Commit Graph
85 Commits
Author SHA1 Message Date
zhanghongyu_0626 d4a2461ba4 feat(nav): Enhance product API with historical NAV tracking and new charting features
- Updated `ready.py` to include a health check for the new `products_nav_history` endpoint, ensuring system readiness.
- Enhanced the `ProductNavChartPanel` component to visualize historical NAV data with various charting options, including line and column charts.
- Introduced new utility functions for filtering and aggregating NAV data, improving data handling in the frontend.
- Updated tests to verify the inclusion of the new `products_nav_history` check in the API response.
- Improved documentation to reflect recent changes and the new testing baseline of 833 passed tests, indicating enhanced stability.

This update significantly improves the product API by providing access to historical NAV data and enhancing user insights through visualizations.
2026-09-11 21:38:54 +08:00
zhanghongyu_0626 2b4eaa9725 feat(nav): Implement historical NAV tracking and enhance product API
- Added `list_nav_history` method in `CoreReadOnlyRepository` to retrieve historical NAV data for products over a specified number of days.
- Introduced `get_nav_history` endpoint in `product_service` to return historical NAV sequences, improving product data accessibility.
- Updated `products.py` to include new API endpoint for fetching NAV history, ensuring compliance with access control.
- Enhanced `ready.py` to include a health check for the new functionality, ensuring system readiness.
- Updated documentation to reflect the new testing baseline of 833 passed tests, indicating improved stability and functionality across the application.

This update significantly enhances the product API by providing access to historical NAV data, improving user insights into product performance.
2026-09-11 20:47:18 +08:00
zhanghongyu_0626 793c0307f8 feat(risk): Enhance risk management functionality and access control
- Updated `RiskListAccess` and `ThresholdWriteAccess` to enforce access control in the risk repository and threshold repository, ensuring only authorized roles can perform sensitive operations.
- Introduced new methods in `RiskRepository` for counting pending alerts and listing alerts with access checks, improving data security and compliance.
- Enhanced the `chat.py` and `deps.py` files to integrate compliance roles into the risk management matrix, allowing for more granular access control.
- Updated documentation to reflect the new testing baseline of 825 passed tests, indicating improved stability and functionality across the application.

This update significantly strengthens the risk management capabilities, ensuring robust access control and compliance with organizational policies.
2026-09-11 17:07:22 +08:00
zhanghongyu_0626 8556da489a feat(analyst): Add sample and escalate functionality to analyst API
- Introduced new endpoints `/api/analyst/query/{trace_id}/sample` and `/api/analyst/escalate` for sampling query results and escalating issues to human analysts, respectively.
- Enhanced `AnalystAgent` to support sampling of SQL results based on trace ID and to handle escalation requests, improving user experience in error scenarios.
- Updated `analyst_schemas.py` to include `EscalateRequest` for structured escalation requests.
- Added corresponding frontend API calls and UI components to facilitate user interactions with the new features.
- Implemented unit tests to ensure the reliability of the new functionalities.

This update significantly enhances the analytical capabilities of the application, allowing users to retrieve detailed query samples and escalate issues effectively.
2026-09-11 15:18:56 +08:00
zhanghongyu_0626 0fb7d34d7a feat(analyst): Implement audit logging for query denial and clarification
- Enhanced the `AnalystAgent` class to include an `_audit_terminal` method for logging query denials, clarifications, and errors, ensuring compliance and traceability.
- Updated error handling paths to call the new audit method, capturing relevant details such as question, user authentication, and SQL context.
- Introduced new validation checks in `sql_guard.py` to enforce ownership filters for sensitive queries, improving security measures.
- Added unit tests to verify the correct logging behavior and ownership filter enforcement, ensuring robust functionality.

This update significantly strengthens the auditing capabilities of the analyst agent, enhancing security and compliance in query handling.
2026-09-11 14:45:16 +08:00
zhanghongyu_0626 aea97a243c feat(analyst): Introduce interpret functionality and enhance chat API
- Added `interpret` flag to `AnalystChatRequest` for optional immediate interpretation of queries.
- Implemented new `POST /api/analyst/interpret` endpoint for on-demand data interpretation based on the latest query snapshot.
- Updated `AnalystAgent` to handle interpretation logic, including error handling and response formatting.
- Enhanced `AnalystQueryPage` to include a button for triggering interpretations, improving user interaction.
- Updated frontend API calls to support the new interpret functionality, ensuring seamless integration with existing workflows.

This update significantly enhances the analytical capabilities of the application, allowing users to request interpretations of their queries directly.
2026-09-11 12:15:18 +08:00
zhanghongyu_0626 9d4d4aaa6d feat(chat): Enhance session management with new API endpoints and filtering options
- Added `status` query parameter to `list_sessions_api` for filtering sessions by their status (active/closed).
- Introduced `close_all_sessions_api` endpoint to allow users to close all active sessions for the current actor.
- Updated `SessionRepository` to support status filtering in session listing and implemented logic for closing active sessions.
- Improved Redis connection settings for better performance and reliability.

This update enhances the chat functionality by providing more control over session management, improving user experience and system efficiency.
2026-09-10 22:30:07 +08:00
zhanghongyu_0626 ddcf53cfa8 feat(template): Implement template caching and SQL rendering for enhanced query handling
- Introduced `TemplateService` for managing SQL templates, allowing for parameterized queries based on user input.
- Added functionality to automatically reload templates upon asset creation in `analyst.py`.
- Enhanced `CacheService` to support table generation bumping, ensuring cache invalidation on data changes.
- Updated `RiskRepository` and `GatewayRepository` to trigger cache invalidation for relevant operations.
- Expanded `analyst_schemas.py` to include new fields for template tracking in response metadata.
- Created seed SQL script for populating initial templates and added unit tests for template rendering logic.

This update significantly improves the efficiency of query handling by leveraging SQL templates, reducing reliance on LLM for common queries.
2026-09-10 15:22:07 +08:00
zhanghongyu_0626 21ced4d38f feat(report): Add battery report generation and update course documentation
- Introduced `battery_report.json` for local data analysis, excluding it from the database.
- Enhanced `AGENTS.md` to reflect updated test baseline with 795 passed tests.
- Added new metrics for trade flow in `dict_service.py`, improving transaction data analysis.
- Updated regex patterns in `guardrail.py` to better handle numeric extraction and prevent misinterpretation of tokens.
- Expanded course modules with new content on FR-8/9/10 capabilities and L3 role management.
- Improved concurrency handling in transaction processing to ensure accurate alert generation.

This update enhances data analysis capabilities and improves the overall structure and clarity of course materials.
2026-09-10 14:32:25 +08:00
zhanghongyu_0626 4b8e11c9bd feat(threshold): Implement customer loss threshold configuration and notification system
- Added `ThresholdRepository` for managing customer loss threshold configurations and notifications.
- Introduced `threshold_service` to handle loss threshold alerts based on customer portfolio performance.
- Enhanced `customer_prompts` to include new intent for querying product net values.
- Updated `customer_service` to integrate new threshold alert functionality into existing workflows.
- Implemented `sanitize_postprocess` for improved compliance handling in customer interactions.
- Enhanced course documentation to reflect updates in advisor training modules and interactive elements.

This update significantly improves the customer experience by providing proactive loss threshold notifications and enhancing the overall service framework.
2026-09-10 10:57:40 +08:00
zhanghongyu_0626 3ad244add0 feat(analyst): Enhance dashboard metrics and customer service interactions
- Updated the `dashboard` function in `analyst.py` to include additional metrics for different user roles, improving data visibility for analysts, customers, advisors, and risk officers.
- Introduced a new `prepare_customer_stream` function in `customer_service.py` to facilitate streaming responses for customer interactions, enhancing the chat experience.
- Added new API endpoints in `analyst.ts` for fetching dashboard metrics and managing analyst assets, streamlining data handling and user interactions.
- Updated frontend components to support new dashboard features and asset management, ensuring a cohesive user experience across the application.

This update significantly improves the functionality and usability of the analyst and customer service features, providing users with enhanced tools for data analysis and interaction.
2026-09-09 21:32:59 +08:00
zhanghongyu_0626 af9fb719e5 refactor(analyst): Update authentication context and add smoke test script
- Replaced `get_auth_context` with `get_platform_auth_context` in `analyst.py` to enhance authentication handling.
- Added a new smoke test script `smoke_analyst.py` for testing the data analysis agent with both fake and live LLM configurations.
- Updated TODO documentation to reflect the completion of Scope B smoke tests, ensuring clarity on testing status.

This update improves the authentication mechanism and introduces a comprehensive testing approach for the data analysis agent.
2026-09-09 21:09:03 +08:00
zhanghongyu_0626 bcd6175d4e feat(analyst): Implement data analysis agent with authentication and query handling
- Introduced `analyst_auth_adapter.py` for managing authentication context and access control for the data analysis agent.
- Added new API endpoints in `analyst.py` for chat, dashboard, asset management, and metrics, utilizing the new authentication context.
- Created Pydantic models in `analyst_schemas.py` for request and response structures, ensuring consistent data handling.
- Updated SQL guard logic in `sql_guard.py` to enforce access restrictions based on user roles and contexts.
- Implemented migration scripts for new database tables related to the data analysis agent, enhancing data management capabilities.
- Removed legacy authentication code from `auth.py`, streamlining the authentication process.

This update significantly enhances the data analysis capabilities, providing a robust framework for querying and managing data securely.
2026-09-09 21:02:11 +08:00
zhanghongyu_0626 aa23e1ae1d Merge branch 'data-analysis-agent-work' into merger 2026-09-09 20:53:59 +08:00
zhanghongyu_0626 bf8f271840 feat(redis): Update Redis configuration and enhance compatibility with Docker
- Changed Redis port mapping in `docker-compose.yml` from `6379:6379` to `6380:6379` to avoid conflicts with Windows Redis.
- Updated `.env.example` to reflect the new Redis URL (`redis://127.0.0.1:6380/0`), ensuring proper configuration for Docker users.
- Enhanced Redis client initialization in `database.py` and `redis_gateway.py` to utilize a new `_redis_kwargs` function for improved compatibility with Windows Redis 3.x and Docker Redis 7.
- Added a new PowerShell script `start-redis.ps1` to facilitate starting Redis in Docker, providing a seamless setup experience for developers.

This update significantly improves the Redis integration, ensuring a smoother development process and better compatibility across environments.
2026-09-09 20:19:55 +08:00
zhanghongyu_0626 2945108f66 feat(kb): Enhance knowledge base with new collections and search functionality
- Added new configuration for knowledge base root directory in `.env.example` and `settings.py`.
- Implemented `find_products` method in `CoreReadOnlyRepository` for fuzzy product search based on user queries.
- Introduced `search_cs_knowledge` function in `rag_service.py` to facilitate semantic search across new `fin_*` collections.
- Updated document parsing to support Markdown and YAML front-matter for knowledge base entries.
- Created multiple new FAQ and policy documents in the `data/kb_collections` directory to enrich the knowledge base.

This update significantly improves the knowledge retrieval capabilities for customer service interactions, ensuring more relevant and accurate responses.
2026-09-09 20:00:06 +08:00
zhanghongyu_0626 b841f68295 feat(visitor): Implement visitor chat functionality and enhance customer service interactions
- Added a new visitor chat API endpoint (`/api/chat/visitor`) to allow unauthenticated users to engage in conversations without requiring customer data.
- Introduced a visitor context dependency to manage visitor interactions seamlessly.
- Enhanced the chat API to support explicit session termination and improved response handling for customer service interactions.
- Updated the database configuration to include Redis client support for caching visitor data.
- Added a new customer note repository to persist user notes independently of the L1 profile slots.

This update significantly improves the customer service experience by enabling visitor interactions and ensuring efficient data handling for both registered and unregistered users.
2026-09-09 18:32:00 +08:00
zyi b19a2415f9 feat: 数据分析 Agent 实现(API/服务/表结构元数据/文档/测试)
- 新增 app/api、app/service 数据分析 Agent 全套服务与接口
- schemas.py 重构为 schemas 包(analyst schema)
- 新增 SQL 防注入、guardrail、缓存、字典、LLM 等服务
- 新增 tests 测试套件与 scripts/dev、scripts/setup 脚本
- 补充需求规格、架构说明书、开发清单、表设计等文档
2026-09-09 18:04:45 +08:00
zhanghongyu_0626 b881893575 feat(chat): Enhance assistant content handling with disclaimer management
- Introduced a new function `_assistant_content_for_persist` to append disclaimers to assistant responses, ensuring consistency in stored content.
- Updated `chat_api` and `chat_stream_api` to utilize the new function for managing assistant replies, improving data integrity.
- Added tests to verify the correct handling of disclaimers in various scenarios, ensuring compliance with expected output.

This update enhances the chat system's reliability by ensuring that disclaimers are consistently applied to assistant responses, improving user experience and data accuracy.
2026-09-09 10:42:24 +08:00
zhanghongyu_0626 d0da627a5c feat(chat): Update trace ID handling in chat stream API
- Modified `chat_stream_api` to use `new_trace()` instead of an empty string for `trace_id`, enhancing traceability.
- Added tests to verify the correct generation and propagation of `trace_id` in responses, ensuring no empty trace IDs are sent to clients.

This update improves the tracking of chat sessions and ensures compliance with traceability standards.
2026-09-08 21:46:08 +08:00
zhanghongyu_0626 c9cac1cdf9 feat(api): 更新代销平台 API v0.1,增强适当性检查功能
- 在 `risk_suitability_log` 表中新增 `check_source` 枚举值 `platform`,支持代销平台的适当性检查。
- 更新相关 SQL 脚本以适应新的数据结构,确保数据一致性。
- 修改文档以反映 API 的最新状态和测试基线,确保文档与实现保持一致。
- 测试基线更新至 530 passed, 0 skipped,确保系统稳定性。

此更新为代销平台提供了更全面的适当性检查能力,提升了系统的功能性与可维护性。
2026-09-08 21:44:16 +08:00
zhanghongyu_0626 ef56c56435 feat(api): 实现代销平台 API v0.1,包括客户、产品、理财师、合规及员工接口
- 新增多个 API 路由:`/api/customers`, `/api/products`, `/api/advisors`, `/api/compliance`, `/api/staff`,支持客户信息、产品详情、理财师客户列表、合规判定及员工上下文查询。
- 引入平台服务层,封装核心只读操作,支持数据脱敏功能。
- 更新依赖注入,确保各 API 路由的权限控制与数据访问一致性。
- 添加相应的单元测试,确保新接口的功能完整性与稳定性。

此更新为代销平台提供了基础的 REST API 支持,增强了系统的可扩展性与可维护性。
2026-09-08 21:01:07 +08:00
zhanghongyu_0626 6d780d45c3 feat(auth): Enhance JWT handling and error management in authentication flow
- Updated the login endpoint to utilize shared JWT issuer/audience settings, improving consistency across modules.
- Introduced error handling for unknown accounts during token issuance, raising an UnauthorizedError when necessary.
- Enhanced traceability by adding trace and request IDs to responses, ensuring better tracking of requests.
- Refactored exception handling in middleware to properly bubble up application-specific errors, preventing them from being swallowed.
- Added new utility functions for generating trace headers to improve debugging capabilities.

This update strengthens the authentication process and enhances error visibility, contributing to a more robust and maintainable codebase.
2026-09-08 19:55:08 +08:00
zhanghongyu_0626 04c12152f6 feat(chat): 重构对话接口与服务,增强会话管理与工具节点支持
- 更新 chat.py,整合四个 Agent 的统一入口,增加输入防护与会话校验逻辑。
- 扩展 agent_service.py,加入工具节点与 LLM 交互,支持意图匹配与合规护栏。
- 改进 memory_service.py,优化会话窗口管理,支持 Redis 与 MySQL 的数据同步。

此更新提升了对话系统的安全性与可扩展性,确保了会话数据的可靠性与合规性。
2026-09-08 19:54:46 +08:00
zhanghongyu_0626andCursor 452b427365 merge: 合并远程 risk-control-agent 到 merger
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-08 17:56:12 +08:00
GaoYiYuan_0626 01ec5fce32 feat(chat): 新增 SSE 流式对话端点 POST /api/chat/stream(方案 C)
契约(OpenAI 兼容 chunk,AI SDK / fetch-event-source 可直接接):
首帧 meta(session_id/trace_id/disclaimer)→ delta → finish_reason=stop → [DONE]。
前端侧:免责声明由首帧下发、前端常驻渲染;落库文本仍按原口径拼尾部。

设计拍板:
1. 新增独立端点,原 POST /api/chat 契约与既有测试零影响;
2. 鉴权/限流/输入防护全部在返回 StreamingResponse 之前完成(SSE 一开就改不了
   状态码),401/403/404/409/429/400 仍是普通 JSON;
3. 整轮一次性落库:中途异常/断连不落消息(Tool 留痕已落可审计),不产生
   半截内容污染历史窗口。

实现:
- agent_service:抽 needs_disclaimer/_degraded_reply/_base_state;新增 stream_chat
  生成器(Tool 节点同步跑完再推 LLM 文本,无 key 走降级整块);
- api/chat:抽 _guard_request(准入→空白→限流→注入拦截)与 _prepare_turn
  (归属+会话解析/创建),同步与流式共用,守卫零偏差;
- session_repository:新增 insert_turn——user+assistant 同事务落库 + 事务内
  取 seq,修掉评审 P0(落库失败会半截落且前端收不到 [DONE] 挂起)与 P1
  (两次写非原子);同步端点一并改用。

测试:新增 9 例(契约/免责/降级/异常不落库/落库失败/鉴权边界/超长/closed/Tool
留痕),全量 pytest 494→503 绿。遗留:无心跳帧(长生成空隙靠反代 timeout 配置),
断连留空会话待清理策略。
2026-09-08 14:23:33 +08:00
GaoYiYuan_0626 8328c2403e feat(chat): 新增前端拉侧三端点(会话列表/历史消息/关闭会话)
方案 B:补前端对话页「拉」侧能力(chat 此前只有 POST 发消息):
- GET /api/chat/sessions:本人 + 本 Agent 线会话分页列表(created_at 倒序,total 供分页器)
- GET /api/chat/sessions/{id}/messages:历史消息 seq_no 升序分页(closed 会话仍可读)
- POST /api/chat/sessions/{id}/close:active→closed + closed_at;重复/非 active 409

守卫复用:抽取 _resolve_agent_type / _assert_chat_entry / _guard_session,
POST "" 改为复用同套守卫(行为零回归);risk_manager 在对话线数据面保持
同口径 403(PRD 4A.1 冻结);会话仓储新增 list_sessions / list_messages_page /
close_session(条件更新防并发静默写)。

测试:新增 12 例(分页、越权 403+留痕、404、409、manager 拒绝、limit 钳制、
JWT 通道),路由挂载清单同步;全量 pytest 482→494 绿。独立 AI 评审 P0=0,
P1(close 并发 rowcount 静默 200)已修复。
2026-09-08 14:07:38 +08:00
GaoYiYuan_0626 66ec7eba08 feat: C6 FR-10 代理人行为链 RISK-008
代理人异常行为链识别(RISK-008)落地:
- 新增 agent_behavior_service:三条件证据聚合(A 诱导调仓/B AUTH_403_SCOPE 越权试探/C AUTH_403_NOT_OWNER|NOT_ASSIGNED 越权查询),按代理人维度独立出 pattern 单,payload.actor_id 指向代理人,审计仅 INSERT event_type=agent_behavior_detected。
- risk_repository 新增 list_audit_events / find_agent_behavior_alert / merge_agent_behavior_payload(同日同代理人一张单,证据并集)。
- trade_gateway.submit_trade 补 actor_id 透传(代理人发起交易归属发起人,缺省 SYSTEM);simulate 路由传入 auth.actor_id。
- chat_tools 新增 query_agent_behavior 只读 Tool(agent_id 过滤 + 客户脱敏),tool_service 补意图词与摘要。
- scripts/cron/agent_behavior_scan.py 定时扫描脚本。
- 修复 append_alert_event 序列化缺 default=str(C6 evidence 含 datetime 字段)。
- 单测 12 例(_count_induce 边界 / 三条件 / 出单去重 / payload 归属 / Tool 过滤脱敏)。
全量 pytest 482 passed 0 failed(470 基线 + 12 C6)。
2026-09-07 19:53:39 +08:00
GaoYiYuan_0626 90d0660b44 feat: C5 FR-9 预警处置时效升级(RISK-007,P0)
- 仓储:新增 list_pending_alerts_all / update_alert_escalation(统一读改写 payload,
  升级标记独占写入,status/handler_* 列不碰;_parse_alert 补 created_at/handled_at
  字符串→datetime 解析,兼容 sqlite 原生 DDL)
- escalation_service.scan_and_escalate:扫描判级(普通 4h/24h、AML 1h/4h 短通道)、
  幂等闸门(仅升不降)、先持久化再推送、按 (customer_id,level) 降噪合并一次推送、
  通知链累积(L1 含 risk_manager / L2 含 compliance)、逐单+任务级审计
- scripts/cron/escalation_scan.py:15min 定时扫描壳(sys.path 引导 + new_trace + JSON 摘要)
- 对话线 query_overdue_alerts Tool + 注册表 + 意图词(置于 alert_query 之前)+ summarize 分支
- C5 前置:seed STAFF-31001/31002(risk_manager) + deps 矩阵放行 + chat.py 显式 deny +
  risk.py 台账全量只读分支;JWT 手册 §5.3/§5.4/§6.1 增补 risk_manager
- 测试:conftest 回拨 fixture + test_escalation_service(9) + risk_api/manager(5) +
  chat deny(1) + chat_tools overdue(2);全量 470 绿(453+17)
2026-09-07 19:28:04 +08:00
GaoYiYuan_0626 fe4801bc0a feat: C4 FR-8 持仓集中度预警(RISK-006)
依据《实现方案-风控追加需求v1.1-C4C6.md》§2;不改表结构(alert_type/status
复用 payload 承载,audit_log.event_type 为 VARCHAR 可直接扩)。

1. settings.py + .env.example:一次性加齐风控追加 v1.1 共 11 项配置(C4~C6 共用)。
2. core_ro.concentration_profile(customer_id, limit=500):一次 SQL 取明细
   (LIMIT limit+1 探测截断)+ Python 端按 min_risk_code in (R4,R5) 聚合;
   收口挂账 #1(PRD 字面为 list_holdings,改聚合封装,docstring 注明偏离)。
3. rules.py:RULE_SCORES/RULE_ALERT_TYPES 加 RISK-006=60/pattern;RuleHit 加
   alert_subtype;RiskThresholds 加 concentration_threshold 且 from_settings
   必须补读(评审 P1-2:漏读会让 conftest monkeypatch 失效打穿现有断言);
   新增纯函数 rule_concentration——空仓不触发、截断视同达标(保守告警)、
   阈值边界 79.9% 不触发 / 80% 触发、R4+R5 为 0 不触发。
4. engine.process_trade_event:run_rules 之后、record_trade_alerts 之前并入
   集中度命中(不动 run_rules 签名);命中后 L3 打 high_risk_concentration
   标签 + 写 risk_concentration 审计(金额只落合计与前 5 条摘要)。
5. risk_repository:find_pending_event_alert 改候选 LIMIT 50 + Python 过滤掉
   payload.alert_subtype 含 agent_behavior 的单(评审 P0-1:代理人维度行为链单
   不得充当客户维度事件单的聚合锚点);append_alert_event 加 extra_subtypes
   合并进 payload.alert_subtype(不传时行为与原先一致,向后兼容)。
6. alert_service:subtypes 集合维护(空集不注入 payload,评审 P2-3);
   追加时 alert_type 按「老单规则 ∪ 本批规则」重算(评审 P1-3,修掉既有
   large_amount 单被本批仅 RISK-006(60) 翻转为 pattern 的缺陷);
   _publish_alert 加 notify_role/extra 可选参数(C5/C6 复用)。
7. 对话线:chat_tools.customer_context 加 profile(concentration_ratio/
   r45_value/total_value/holdings_truncated),tool_service.summarize 加
   「高风险持仓占比 X%(仅供参考)」;不新增意图词。
8. 02-redis-keys.md 增补 alert_subtype / escalation_level 附加推送字段。

测试:conftest 加 autouse _disable_concentration_rule(阈值推 1.01 做回归隔离,
现有用例断言零改动);test_risk_rules 加 RISK-006 纯函数 6 例;新建
tests/test_concentration_c4.py 11 例(与 RISK-001 同单聚合、score max=70、
L3 tag、risk_concentration 审计、仅集中度也出单、subtype 合并、P0-1 回归、
alert_type 不翻转、对话线 ratio)。全量 453 绿(436 + 17)。
2026-09-07 19:05:02 +08:00
GaoYiYuan_0626 8c226f0c6d chore: 风控Agent模块自治边界标注 + AL-09 合并预处置
背景:远端 main 新提交 3995cb4(09-07 17:20,交接文档漏记)为 Wave 0 鉴权/
chat/防护平行实现,与已完工 T-01/T-02/T-03/T-06 同名不同路径;试合并实测
20 文件冲突(原记 9 个),另有 13 个 main 新增文件不报冲突会静默并入。
拍板:风控 Agent 按独立封装模块自治,与宿主耦合收敛到 4 个接缝。

1. 《风控Agent模块边界与合并接缝标注》入库存档:A~D 四类文件归属表;
   4 接缝(S1 挂载点 main.py / S2 AuthContext / S3 settings / S4 引擎工厂);
   20 冲突文件逐个裁决(core_ro、model/suitability、conftest、02-seed-base
   以模块版为准;chat/main/settings/agent_service 等公共层以 main 为主);
   三处硬伤处置:issuer 不一致改为适配器映射不统一、STAFF-90001 必保、
   main infer_roles 未知 actor 默认 analyst(fail-open)记宿主侧 P1。
2. app/api/auth_adapter.py:S2 接缝适配器预制件(当前未接线,AL-09 接入)。
   鸭子类型读宿主 ctx 故不依赖宿主文件;sub→actor_id、trace_id→contextvar、
   perm_matches 兼容宿主 `前缀:*` 通配;缺主体即 HostAuthAdapterError,
   fail-closed 不静默降级。
3. tests/test_module_boundary.py:边界防呆 4 类断言——模块私有文件存在、
   禁止跨层 import 宿主私有实现(gateway.*/config.database/middleware.*/
   utils.input_guard/model.schemas)、AuthContext 契约完整(actor_id 与
   has_role 多参)、settings 私有字段与 AGENT_TYPES 四值不漂移。
4. tests/test_auth_adapter.py:适配器 11 例(映射/回退/fail-closed/trace 绑定/通配)。

基线:406 → 436 全绿(演示库已按演练 SOP §2 重灌:AML 8 条 / 演示 7 行 / sync 33 rows)。
2026-09-07 18:28:18 +08:00
GaoYiYuan_0626 b5fd52ef02 AL-08: 演示库重灌与种子核对对齐 main 基准——prepare_risk_demo.sql 改写 expires_at 口径(演示客户刷新为测评 90 天前/剩余 275 天,CUST-1004 保持过期演示 FM-03,替代 SUIT-008 evaluated_at+365 旧写法);演示 SOP 同步(§2 完成标志 33 客户口径+expires_at 剩余天数,A-1 预期改 SUIT_RISK_MISMATCH,A-2 改 FM-01 SUIT_AGE_CONFIRM 网点确认);网关阻断响应补全 main 契约字段(match_result/mismatch_type/requires_disclosure/needs_branch_confirm/rule_refs)+audit detail 加 block_response_code;集成测试 4 例旧口径断言更新(A-1 trace 一致性断机器码/A-1 audit JSON 断机器码/A-2 重写为 FM-01 语义/settings 退役断言)。SOP §2 脚本化全量重灌双库验证通过(AML 8 条/演示 7 行/sync 33 rows);全量 406 passed 0 failed 0 skipped(集成测试真库走 21 列新表+expires_at 数据恢复执行) 2026-09-07 17:49:39 +08:00
GaoYiYuan_0626 38da477be4 AL-06: 对话 Tool 与 API 响应对齐 main 基准——chat_tools.suitability_check 返回体扩展 match_result/mismatch_type/requires_disclosure/needs_branch_confirm/block_response_code/rule_refs(替代 rule_id/reasons/effective_level 展示),check_source='r02_chat',not_found 转结构化 found=False(NotFoundError except 死代码清除);tool_service.summarize suitability 分支按新枚举重写文案(网点当面确认 FM-01/签署风险揭示书/测评过期 FM-03/专业豁免,附 rule_refs 依据);risk_api 断言改 block_response_code。全量 373 passed 0 failed(1 skip=test_suitability 占位待 AL-07)。遗留:chat 链路 risk_suitability_log.actor_id 暂落 SYSTEM(run_tool 统一透传需动 core_tools/kb_tools 冻结 func 契约,发起者留痕已由 agent_tool_call 覆盖) 2026-09-07 17:39:04 +08:00
GaoYiYuan_0626 adf5e8013a AL-05: suitability 服务重构换核对齐 main 基准——判定内核由 SUIT-001~008 纯函数矩阵改为 core_ro.check_suitability(C×R 数据驱动);SuitabilityResult 扩 main 新字段(match_result 五值/mismatch_type 七值/requires_disclosure/needs_branch_confirm/block_response_code/rule_refs)并保留旧字段兼容层(rule_id=机器码别名/effective_level=customer_level/reasons=[reason]);check_core/cap_by_age/match_by_matrix/is_assessment_valid 删除(SUIT-006 被 FM-01 替换,SUIT-008 被 FM-03 expires_at 替换);settings.risk_assessment_valid_days 退役(.env/.env.example 注释);NotFoundError 不再抛(not_found 结构化,main 契约);写库走 build_suitability_log_row + insert_suitability_log 升级 21 列(rule_refs JSON 序列化);check_source 参数化(网关 r02_trade/risk.py manual)+actor_id 透传;网关阻断响应补 block_response_code;model 抽 compute_rule_refs 公共函数防两处漂移;测试配套:_ddl 加矩阵 25 行种子 helper、conftest fixture 灌种子+集成就位校验改 expires_at 口径、trade_gateway/risk_api fixture 补种子与 expires_at、404 两例改 200+blocked 新契约、repository 21 列断言、settings 退役断言、test_suitability 占位 skip 待 AL-07 重写。sqlite 端到端七语义+落库验证通过;剩 4 failed 均为 chat_tools/API 旧展示断言(AL-06 处理) 2026-09-07 17:34:32 +08:00
zhanghongyu_0626 3995cb44d8 Implement authentication and chat functionality with JWT support
- Added `auth.py` for mock login and JWT issuance.
- Introduced `chat.py` for handling chat requests with role-based access control.
- Enhanced `main.py` to include new routers and middleware for tracing.
- Implemented input validation in `input_guard.py` to prevent SQL injection.
- Created repositories for managing agent sessions and audit logs.
- Added exception handling for authorization errors.
- Updated settings to include JWT configuration.
- Introduced tests for authentication and input validation.
2026-09-07 17:20:42 +08:00
GaoYiYuan_0626 c92f0d7020 AL-04: 引入 model/suitability.py 对齐 main 基准——build_suitability_log_row 原样引入(check 结果→risk_suitability_log INSERT 行映射;rule_refs 组合:JR-AST-012 等级不配/FM-03 风评过期/FM-01 网点确认/JR-AST-PRO 专业豁免;CheckSource 四值 Literal) 2026-09-07 17:12:46 +08:00
GaoYiYuan_0626 ba3465a953 AL-03: core_ro.py 融合对齐 main 基准——我方骨架保留(utils/db.get_engine 统一引擎工厂,main 自带 create_engine 工厂不采纳;风控扩展 get_trade_by_id/sum_trades_on_date/list_trades_range/list_active_customers 全保留),吸收 main 四项+1:①get_customer_l0 扩列版(c.*+风评新列+risk_is_expired) ②check_suitability+_suitability_result(C×R 矩阵判定,判定链 not_found→FM-03 过期→JR-AST-PRO 豁免→JR-AST-012 矩阵→披露→FM-01 网点确认) ③list_products_for_customer(C-11) ④list_holdings 合并(limit=500 截断防护+min_subscribe_amount/term_days 新列) ⑤list_trades(差距#13 新查询能力)。移植坑消解:main 三处 CURDATE() SQL 表达式统一改 Python 端 _is_expired 计算(sqlite 测试库兼容),date/datetime/str 统一 _as_date 归一。双方言验收:MySQL 真库(not_found/expired 真跑)+sqlite 七路径可控日期验证通过;pytest 失败面与 AL-02 基线一致(15 failed 均旧契约断言) 2026-09-07 17:11:52 +08:00
GaoYiYuan_0626 9cc2e59bb7 fix: T-21 评审闭环(P1-1 MILVUS_URI 遮蔽)——milvus_service 环境防御顺序重排: settings 先初始化(干净读 .env)→os.environ 归位合法 http 占位(仅替换文件 URI)→import pymilvus; 原顺序下 pydantic 读到被污染 env 会把 .env 的 MILVUS_URI 一并遮蔽(最坏 import 顺序真连接事故); 最坏顺序断言+全量 425 绿+端到端检索通过 2026-09-07 12:24:46 +08:00
GaoYiYuan_0626 535c8a0a20 fix: T21 真库联调三坑——①Milvus Lite 文件库跨进程重开 collection released, ensure_collection 补显式 load(单测同进程覆盖不到); ②faiss 不支持中文路径(faiss C++ IO), 本机 .env 改英文绝对路径 C:/Users/YUAN/.jinrong/milvus/, .env.example 加警告; ③build_kb 直跑 sys.path 引导项目根(同 rebuild_alerts 先例); 真库 24 块入库+检索验收通过(基金申购 Top3 命中申赎规则, 溯源完整), 425 绿 2026-09-07 12:11:10 +08:00
GaoYiYuan_0626 1c51149912 feat: T21-5 知识库 Tool 接入对话——kb_tools(search_knowledge)挂统一注册表第三层; ToolSpec 新增 skip_access_check(公开知识无归属语义, advisor 无绑定客户可查, 意图层限定 customer/advisor); 意图关键词 customer/advisor 组尾挂 kb 词(Core 词优先, risk 不开放); tool_node 按 spec 白名单注入 query; summarize 溯源口径; 单测 13 例, 425 绿 2026-09-07 12:05:36 +08:00
GaoYiYuan_0626 e2a444453e feat: T21-4 RAG 检索编排——rag_service.search_knowledge(query→bge-m3 向量→Milvus 检索→chunks+source_refs 溯源去重), 异常原样上抛不吞(防 LLM 编造回答), 空白 query 短路, ensure_collection 幂等防御; 单测 8 例注入 mock, 412 绿 2026-09-07 12:01:45 +08:00
GaoYiYuan_0626 1056a95343 feat: T21-2 Milvus 接入层——kb_product_rules 幂等建集合(冻结 11 字段+AUTOINDEX COSINE)+upsert 入库+search_kb(溯源字段必带+effective_date 合规过滤+标量过滤); 规避 pymilvus 3.x import 阶段读 .env 文件 URI 炸 import 的坑(setdefault 预置合法 MILVUS_URI); 单测 8 例真 Lite 临时库, 394 绿 2026-09-07 11:49:43 +08:00
GaoYiYuan_0626 e34973f018 feat: T21-1 embedding 服务——Ollama bge-m3 批量 /api/embed(1024 维), 连接/模型/结构/维度四类失败一律 EmbeddingError 不静默降级(拍板口径), 空输入短路; settings 增 embed_dim/embed_timeout; 单测 10 例 mock HTTP 不依赖 Ollama, 386 绿 2026-09-07 11:46:24 +08:00
GaoYiYuan_0626 207fc79f61 test: T-03 评审闭环(PASS, P0=0)——P2-1 词表规范化断言修正/P2-2 补 7 条同构变体(你现在是管理员/ignore the above instructions 等)+变体单测/P2-3 窗口 TTL 断言+EXPIRE 失败取舍锁定; P3 session_id 落库截断+trace 兜底注释, 378 绿 2026-09-07 11:16:15 +08:00
zhanghongyu_0626 3fb0ceb334 Enhance suitability assessment and documentation
- Implemented `check_suitability` method in `CoreReadOnlyRepository` for suitability determination based on customer and product risk levels.
- Added `build_suitability_log_row` function in `suitability.py` for mapping suitability check results to `risk_suitability_log`.
- Updated `AGENTS.md`, `ENVIRONMENT.md`, and `FLOW.md` to reflect changes in suitability assessment processes and documentation.
- Revised `FRAMEWORK.md` and `MEMORY.md` to clarify project structure and data flow related to suitability checks.
- Expanded `TODO.md` with tasks related to logging and auditing suitability assessments.
2026-09-07 11:15:30 +08:00
GaoYiYuan_0626 cc6f34fbbd feat: T-03 输入防护限流(T3-3)——actor 级 Redis 固定窗口 30 次/分(settings 可调), 超限 429 GUARD_RATE_LIMITED+留痕, Redis 故障 fail-open, 测试 4 例(429/窗口滚动/fail-open/注入计数), 376 绿 2026-09-07 11:10:26 +08:00
GaoYiYuan_0626 65b45aa917 feat: T-03 输入防护接入 chat(T3-2)——注入/超长命中即拒 400 + input_guard_log 留痕(fail-fast 不建会话, 留痕降级不改拒绝语义), Pydantic 硬顶 20000, 集成测试 7 例 2026-09-07 11:02:36 +08:00
GaoYiYuan_0626 497554da43 feat: T-03 输入防护服务(T3-1)——input_guard 纯函数检测(注入短语词表/oversize 4000) + 单测 20 例(不误杀用例/判定顺序锁定), 365 绿 2026-09-07 10:59:25 +08:00
GaoYiYuan_0626 930ea9db56 feat: 阶段C 风控对话线(C1 四只读 Tool + C2 risk 分支意图 + C3 A-6 验收与边界)
- C1: app/service/risk/chat_tools.py 新增 alert_query/customer_context/suitability_check/aml_lookup 四只读 Tool,挂 RISK_TOOL_REGISTRY(与 core_tools.ToolSpec 同构)
- C1: tool_service.run_tool 改查 core+risk 统一注册表并恒传 risk_repo;_normalize_params 读 spec 白名单;core_tools 三函数加 risk_repo=None;summarize 补四工具分支
- C2: match_intent 按 agent 分组扩 risk 关键词;agent_service.tool_node 守卫放宽(requires_customer=False 的 Tool 允许无绑定客户运行,支撑 A-6 全局待审)
- C3: A-6 验收(risk_officer 问待审预警→alert_query 全量→回复含待审数)+ 诱导处置边界(无处置 Tool、系统提示禁自动处置、诱导只触发只读且预警状态不变)
- 测试 tests/test_risk_chat_tools.py(21 例);全量 pytest 342 绿(原 321 + 21)
2026-09-07 10:26:54 +08:00
GaoYiYuan_0626 1216d26083 fix: T-04 复审闭环——P2-1 test_chat 夹具补 _risk_repo 打桩(防越权双写写脏演示 MySQL)/P3 归属码改为显式集合+前缀兜底/truncated 判定多取 1 条防恰好 500 误报, 321 绿 2026-09-07 09:51:38 +08:00