(60) 翻转为 pattern 的缺陷);
   _publish_alert 加 notify_role/extra 可选参数(C5/C6 复用)。
7. 对话线:chat_tools.customer_context 加 profile(concentration_ratio/
   r45_value/total_value/holdings_truncated),tool_service.summarize 加
   「高风险持仓占比 X%(仅供参考)」;不新增意图词。
8. 02-redis-keys.md 增补 alert_subtype / escalation_level 附加推送字段。

测试:conftest 加 autouse _disable_concentration_rule(阈值推 1.01 做回归隔离,
现有用例断言零改动);test_risk_rules 加 RISK-006 纯函数 6 例;新建
tests/test_concentration_c4.py 11 例(与 RISK-001 同单聚合、score max=70、
L3 tag、risk_concentration 审计、仅集中度也出单、subtype 合并、P0-1 回归、
alert_type 不翻转、对话线 ratio)。全量 453 绿(436 + 17)。
2026-09-07 19:05:02 +08:00
GaoYiYuan_0626 adf5e8013a AL-05: suitability 服务重构换核对齐 main 基准——判定内核由 SUIT-001~008 纯函数矩阵改为 core_ro.check_suitability(C×R 数据驱动);SuitabilityResult 扩 main 新字段(match_result 五值/mismatch_type 七值/requires_disclosure/needs_branch_confirm/block_response_code/rule_refs)并保留旧字段兼容层(rule_id=机器码别名/effective_level=customer_level/reasons=[reason]);check_core/cap_by_age/match_by_matrix/is_assessment_valid 删除(SUIT-006 被 FM-01 替换,SUIT-008 被 FM-03 expires_at 替换);settings.risk_assessment_valid_days 退役(.env/.env.example 注释);NotFoundError 不再抛(not_found 结构化,main 契约);写库走 build_suitability_log_row + insert_suitability_log 升级 21 列(rule_refs JSON 序列化);check_source 参数化(网关 r02_trade/risk.py manual)+actor_id 透传;网关阻断响应补 block_response_code;model 抽 compute_rule_refs 公共函数防两处漂移;测试配套:_ddl 加矩阵 25 行种子 helper、conftest fixture 灌种子+集成就位校验改 expires_at 口径、trade_gateway/risk_api fixture 补种子与 expires_at、404 两例改 200+blocked 新契约、repository 21 列断言、settings 退役断言、test_suitability 占位 skip 待 AL-07 重写。sqlite 端到端七语义+落库验证通过;剩 4 failed 均为 chat_tools/API 旧展示断言(AL-06 处理) 2026-09-07 17:34:32 +08:00
zhanghongyu_0626 3995cb44d8 Implement authentication and chat functionality with JWT support
- Added `auth.py` for mock login and JWT issuance.
- Introduced `chat.py` for handling chat requests with role-based access control.
- Enhanced `main.py` to include new routers and middleware for tracing.
- Implemented input validation in `input_guard.py` to prevent SQL injection.
- Created repositories for managing agent sessions and audit logs.
- Added exception handling for authorization errors.
- Updated settings to include JWT configuration.
- Introduced tests for authentication and input validation.
2026-09-07 17:20:42 +08:00
GaoYiYuan_0626 516b1132a3 fix: B8 复审 P1-1——conftest except pytest.SkipRequested 引用不存在属性致 skip 路径炸收集(删, Skipped 继承 BaseException 直传, 错密码故障注入验证 skip 不 error); P3 顺手: teardown l3_snapshot 哨兵 + A-1 补 trace 响应头/suitability_log 两环; P2-1 演示库耦合前置断言挂 B9b 核查单⑥ 2026-09-06 23:52:59 +08:00
GaoYiYuan_0626 e7bd8880e2 test: B8 主体——conftest(演示数据校验/幂等代跑/TRD-TEST- teardown)+集成测试 A-1~A-5/A-7/A-9+trace一致性+审计JSON(11例)+_ddl.py 单一事实源+L3 DEL 行为断言(B7复审P2-1)+locks 文案中性化(P3-2), 196 绿 2026-09-06 23:27:37 +08:00