forked from EduCraft/curriculum-project-hub
59 lines
3.2 KiB
Markdown
59 lines
3.2 KiB
Markdown
# Audit the accepted product surface for production completeness
|
||
|
||
Type: research
|
||
Status: resolved
|
||
|
||
## Question
|
||
|
||
Against ADR-0020 and ADR-0021, which required platform-admin, org-admin,
|
||
project-onboarding, team/access, session, usage, provider-mode, Organization
|
||
policy-limit, emergency workload-control, and Feishu flows are absent,
|
||
unreachable, or only test-facing rather than usable in the initial production
|
||
service? Treat ADR-0022's capacity control surfaces as part of the accepted
|
||
product boundary.
|
||
|
||
## Answer
|
||
|
||
The current Hub is not a usable or production-complete SaaS product surface.
|
||
Its Organization-scoped JSON APIs and single-Feishu-app Agent Run path are
|
||
worth retaining, but the running service has one process-global Feishu
|
||
app/bot, one global provider key/base URL, no Organization connection/secret
|
||
plane, no platform-administrator control plane, and no real Organization or
|
||
platform management UI. OAuth redirects a successful login to an unmounted
|
||
`/admin/org/:orgSlug` route.
|
||
|
||
Two real Fastify integration probes, each run twice, proved that an authenticated
|
||
Organization ADMIN receives 404 at the post-login destination and two distinct
|
||
Organization return paths produce the same OAuth `client_id`. Official Feishu
|
||
documentation also proves that `open_id` is application-scoped, `user_id` is
|
||
tenant-scoped, and `union_id` only links applications from the same application
|
||
provider. The current globally unique `User.feishuOpenId`, raw `chatId`, event
|
||
identity, OAuth state and one-listener composition therefore cannot safely
|
||
route independently customer-owned applications.
|
||
|
||
ADR-0022 remains an additional release blocker: beyond a process-memory
|
||
Project queue and global max-turn setting, layered limits, durable
|
||
Organization-fair admission, hard storage/run/process budgets, alerts and
|
||
audited emergency brakes have no complete persistence or product surface.
|
||
|
||
The full verdict, deterministic probe results, root causes, retained seams and
|
||
required end-to-end release evidence are in the
|
||
[accepted SaaS product-surface completeness audit](../assets/product-surface-completeness-audit.md).
|
||
The detailed route/schema/test matrix is in the
|
||
[accepted product-surface code inventory](../assets/product-surface-code-inventory.md),
|
||
and the Feishu identifier/OAuth/event/long-connection facts are in the
|
||
[Feishu product-surface primary sources](../assets/product-surface-feishu-primary-sources.md).
|
||
|
||
The newly-clear execution frontier is:
|
||
|
||
- [Decide the platform-administrator identity and audit boundary](42-decide-platform-admin-identity-audit.md)
|
||
- [Implement the Organization connection and secret plane](43-implement-org-connection-secret-plane.md)
|
||
- [Route Feishu identity and traffic by Organization connection](44-route-feishu-by-org-connection.md)
|
||
- [Build the private platform-administrator control plane](45-build-private-platform-admin-control-plane.md)
|
||
- [Build the private Organization-administrator control plane](46-build-private-org-admin-control-plane.md)
|
||
|
||
Existing tickets 23 and 32–38 remain the owners of durable ingress/admission,
|
||
capacity enforcement, usage alerts, workload brakes and calibration. Ticket 08
|
||
now requires all of these product slices before claiming the production release
|
||
gate.
|