3.2 KiB
Audit the accepted product surface for production completeness
Type: research Status: resolved
Question
Against ADR-0020 and ADR-0021, which required platform-admin, org-admin, project-onboarding, team/access, session, usage, provider-mode, Organization policy-limit, emergency workload-control, and Feishu flows are absent, unreachable, or only test-facing rather than usable in the initial production service? Treat ADR-0022's capacity control surfaces as part of the accepted product boundary.
Answer
The current Hub is not a usable or production-complete SaaS product surface.
Its Organization-scoped JSON APIs and single-Feishu-app Agent Run path are
worth retaining, but the running service has one process-global Feishu
app/bot, one global provider key/base URL, no Organization connection/secret
plane, no platform-administrator control plane, and no real Organization or
platform management UI. OAuth redirects a successful login to an unmounted
/admin/org/:orgSlug route.
Two real Fastify integration probes, each run twice, proved that an authenticated
Organization ADMIN receives 404 at the post-login destination and two distinct
Organization return paths produce the same OAuth client_id. Official Feishu
documentation also proves that open_id is application-scoped, user_id is
tenant-scoped, and union_id only links applications from the same application
provider. The current globally unique User.feishuOpenId, raw chatId, event
identity, OAuth state and one-listener composition therefore cannot safely
route independently customer-owned applications.
ADR-0022 remains an additional release blocker: beyond a process-memory Project queue and global max-turn setting, layered limits, durable Organization-fair admission, hard storage/run/process budgets, alerts and audited emergency brakes have no complete persistence or product surface.
The full verdict, deterministic probe results, root causes, retained seams and required end-to-end release evidence are in the accepted SaaS product-surface completeness audit. The detailed route/schema/test matrix is in the accepted product-surface code inventory, and the Feishu identifier/OAuth/event/long-connection facts are in the Feishu product-surface primary sources.
The newly-clear execution frontier is:
- Decide the platform-administrator identity and audit boundary
- Implement the Organization connection and secret plane
- Route Feishu identity and traffic by Organization connection
- Build the private platform-administrator control plane
- Build the private Organization-administrator control plane
Existing tickets 23 and 32–38 remain the owners of durable ingress/admission, capacity enforcement, usage alerts, workload brakes and calibration. Ticket 08 now requires all of these product slices before claiming the production release gate.