feat: release ContentCloud v0.6.0

.agents/plugins/evaluations/contentcloud-video-production-0.5.0.json → .agents/plugins/evaluations/contentcloud-video-production-0.6.0.json

@@ -3,8 +3,8 @@
   "schema_version": "1.0",
   "plugin": {
     "id": "contentcloud-video-production",
-    "version": "0.5.0",
-    "digest": "sha256:025e6f31b491f8cd529d39dbbae31a464743dba653234be2012426631950b26a"
+    "version": "0.6.0",
+    "digest": "sha256:14076c0a2dd8031589e6e5904cc13bd63f14fe8ad23d54b208aa4dbde7bbb326"
   },
   "scope": "deterministic_release_contract",
   "status": "passed",
@@ -18,9 +18,9 @@
     },
     {
       "id": "bootstrap-confirmation",
-      "requirement": "Bootstrap uses a deterministic plan_id, performs no mutation before exact confirmation, runs doctor before registration, and preserves recoverability on failure.",
-      "command": ["go", "test", "-v", "./internal/cli", "-run", "^(TestBootstrapPlanIsReadOnlyAndDoesNotExposeConnectKey|TestBootstrapPlanIDIsStableUntilInputsChange|TestBootstrapApplyInstallsInitializesDoctorsAndRegisters|TestBootstrapApplyRollsBackWithIndependentContextAfterCancellation|TestBootstrapApplyRejectsUnconfirmedPlanID|TestBootstrapApplyRequiresPlanIDBeforeMutation|TestBootstrapApplyRejectsPlanAfterCodexStateChanges)$"],
-      "evidence": ["TestBootstrapPlanIsReadOnlyAndDoesNotExposeConnectKey", "TestBootstrapApplyInstallsInitializesDoctorsAndRegisters", "TestBootstrapApplyRejectsUnconfirmedPlanID", "TestBootstrapApplyRejectsPlanAfterCodexStateChanges"],
+      "requirement": "Bootstrap uses a deterministic plan_id, performs no mutation before exact confirmation, binds one browser authorization attempt to one session, runs doctor before registration, and preserves recoverability on failure.",
+      "command": ["go", "test", "-v", "./internal/cli", "./internal/app", "-run", "^(TestBootstrapPlanIsReadOnlyAndUsesOnlyPublicSessionID|TestBootstrapPlanIDIsStableUntilInputsChange|TestBootstrapApplyInstallsInitializesDoctorsAndRegisters|TestBootstrapApplyAuthorizationFailureDoesNotMutatePluginOrWorkspace|TestBootstrapApplyRejectsUnconfirmedPlanID|TestBootstrapApplyRequiresPlanIDBeforeMutation|TestBootstrapApplyRejectsPlanAfterCodexStateChanges|TestBootstrapAuthorizationRequiresApprovalAndMatchingVerifier|TestBootstrapAuthorizationAllowsOnlyOneActiveAttemptPerSession)$"],
+      "evidence": ["TestBootstrapPlanIsReadOnlyAndUsesOnlyPublicSessionID", "TestBootstrapApplyInstallsInitializesDoctorsAndRegisters", "TestBootstrapApplyRejectsUnconfirmedPlanID", "TestBootstrapApplyRejectsPlanAfterCodexStateChanges", "TestBootstrapAuthorizationRequiresApprovalAndMatchingVerifier", "TestBootstrapAuthorizationAllowsOnlyOneActiveAttemptPerSession"],
       "status": "passed"
     },
     {
@@ -61,8 +61,8 @@
     {
       "id": "environment-control-plane",
       "requirement": "Project-bound Manifests and Execution Bundles are signed and expiry-checked; Registry, local Lock, Pack, capability digest, subject binding, Automation pre-lease resolution, and attempt-scoped execution workspaces all fail closed without leaking run credentials or leaving an unfinished attempt.",
-      "command": ["go", "test", "-v", "./internal/environment", "./internal/app", "./internal/localworkspace", "./internal/capabilitycatalog", "./internal/serverconfig", "./internal/automationworkspace", "./internal/agentadapter", "./internal/cli", "-run", "^(TestManifestSignatureBindsPayloadProjectExpiryAndTrust|TestBuildManifestUsesOnlyExactPublishedCompatibleRegistryEntries|TestRevokedEntryBlocksNewUseButRemainsHistoricallyAuditable|TestLocalResolverIntersectsManifestRegistryAndLock|TestPreparationPlanBindsSignedPermissionsCostAndExecutionPlan|TestPreparedLockAddsOnlyExactConfirmedTaskPack|TestRegistryCanonicalPayloadMatchesNodeConformanceVector|TestCreativeExecutionBundleIsDeterministicAndBindsSubjectEnvironmentAndTrust|TestCreativeExecutionBundleFailsClosedForPackRegistryLockAndCapabilityDrift|TestConnectDeviceReturnsProjectBoundSignedEnvironmentManifest|TestAutomationPollRequiresVerifiedEnvironmentPackAndCapabilityBeforeLease|TestEnvironmentStateStoresAndVerifiesSignedManifestAndExactLock|TestEnvironmentStateFailsClosedForWrongProjectMissingPluginAndTampering|TestEnvironmentLockCompareAndSwapRejectsConcurrentChange|TestEnvironmentPreparationAndRunClaimAreMutuallyExclusive|TestBuiltinsUseDeterministicSHA256Digests|TestLoadEnvironmentBuildsVerifiedControlPlaneAndAutomationPolicy|TestLoadEnvironmentFailsClosedForPartialOrUnsafeConfiguration|TestMCPEnvironmentExecutionPlanUsesVerifiedOfflineState|TestMCPEnvironmentPreparationRequiresExactConfirmationAndReachesReady|TestWorkspacePrepareCLIPlanAndApplyUseTheSameDeterministicPlan|TestEnvironmentPreparationFailureRollsBackOnlyTheNewPack|TestAttemptWorkspaceFreezesInputsWithoutRunCredentialAndUsesExclusiveLease|TestAttemptWorkspaceRejectsInteractiveOverlapAndRecoversOnlyExpiredOwnedLease|TestAttemptWorkspaceRenewsExclusiveLeaseFromServerExpiry|TestAdapterLoadsOnlyFrozenAutomationWorkspaceResources|TestAgentEnvironmentDoesNotInheritUnrelatedSecret|TestDaemonFixtureUsesAttemptScopedWorkspaceWithoutPersistingRunCredential|TestDaemonFinishesAttemptWhenWorkspaceIsolationFails)$"],
-      "evidence": ["TestManifestSignatureBindsPayloadProjectExpiryAndTrust", "TestBuildManifestUsesOnlyExactPublishedCompatibleRegistryEntries", "TestRevokedEntryBlocksNewUseButRemainsHistoricallyAuditable", "TestLocalResolverIntersectsManifestRegistryAndLock", "TestPreparationPlanBindsSignedPermissionsCostAndExecutionPlan", "TestPreparedLockAddsOnlyExactConfirmedTaskPack", "TestRegistryCanonicalPayloadMatchesNodeConformanceVector", "TestCreativeExecutionBundleIsDeterministicAndBindsSubjectEnvironmentAndTrust", "TestCreativeExecutionBundleFailsClosedForPackRegistryLockAndCapabilityDrift", "TestConnectDeviceReturnsProjectBoundSignedEnvironmentManifest", "TestAutomationPollRequiresVerifiedEnvironmentPackAndCapabilityBeforeLease", "TestEnvironmentStateStoresAndVerifiesSignedManifestAndExactLock", "TestEnvironmentStateFailsClosedForWrongProjectMissingPluginAndTampering", "TestEnvironmentLockCompareAndSwapRejectsConcurrentChange", "TestEnvironmentPreparationAndRunClaimAreMutuallyExclusive", "TestBuiltinsUseDeterministicSHA256Digests", "TestLoadEnvironmentBuildsVerifiedControlPlaneAndAutomationPolicy", "TestLoadEnvironmentFailsClosedForPartialOrUnsafeConfiguration", "TestMCPEnvironmentExecutionPlanUsesVerifiedOfflineState", "TestMCPEnvironmentPreparationRequiresExactConfirmationAndReachesReady", "TestWorkspacePrepareCLIPlanAndApplyUseTheSameDeterministicPlan", "TestEnvironmentPreparationFailureRollsBackOnlyTheNewPack", "TestAttemptWorkspaceFreezesInputsWithoutRunCredentialAndUsesExclusiveLease", "TestAttemptWorkspaceRejectsInteractiveOverlapAndRecoversOnlyExpiredOwnedLease", "TestAttemptWorkspaceRenewsExclusiveLeaseFromServerExpiry", "TestAdapterLoadsOnlyFrozenAutomationWorkspaceResources", "TestAgentEnvironmentDoesNotInheritUnrelatedSecret", "TestDaemonFixtureUsesAttemptScopedWorkspaceWithoutPersistingRunCredential", "TestDaemonFinishesAttemptWhenWorkspaceIsolationFails"],
+      "command": ["go", "test", "-v", "./internal/environment", "./internal/app", "./internal/localworkspace", "./internal/capabilitycatalog", "./internal/serverconfig", "./internal/automationworkspace", "./internal/agentadapter", "./internal/cli", "-run", "^(TestManifestSignatureBindsPayloadProjectExpiryAndTrust|TestBuildManifestUsesOnlyExactPublishedCompatibleRegistryEntries|TestRevokedEntryBlocksNewUseButRemainsHistoricallyAuditable|TestLocalResolverIntersectsManifestRegistryAndLock|TestPreparationPlanBindsSignedPermissionsCostAndExecutionPlan|TestPreparedLockAddsOnlyExactConfirmedTaskPack|TestRegistryCanonicalPayloadMatchesNodeConformanceVector|TestCreativeExecutionBundleIsDeterministicAndBindsSubjectEnvironmentAndTrust|TestCreativeExecutionBundleFailsClosedForPackRegistryLockAndCapabilityDrift|TestBrowserBootstrapReturnsProjectBoundSignedEnvironmentManifest|TestAutomationPollRequiresVerifiedEnvironmentPackAndCapabilityBeforeLease|TestEnvironmentStateStoresAndVerifiesSignedManifestAndExactLock|TestEnvironmentStateFailsClosedForWrongProjectMissingPluginAndTampering|TestEnvironmentLockCompareAndSwapRejectsConcurrentChange|TestEnvironmentPreparationAndRunClaimAreMutuallyExclusive|TestBuiltinsUseDeterministicSHA256Digests|TestLoadEnvironmentBuildsVerifiedControlPlaneAndAutomationPolicy|TestLoadEnvironmentFailsClosedForPartialOrUnsafeConfiguration|TestMCPEnvironmentExecutionPlanUsesVerifiedOfflineState|TestMCPEnvironmentPreparationRequiresExactConfirmationAndReachesReady|TestWorkspacePrepareCLIPlanAndApplyUseTheSameDeterministicPlan|TestEnvironmentPreparationFailureRollsBackOnlyTheNewPack|TestAttemptWorkspaceFreezesInputsWithoutRunCredentialAndUsesExclusiveLease|TestAttemptWorkspaceRejectsInteractiveOverlapAndRecoversOnlyExpiredOwnedLease|TestAttemptWorkspaceRenewsExclusiveLeaseFromServerExpiry|TestAdapterLoadsOnlyFrozenAutomationWorkspaceResources|TestAgentEnvironmentDoesNotInheritUnrelatedSecret|TestDaemonFixtureUsesAttemptScopedWorkspaceWithoutPersistingRunCredential|TestDaemonFinishesAttemptWhenWorkspaceIsolationFails)$"],
+      "evidence": ["TestManifestSignatureBindsPayloadProjectExpiryAndTrust", "TestBuildManifestUsesOnlyExactPublishedCompatibleRegistryEntries", "TestRevokedEntryBlocksNewUseButRemainsHistoricallyAuditable", "TestLocalResolverIntersectsManifestRegistryAndLock", "TestPreparationPlanBindsSignedPermissionsCostAndExecutionPlan", "TestPreparedLockAddsOnlyExactConfirmedTaskPack", "TestRegistryCanonicalPayloadMatchesNodeConformanceVector", "TestCreativeExecutionBundleIsDeterministicAndBindsSubjectEnvironmentAndTrust", "TestCreativeExecutionBundleFailsClosedForPackRegistryLockAndCapabilityDrift", "TestBrowserBootstrapReturnsProjectBoundSignedEnvironmentManifest", "TestAutomationPollRequiresVerifiedEnvironmentPackAndCapabilityBeforeLease", "TestEnvironmentStateStoresAndVerifiesSignedManifestAndExactLock", "TestEnvironmentStateFailsClosedForWrongProjectMissingPluginAndTampering", "TestEnvironmentLockCompareAndSwapRejectsConcurrentChange", "TestEnvironmentPreparationAndRunClaimAreMutuallyExclusive", "TestBuiltinsUseDeterministicSHA256Digests", "TestLoadEnvironmentBuildsVerifiedControlPlaneAndAutomationPolicy", "TestLoadEnvironmentFailsClosedForPartialOrUnsafeConfiguration", "TestMCPEnvironmentExecutionPlanUsesVerifiedOfflineState", "TestMCPEnvironmentPreparationRequiresExactConfirmationAndReachesReady", "TestWorkspacePrepareCLIPlanAndApplyUseTheSameDeterministicPlan", "TestEnvironmentPreparationFailureRollsBackOnlyTheNewPack", "TestAttemptWorkspaceFreezesInputsWithoutRunCredentialAndUsesExclusiveLease", "TestAttemptWorkspaceRejectsInteractiveOverlapAndRecoversOnlyExpiredOwnedLease", "TestAttemptWorkspaceRenewsExclusiveLeaseFromServerExpiry", "TestAdapterLoadsOnlyFrozenAutomationWorkspaceResources", "TestAgentEnvironmentDoesNotInheritUnrelatedSecret", "TestDaemonFixtureUsesAttemptScopedWorkspaceWithoutPersistingRunCredential", "TestDaemonFinishesAttemptWhenWorkspaceIsolationFails"],
       "status": "passed"
     }
   ],

.agents/plugins/registry.json

@@ -5,18 +5,18 @@
     {
       "id": "contentcloud-video-production",
       "kind": "scene_plugin",
-      "version": "0.5.0",
+      "version": "0.6.0",
       "source": {
         "repository": "https://github.com/limecloud/contentcloud",
-        "ref": "v0.5.0"
+        "ref": "v0.6.0"
       },
       "license": "Apache-2.0",
-      "digest": "sha256:025e6f31b491f8cd529d39dbbae31a464743dba653234be2012426631950b26a",
+      "digest": "sha256:14076c0a2dd8031589e6e5904cc13bd63f14fe8ad23d54b208aa4dbde7bbb326",
       "signature": {
         "status": "verified",
         "algorithm": "ed25519",
         "key_id": "contentcloud-plugin-release-2026-07",
-        "value": "59mUalQ+sdVk9ROcULIOJHE/4PhuN1fMxIYuN14Ae/2Vp/zefWDppKJRgOWPvwHO/50ODZim9Jamd7q4BcBLAw=="
+        "value": "Gl1+uaUsqYUQ13Rsm+8jVEPs5u7rb3nwTkVaRc9gutHeOSTz+xdjCKdR2EQ5+eePcEMxesO3dzEK5yyxZCNfBw=="
       },
       "compatible_profiles": [
         "contentcloud.video-production"
@@ -30,7 +30,7 @@
       "data_flow": {
         "local_by_default": true,
         "cloud_actions": [
-          "device.connect",
+          "bootstrap.authorization.complete",
           "workspace.register",
           "explicit publish and review synchronization"
         ]
@@ -45,8 +45,8 @@
       ],
       "evaluation": {
         "status": "passed",
-        "report": ".agents/plugins/evaluations/contentcloud-video-production-0.5.0.json",
-        "digest": "sha256:8dbecc50bb45fee5904889d4a29b19b7ae49a10c7cb7242afb4251eb6913c93e",
+        "report": ".agents/plugins/evaluations/contentcloud-video-production-0.6.0.json",
+        "digest": "sha256:63eda3784fca5467e5c7ef066986ebc18f439988848ae0e3926b91b542772d28",
         "evidence": [
           "codex-plugin-transaction",
           "bootstrap-confirmation",

CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ContentCloud 的重要变更记录在此文件中。
 
+## [0.6.0] - 2026-07-27
+
+### Added
+
+- 增加面向普通客户的 bootstrap 环境预检、浏览器设备授权、实时阶段进度、版本化处置动作和显式确认流程。
+- 增加本地脱敏诊断预览与确认后上传能力，并补齐初始化流程、诊断协议和支持 Runbook。
+- 增加 Web 初始化进度与短码核对界面，支持后台等待、失败恢复和新 Codex 对话交接。
+
+### Changed
+
+- 初始化 Prompt 改用公开 ConnectSession ID，设备与 Workspace 凭据只通过 PKCE 浏览器授权换取并存入 macOS Keychain。
+- 将 CLI、Web、npm 安装器、Plugin、MCP、Environment Profile 与 bootstrap 固定版本统一为 `0.6.0`。
+- 移除旧 `cck_` 连接码通路，云端只接收版本化进度事件和用户明确同意上传的脱敏诊断摘要。
+
+### Fixed
+
+- 修复 bootstrap 匿名入口绕过 PostgreSQL 租户上下文直接读取 RLS 表，导致真实数据库无法启动授权的问题。
+- 修复生产曾登记旧 `00018` 后会跳过新 bootstrap 表结构的问题，新增兼容迁移并保留已发布迁移不变。
+- 修复同一初始化会话可并发创建多个待批准 attempt，以及 CLI 可能打开非同源验证地址的问题。
+- 修复 Environment Manifest 签发失败时授权已被提前消费、导致设备凭据无法重试的问题。
+- 修复诊断重试返回未落库 ID，以及初始化 attempt 进入终态后仍可追加进度的问题。
+
 ## [0.5.0] - 2026-07-27
 
 ### Added

README.md

@@ -46,7 +46,7 @@ CLI 示例：
 ```bash
 ./bin/contentcloud --json doctor --offline
 ./bin/contentcloud --json schema
-./bin/contentcloud init --connect cck_xxx --target all --accept-project-config ./contentcloud-project
+./bin/contentcloud bootstrap preflight ./contentcloud-project --offline --json
 ./bin/contentcloud workspace doctor ./contentcloud-project
 ./bin/contentcloud publish script --dry-run
 ./bin/contentcloud submission list
@@ -97,34 +97,41 @@ CONTENTCLOUD_REQUIRE_MALWARE_SCAN=1 ./bin/contentcloud-worker
 ## 首次项目连接
 
 1. 用户在 Web 创建项目。
-2. 项目总览生成 10 分钟有效、单次使用的 `cck_`，并拼成不含登录态的 Agent Prompt：
+2. 项目总览创建 10 分钟有效的公开 ConnectSession ID，并拼成不含凭据的 Agent Prompt：
 
 ```text
-Fetch https://content.example.com/api/bootstrap and follow it to connect this ContentCloud project to Codex.
+Fetch https://content.example.com/api/bootstrap and follow it to initialize this ContentCloud project in Codex.
 
 server-url: https://content.example.com
-connect-key: cck_xxx
+session-id: 11111111-1111-4111-8111-111111111111
 contentcloud-cli: npx --yes @limecloud/contentcloud@<pinned-version>
 project: "品牌 / 单品"
 ```
 
-3. 用户把 Prompt 粘贴到 Codex 安装会话。Agent 获取公开的 `/api/bootstrap` 协议并执行只读 `bootstrap plan`。
+3. 用户把 Prompt 粘贴到 Codex 安装会话。Agent 获取公开的 `/api/bootstrap` 协议，先执行只读 `bootstrap preflight`，通过后再执行 `bootstrap plan`。
 4. CLI 返回固定 Marketplace、Plugin、目标目录变化和确定性 `plan_id`；用户确认该计划后，Agent 才能把同一个 `plan_id` 传给 `bootstrap apply`。
-5. CLI 安装并验证固定 Plugin，然后消费连接码、初始化 `codex-plugin` Workspace、执行 offline doctor；只有 `workspace.register` 成功后 Web 才显示 `connected`。
-6. 新安装的 bundled Skills/MCP 在新的 Codex chat/session 生效。CLI 用不含连接码的 Plugin mention 和恢复 Prompt 打开 Workspace 新对话。
-7. npm 安装器校验 GitHub Release 的 `checksums.txt`，原子安装 Go binary；Workspace/Device Credential 写入 macOS Keychain。
-8. 初始化默认不注册 LaunchAgent、不启动 Daemon、不上传文件，也不写项目级 `.codex/config.toml` 或重复的 `.agents/skills`。
+5. CLI 在本机生成 PKCE verifier/challenge 并打开浏览器。用户在已登录的 ContentCloud 页面核对短码并批准后，CLI 才能换取设备和 Workspace 凭据。
+6. CLI 安装并验证固定 Plugin、初始化 `codex-plugin` Workspace、执行 doctor；只有 `workspace.register` 成功后 Web 才显示 `connected`。
+7. 新安装的 bundled Skills/MCP 在新的 Codex chat/session 生效。CLI 用不含凭据的 Plugin mention 和恢复 Prompt 打开 Workspace 新对话。
+8. npm 安装器校验 GitHub Release 的 `checksums.txt`，原子安装 Go binary；Workspace/Device Credential 写入 macOS Keychain。
+9. 初始化默认不注册 LaunchAgent、不启动 Daemon、不上传文件，也不写项目级 `.codex/config.toml` 或重复的 `.agents/skills`。
 
-无法使用 Prompt 流程时，在空目录使用 Web 提供的固定 `contentcloud-cli`，不能替换为 `@latest`。先运行只读计划：
+无法使用 Prompt 流程时，在空目录使用 Web 提供的固定 `contentcloud-cli`，不能替换为 `@latest`。先运行环境检查：
 
 ```bash
-<contentcloud-cli> bootstrap plan . --server-url https://content.example.com --connect cck_xxx --json
+<contentcloud-cli> bootstrap preflight . --server-url https://content.example.com --json
+```
+
+再使用 Web 显示的公开 ConnectSession ID 生成计划：
+
+```bash
+<contentcloud-cli> bootstrap plan . --server-url https://content.example.com --session 11111111-1111-4111-8111-111111111111 --json
 ```
 
 检查返回的 `plan_id` 后再确认执行：
 
 ```bash
-<contentcloud-cli> bootstrap apply . --server-url https://content.example.com --connect cck_xxx --plan-id bp_xxx --accept --json
+<contentcloud-cli> bootstrap apply . --server-url https://content.example.com --session 11111111-1111-4111-8111-111111111111 --plan-id bp_xxx --accept --json
 ```
 
 用户 CLI 登录与设备连接凭据分离：`contentcloud auth login --no-wait --json` 发起浏览器确认，之后用 `--device-code` 完成并把 `ct_` 写入 Keychain。

VERSION

@@ -1 +1 @@
-0.5.0
+0.6.0

contracts/plugin-release-signature-v1.fixture.json

@@ -24,7 +24,7 @@
     "data_flow": {
       "local_by_default": true,
       "cloud_actions": [
-        "device.connect",
+        "bootstrap.authorization.complete",
         "workspace.register",
         "explicit publish and review synchronization"
       ]
@@ -57,5 +57,5 @@
       "status": "active"
     }
   },
-  "payload_sha256": "sha256:5ae90785f761e3c189594973210ffedbbd5ef530c0f155ce4fada8f618120d3b"
+  "payload_sha256": "sha256:0b3dc4d70b63c109eaaca410e4120d28ecac3a72d0878c8e07865331dbc4be3f"
 }

deploy/systemd/contentcloud.env.example

@@ -15,5 +15,5 @@ CONTENTCLOUD_PLUGIN_TRUST_FILE=/etc/contentcloud/plugin-trusted-keys.json
 CONTENTCLOUD_ENVIRONMENT_TRUST_FILE=/etc/contentcloud/environment-trusted-keys.json
 CONTENTCLOUD_ENVIRONMENT_SIGNING_KEY_FILE=/etc/contentcloud/secrets/environment-ed25519.key
 CONTENTCLOUD_ENVIRONMENT_SIGNING_KEY_ID=contentcloud-environment-2026-07
-CONTENTCLOUD_CAPABILITY_RELEASE_VERSION=0.5.0
+CONTENTCLOUD_CAPABILITY_RELEASE_VERSION=0.6.0
 CONTENTCLOUD_ENVIRONMENT_MANIFEST_TTL=24h

deploy/systemd/environment-profile.json

@@ -8,7 +8,7 @@
     {
       "id": "contentcloud-video-production",
       "kind": "scene_plugin",
-      "version": "0.5.0",
+      "version": "0.6.0",
       "required": true,
       "scope": "environment",
       "capabilities": [