[cuipengdba]

Scope

2026-11-02 scope update: The user moved cutover and rollback of their actual business system out of the v4.5.0 release gates. They will arrange integration after release and plan any issues then. Unchanged original-client and synthetic API/MCP/embed callers, negative security acceptance, signed offline delivery and public release checks remain gates. Release notes must explicitly say that the user's business system has not been validated and must not claim 100% compatibility or completed zero-change replacement. Historical references below to business cutover as a blocker record the earlier scope.**

Draft v4.5.0 builds on v4.4.0 toward SQLBot Community v1.10.3 functional, page and integration parity. AgentSQL is independently implemented and branded for both standalone data Q&A and SQLBot security-gateway deployment. Repository and planned website copy use Apache-2.0 positioning without commercial-license claims. SQLBot's original frontend assets are used only in isolated comparison tests and are not shipped.

The candidate one-command offline assembler and installer verify signatures and hashes, then install binaries and the Q&A store without network access. A disconnected installation using official v4.3.0 assets passed pinned and independently trusted key modes and rejected tampering. PostgreSQL's native binder extension and runtime-role grants are separate database-side requirements and are not installed by the current 15-asset application bundle. Trusted offline database-side delivery or explicit preconfiguration, formal v4.5.0 assets, dual-architecture startup, upgrade and rollback remain open.

The installable bundle carries a read-only PostgreSQL binder preflight. In isolated PostgreSQL 16 databases it passed for a configured reader and returned distinct failures for missing extension, schema usage, function execution, invalid role input and a same-name SQL function spoof. It counts only functions owned by the native extension. The helper is included in the archive with executable mode; it does not install or grant anything.

Local acceptance

• The unchanged original browser completed selected administrator, user, workspace, model, API Key, system-variable, managed-file and Q&A flows. A managed CSV produced illustrative future trend points through the original Prediction page; the controlled calculation supplies consistent bilingual explanatory text. Historical analysis and prediction text require fresh authorization, a matching result digest and an audited read.

• The original datasource page and AgentSQL's bilingual native page edit managed-file table and field remarks, export XLSX, import an edited workbook and download a template. The native page retained both imported remarks after reopening. Managed-file remarks reach local Qwen only through current gateway-visible schema and are labeled descriptive context.

• Local Qwen returned two nonaggregate rows with audit record 1201. A grouped query initially failed closed because the test reader lacked native PostgreSQL binder privileges. After the quickstart's minimal grants, grouped Q&A returned two rows with allow audit 1234. A repeat on the candidate binary without diagnostic logging passed with audit 1248.

• Both clients created, read and edited kv, number-range and date-range system variables. The unchanged original Edit User and Add User forms saved and reloaded current-workspace variable assignments. The server validates values, ranges and scope, encrypts records, audits writes, and rejects generated-ID collisions. New system variables use 13-digit IDs after a reproducible original-select display failure with earlier 16-digit IDs. At that stage these bindings were management data only; the later variable row-rule work is recorded below.

• AgentSQL's own bilingual Web user form edits text, KV and range assignments for the current workspace. Local browser acceptance added and removed a number-range binding on an existing account, created an account with a text binding, and read the results back through the API. A different workspace shows a switch-workspace notice instead of editable controls. That earlier browser check alone did not establish row-permission enforcement.

• The unchanged original model page created a second non-default Generic OpenAI model, reloaded it, renamed it and deleted it. It then created a test model, switched the default to it, reloaded the state, switched back to the local Qwen default and removed the test model. Focused service tests cover authorization, secret redaction, encrypted persistence, idempotence and rollback after an injected audit-write failure. The original form now saves its default temperature 0.6, reopens with the same value, and a focused service test confirms the value reaches an OpenAI-compatible model request. The AgentSQL English page also saved, reloaded and restored its own temperature value. Its bilingual model catalog then created a second model, selected it as default, restored the local Qwen default and deleted the test model. The native API lifecycle test covers administrator checks, secret redaction, revision conflicts and reversible switching. After the browser restored the local Qwen default, the native connection check returned success without executing its generated probe SQL. Other advanced parameters, cross-workspace mappings and key rotation remain open.

• The pinned original model page created, reloaded, edited and deleted a DeepSeek configuration. The local Qwen default stayed active. The Go service now preserves supplier IDs for nine additional OpenAI-compatible options in the original and native model pages and current-workspace MCP model list, with secret redaction. Focused tests cover all supported IDs, unsupported-ID rejection, temperature bounds, actual model-request propagation and default switching. Alibaba Cloud and iFlytek need dedicated parameters and remain rejected. Live vendor services and full cross-workspace model mapping remain unaccepted.

• AgentSQL's bilingual native user page can download a bounded XLSX template, import local member accounts and download a scoped error workbook. In an isolated browser run, one valid row imported and one external-ID row failed; the page showed both counts and the downloaded report contained only the rejected row. The final implementation also rejects administrator rows because the current user lifecycle cannot demote a global administrator. Focused tests cover permission denial, missing configured initial password, active and disabled accounts, duplicates, administrator and external-ID rows, and private error-report access. SQLBot v1.10.2's batch-import UI button is commented out in the pinned original frontend, so the original page was not used for this flow.

• The unchanged original datasource page edited the name and description of a claimed XLSX datasource, reloaded and read back both changes, then restored the test values. The new update endpoint verifies the resubmitted file and sheet identity against the server-owned binding, never changes gateway credentials or table selection, rejects duplicate names and another administrator's datasource, and commits metadata with audit in one transaction. A focused test injects audit failure and confirms rollback. Database connection-parameter editing remains open; bounded display metadata editing is covered below.

• The original PostgreSQL datasource page now reads a current server binding, returns only a nonsecret gateway-managed form placeholder, and never exposes database credentials, Agent Key or connector token. In an isolated PostgreSQL 16 database, the unchanged SQLBot v1.10.2 frontend read synthetic datasource 11, discovered its three fields, cleared all table choices and restored the table through getTablesByConf/chooseTables, then previewed two rows. The old managed-file-only binding 10 remained denied for unrelated file tables. Preview correctly failed with AUTH_COLUMN_GRANT_MISSING before a closed column policy was enrolled. MySQL connection creation/editing and broader page flows remain unaccepted.

• The unchanged original PostgreSQL edit form now changes only datasource name and description for a server-owned binding. In the isolated browser, save returned 200, the list immediately showed the new values, and opening the renamed datasource still resolved the original gateway mapping and schema. The test values were restored through the same page. Focused tests cover cross-administrator denial, duplicate names, forged host rejection, audit-write rollback, secret preservation and repeated rename. Real connection parameters cannot be edited by this route.

• The same original edit dialog's Check button originally returned 404. The new POST /datasource/check path accepts only a current server-owned datasource ID plus an unchanged gateway-managed display configuration, probes the live gateway schema and rechecks identity and binding before reporting success. In the isolated PostgreSQL 16 browser run, the original button then returned 200 and displayed “连接成功”. Focused tests cover missing ID, non-administrator, a forged AES host, gateway failure and concurrent binding change. New database connections and their arbitrary configuration checks remain unsupported.

• The original Get Schema button also initially returned 404. POST /datasource/getSchemaByConf now uses only the bound gateway's current authorized schema, then checks identity and binding before returning sorted schema names. The unchanged browser returned 200 and offered public in its dropdown. Focused tests cover missing ID, forged configuration, gateway failure and concurrent binding change. Selecting a real schema in the original connection form does not yet complete a save/update flow.

• The unchanged SQLBot v1.10.2 datasource page saved a table remark and an amount field remark for the synthetic PostgreSQL table through the original editTable and editField requests, both HTTP 200. Both remarks survived browser reload and reopening the table. AgentSQL's own page exposes individual database table and field remark editors. Each update checks the current gateway-visible schema, stable table/field ID, identity and binding revision and commits encrypted metadata with management audit. Focused tests reject a forged table/field, deny writes after revocation and prove audit-write rollback; the full ChatBI suite passed in 341 seconds. MySQL browser acceptance remains open.

• The same original browser's Sync Fields button initially received 404. Current head re-reads the gateway's live schema, validates the selected table ID, current identity and binding, and audits the refresh. The original syncFields/11/{tableID} request then returned 200, followed by fieldList 200; the existing field remark stayed visible. Focused tests cover invalid ID, anonymous access, revoked table and audit failure. Native database comments and field enable/disable remain open.

• The original PostgreSQL datasource page downloaded its remark XLSX through Export Remarks. Local openpyxl read the table and amount field remarks from that workbook. The export is built from current gateway-visible schema and encrypted owner remarks, excluding hidden-table notes, connection settings and secrets; audit failure stops the download. Focused tests cover isolation, audit denial, anonymous access and the bounded 256-table workbook layout.

• The unchanged original Import Remarks dialog uploaded an edited copy of that XLSX to the same PostgreSQL datasource. uploadDsSchema/11 returned 200, the page reported success, and reopening the table showed Imported sales table and Imported amount field. The Go importer matches only current gateway-visible tables and fields, ignores unknown/revoked objects, and commits encrypted remarks with management audit. Focused tests cover anonymous denial, hidden-table/unknown-field isolation, audit rollback and the 256-sheet parser boundary. Legacy XLS, complex multi-table browser cases and MySQL remain open. The CI SQL-callsite manifest now includes all new fixed local control-store SQL files; the focused manifest test passes.

• After a full browser reload, reopening the same table still showed both imported remarks. Database remarks now reach the local Q&A model as bounded descriptive context only for gateway-visible, currently selected tables and columns. A focused Ask test excludes hidden, deselected and revoked remarks; the existing prompt explicitly labels remarks as data rather than authority. The hint builder now also observes the model's 264-item limit as well as its 256 KiB encoded-size limit. No real-model quality claim follows from this synthetic test.

• The unchanged SQLBot v1.10.2 Table Relationship page now reads a graph from the synthetic PostgreSQL datasource, drags its gateway-visible table into the canvas, saves it and restores the node after reopening. Original table_relation/get and table_relation/save requests return 200. The Go service validates stable table/field IDs against current gateway selection, rebuilds nodes and edges rather than persisting client styling, and commits the encrypted graph with management audit. Focused tests cover a cross-table edge, forged field, audit rollback, revocation and stale-graph clearing. Relationship hints enter Q&A only as descriptions; SQL still passes the gateway. A real edge between two database-backed tables and MySQL remain unaccepted.

• AgentSQL's own bilingual datasource page now renders the same graph as a compact relationship list and an add/remove form for gateway-visible managed-file or PostgreSQL/MySQL tables. The isolated one-table PostgreSQL source showed the two-table prerequisite in Chinese and English and hid the unusable form. On an isolated two-table managed-file source, the native English page added a region → region edge, read it back after reload and removed it, with 200 on both saves. The unchanged original page saw two nodes and one edge, then zero edges after removal. The first local build exposed a missing static-module allowlist entry. Its regression test now requires HTTP 200 for the new module, and the login form uses POST at the root when JavaScript is unavailable. A browser test blocked the module and observed HTTP 405 at the root URL without submitted values in the query string.

• The original database datasource Delete route now removes only the current administrator's encrypted Q&A alias for an existing PostgreSQL/MySQL binding; it never deletes an operator gateway binding or database account. The alias removal, retired-ID marker and audit commit in one local transaction. The retired ID cannot be rebound to a different datasource through operator connection setup, so old chats cannot read a replacement source. Focused tests cover wrong name, demotion, audit rollback, another alias, old-chat denial and ID-reuse rejection. The native page exposes a bilingual removal confirmation; cancelling the English dialog kept the source. On a consistent local copy of the control store, the unchanged SQLBot v1.10.2 browser deleted synthetic PostgreSQL datasource 11: the original request returned 200, the card disappeared and remained absent after a copied-service restart, while another source and the original acceptance instance stayed intact. A second independent control-store copy passed native AgentSQL English-page PostgreSQL removal: the request returned 200, the success message appeared, and the source stayed absent after restart while another source remained. In two further MySQL demo-database copies, both AgentSQL and unchanged SQLBot pages read the gateway-visible orders table and seven fields; a missing column grant denied preview. Native removal of MySQL datasource 12 persisted after restart. The original SQLBot delete request returned 200 and its card stayed absent after restart. MySQL connection creation/editing, real Q&A and complete revocation remain open.

• In an isolated MySQL gateway copy, a dedicated PROCESS-only metadata account and read-only business account enabled seven-field single-table column authorization. The native AgentSQL page and unchanged SQLBot page each previewed 100 agentsql_demo.orders rows after the generated SQL was qualified with the authorized schema. Deleting only the column policy while retaining table-level allow did not revoke access; deleting both policies made a new original-page preview return 403 without a new allow audit. The unchanged original frontend retained previously rendered rows until reload. Focused regression and the full ChatBI suite passed on 866cdae6; this does not establish full SQLBot parity or business-system cutover.

• The original SQLBot field switch now persists checked in the encrypted Q&A binding with management audit; disabled columns leave Q&A model schema and selected preview columns, while gateway permissions remain separate. Focused tests cover managed files and database fields, forged names, re-enable, model grounding and rollback when audit storage fails. On an isolated PostgreSQL control-store copy, AgentSQL English UI disabled amount, previewed only id and region, read the state back after signing in again and restored three-column preview. The unchanged SQLBot v1.10.2 page toggled the same field, previewed two columns, read the state back after reopening the table and re-enabled it. Full ChatBI suite passed before a final audit-action label adjustment; focused tests passed after it. Other field cases and real-model behavior remain open.

• The original table switch now persists semantic checked status through editTable and reads it through tableList; disabled tables remain manageable but leave Q&A model schema and new preview requests. Focused database and managed-file tests cover forged tables, audit rollback and re-enable. In an isolated PostgreSQL copy, AgentSQL English UI showed a disabled table and empty preview. The unchanged SQLBot v1.10.2 page read the disabled switch; its new preview returned 404, re-enable returned 200 with three columns, and disabling again returned 404. The original frontend kept earlier rendered rows on the same page after denial, so this is explicitly a replacement limitation. Field and table status do not revoke gateway policy. Full ChatBI suite passed in 356.8 seconds on this code.

• Disabled-table status is also checked on every Q&A SQL submission, including an old conversation: PostgreSQL closed SELECT and MySQL SELECT references to a disabled qualified table or an ambiguous unqualified name are rejected before the gateway executes. Focused tests cover both dialects and verify that denied SQL never reaches the gateway. The full ChatBI suite passed in 336.5 seconds on f0186566. Broader parity remains open.

• Disabled-field status is now checked on every Q&A SQL submission. PostgreSQL uses a closed SELECT parser, including joins and nested subqueries; MySQL uses a bounded single-table SELECT shape and case-insensitive identifier checks. Output and predicate references to disabled fields, wildcard output, and unprovable shapes fail before the gateway. Focused tests cover both dialects, a real old-conversation Ask denial before any gateway query, nested join-condition subqueries, enabled-column allowance, and MySQL case variants. The full ChatBI suite passed in 347.3 seconds after the first field guard; final nested-query additions passed focused tests. This conservative guard can reject safe complex/aggregate SQL while a field is disabled, and real-model behavior remains unaccepted.

• The original assistant public GET/OPTIONS /api/v1/system/assistant/validate/{id} origin check now resolves only a server-owned enabled application and matches its exact allowed domain. It returns the original {valid, origin} shape and restricted CORS header without any application secret, and marks responses non-cacheable. Focused tests cover Origin, Referer, preflight, forged subdomains, unknown and disabled apps; the full ChatBI suite passed in 328.9 seconds. The signed original info handshake, SDK and callbacks remain open.

• The pinned original assistant SDK RSA-encrypts an info header using the public /system/config/key; that ciphertext and an asserted Origin do not authenticate a business user. AgentSQL must bind the assistant to server-owned identity and current app/datasource permissions before issuing a usable token, then recheck revocation on each data read. Returning a token solely because the header decrypts would undermine the security-gateway claim. This handshake and unchanged business-system cutover remain release blockers.

• The original PATCH /api/v1/system/assistant/ui multipart form saves bounded colors, welcome text, floating-window position and drag state for server-owned basic, advanced and page applications. It preserves workspace and datasource configuration, rejects forged settings, and commits with application revision plus management audit. An audit-write failure leaves the prior configuration intact. The unchanged SQLBot v1.10.2 page first reproduced a 422 save error for a basic application; after the fix it created the app, saved display settings, and read back welcome text, description, drag state and 45/55-pixel position after a full reload. Exact-head CI on dcb2a05f passed all four jobs.

• The original form now accepts PNG/JPEG app-logo and floating-icon uploads, each bounded to 10 MiB and 2048×2048 pixels. Images are encrypted per workspace/app; the public picture route serves only an enabled app's currently referenced unguessable ID. Replacement, clearing and assistant deletion remove image objects transactionally with audit; forged IDs, invalid images, disabled apps and audit failures fail closed. Focused tests and the full ChatBI suite (318.8 seconds) passed on b31e1c6f; bilingual docs validation passed for 253 documents and two sites. The unchanged SQLBot v1.10.2 page uploaded both a 32×32 PNG logo and floating icon through its real file chooser. After a full reload, the logo rendered, both IDs persisted and the icon URL returned HTTP 200 with the original PNG bytes. The actual floating-window embed and signed info handshake remain open.

• A full-repository CI run on b31e1c6f exposed one missing SQL callsite manifest entry for the fixed, parameterized control-store image transaction. The narrow assistant_images.go entry is now registered. General application edits that remove a referenced logo or icon also delete its encrypted object in the same compare-and-swap/audit transaction; an injected audit failure preserves both the app configuration and image. Focused image and callsite-manifest tests passed. The full ChatBI suite passed in 342.5 seconds on 5ed27293; exact-head CI run 40908694853 passed all four jobs.

• AgentSQL's own bilingual assistant page now edits original display settings and uploads/removes logo and floating-icon images through that audited endpoint. In an isolated browser, replacing a logo and welcome text persisted, the old image URL returned 404 and the new one 200; the English page removed the logo while retaining the icon. Clearing local language preference and reloading recovered English from the account and translated the assistant controls. A 600-pixel-wide viewport remained usable. A separate basic test app was created and deleted to verify that hidden display controls do not block the existing creation form. JavaScript syntax, static-asset boundary and bilingual docs checks passed on a830f8c5; exact-head CI run 40913380059 passed all four jobs (Go, Web, docs/integrations and govulncheck) on a830f8c5. Real floating-window embedding and the signed info identity flow remain open.

• The Q&A service installer now restores configuration and credential files on a first-install startup failure. An isolated disconnected container injected that failure and found no partial config, credentials, binary, unit or database. Normal offline preinstallation, unprivileged login and existing-install startup rollback then passed. Formal v4.5.0 offline-bundle upgrade and rollback acceptance remains open.

• Full go test -p 1 ./internal/chatbi -count=1 passed on relation-graph head 7655afd4 in about 340 seconds. Focused database/file remarks, sync, export, import, 256-table workbook/parse, model-context exclusion/count bound, bound connection check, authorized schema discovery, table relations, static asset routing and SQL-callsite manifest tests passed after their final changes. Bilingual documentation validation passed (253 documents, two website variants), as did node --check and git diff --check. Exact-head CI for native relationship editor e3e9dbdb passed all four jobs. Full go test -p 1 ./internal/chatbi -count=1 passed on the database-alias removal code in about 356 seconds; Exact-head CI for 8185ffc6 passed all four jobs. Exact-head CI for MySQL preview 866cdae6 passed all four jobs. Exact-head CI for field status e81b03c6 passed all four jobs. Exact-head CI for disabled-table SQL guard f0186566 passed all four jobs. Exact-head CI for 678af408 passed all four jobs. Exact-head CI for 4eeeb78b passed all four jobs. Exact-head CI for dcb2a05f passed all four jobs.

Release status

• The bilingual v4.5.0 acceptance matrix now defines the original SDK identity gate: its public-key-encrypted header and asserted Origin cannot authenticate a business user. It separates explicitly published guest data from private-user grants, requires per-visitor history isolation and read-time revocation checks, and lists negative cases for the unchanged SDK. Docs structure validation passed for 253 documents and two sites. CI run 40915764224 covered the documentation-only commit ab213afb and is superseded by the next code commit.

• A bounded decoder for the original SDK SQLBOT-EMBEDDED-SIGN RSA PKCS#1 v1.5 chunked header is now in identity_embedded_sign.go. A test creates the header using only the public key, verifies multi-chunk parsing and rejects malformed/oversized ciphertext and JSON. This decoded payload is explicitly not an authenticated principal and no info query token is issued. The focused test passed in a Linux container; bilingual docs validation passed. CI run 40916970108 was superseded by the next code commit.

• The parsed SDK claims now have a separate request-consistency validator for assistant ID, exact allowed Origin/target, User-Agent, webdriver flag, ten-second timestamp and IANA timezone offset. Focused Linux-container tests cover accepted and rejected claims. This validator still cannot establish a user identity or issue a token. Exact-head CI run 40917424273 passed all four jobs on 3da39ca5.

• Pinned v1.10.2 frontend source confirms the exact basic-assistant handoff: the outer SDK posts sqlbot_embedded_token and display configuration to the iframe; the unchanged request interceptor sends X-SQLBOT-ASSISTANT-TOKEN: Assistant <token> (distinct from Type 4 Embedded), GET /system/assistant/ds lists available sources, and POST /chat/assistant/start carries origin: 2. The next implementation slice must preserve this wire shape while binding the token to a server-owned guest or authenticated business user and isolating each visitor history. No route is yet claimed as complete.

• Page-embed JWTs now accept an optional 128-bit visitor scope, checked by current identity comparison and by chat reads, chat lists and recent-question suggestions. In focused Linux-container tests, two visitors under the same app and account could not read or list one another or access the other visitor suggestions; an unscoped token could not read a scoped chat, and malformed visitor IDs were rejected. Existing tokens without the optional claim retain their prior behavior. This is groundwork for a future server-issued guest identity; the original basic-assistant info token path is still absent. Bilingual docs validation passed for 253 documents and two sites. Exact-head CI run 40924666892 passed all four jobs on 1591e00d.

• A basic assistant can now be explicitly configured through the authenticated management API with a dedicated public_guest_user; saving requires an enabled local non-admin guest in the same workspace with its own current binding for every listed datasource. Creation generates a server-owned app secret; the original browser form does not see that secret. Focused Linux-container tests reject a missing guest binding, an administrator as guest, empty source scope and a disabled guest. This is only a configuration gate: no public info token is issued yet and runtime gateway permissions must still be rechecked. Bilingual docs validation passed. CI run 40928937271 was superseded by the next code commit.

• The internal token verifier now accepts service-signed, visitor-scoped publicGuest JWTs for explicitly configured basic assistants, with a one-hour maximum lifetime and exact guest-user/app binding. Runtime reads recheck guest status, assistant revision and datasource scope. The original Assistant header is accepted only for this mode; the existing Type 4 Embedded header remains distinct. Focused Linux-container tests pass for the allowed request, wrong prefix, missing visitor scope, overlong expiry and disabled guest. No public info issuance exists yet, so an unchanged external SDK cannot obtain this token. Bilingual docs validation passed. CI run 40929675342 was superseded by the next code commit.

• A server-only issuer now creates fresh 128-bit visitor scopes and one-hour Assistant JWTs bound to the current application revision and guest account auth revision. The verifier rejects stale revisions, long expiries and disabled guests; data requests still recheck the app and current binding. Focused Linux-container tests pass, including old-token rejection after app edit. The issuer is not yet exposed through original info; the unchanged SDK still cannot access it. CI run 40930414646 was superseded by a later commit.

• A restricted GET/OPTIONS /api/v1/system/assistant/info/{id} now accepts the original RSA header only for an enabled basic assistant with an explicitly configured, independently bound public guest. It returns a new one-hour visitor-scoped Assistant token and display-only configuration; no app secret or unknown configuration is exposed. GET /api/v1/system/assistant/ds lists only current guest-bound app sources through the gateway schema. Focused Linux-container tests passed for preflight, valid original-format RSA payload, token and datasource retrieval, missing/stale signatures, forged Origin or User-Agent, unconfigured app, revoked guest binding and disabled app. The same test starts a chat through the original origin: 2 route, reads it with the first issued token, and rejects a second visitor token from reading that chat; replay of the public RSA header creates a distinct visitor scope. Bilingual docs validation passed for 253 documents and two sites. The unchanged original SDK browser flow and refresh continuity still require acceptance; these guest data must be treated as public.

• In an isolated local browser, the unchanged pinned SQLBot v1.10.2 assistant.js fetched the AgentSQL public key and called info/{id}?virtual=... for an explicitly published guest; both returned HTTP 200, and the original script constructed its /#/assistant iframe. Chromium then blocked that iframe because the current AgentSQL root page sets a restrictive frame-ancestors policy. This is a concrete page-embedding release blocker: the original SDK requires a root URL, while the management page must keep clickjacking protection. A separate assistant-only origin and controlled frame policy, followed by original iframe datasource, Q&A, history and revocation checks, are required. This browser evidence proves only the bootstrap handshake, not full SDK or zero-change cutover.

• A second acceptance-only local proxy served the pinned, unchanged SQLBot v1.10.2 frontend assets and forwarded API calls to an isolated AgentSQL Go fixture; no original assets were added to the product. The unchanged SDK opened its original iframe, listed the guest-scoped source, selected it, started an origin: 2 chat and submitted one question. The original page displayed the answer and execution details. assistant/ds, chat/assistant/start, chat/question, record data and usage all returned 200. After page reload, chat/list returned an empty array because a new visitor scope was issued. The model and gateway in this fixture were synthetic doubles, so real-model, real-gateway, safe history continuity and an AgentSQL-owned assistant-only iframe remain release blockers.

• The native bilingual assistant page now offers a searched, workspace-scoped public-guest selector only for basic apps and warns that the selected sources become public and require separate bindings for the guest account. An isolated browser showed the selector and warning in English and Chinese, hid the field for advanced apps, filtered candidate users by account, and rejected an unbound guest/source save with HTTP 422 while the app list remained empty. The UI uses the existing authenticated management API; successful publication has server-fixture coverage using the existing operator-only chatbi configure command with a distinct synthetic guest binding. A real installation still needs a guest-specific gateway grant, and guided browser provisioning is unavailable. JS syntax and bilingual documentation checks passed.

• The guest bootstrap regression test now provisions its synthetic guest binding through the existing operator-only chatbi configure path with a distinct connector credential, then checks disablement and gateway-schema failure after a token has been issued. Disabled guests cannot obtain a new token or use the old one to list sources; a gateway schema failure rejects source listing before any query executes. The focused Linux-container test and bilingual docs validation passed. This is still fixture evidence, not a real gateway grant or unchanged business-system cutover.

• The server now exposes a guest-session resume foundation for explicitly published basic assistants: a current one-hour Assistant token obtains a separate seven-day signed proof, and a fresh guest token plus the proof can reissue the previous visitor scope. The proof alone is rejected as a data token. Focused Linux-container tests pass for restored chat access, isolation from a second visitor, cross-app proof rejection, tampering, expiry, guest disablement, binding removal and app disablement. Both endpoints set Cache-Control: no-store. The original SDK does not call these new endpoints, and a product-owned assistant iframe and browser reload acceptance are still open; the proof is a browser-held credential without per-visitor immediate revocation. Bilingual docs validation passed for 253 documents and two sites.

• A dedicated chatbi serve --assistant-only listener now serves AgentSQL's own assistant iframe and only public assistant bootstrap, scoped guest Q&A/history and resume APIs. Its root permits framing while the management page keeps frame-ancestors 'none'; management login and APIs are unavailable on the assistant listener. The unchanged pinned SQLBot v1.10.2 SDK was served only by a local test proxy across separate 127.0.0.1/localhost browser origins. It fetched the public RSA key and restricted info, opened AgentSQL's own iframe, selected a guest-scoped source, submitted a synthetic question, displayed row 123 and audit ID 1, then recovered the same conversation and row after a full browser reload through the signed resume proof. Chinese/English switching and management-surface denial were checked. The model and gateway were synthetic; the original SDK asset is not shipped, and real-model/gateway, wider page/API parity and unchanged business cutover remain release blockers. A separate original-SDK browser negative revoked the guest datasource binding after a synthetic answer: the next history action was denied and the iframe cleared the displayed row. Server tests also reject chat-list titles, history and new questions after revocation without a new gateway query. Already displayed data clears at the next controlled action, not instantaneously. Exact-head CI run 40960280885 passed all four jobs for commit 59a3a87.

• A separate v4.5.0 binary built at 59a3a87 ran against a consistent copy of the v4.4.0 acceptance store, with the existing local llama.cpp Qwen3-4B model and bound PostgreSQL gateway datasource. One administrator question over sqlbot_parity_sales finished without an error; history returned two rows, read-only SQL and gateway audit ID 1688. Removing only datasource alias 11 in that copy made both historical row retrieval and another question return 404. This is a one-question API smoke, not original-browser, guest-iframe or complete model/gateway parity. Exact-head CI run 40962595795 passed all four jobs for the documentation commit.

• Ordinary chat/list now rechecks each historical datasource binding and live gateway schema under a bounded historical-read slot. Focused negatives show that deleting one database alias hides its old conversation title while a second authorized alias stays visible; gateway schema failure rejects the list. The full local ChatBI package passed in 374 seconds. The original browser list has not yet been compared for this case. Exact-head CI run 40964353566 passed all four jobs for commit 40104f9.

• The unchanged SQLBot Community v1.10.2 frontend, served through an acceptance-only local proxy against the v4.5.0 candidate, displayed two fixture conversations before datasource-alias revocation. After alias 11 was deleted only in a copied control store, the original page reload hid its old title while retaining and opening the other authorized conversation. Direct old-chat metadata and data reads returned 404; browser error log was empty. This covers one administrator and reload after alias revocation, not instant updates or table/column/row revocation. Exact-head CI run 40966401537 passed all four jobs for documentation commit 8c673c4.

• A separate fault-injection copy pointed the candidate to an unreachable gateway port while the unchanged SQLBot v1.10.2 frontend remained connected. chat/list and an existing /with_data read both returned 403 without historical titles or rows. The original page persistently displayed “No conversations” and logged the generic 403 error, so the data path fails closed but the user-visible fault state remains a release gap. Original gateway and store were untouched. Exact-head CI run 40968093806 passed all four jobs for documentation commit bbb9457.

• The original frontend calls /chat/recent_questions/{datasource_id} for historical suggestions. The candidate previously checked only its local binding before returning old question text. It now checks the live gateway schema, uses the bounded historical-read queue and revalidates the bearer token before response. Focused tests reject both gateway schema outage and binding revocation without old questions; the full local ChatBI package passed in 364 seconds. Original-browser fault presentation for this specific route remains open. Exact-head CI run 40970550595 was cancelled when the follow-up commit superseded it; its web, docs and govulncheck jobs had passed.

• Saved recommendation reads now recheck the current gateway schema and datasource binding before returning configured question text; original-compatibility and native reads share the bounded historical queue, while writes use controlled slots. Focused gateway-outage negatives reject old configured text, the full local ChatBI package passed in 344 seconds, and bilingual docs validation passed. The unchanged original browser recommendation-page fault presentation remains open. Exact-head CI run 40971915164 passed all four jobs for commit fa5f855.

• Historical record metadata now checks the current datasource binding and live gateway schema, and rechecks the binding before response. Layout-only dashboard reads apply the same check to each referenced record. Focused negatives reject saved SQL/card metadata after gateway outage or binding revocation; the full local ChatBI package passed in 371 seconds, with focused tests repeated after the final refactor. The original browser fault presentation remains open. Exact-head CI run 40973571164 passed all four jobs for commit 5cab558.

• The unchanged original v1.10.2 datasource card exposed a compatibility defect: after saving a custom recommended question, reopening the configuration dialog selected AI mode because /datasource/list omitted recommended_config. The candidate now returns display-only mode 1 or 2 without question text. Focused tests cover initial, saved and rejected-audit states; the full local ChatBI package passed in 382 seconds. A rebuilt candidate and unchanged original browser now reopen with User Defined selected and the saved synthetic question visible. In an isolated gateway-outage rerun, the read returned 403 and no saved text; the original dialog showed an empty custom list with a generic console error, so fault presentation remains a blocker. Screenshots and request traces are under D:\CodexLS\tmp\agentsql-v450-recommend-browser\.playwright-cli. Exact-head CI run 40976396018 passed all four jobs for commit eb7464d.

• Added original SQLBot fieldEnum path as a controlled and audited read. The field ID must resolve from current visible and enabled gateway schema. The route uses a schema qualified SELECT DISTINCT with a 100 value ceiling, then rechecks the audit ID, identity and binding. Focused synthetic gateway negatives cover wrong IDs and source, removed field, gateway failure, missing audit and revocation during query; PostgreSQL and MySQL quoting is covered. The full local ChatBI package passed in 335 seconds, and bilingual docs validation passed. The 100 value ceiling differs from upstream; original client and real gateway parity remain open. Exact-head CI run 40978286505 passed all four jobs for commit 0ec075e.

• A separate isolated v4.5.0 candidate used the existing local PostgreSQL gateway and a copied control store. A current datasource and field lookup followed by the fieldEnum compatibility call returned HTTP 200 and two distinct values for the synthetic sales region column. The server requires a positive audit ID in the gateway response. This proves one real local PostgreSQL path only; MySQL and unchanged original-client invocation remain open. The isolated container was stopped and removed. Exact-head CI run 40979759843 passed all four jobs for documentation commit 409c150.

• A second isolated MySQL copy retained datasource alias 12 and a dedicated gateway. Initial list_schema denial was traced to a missing test Agent grant; table and column policy plus real-column enrollment were configured through the admin API. Schema discovery then passed, but the old SELECT DISTINCT query failed closed with AUTH_COLUMN_SHAPE_UNSUPPORTED under the MySQL column binder. Commit d2232d0 uses a bounded single-column projection and in-server deduplication. A rebuilt candidate returned HTTP 200 and four distinct values for one synthetic agentsql_demo.orders.status field; the gateway query decision was allow and the ChatBI route required a positive audit ID. Focused and complete local ChatBI tests passed. The result covers only this MySQL field and may miss values beyond the first 100 authorized rows; unchanged original-client invocation and broader MySQL parity remain unaccepted. The isolated containers were stopped and removed. CI for the prior documentation commit passed all four jobs; exact-head CI for 78b9b9e3 is pending.

• A live isolated MySQL revocation replay found that deleting the column policy while retaining the table allow made the old gateway fall back to table-only access: fieldEnum still returned values. Commit 79e288b prevents that widening in the policy repository transaction and returns HTTP 409 from the admin API. On the rebuilt gateway, the unsafe deletion returned 409; revoking the table allow first and then deleting the column policy made the old fieldEnum request return 403 with no values and the latest gateway audit deny. The focused store test, complete local store/admin API packages, and bilingual docs check passed. Exact-head CI run 40986653732 passed all four jobs for commit 79e288b. This verifies one synthetic MySQL table and deletion order only; broader revocation remains open.

• A second real MySQL negative showed that an admin PUT changing the column policy to a table policy returned 200 on the old candidate and left fieldEnum returning four values. The store now blocks scope-changing updates while the same Agent/datasource/table has a table allow; the admin API returns 409. On a rebuilt isolated gateway, the unsafe update returned 409 and the bound field remained available. After the table allow was revoked, fieldEnum returned 403 without values and the latest gateway audit was deny; the remaining policy could then be explicitly updated. Focused store tests, full local store/admin API packages, and bilingual docs validation passed. Exact-head CI run 40989178663 passed all four jobs for commit 457cb2a. This covers one synthetic MySQL table, not all update shapes or unchanged business cutover.

• The unchanged SQLBot v1.10.2 browser opened a synthetic conversation and showed five recent questions through GET /chat/recent_questions/{id} (200). In an isolated copy with the gateway disconnected, a fresh API request returned 403 without question text. The original page retained its already-loaded five suggestions until reload because tab switching did not refetch. Clicking a cached suggestion resulted in the page showing “Request did not complete; no result was released.” A reload made the chat list return 403 and removed old conversation titles from view. Bilingual acceptance notes and local screenshots/request traces are under D:\CodexLS\tmp\agentsql-v450-recent-browser\.playwright-cli. This closes the original-client positive path and documents the original frontend's cached-text limitation; other client, revocation and business-system scenarios remain open. Exact-head CI run 40994374041 passed all four jobs for commit f2340fe.

• A dual-architecture v4.5.0 release dry run from clean source commit f2340fe built and executed Rocky Linux 8 amd64/arm64 binaries, checked ELF/glibc and YashanDB runtime inclusion, and generated 15 assets. The build and independent validate-only pass both reported 15 passed and zero failed. An actual agentsqlctl release verify rejected the unsigned placeholder public key with exit 1. The local output is under D:\CodexLS\workspaces\agentsql-v450\dist\release-dryrun\v4.5.0-candidate-f2340fe9; bilingual evidence is in commit 3b7d05d. Images were explicitly skipped. This is not a signed installable package; one-command offline installation, upgrade/rollback, image, and business cutover gates remain open. Exact-head CI run 41000714861 passed all four jobs for commit 3b7d05d.

• The original SQLBot v1.10.2 frontend still references legacy POST /datasource/uploadExcel. Candidate commit 9e4a9dd now sends this multipart request through the bounded managed import, encrypted stage, gateway, receipt and audit path. Focused negatives cover missing auth, non-admin, unsupported .xls, audit write failure and gateway rejection; a CSV upload followed by original-shaped datasource/add claims the receipt without importing twice. The complete local ChatBI package and bilingual documentation checks passed. A rebuilt candidate with an isolated control-store copy and the real local managed PostgreSQL gateway completed two CSV uploads, claims, table listings and deletions. The first preview failed closed with gateway AUTH_FINAL_FENCE_FAILED; the second returned two rows. This leaves preview reliability, original-browser upload, .xls, limits and revocation reads unaccepted. Commit f891755 records the bilingual evidence. CI for 9e4a9dd4 and exact-head CI for f8917550 are pending.

• The unchanged active SQLBot v1.10.2 datasource form was served by a local acceptance proxy against a rebuilt v4.5.0 candidate and real managed PostgreSQL gateway. Browser upload of a two-row CSV showed both rows in the original file preview, selected its one sheet, saved a 1/1 datasource card, and displayed the two rows again in the original detail Data Preview. The test datasource was deleted through the controlled API with HTTP 200; snapshots are under D:\CodexLS\tmp\agentsql-v450-legacy-upload-live\.playwright-cli. This active form calls parseExcel/importToDb; the older uploadExcel route has separate API/real-gateway coverage. .xls, multiple sheets, limits, revocation and original business-system cutover remain open. Bilingual evidence is in commit 49297b0. Exact-head CI run 41003516465 is pending.

• SQLBot Community v1.10.3 became the latest release on 2026-10-29 (pinned tag 96f06c7). Its source diff changes MCP workspace validation, file import errors and metadata, embedded navigation, retrieval settings, model options and database behavior, without added or removed public route decorators. Commit b961f28 adds a bilingual delta acceptance matrix. Prior v1.10.2 browser evidence remains specifically labeled; v1.10.3 original-client delta tests are open before any “latest version” claim. Exact-head CI run 41004208722 passed all four jobs for commit b961f28.

• The unchanged SQLBot Community v1.10.3 frontend from official image digest sha256:ff9012a95e6ac0e7921aa74e96c73de33550af61615fe850edb27b322c342288 was connected to an isolated AgentSQL candidate and real local managed PostgreSQL gateway. The original page completed admin login, two-row CSV upload preview, single-table selection, datasource save, schema read and data preview; numeric column name 123 was preserved and values east/10 and west/20 were read. The test datasource was removed through the controlled delete API. A focused Go negative confirms that MCP questioning after workspace membership revocation returns 404 with zero gateway schema/query calls. Original-page snapshots and bilingual scope notes are recorded in commit c648c55. The first local full-package run timed out in SQLite fsync on the Docker host. With the test temporary directory on container tmpfs, both go test -short ./internal/chatbi and full go test ./internal/chatbi passed in 15 seconds each; the focused test also passed. CI run 41006660070 passed web, docs and govulncheck, then its Go job was cancelled by the newer commit. This does not cover XLS, 50 MiB, full v1.10.3 behavior, original MCP client, real business cutover or signed offline delivery.

• A v1.10.3-specific Excel remark import regression now sends an XLSX with a real numeric field-name cell 123 to the original-shaped uploadDsSchema API. The controlled gateway reports column 123, and the saved field remark reads back as Numeric field. The focused Go test passed; this is API coverage, not original-page Excel coverage. Bilingual evidence is in commit a1b5a4e. Exact-head CI run 41006983471 passed all four jobs for commit a1b5a4e.

• The unchanged SQLBot Community v1.10.3 Import Notes page was tested against an isolated AgentSQL candidate and real managed PostgreSQL gateway. The datasource was prepared through the compatibility API with a numeric column name 123. An XLSX whose field-name cell was a genuine Excel number 123 was selected in the original browser. uploadDsSchema returned 200, the original page displayed Import Successful, and both the table remark and column remark appeared in its table schema. A full reload and reopening retained them. The test datasource was removed through the controlled API. Original-page snapshots and bilingual evidence are in commit 73bab2d. Exact-head CI run 41008989624 passed all four jobs for commit 73bab2d. Other remark formats, .xls, revocation, concurrent imports, and business-system cutover remain open.

• A negative comparison against the unchanged SQLBot Community v1.10.3 page opened PostgreSQL datasource 11 and previewed east/10 and west/20. Removing only that alias in an isolated control-store copy caused subsequent original-page fieldList and previewData requests to return 404, without new row release. The original page kept its previously rendered two rows on screen and showed a transient Resource not found message; a full reload removed the card and rows. This is a client-side stale-render gap despite server-side fail closure and HTTP no-store. Immediate clearing cannot be claimed for the unchanged original client. The real gateway and canonical store were unchanged. Bilingual evidence is in commit a954ec7. Exact-head CI run 41014637304 was cancelled after the following commit superseded it.

• AgentSQL's own bilingual datasource page now clears its old card list, detail, fields and preview DOM before asking the server for a fresh authorized list. In an isolated browser test with real PostgreSQL rows displayed, datasource alias 11 was revoked in a copied store and only the acceptance candidate API was stopped. Clicking Datasources removed the old name and east/10, west/20 even though refresh failed, and displayed an error. This is next-action clearing in AgentSQL's own page; it does not change the unchanged original SQLBot client's stale pixels or prove instantaneous revocation. node --check, bilingual docs validation and local full ChatBI package tests passed. Bilingual evidence and the fix are in commit 6b78491. Exact-head CI run 41015598755 passed all four jobs for commit 6b78491.

• Added a SQLBot v1.10.3 MCP negative regression for another valid user in the same workspace attempting to reuse an existing conversation ID. Both JSON and streaming requests return 404 before any gateway schema or query call and release no question or data. This is a synthetic server fixture, not original-client compatibility acceptance. Focused and full ChatBI tests, bilingual documentation check and diff check passed locally. Commit 2b4c888; exact-head CI run 41017643394 passed all four jobs.

• Compared SQLBot Community v1.10.3 non-page mcp_question streaming source. Candidate MCP streams now render audited rows as a field-ordered Markdown table instead of a JSON text line, with empty-result text and escaping for link, HTML, pipe and multiline gateway values. A synthetic server fixture checks the stream; original MCP client event, image and error-path runtime comparisons remain open. Full ChatBI and bilingual documentation tests passed locally. Commit c11a314; exact-head CI run 41020657113 passed all four jobs.

• An isolated official SQLBot Community v1.10.3 API showed MCP helper success responses use the code/data/msg envelope, while mcp_question returns direct JSON or a stream. It also showed mcp_ws_list requires a query-string token: a JSON-string body returned 422, query token returned 200. Candidate helpers now use the original success envelope; workspace listing accepts the original query form and the earlier body form, rejects conflicting/malformed credentials, and sets no-store/no-referrer headers. Server allow/revoke/negative tests and full ChatBI tests passed locally. Anonymous original mcp_model_list remains intentionally unsupported by the secure candidate, so zero-change parity is still open. Commit 5dcefd8; CI run 41024799192 was superseded by the following documentation commit after three jobs passed; exact-head CI run 41025808662 passed all four jobs.

• Rebuilt the current candidate from 5dcefd8 and ran the original-shaped helper calls against an isolated copy of the control store and the real local gateway. Login, session start, query-token workspace list, datasource list and authenticated model list returned 200 with the original envelope. A body-only workspace token also worked; mixed credentials returned 422 and anonymous model listing 401. The original v1.10.3 comparison used its own clean database, so list contents and successful question behavior remain unpaired. Both isolated containers were stopped. Bilingual evidence is in 9d08529; local docs parity passed.

• Added guarded legacy HTTP+SSE /mcp transport with six SQLBot-compatible tools routed through the existing checked ChatBI handlers. Anonymous SSE handshakes grant no data rights; sessions are capped at 16 and 10 minutes, cross-origin requests are rejected, and unauthenticated mcp_assistant remains absent. Go SDK protocol tests cover discovery, a controlled audited question, invalid token and missing gateway audit. The unmodified Python MCP client library from the official SQLBot Community v1.10.3 image connected to the isolated candidate, discovered six tools, listed authorized metadata, rejected an invalid token, and completed real local model plus PostgreSQL gateway questions in both JSON and streamed forms with two rows and a Markdown table. This is one synthetic datasource, not complete MCP parity. Full ChatBI tests and bilingual docs passed locally. Commit 14a1031. In the same original-client SSE session, logout returned HTTP 200 and subsequent question and workspace-list calls both returned MCP tool errors, proving the open transport did not preserve the revoked login. The same original client also created an isolated two-workspace member, started a chat in workspace 1, and observed MCP tool errors for the stale token and for JSON/streamed old-chat questions after workspace 1 membership revocation and fresh login. The same original client denied the new member access to the administrator old chat in both JSON and stream forms while both still belonged to workspace 1. Bilingual evidence updated in commits 06daa5e, bbcac0a and 8589f92. The first exact-head CI detected a Windows line-ending mismatch in the source hash; commit 02be1d2 normalizes the manifest hash against the staged Git blob, and exact-head CI run 41033509837 passed all four jobs. The pinned v1.10.3 identity and history exporters now verify official source hashes and X-Pack version; the Go readers accept only matching v1.10.2/v1.10.3 version+commit pairs. On a clean official v1.10.3 instance, the identity exporter produced one user; the unchanged original browser login supplied encrypted credentials and token, and the Go opt-in test passed import, decryption, local login and original-token verification. The history exporter ran read-only but this clean instance had zero chats; a later synthetic nonempty fixture is reported below. Private fixtures and isolated original containers were removed. Commit 5b045b7. The full local ChatBI short suite passed (352.600 s), alongside both pinned-image exporter checks and the real original-browser login fixture test; exact-head CI run 41036711530 passed all four jobs. Added optional isolated legacy MCP listener in commit dbcb957. The default systemd example leaves port 8001 disabled to avoid colliding with local model servers; an isolated candidate bound it explicitly. The unmodified official SQLBot v1.10.3 Python MCP client connected on 8001 and repeated six-tool discovery, real-model PostgreSQL Q&A, logout, membership-revocation and cross-user denials; a normal API request to the MCP port returned 404. Public ingress, TLS, proxy, offline installation and original business URL cutover remain open. Exact-head CI run 41038099966 passed all four jobs. A disposable official v1.10.3 instance was seeded with one explicitly synthetic chat and question through its original ORM; the read-only exporter returned one chat and question with zero skips. The Go private-fixture test passed import and authorized metadata read without replaying historical SQL, rows or model calls. This is not a real business-history migration. Commit 4b7a577; exact-head CI run 41041634274 passed all four jobs.

The official v1.10.3 self-service password endpoint adds a check that rejects the configured initial password when login.initial_pwd_disabled is enabled. Candidate commit edc0c95 now persists and audits this administrator-controlled setting, reflects it in public and administrator parameter reads, requires a password change at browser login, rejects reuse through both password-change routes, and closes the direct-credential MCP login bypass. Focused Go positive and negative tests and bilingual documentation checks passed locally. A disposable official v1.10.3 API instance then confirmed the public and administrator login-parameter lists contain only initial_pwd_disabled=false and initial_pwd_hidden=false. Saving the original full form record returned 200 and public readback true; authenticated and login-stage attempts to reuse the configured initial password each returned HTTP 400. Candidate commit ccf06cf now returns the same two keys and defaults, accepts the original full form shape, and persists the hidden flag; focused local Go tests and bilingual docs checks passed. The unmodified official v1.10.3 login page then connected through an isolated proxy to the latest candidate: a newly created synthetic non-admin using the configured initial password saw the forced-change dialog without a login token; reusing that password sent /login/change-pwd and received HTTP 400 with a visible refusal; a different valid password returned 200, and the user subsequently logged into the Q&A page. Bilingual evidence is in a2dcd9d and local browser snapshots remain under D:\CodexLS\tmp\agentsql-v450-password-v1103.playwright-cli. This covers one synthetic account. The original administration screen did not expose this setting; other accounts, self-service page variations, error response details, original MCP client comparison, and real business cutover remain open.

This is a draft based on unreleased v4.4.0. Full SQLBot Community function, page and integration parity; dynamic row-rule resolution; unchanged cutover of the user's real business system; formal one-command offline package; and final website, Demo, documentation and GitHub Release synchronization remain open. The public site, Demo and formal release remain v4.3.0.

Binder offline-install trust boundary: commit 29a6eae requires an explicitly supplied public key obtained outside the bundle; bundled keys and symlinks back into the bundle fail before package-manager access. A disconnected container passed negative checks plus a temporary signed-package positive test and tamper rejection, using a package-manager stub so no system package was installed. Bilingual docs checks passed locally. Formal publisher signing, native binder distribution, full disconnected installation and zero-change cutover are still open. Exact-head CI: https://github.com/cuipengdba/agentsql/actions/runs/41060210564 (all four jobs passed).

SQLBot v1.10.3 shared Excel-database table scope: commit 169d6dc now bounds schema discovery and SQL checks to the server-held sheets for each file datasource, including default all-sheets selection. It also preserves that scope on import-receipt retry. Synthetic cross-file negative tests and the complete internal/chatbi short suite passed locally (364.469 s); the original v1.10.3 browser comparison is recorded below. Exact-head CI: https://github.com/cuipengdba/agentsql/actions/runs/41064106964 (all four jobs passed).

Real two-file shared-PostgreSQL acceptance passed on a freshly built 169d6dc candidate and a fresh controlled gateway. Two one-row CSV sources shared one physical database. Each source listed only its own table; cross-file preview requests were denied without returning either marker row. The unchanged frontend from the official SQLBot v1.10.3 image listed both as Excel/CSV 1/1 and previewed ONLY_FIRST/1 and ONLY_SECOND/1 in their respective source pages. Both test sources were deleted and disappeared after an original-page refresh; the dedicated candidate, gateway and static-page containers were removed. Bilingual evidence and manifest are in 17660ab. The earlier shared test gateway 401/disk-I/O failure was isolated by using a fresh gateway. This covers default table scope for two CSV files on one local PostgreSQL instance; Excel multisheet, concurrent imports, revocation and other database types remain open. Exact-head CI: https://github.com/cuipengdba/agentsql/actions/runs/41068327098 (all four jobs passed).

SQLBot v1.10.3 nested-JSON extraction delta: commit dd1f1d6 selects the first complete valid outer JSON value in OpenAI-compatible SQL generation, including explanation and fenced output while preserving braces and escapes inside SQL strings. Invalid or truncated outer values cannot expose a child SQL value; a later SQL value cannot replace a first valid value without sql. The unmodified official v1.10.3 image passed its 34 extraction tests, candidate focused HTTP tests passed, the full internal/chatbi short suite passed locally in 387.526 s, and bilingual documentation validation passed. This covers this model path only; original-browser downstream JSON paths and malformed real-model behavior remain open. Current-head CI: https://github.com/cuipengdba/agentsql/actions/runs/41071941571 (all four jobs passed).

v4.4.0 head integration and v1.10.3 datasource edit (2026-10-31)

Merge commit 33dcc648 brings PR #90 onto the current v4.4.0 draft head 16a27384 without a force push. The two branches had independently implemented database remarks and table relationships; the merge retains the v4.5 implementations and their tests while incorporating the v4.4 PostgreSQL per-table catalog-fingerprint fix, original edit-form engine: "hive" acceptance, and current bilingual v4.4 design evidence. PR #90 is now mergeable against its v4.4.0 base. Focused ChatBI, PostgreSQL fingerprint and SQL-callsite manifest tests passed locally; documentation parity passed for 253 source documents and both site variants.

The unchanged official SQLBot Community v1.10.3 frontend then ran against a Linux candidate binary built from exact commit 33dcc648 with an isolated copy of a local PostgreSQL gateway fixture. Login, Get Schema, Check and Save returned HTTP 200; a forged Host/Ip sent through the original edit form made both Check and Save return HTTP 422, and a follow-up list/table read kept the valid binding. Local evidence and screenshots: D:\CodexLS\outputs\agentsql-v450\v1.10.3-datasource-edit-33dcc648.md. This is one administrator and one datasource-edit slice, not full replacement parity. Exact-head CI run passed all four jobs. This remains a draft and is not a release gate waiver. Formal v4.4.0 and v4.5.0 releases remain gated on broader original-client/API/MCP/embed, security-negative, offline-package and unchanged cutover acceptance.

SQLBot v1.10.3 data-permission rule-group foundation (2026-10-31)

Commit 33ab670d adds the original /ds_permission list/get/save/delete route shapes for workspace-scoped encrypted rule-group drafts, with administrator checks, membership validation and same-transaction management audit. An isolated unmodified SQLBot v1.10.3 API established the 200/401 status and response field shapes for a disposable disabled empty group. Candidate focused positive/negative tests and the complete local internal/chatbi short suite passed; bilingual docs parity passed (253 documents, two site variants). Direct schema-discovery routes now share the unresolved-rule guard; all ChatBI gateway schema/query calls are wrapped by the candidate policy boundary.

Nonempty row/column rules can only be saved disabled. Enabling them is rejected, and a restored active unresolved rule closes schema and query reads. This is not row/column policy enforcement, full original page parity or zero-change replacement. The original page normally saves nonempty rules without a disabled flag, so this operation is still incompatible. Exact-head CI for 33ab670d: https://github.com/cuipengdba/agentsql/actions/runs/41125094886 (all four jobs passed). v4.4.0 and v4.5.0 remain unreleased; signed offline package and business-system cutover remain open. ### Row-rule parser and original rule-item response shape (2026-10-31)

Commits bc4f3f9e and 9681e0cb add a bounded PostgreSQL predicate compiler for original-client row-rule trees, checking current datasource and live table/field IDs. It rejects forged IDs, variables, multi-item OR, unsupported terms and malformed literals, and passes the result through the existing row-filter parser. This compiler is not connected to query execution and does not activate nonempty rules. The disabled-draft API now returns rule-item IDs in permission_list, expanded items with tree on list/get, and stable server-assigned IDs on edit. An isolated official v1.10.3 API probe showed that the original accepts a nonexistent datasource/table/field rule and enables it by default; AgentSQL deliberately keeps such activation closed. Evidence: D:\CodexLS\outputs\agentsql-v450\v1.10.3-row-rule-contract-20261031.md. Local focused negative tests, full internal/chatbi and internal/authorizedexecute short suites (388 s / 72 s), and bilingual documentation parity passed. Exact-head CI for 9681e0cb: https://github.com/cuipengdba/agentsql/actions/runs/41128119029 (all four jobs passed). This is still a draft, not release parity. ### Bounded PostgreSQL row-rule execution (2026-10-31)

Commit 292b0818 connects live-field-validated SQLBot-shaped row groups to the ChatBI controlled-query path. For the supported PostgreSQL constant-comparison/conjunction subset, applicable user rules are rewritten into SQL before the existing gateway B2 column authorization, query audit and result fence. Query and schema paths compare the complete rule-group snapshot around remote work; a changed policy suppresses the result. Unsupported column items, variables, multi-item OR, MySQL row rules and SQL shapes outside the proven single-table rewrite remain closed. Active save requires current server-owned binding and live field IDs; forged IDs return 422. This is partial SQLBot compatibility and does not establish direct AgentSQL MCP policy mapping or complete original UI behavior.

In an isolated copy of the ChatBI store against local real PostgreSQL 16, an original-shaped API rule changed preview from east/west (2 rows) to east (1); updating the same item changed it to west (1); forged-field save returned 422 and retained west (1); deleting the group restored both rows (2). Controlled-gateway query audit IDs 703/712/721/730/735 recorded 2/1/1/1/2 allow rows with the active predicate in restricted SQL. Local full internal/chatbi and internal/authorizedexecute short tests passed (447 s / 75 s); bilingual documentation parity passed. Evidence: D:\CodexLS\outputs\agentsql-v450\v1.10.3-row-rule-real-postgres-20261031.md. A clean binary rebuilt from exact head 292b0818 passed the same isolated real-PostgreSQL API probe (REAL_ROW_RULE_ACCEPTANCE=PASS); its gateway audit recorded baseline 2 rows (744), east-only 1 row (753), and west-only 1 row (762). Later preview responses used cache and are not counted as fresh gateway executions. Exact-head CI for 292b0818: https://github.com/cuipengdba/agentsql/actions/runs/41131271211 (all four jobs passed). Original v1.10.3 page, ordinary users, history, MCP/embed, revocation races and full row/column coverage remain open. No formal release.

The unchanged official v1.10.3 frontend from image digest sha256:ff9012a95e6ac0e7921aa74e96c73de33550af61615fe850edb27b322c342288 (entry asset ^Gssets/index-WTi-KCXX.js) selected the local PostgreSQL sales table, built egion = east, selected a temporary ordinary member and saved an enabled rule with HTTP 200. The original page sent decimal-string IDs and requested the bounded 1,000-member first page; commit 1b35217 handles those shapes while rejecting malformed or oversized requests. The ordinary member had no independent datasource binding, so its preview returned 404 with zero rows; rule and user cleanup both returned 200. Focused Go tests passed for string-ID negatives, page bounds, and ordinary-user row rewriting when an independent binding exists. Evidence: D:\CodexLS\outputs\agentsql-v450\v1.10.3-original-row-page-20261031.md. Exact-head CI passed all four jobs. Shared-datasource access, full original-page question flow, MCP/embed, zero-change business cutover and signed offline release remain open; no formal v4.4.0/v4.5.0 release.

Original v1.10.3 ordinary-user row-rule and revocation (2026-10-31)

The unchanged official SQLBot v1.10.3 Permission Config page saved an enabled region = east rule (HTTP 200) for an ordinary member with a separate, query-only AgentSQL identity, SQLBot gateway mapping and encrypted datasource binding. The member's preview through the candidate and local PostgreSQL 16 returned only east (HTTP 200, one row); deleting the rule restored east/west (two rows). Gateway audit IDs 976/991 recorded the unfiltered two-row query and filtered one-row SQL. Disabling that member's own gateway mapping made a new preview fail closed (HTTP 403, zero rows) without a new gateway query audit; restoring it restored access. This is a single-table acceptance in isolated copied stores; the original SQLBot workspace-wide datasource listing differs from AgentSQL's per-user bindings. Shared-source migration, full Q&A/MCP/embed, unchanged business-system cutover and signed offline delivery remain open. Evidence: D:\CodexLS\outputs\agentsql-v450\v1.10.3-original-row-rule-ordinary-realpg-20261031.md. Commit 68d2c138 records bilingual documentation; previous exact-head CI passed all four jobs. Superseded CI was cancelled after a newer head was pushed. The PR remains a draft; no formal v4.4.0/v4.5.0 release.

Original v1.10.3 ordinary Q&A page and admission fix (2026-10-31)

An independently mapped ordinary member used the unchanged official v1.10.3 Permission Config page to save region = east, then the unchanged Q&A page to start a chat and ask local real Qwen about one PostgreSQL sales table. chat/question and the page's automatic record-data request returned HTTP 200; the record-data response and original canvas table showed only east/10. The rule was removed after the test. A separate historical two-row record returned 403 without rows on both chat-detail and record-data routes after the member's gateway mapping was disabled; a new chat start also returned 403 without a gateway query.

The isolated concurrency limit of two exposed a transient 429 while the original page loaded history. Commit e359a02f reserves one query slot from historical reads when the configured limit is at least two. A focused admission test and the full local ChatBI short suite (388.578 s) passed; a rebuilt candidate at the same limit of two passed the original page flow. The page evidence, screenshot, negative and retest notes are in D:\CodexLS\outputs\agentsql-v450\v1.10.3-original-row-rule-ordinary-realpg-20261031.md. Previous exact-head CI passed all four jobs. Exact-head CI passed all four jobs, including Go short tests and native offline installation/rollback verification. This remains one PostgreSQL table and member; shared datasource migration, complete API/MCP/embed and zero-change business cutover, and signed offline delivery remain release blockers. PR #90 remains draft.

Current official route-shape audit (2026-10-31)

The pinned official SQLBot Community v1.10.3 image exposes 130 method/path pairs in the same isolated configuration. The candidate explicitly registers 123 exact normalized shapes. Six remaining shapes have constrained/dynamic dispatch: recent questions, two semantic enable routes, record analysis/predict, default-model switch, and workspace mapping. Those still need behavioral and negative comparison. POST /api/v1/mcp/mcp_assistant is absent. The original route accepts an arbitrary client-supplied third-party datasource-catalog HTTP URL and credential without an AgentSQL user token; reproducing it directly would create an unauthenticated outbound-request path. A server-pinned destination and trusted caller identity are required before a compatible implementation can be accepted. Evidence and current script: D:\CodexLS\outputs\agentsql-v450\v1.10.3-current-route-shape-20261031.md. Route shape alone is not function parity.

Source-verified third-party datasource assistant contract (2026-10-31)

The official v1.10.3 mcp_assistant request uses an HTTP datasource-catalog URL, not an MCP transport URL. Its anonymous virtual user and client-supplied header/cookie/query credentials cannot be copied safely. Commit 883b157 documents the server-registered endpoint, revocable caller and existing controlled binding contract plus original-client success and negative acceptance matrix in both languages. The route remains absent and is a release blocker; the document is design evidence, not functional acceptance.

Original v1.10.3 mcp_assistant runtime gate (2026-10-31)

Two correctly typed unauthenticated synthetic requests to the pinned official v1.10.3 image (stream false and true) both returned HTTP 500 before catalog fetch: BaseUserDTO requires name, but the original route omits it. A malformed request returned 422. The candidate route is still absent. We will not present an original success baseline or copy the 500 as functionality; real business-client behavior and the safe mapped catalog contract remain release gates. Bilingual evidence is committed at f96b1e9, with local raw evidence under D:/CodexLS/outputs/agentsql-v450/v1.10.3-original-mcp-assistant-20261031.md.

Scoped third-party catalog registration (2026-10-31)

Commits af47f7d and 0d0f97d add the original mcp_assistant request parser and an operator-only private assistant_catalogs registration. An HMAC lookup binds the exact endpoint and credential array to a live nonadministrator and explicit external-to-owned-datasource IDs; raw authorization is not persisted in the encrypted store or audit. HTTP endpoints require explicit allow_http. Focused Go tests pass for original request shape, wrong credentials and endpoint, missing or revoked binding, deactivated caller, disabled registration, and audit-write rollback. This is a foundation only: no HTTP route, outbound catalog fetch, egress policy, original business-client success, or controlled Q&A is implemented or claimed. Exact-head CI is running for 0d0f97d; prior parser-only head af47f7d passed all four jobs. The PR stays draft.

Pinned catalog metadata fetch (2026-10-31)

Commit 1c1649f adds an internal fetch for operator-approved CIDRs. It pins an approved DNS IP for the request, bypasses proxies, refuses redirects, bounds time/header/body, discards database connection fields, and rechecks the mapped caller after the network response. Synthetic local HTTP tests pass for header/cookie/query credential forwarding, mixed approved/unapproved DNS answers, redirects, oversized or unmapped responses, and deactivation during the response. Prior parser-only exact-head CI passed; CI on 1c1649f6 is pending. No mcp_assistant HTTP route, controlled Q&A, real catalog/TLS or unchanged business-client success is claimed; PR remains draft.

Constrained single-source mcp_assistant route (2026-10-31)

Commit 72e33ee9 exposes POST /api/v1/mcp/mcp_assistant only for an operator-registered exact catalog URL and credential mapped to a live nonadministrator and that user's existing controlled datasource binding. The route refuses additional Authorization headers, multiple catalog sources and unmapped IDs. It records a catalog-access audit before model/database work, rechecks registration and live identity around the catalog fetch and Q&A, and releases JSON or Markdown over text/event-stream only after the controlled gateway query and durable result audit. Focused synthetic Go tests pass for one-source JSON and SSE, wrong credentials, registration revocation during model work, multiple-source denial and catalog-audit failure; the last three do not reach the gateway. Bilingual documentation parity passes. Exact-head CI is pending.

The official v1.10.3 original mcp_assistant returns HTTP 500 before catalog fetch because its virtual user lacks the required name; no successful original response baseline exists. Candidate stream output is emitted after completion and is not yet verified against an unchanged business client. Real catalog/TLS, local real model and PostgreSQL for this route, multi-source behavior, full page/API/MCP/embed parity, zero-change cutover, and signed offline v4.5 assets remain open. Both PRs remain drafts. No formal v4.4.0/v4.5.0 release or public Demo update is claimed.

Approved catalog HTTPS certificate pin (2026-10-31)

Commit 69286f21 requires an operator-registered leaf-certificate SHA-256 fingerprint for every HTTPS assistant catalog. The outbound client keeps normal certificate-chain and hostname verification, then compares the approved fingerprint during the TLS handshake. HTTP catalogs still require explicit allow_http and cannot carry an irrelevant TLS pin. Focused tests passed for missing/malformed pins, matching/mismatched certificate fingerprints, a synthetic local TLS catalog with a private test CA, rejection of an untrusted CA and rejection of a wrong pin before any catalog handler or query gateway work. Bilingual documentation parity passed. Exact-head CI is pending.

This remains an isolated fixture. A real business HTTPS catalog, unchanged client response behavior, local real model/database for this route, full SQLBot v1.10.3 page/API/MCP/embed parity and signed offline v4.5 delivery are still release gates. No formal v4.4.0/v4.5.0 release is claimed.

Local real Qwen/PostgreSQL mcp_assistant slice (2026-10-31)

Commit f9a746eb records a new isolated acceptance in bilingual docs. A binary built from 69286f21 used an ordinary mapped member, the local real Qwen model, the controlled gateway and PostgreSQL 16. An operator registered one exact synthetic HTTP catalog URL, its credential and CIDR, and the external ID-to-existing-binding mapping. An unchanged request body to the candidate route returned HTTP 200 JSON with SQL SELECT region, amount FROM public.sqlbot_parity_sales LIMIT 2 and east/10, west/20; the then-current stream form returned HTTP 200 and framed id/sql/sql-data/finish events. Official source inspection subsequently showed that wire shape was wrong; it has been corrected. Gateway query audit IDs 1495 and 1502 both recorded allow, two rows. The catalog's fake password did not appear in the response. Wrong credentials and disabling registration each returned 401; the gateway successful-query audit count stayed at 115, with no leaked credential. Local evidence and scripts. Exact-head CI is pending.

This is one member, one database and a synthetic catalog. The official v1.10.3 route has no successful response baseline because it returns 500 before catalog fetch. Real business catalog, unchanged business client, multi-source behavior, complete SQLBot page/API/MCP/embed parity, zero-change cutover and formal signed offline assets remain release gates. The PR stays draft; v4.4.0 and v4.5.0 have not been released.

Audited selection among mapped assistant catalog sources (2026-10-31)

Commit ebb0918b adds the official source-inspected multi-candidate flow: the local OpenAI-compatible model sees only bounded catalog IDs and names, chooses exactly one registered ID, and cannot authorize a new datasource. A management audit precedes model choice; the selected ID is mapped to the current member's existing binding and the complete catalog, registration revision and identity are rechecked before query and result release. Missing selector, ambiguous/forged ID, audit failure and registration revocation during choice fail closed. Focused Go tests map two IDs to distinct registered datasources and verify choosing 82 audits target 11; negatives execute no gateway query.

An isolated local Qwen/PostgreSQL run also returned HTTP 200 JSON and SSE for a two-entry catalog, with gateway allow audits 1510/1517 (two rows each). Wrong credentials and disabled registration returned 401 without incrementing the successful-query count (117). Both catalog IDs in that real-model slice intentionally map to the same existing binding, so distinct-datasource selection remains unaccepted. The official v1.10.3 route still returns 500 before model choice and has no successful client baseline. Local evidence. Exact-head CI is pending.

Real business catalog and unchanged business client, distinct-datasource model choice, complete SQLBot page/API/MCP/embed parity, zero-change cutover and signed offline delivery remain release gates. PR #90 remains draft; neither v4.4.0 nor v4.5.0 has a formal Release.

Commit ae9286e5 also accepts the original model's numeric JSON catalog ID form, while requiring an exact registered ID and rejecting extra fields. Focused selector/route tests passed. Latest exact-head CI is pending.

Two disjoint logical datasource scopes on real local Qwen/PostgreSQL (2026-10-31)

Commit 42e67fe7 records a stronger isolated run in bilingual docs. The same ordinary member had two separately registered AgentSQL bindings: 10 exposed only public.sqlbot_parity_sales, and 11 exposed only public.sqlbot_parity_regions. The synthetic catalog mapped Sales/81 → 10 and Regions/82 → 11; both bindings used the same existing gateway mapping and PostgreSQL 16 instance. Local real Qwen selected the appropriate source: the sales JSON question returned east/10 and west/20; the regions JSON question returned east/East Region and west/West Region. Regions SSE also completed. All three requests were HTTP 200; gateway query audits 1539/1546/1553 each recorded allow, two rows and SQL against the corresponding table. Wrong credentials and a disabled catalog registration each returned 401, with the gateway successful-query count fixed at 122. Local evidence. Latest exact-head CI is pending.

This verifies two logical datasources with disjoint table scopes, not two physical databases. A real business catalog, unchanged original business client, complete SQLBot v1.10.3 functionality/pages/API/MCP/embed, zero-change cutover and formal signed offline assets remain open. PR #90 remains draft; no v4.4.0/v4.5.0 Release or website/Demo update is claimed.

mcp_assistant stream wire correction (2026-10-31)

Commit df809484 corrects the candidate stream body. In the official SQLBot v1.10.3 image, apps/mcp/mcp.py calls question_answer_inner(..., in_chat=False, stream=chat.stream); the in_chat=False branch in apps/chat/task/llm.py writes a record ID, question, SQL fence and Markdown table with text/event-stream response type. It does not emit the data: JSON SSE frames used by the in-chat page. Previous candidate JSON SSE observations in this PR are historical evidence of execution only, not compatibility passes. The corrected candidate passes targeted Go tests and a fresh isolated local real-Qwen/controlled-PostgreSQL run for both sales and regions streams: HTTP 200, Markdown record ID/SQL/table present, JSON SSE frames absent, no catalog secret in the response. Local correction evidence. The original v1.10.3 route still returns 500 before reaching a successful stream, so source inspection is not a runtime parity baseline. Unchanged business-client acceptance, true incremental streaming, all other parity and signed offline-package gates remain open; this PR stays draft.

Nonstreaming mcp_assistant JSON metadata (2026-10-31)

Official v1.10.3 source apps/db/db.py returns Base64 SQL with fields, data and fields_info; apps/chat/task/llm.py adds the selected datasource ID before returning the stored result under data. Commit 8e2bea67 adds the previously missing data.sql and numeric data.datasource to the candidate route. A focused Go test decodes data.sql and verifies catalog ID 81. A rebuilt isolated candidate with local real Qwen and controlled PostgreSQL returned HTTP 200 for sales (data.datasource=81, east/10 and west/20) and regions (data.datasource=82, east/East Region and west/West Region). In both, decoded SQL matched the top-level SQL and no catalog secret appeared. Local evidence. The official original route still returns 500 before a successful result, so this source-derived shape is not a runtime parity baseline or unchanged business-client acceptance. Other release gates remain open; PR stays draft.

Original permission target default and unsupported-target denial (2026-10-31)

An isolated official v1.10.3 API run saved/read/deleted a synthetic row item. With no explicit target type, its expanded response returned auth_target_type="user", auth_target_id=null and white_list_user="[]". Commit 561922e1 corrects the candidate's previous null target type to "user". Explicit role targets or target IDs cannot yet be enforced, so activation rejects them. A persisted active unsupported target now closes schema and query reads before the gateway, even if its group has no user list. Focused Go tests and bilingual documentation validation pass. Original runtime and negative evidence. The unchanged original browser also exposed the column-permission dialog, but no datasource or field was configured in that fresh original instance; the screenshot is UI-shape evidence only. Complete column/role enforcement and zero-change cutover remain release gates. Exact-head CI is pending; PR remains draft.

Original v1.10.3 column-rule page and real PostgreSQL (2026-10-31)

Commit 863d124 implements a bounded column-permission slice. Active user-targeted rules resolve the original browser's decimal datasource, table and field IDs against the current controlled gateway schema. Disabled fields are removed from field discovery and rejected in projected SQL, predicates and star selections before a gateway query. Unsupported or stale rules fail closed, and a rule change during execution suppresses the result. Focused negative tests and the full ChatBI short package (414.393 seconds) passed.

The unchanged official v1.10.3 frontend saved a column rule through its Permission Config page in an isolated candidate deployment: it disabled amount for an ordinary member with an independent binding. The original-shaped field endpoint and preview against real local PostgreSQL 16 returned only id and region, with two east/west rows; the administrator retained all three fields. Deleting the rule restored the member's third field. A separate real local Qwen question under an active column rule completed with only the region column and east/west rows; controlled query audit ID 1707, with no amount value in the history result. The temporary rule was deleted. Local browser screenshot and acceptance. Bilingual docs and the translation manifest pass validation. Current exact-head CI was dispatched and is awaiting results.

A separate original-browser and real-MySQL slice is recorded below. Complete SQLBot page/API/MCP/embed parity, business-system zero-change cutover and formal signed offline assets remain open. PR #90 remains draft; v4.4.0 and v4.5.0 are not released.

Original v1.10.3 column-rule page and real MySQL (2026-10-31)

Commit 6a2fde4 records a fresh isolated acceptance from a copied control store. An ordinary member had a separate ChatBI binding, gateway user and query.execute-only role for the real local agentsql_demo.orders MySQL table. The unchanged official v1.10.3 Permission Config page selected this datasource and table, disabled amount, selected that member and saved. Its readback contained a column/user item and seven field-permission entries. The member's field list and 100-row MySQL preview both contained six fields without amount; a blocked fieldEnum returned 404. The administrator still saw all seven fields, and deleting the rule restored the member's seventh field. Original-page screenshot and isolated evidence. Bilingual docs validation passed. Current exact-head CI was dispatched and is pending.

This verifies one MySQL table's original rule page and real preview. One allowed-field Q&A case under the MySQL rule now has the original-page and real-model evidence below. Broader SQL and client matrices, complete page/API/MCP/embed parity, business-system zero-change cutover and formal signed offline assets remain release gates. PR #90 remains draft; v4.4.0 and v4.5.0 are not released.

Unchanged original v1.10.3 MySQL Q&A page under a column rule (2026-10-31)

Commit 293af2c records two isolated real-model acceptances. Under an active amount-denying column rule, a separately bound ordinary member asked for status in the local Qwen and controlled MySQL API path; the stream finished, the fresh historical result contained only status and two rows, and gateway audit ID was 1847. The unchanged official v1.10.3 Q&A browser then asked the same question under a reactivated rule and rendered only status with paid/shipped rows. Its record-data response had audit ID 1897 and no amount field. Original-browser screenshot and evidence. Each temporary rule was deleted, and all seven fields became visible again. Bilingual docs validation passed. Current exact-head CI is pending.

This is one allowed-field question on one MySQL table. Forbidden-field model prompts, other SQL shapes and databases, complete SQLBot client/page/API/MCP/embed behavior, unchanged business cutover, and signed offline delivery remain open. PR #90 stays draft; neither v4.4.0 nor v4.5.0 is formally released.

Real MySQL forbidden-column and historical-result denial (2026-10-31)

Commit 873c764 records two further negatives on the same isolated real MySQL and local Qwen setup. Asking for the disabled amount column produced only id/error stream events, no finish, and the allowed gateway-query count stayed 282. Separately, a two-row amount result generated before a rule was active had gateway audit ID 1925. With a new amount-denying column rule active, its old record-data read returned HTTP 403 without values and without a new allowed gateway query; the temporary rule was removed. Local evidence. Bilingual docs validation passed. Current exact-head CI was dispatched and is pending.

These checks cover one table and one former record. Broad query shapes, SQLBot page/API/MCP/embed parity, unchanged business-system cutover and formal signed offline assets remain open. PR #90 remains draft, and v4.4.0/v4.5.0 are not released.

2026-10-31 bounded MySQL row-permission update (628f1628): official SQLBot community v1.10.3 unchanged permission page saved a real status = paid row rule for a separately bound ordinary member on agentsql_demo.orders; the member's real MySQL preview returned 100 paid rows while an administrator retained shipped rows, and deletion restored shipped rows. Focused Go tests cover rule conjunction, OR preservation, unsupported SQL rejection before gateway access and in-flight rule changes. A local real Qwen simple projection returned only paid rows (audit 2012/2034); a request for shipped rows returned zero controlled rows. Isolated evidence and screenshot: D:\CodexLS\outputs\agentsql-v450\v1.10.3-original-mysql-row-rule-real-20261031.md. This is a narrow single-table slice; aggregation, all original rule forms, MCP/embed/export, other original Q&A paths, broader historical revocation and zero-change business cutover remain unaccepted. PR remains draft; no v4.4.0/v4.5.0 release, website or public Demo update is authorized by acceptance yet. Follow-up at 748ac33f: Linux Go 1.26.10 go test -short ./internal/chatbi ./internal/rowfilter -count=1 passed (ChatBI 420.825 s). With a paid-only rule, local real Qwen returned two paid rows (audit 2012/2034); requesting shipped returned zero rows. A pre-existing two-row shipped record (audit 2063) was re-read after tightening and returned zero recalculated rows. The unchanged original v1.10.3 Q&A page also created a new conversation and rendered two paid rows under this rule; record-data audit 2121. All disposable rules and local browser/proxy/test containers were cleaned up. Screenshots and bounded limitations are in the evidence note. This remains draft and does not establish full SQLBot compatibility or release readiness.

• MySQL row-rule compiler now preserves bounded nested OR groups from the original expression tree; the gateway parser rejects constant-true/function/subquery branches, and PostgreSQL remains fail-closed for multi-branch OR. Focused security tests, real MySQL expression check, full ChatBI short suite (481.657s), and docs parity passed. This is not original-client end-to-end OR acceptance or complete SQLBot compatibility.

• Follow-up original SQLBot v1.10.3 browser acceptance: the unchanged permission page saved and reloaded a root-level paid OR shipped rule for one ordinary member. Real MySQL preview exposed only those statuses to that member; the administrator still saw pending/cancelled. An isolated original-shaped API nested OR/AND rule produced paid-only preview, forged-field save returned 422, and both temporary rules were deleted. Evidence: D:\CodexLS\outputs\agentsql-v450\v1.10.3-original-mysql-or-rule-20261031.md. Nested OR in the original page and other client paths remain open.

• Under the isolated nested MySQL rule, local real Qwen returned two paid rows (gateway audit 2256); an explicit shipped question returned zero rows. A pre-rule shipped result (audit 2284) was re-read after activation with zero rows, without replaying old values. Both rules were removed. Evidence and limits: D:\CodexLS\outputs\agentsql-v450\v1.10.3-original-mysql-or-rule-20261031.md. This does not accept original-page nested editing or MCP/embed behavior.

• The unchanged original v1.10.3 permission page also saved and reloaded a nested AND(OR(paid,shipped),paid) rule for one member. Compatibility API readback matched; real MySQL preview returned only paid to the member and all four statuses to the administrator. Temporary rule deleted. Screenshot and script: D:\CodexLS\outputs\agentsql-v450\v1.10.3-original-mysql-or-rule-20261031.md. Original Q&A page, MCP/embed and unchanged cutover remain open.

• Original SQLBot v1.10.3 Q&A page completed one real local Qwen question under nested MySQL AND/OR row rule. The original table and controlled record both showed two paid rows; gateway audit 2456. Temporary rule deleted. Evidence: D:\CodexLS\outputs\agentsql-v450\v1.10.3-original-mysql-or-rule-20261031.md. This accepts one narrow flow; MCP/embed, full compatibility and release gates remain open.

• Controlled third-party assistant route exercised against isolated real MySQL and local Qwen: JSON and Markdown transport returned real rows; wrong credential and URL failed 401; a nested member row rule returned paid-only rows; disabling the catalog bridge revoked the old credential. This is one test catalog and one member, not unchanged business-client or full SQLBot parity. Evidence: D:\CodexLS\outputs\agentsql-v450\v1.10.3-mcp-assistant-real-mysql-20261031.md.

• Read-only gateway audit follow-up: isolated assistant requests produced allowed MySQL audit events 2471 and 2486, both returned two rows and are present in the audit stream; event 2486 executed SQL with the nested AND/OR member row rule. Evidence note updated. Other failure and real-business paths remain open. - Candidate 99b4a276 resolves original value_type=variable row conditions from the current member binding with fail-closed definition/user snapshot checks. The unchanged official v1.10.3 permission page saved one custom-text-variable equality rule; real MySQL preview changed from paid-only to shipped-only after rebinding. On rebuilt candidate code, local real Qwen returned two paid rows (gateway audit 2535), an old result tightened to zero after rebinding, and a new question returned two shipped rows (audit 2558). Temporary rule, variable and binding were cleaned and verified. Focused Linux Go tests and docs parity passed; exact-head CI for f2c30313 is running. Evidence: D:\CodexLS\outputs\agentsql-v450\v1.10.3-original-variable-row-real-mysql-20261031.md. This is one MySQL equality slice, not complete SQLBot compatibility or zero-change business cutover. - Follow-up 16e5d205: SQLBot v1.10.3 custom-text-variable IN/NOT IN now resolves all current bound values in the controlled MySQL single-table path. The unchanged original permission page saved and reopened both operators. Real MySQL member previews contained only paid/shipped for IN and only cancelled/pending for NOT IN, 100 rows each. Removing the user binding while the rule was active made preview return 403. Temporary objects were removed and original bindings verified restored. Focused Go parser/rowfilter/ChatBI tests and bilingual-doc parity passed; exact-head CI is running. Evidence: D:\CodexLS\outputs\agentsql-v450\v1.10.3-original-variable-membership-mysql-20261031.md. Other operators, PostgreSQL multi-value IN, MCP/embed and unchanged cutover remain open. - The exact-head CI for 16e5d205 passed all four jobs. The candidate now also compiles PostgreSQL multi-value variable membership into bounded equality OR / inequality AND predicates; focused ChatBI and row-filter tests passed, including closed-parser acceptance, original-query OR containment, constant-true and subquery rejection, and escaped injection-shaped values. This remains a source/parser slice: the unchanged original client, real PostgreSQL gateway, MCP, embedding and business cutover are not yet accepted. Candidate head bfc12a9f has a five-job CI run in progress. The v4.4.0 parent now includes PG16 amd64 Debian package and derived-image runtime acceptance plus external-key trust tests; its final signed matrix remains open. ### PostgreSQL multi-value rule and v1.10.3 contract refresh (2026-10-31) The current official SQLBot community release remains v1.10.3. Commit 7cab4af7 adds a separate pinned v1.10.3 static route inventory; v1.10.2 and v1.10.3 each contain 144 source-level method/path entries, with no additions or removals in this limited inventory. That count is not a compatibility percentage. Commit d54c97ae updates three stale Go assertions after bounded PostgreSQL OR support while continuing to reject constant-true row rules. Exact-head five-job CI run: https://github.com/cuipengdba/agentsql/actions/runs/41176617865. An isolated real PostgreSQL fixture now passed ordinary-member API checks for two-value variable IN and NOT IN, forged-field rejection, rule revocation, and fail-closed missing variable binding. The disposable gateway identity and copied ChatBI database were restored and verified after the check. Evidence: D:\CodexLS\outputs\agentsql-v450\real-postgres-variable-row-20261031.md. This check used SQLBot-compatible API bodies; the unchanged v1.10.3 browser page and original-client MCP/embed/other paths have not been accepted for this PostgreSQL slice. The full compatibility, business cutover and signed offline release gates remain open; PR v4.5.0: SQLBot page parity scope and Apache-only positioning (draft) #90 stays draft. ### Original v1.10.3 PostgreSQL permission-page follow-up (2026-10-31) The unchanged official v1.10.3 Permission Config page created and reopened a PostgreSQL region variable IN rule for a disposable ordinary user, then edited, saved and reopened it as NOT IN. Compatible API readback matched both operators, the current variable ID, datasource and selected member. The temporary rule, variable and user were removed and verified absent. Screenshots and exact limits: D:\CodexLS\outputs\agentsql-v450\real-postgres-variable-row-20261031.md. The separate real PostgreSQL API enforcement check covered IN, NOT IN, forged field and missing binding; unchanged original-browser member execution remains a separate gate. Exact-head CI run 41176617865 passed all five jobs. PR v4.5.0: SQLBot page parity scope and Apache-only positioning (draft) #90 remains draft pending full parity, zero-change business-client evidence and final signed offline assets. ### Original v1.10.3 ordinary-member PostgreSQL Q&A under variable membership (2026-10-31) In an isolated copied control store, the unchanged official browser logged in as a disposable ordinary member. With a two-value text variable and region IN variable, local real Qwen Q&A rendered only east; record-data audit 1175 matched the gateway's one-row allow audit and equality-OR PostgreSQL predicate. After changing the rule to NOT IN, a reread of that same historical record and the original browser showed only west; fresh audit IDs 1194 and 1209 matched one-row allow audits and inequality-AND predicates. The temporary member, rule, variable and gateway mapping were removed and copied store restored. Evidence: D:\CodexLS\outputs\agentsql-v450\real-postgres-variable-row-20261031.md. This is one table, one member and one real-model question. Full original API/MCP/embed matrix, business-system zero-change cutover and signed offline release assets remain open. PR remains draft; v4.4.0 and v4.5.0 are not released. ### Offline PostgreSQL prerequisite gate (2026-10-31) Candidate 40cd82a5 adds opt-in --require-postgres-binder and --runtime-role to the offline installer. The 15 signed application assets are verified first; then a private copy of the pinned-hash, read-only PostgreSQL preflight checks the actual server and runtime-reader privileges before install.sh. A disconnected test bundle assembled from formal v4.3.0 assets passed a PostgreSQL 16 ordinary-reader preflight and --no-start installation. With native prepare(text,text) execution revoked in a separate container, installation failed with FUNCTION_EXECUTE_MISSING and left no application binary or Q&A store. Missing PGDATABASE and tampered preflight bytes were also rejected. Bilingual docs parity passed. Evidence: D:\CodexLS\outputs\agentsql-v450\offline-postgres-preflight-20261031.md. This does not install the binder on a remote database host or authenticate the archive's unsigned top-level installer. Formal v4.5.0 signed assets, outer archive trust, dual-arch startup, upgrade/rollback, full SQLBot parity and unchanged business cutover remain open. Exact-head CI: https://github.com/cuipengdba/agentsql/actions/runs/41181969331 (pending). PR stays draft; no release or website/Demo update yet. ### Outer offline transport signature verification (2026-10-31) Candidate 0b265506 adds scripts/verify-offline-archive.py, a separate pre-extraction verifier for the complete offline .tar.gz and its detached Ed25519 signature JSON. The existing production scripts/releasesign signer can sign the archive after assembly; recipients must obtain the verifier and trusted public key independently before running any script from the archive. A one-time DEV TEST ONLY key signed the approximately 193 MB v4.3.0-asset test archive, and the verifier accepted it. Changed test bytes and a wrong public key were rejected. Three OpenSSL-backed negative/positive cases passed offline and are now a CI gate. Evidence: D:\CodexLS\outputs\agentsql-v450\offline-postgres-preflight-20261031.md. No production v4.5.0 archive or outer signature exists yet; this does not close formal signing, download, service-start, rollback, compatibility or unchanged business cutover gates. Exact-head CI: https://github.com/cuipengdba/agentsql/actions/runs/41182617581 (pending). PR remains draft. ### Active model selection on draft head 34ef299 The active global catalog now supports the original chat and MCP custom_model field for the global default or an explicitly mapped model in the caller's workspace. A model lease rechecks activation, mapping, revision and encrypted-body digest through generation, the controlled query and result return. Embedded assistant questions derive their configured custom model from the current application revision and reject a client override. Multi-source MCP assistant selection also rechecks the global model lease. The native model page has a bilingual workspace-mapping selector visible only after catalog activation. Focused Go tests cover mapped selection, cross-workspace and unmapped denial, mapping revocation during generation, embedded override denial and MCP selector key rotation. The full local go test ./internal/chatbi -count=1 passed on this head. CI run 41222067852 is in progress. The browser mapping selector has only been exercised against mocked APIs. Formal catalog activation, real-backend browser and original-client acceptance, the remaining API/MCP/embed parity, signed offline bundle and zero-change business-system cutover remain open. This PR stays draft; no v4.5.0 Release or public Demo update is claimed. ### Internal model-catalog cutover on draft head 61eb993 The new ActivateModelCatalogMigration transaction verifies the staged source digest against a fresh legacy snapshot, validates every staged model and mapping, requires a current administrator, and writes the active marker with its management audit. Legacy model writes and restaging reject an active catalog. Focused tests pass for the chosen global default, old lease revocation, mapped model selection, wrong digest, non-admin access, changed source or staged target, and audit rollback. This is an internal transaction only; it has no public management route or production cutover. Formal upgrade and rollback rehearsal, original-client comparison, and the remaining release gates are still open. Exact-head CI run 41223192194 is in progress. ### Isolated Go HTTP and browser cutover on draft head dd202ac Administrator-only preflight, stage and activate routes now drive the audited catalog cutover. A temporary synthetic Go HTTP handler served the native Web UI to a real browser. Before activation the mapping controls were hidden. The administrator activated a staged one-model catalog through the real HTTP routes; after reload, the browser saved a second workspace mapping through PUT /api/v1/system/aimodel/20/ws_mapping (HTTP 200), switched to English, and confirmed both mappings survived a full page reload. Browser console had no JavaScript errors. Local screenshot and limited evidence: D:\CodexLS\outputs\agentsql-v450\model-catalog-live-browser-20261101.md. The temporary fixture and container were removed after the check. This is synthetic control-store evidence, not a production upgrade, original SQLBot client comparison, real-model acceptance or zero-change cutover. PR remains draft. Exact-head CI run 41224256202 passed all five jobs on dd202ac: web, docs/integrations, Go, native binder package smoke, and govulncheck.

Isolated v4.4 store migration rehearsal (2026-11-01)

On exact candidate head dd202ac1, a SQLite online backup of the running v4.4 PostgreSQL remarks fixture was served by the v4.5 binary on a separate Docker port. Admin HTTP preflight and stage succeeded; a wrong source digest returned 409, the correct activation returned 200, and the one model ID and one mapping survived. After service restart, the active catalog and model remained; restage and repeated activation returned 409. The source fixture was untouched. Evidence: D:\CodexLS\outputs\agentsql-v450\model-catalog-v440-copy-upgrade-20261101.md. A second isolated copy also passed one post-cutover question through the configured local Qwen model and real PostgreSQL gateway: the streamed original chat API completed with two rows and a nonempty gateway audit ID in the stored record. This remains a local fixture slice; installed-package upgrade and rollback, original-client parity, zero-change business cutover, signed offline assets, and release acceptance remain open.

Unchanged v1.10.3 model-mapping page after cutover (2026-11-01)

The official v1.10.3 static frontend, served unchanged through an isolated same-origin test proxy, logged into an exact-head dd202ac1 binary backed by a copied v4.4 control store after catalog activation. Its AI model page displayed the migrated local Qwen model. The original Workspace page created Migration QA; original model controls added and removed that workspace with POST/DELETE mapping requests returning 200. The dialog showed two mappings after add and only the original mapping after removal and a full browser reload. A forged workspace ID returned 404 without changing the mapping; anonymous mapping read returned 401. Browser console errors/warnings: zero. Evidence and screenshots: D:\CodexLS\outputs\agentsql-v450\v1.10.3-original-model-mapping-after-cutover-20261101.md. This is one original-client workflow, not full parity or release acceptance.

Exact-head CI run 41227221127 passed all five jobs on the updated documentation commit 0ef0a6e4.

Native bilingual data-permission page candidate (2026-11-01)

Commit da62d52b adds an administrator-only AgentSQL Web page for current-workspace members, permitted PostgreSQL/MySQL sources, rule groups, a single ordinary-value row condition, and column visibility. The original-compatible API and live server-side schema checks remain authoritative. An isolated browser run against a real local PostgreSQL gateway saved and read back region=east and a hidden amount column with their target member, switched the page to English, removed both rules, and verified that an ordinary member saw no management navigation and received HTTP 401 from the management API. No browser errors. Focused offline Go test, Node syntax checks, docs i18n validation, and git diff --check passed. Evidence: D:\CodexLS\outputs\agentsql-v450\native-permission-browser-20261101.log and the adjacent two English screenshots. The browser run did not assert member query enforcement; nested conditions, variable authoring, installed-package upgrade/rollback, original-client breadth, unchanged business-system cutover, and signed assets remain open. Exact-head CI run 41233163350 passed all five jobs on this commit.

Unbound-member negative check after native permission save

The same isolated browser flow was rerun against a clean copy at head 94427f44: a newly created current-workspace member, deliberately given no personal datasource binding, was targeted by an enabled row rule. Real PostgreSQL preview still returned HTTP 404 with zero rows; the rule did not grant source access. The row/column save, readback, English reload, deletion and non-admin management denial checks also passed with zero browser errors. Evidence: D:\CodexLS\outputs\agentsql-v450\native-permission-member-enforcement-20261101.log. This is a negative check, not proof of row/column enforcement for a bound member. CI run 41234723754 was superseded by the subsequent candidate commit; exact-head CI for 9590fdad is run 41235134607 and passed all five jobs.

One-command signed offline transport candidate

Commit 9590fdad extends the independently obtained verify-offline-archive.py with --install: it authenticates a private copy of the outer archive, safely extracts it, and only then invokes the authenticated inner installer with the separately supplied release key. --action upgrade, --no-start, and PostgreSQL binder preflight options are forwarded. Eleven disconnected Python/OpenSSL unit cases passed, including verified installer execution, tamper rejection before execution, signed symlink rejection, wrong key and unsafe extraction. Bilingual candidate instructions and the translation manifest were updated; docs parity passed. The currently available full v4.3.0 rehearsal archive has a DEV-ONLY outer signature while its inner assets use the formal release key, so it cannot establish a same-key end-to-end installation for this path. Formal v4.5.0 signed assets, real disconnected install/upgrade/rollback, and database extension provisioning remain open.

Full 193 MB DEV ONLY outer-signature rehearsal rejected the mismatched inner release key before application installation; this negative result and the 11-test record are in D:\CodexLS\outputs\agentsql-v450\one-command-offline-verifier-20261101.md.

Native data-permission expression editor (2026-11-01)

Commit f120c7e adds saved-item editing, condition summaries, nested AND/OR authoring, and system-variable selection to the bilingual AgentSQL permission page. A real local PostgreSQL browser flow saved and reopened enabled AND(region=east, AND(amount>0)), read back the complete expression through the API, saved/read/deleted a hidden-column rule, and kept a disabled OR/variable draft closed when activation failed for a member without a variable binding. Ordinary-member management denial and zero browser errors passed. Evidence: D:\CodexLS\outputs\agentsql-v450\native-expression-browser-20261101.log and native-expression-row-en-20261101.png. Focused offline Go, Node syntax, and bilingual docs checks passed. This does not prove actual queries for a bound member, all original SQLBot page flows, business cutover, or full release parity. Exact-head CI: https://github.com/cuipengdba/agentsql/actions/runs/41238905652.
Follow-up 8b493acc clears stale datasource, table, field and expression controls when switching between rule groups, and resets an invalid saved expression before item editing. The isolated browser flow was rerun against the rebuilt exact-head binary and passed nested rule save/readback, column rule round trip, denied OR/variable activation and ordinary-member management denial with zero browser errors. Exact-head CI: https://github.com/cuipengdba/agentsql/actions/runs/41239570373.
The v4.4.0 original-client relation evidence commit d9f093f5 was merged into the v4.5.0 candidate as 2dd07afc; the translation-manifest conflict was resolved by retaining v4.5 entries and the new v4.4 source hash. Bilingual docs parity passed locally. Prior exact-head 8b493acc CI run 41239570373 passed all five jobs; new merge-head CI: https://github.com/cuipengdba/agentsql/actions/runs/41240703485. Neither passing run by itself closes the broader release gates.
The v4.4.0 native-login relation evidence commit d2060e1a is included in merge head 2c54a1c0. Manifest resolution retained the v4.5 entries and recomputed the v4.4 source hash; local docs parity passed. New exact-head CI: https://github.com/cuipengdba/agentsql/actions/runs/41241024357.
The v4.4.0 original-member relation-denial evidence a67a94a6 is included in v4.5.0 merge head 10446beb. The translation manifest retains the v4.5 documents and the new v4.4 hash; local bilingual docs validation passed. New exact-head CI: https://github.com/cuipengdba/agentsql/actions/runs/41241773128.

Offline upgrade flag (2026-11-01)

Commit 33a689fb passes explicit --external-backup-done through the signed offline transport and inner installer to install.sh for upgrade of an externally backed database. The option is rejected for first install or verification-only use. Twelve detached-signature tests and bilingual docs checks passed. Disconnected disposable amd64 containers used the formal v4.2.0 archive and verified v4.3.0 offline assets with the candidate inner script: without the option the missing default database correctly blocked upgrade; with the option a --no-start upgrade succeeded. This proves local option propagation, not an external PostgreSQL backup, service startup, rollback, dual architecture or formal v4.5.0 signing. Evidence: D:\CodexLS\outputs\agentsql-v450\offline-external-upgrade-flag-20261101.md.

Legacy XLS datasource upload slice (2026-11-01)

Commit 0d69fecd adds bounded BIFF XLS datasource import, preserves the .xls staged-file extension and derives the scoped gateway identity. It uses pinned github.com/b0r1ssh/go-xls v1.1.6 and adds read, decoded-text, row, field and sheet limits. Real synthetic ASCII and Chinese XLS files, mislabeled/corrupt bytes, a cyclic OLE sector chain, the managed upload/plan route and derived identity passed focused ChatBI/Bootstrap Go tests inside a --network none Linux container with the source mounted read-only. The tested isolated branch and PR head have the same Git tree. Local evidence: D:\CodexLS\outputs\agentsql-v450\xls-datasource-import-c7b55eb2-20261101.md.

The original SQLBot v1.10.3 datasource form advertises XLS/XLSX/CSV up to 50 MB; this candidate still enforces 4 MiB, 1000 rows and 32 fields. The unchanged original upload page, real database import and 50 MB parity remain unaccepted. Exact-head CI passed all five jobs. The 0d69fecd Rocky8 dual-architecture packages and 15 unsigned asset checks passed, and an independent -ValidateOnly returned 15 PASS; the OCI image phase was cancelled when the next XLS user-import commit became ready. A local datasource upload against an older copied gateway returned 403 for both XLS and CSV, with gateway identity 401 and audit disk-I/O errors; that fixture cannot establish XLS success or an XLS-specific regression. Partial release evidence and XLS import evidence retain the limits. These are not formal signed assets or final-head release proof.

Legacy XLS user batch API (2026-11-01)

Commit 9f91f93d accepts bounded BIFF XLS in /api/v1/user/batchImport through the existing parser. The synthetic original-shaped Go route test verifies ordinary-user denial, corrupt and truncated input denial, one member creation and login, and rejection of an administrator row; the previous XLSX user-import and XLS parser tests also pass. The isolated commit and PR head have identical Git trees. A separate Linux v4.5.0 candidate binary imported a real synthetic XLS through HTTP, logged in the created member, found it via the legacy pager and deleted it; management audits rose by two. Local candidate and original-runtime evidence.

The isolated official SQLBot Community v1.10.3 API accepted a Chinese-template XLS member (successCount=1) and the synthetic account was removed afterward. Its dormant UserImport.vue component accepts XLS/XLSX, but the opening button and handler are commented out in User.vue; no unchanged original browser path exists to claim for this operation. The original English-template API returned HTTP 500 on a pandas header accessor; AgentSQL does not copy that error. Candidate user import remains limited to 4 MiB and 1000 rows versus the original frontend's 10 MB limit. Full API/error parity remains open; actual business cutover follows this release. Exact-head CI is running. Final-head signed offline assets, the original-client/API/MCP/embed matrix, security-negative acceptance and public deployment remain release gates. Actual business-system cutover is excluded from the v4.5.0 gate. PR remains draft; there is no formal v4.5.0 release.

Exact-head MCP login validation differential (2026-11-02)

Commit f456c5bd was built as a fresh Linux candidate and compared with the isolated official SQLBot Community v1.10.3 API. Nine malformed /api/v1/mcp/access_token requests matched HTTP statuses and validation type/loc/msg fields 9/9. AgentSQL intentionally omits the original input field because it can echo submitted passwords. This is one endpoint's negative-input slice; valid login, full API/MCP/page parity and final release gates remain open. Local evidence: D:\CodexLS\outputs\agentsql-v450\mcp-access-token-f456-v1103-20261102.md.

Authenticated SQLBot read-route differential (2026-11-02)

The unchanged official v1.10.3 API and a fresh f456c5bd candidate each accepted isolated administrator login. A non-mutating matrix of 27 authenticated GET routes matched HTTP status on 18; remaining differences include original 500 responses for missing IDs, other error-shape differences, and GET /api/v1/user/info omitting system_variables in AgentSQL. Raw status/shape matrix: D:\CodexLS\outputs\agentsql-v450\authenticated-get-matrix-f456-v1103-20261102.json. Commit 79fee87c adds only current-workspace variable assignments to that response. A focused Go test confirms the field and that the old user token is revoked by an assignment update; the 79fee87c exact-head Linux runtime recheck now returns system_variables on /api/v1/user/info; the candidate additionally includes create_time. This matrix does not assert feature parity for these routes.

Additional release gate: original retrieval settings (2026-11-02)

Authenticated fixed-v1.10.3 /api/v1/system/parameter returned 18 keys; current AgentSQL returned 9. Ten upstream embedding.* settings for terminology, training examples and table retrieval are absent. Implementing only response placeholders would not meet the product requirement; save/read/restart and actual retrieval behavior with original-browser and local real-model tests remain open. Evidence: D:\CodexLS\outputs\agentsql-v450\parameter-gap-v1103-20261102.md. Commit 9235bef3 separately aligns the missing oid query error on the workspace member-candidate pager with the original 422 response.

Exact-runtime query validation recheck (2026-11-02)

The e794b265 Linux candidate and official SQLBot Community v1.10.3 both returned HTTP 422 with the same detail type, location and message when oid was absent from /api/v1/system/workspace/uws/option/pager/1/10 and keyword was absent from /api/v1/system/workspace/uws/option. JSON key order differs only. Focused Go tests and exact-runtime log: D:\CodexLS\outputs\agentsql-v450\required-query-e794-v1103-20261102.log. This covers two missing-parameter branches, not the full member-management contract.