feat(控制台): Console v2 P3 产物栏与 P2 fail-closed 收口

[Dandre126]

Console v2 P3 overlay artifact rail on the existing workspace-detail page (channel/event panes, not a fourth tab). Version stays 0.7.7. Also folds leftover P2 fail-closed items from #47.

What this does

Authority is overlay, not product git and not the Proof store:

• .dyro/families/<parent>/artifacts.jsonl
• .dyro/families/<parent>/artifacts/<artifact-id>

Allowed types: review (JSON card), image (same-origin bearer fetch → blob: URL), chart (image bytes or on-page SVG points), video (card + copyable --dry-run open command; no <video>, no media-src).

HTTP is GET only:

• GET /api/v1/workspaces/{alias}/families/{parent}/artifacts
• GET /api/v1/workspaces/{alias}/families/{parent}/artifacts/{id}

ADR 0005 still holds: the only browser write is POST .../families/{parent}/channel (decision|contract|ack). Artifact endpoints do not write. Inspection worker stays read-only (no post_channel, no artifact mutation). Image path is jailed (no symlink, no .., size cap). List/get never scan outputs/images/, harness home, or sidecar generator dirs.

meta.surfaces / capabilities gain artifacts. Overview polling still does not fetch artifacts. Channel rows of kind artifact use facts.artifact_id; missing/unknown ids fail-closed (「产物不可用」, no fake preview).

No new top-level CLI. Attach via line post --kind artifact plus overlay files (plant_family_artifact helper for tests). No dyro artifact upload.

Page assets still fail closed on the existing static scan: no http:// / https:// / --yes / --push literals in app.js. SVG namespace and video-command guards are assembled at runtime. Manifest digest/size updated.

Leftover P2 fail-closed (same PR)

1. family_unacked / unread_by_member no longer swallow CHANNEL_LOG_INCONSISTENT as unread 0; the broken family is surfaced (unread is not repair_required).
2. retracted_message_ids / channel_at pair-check channel.jsonl like the other readers.
3. HTTP ack runs the URL-family check before the write.
4. Page channel dedupe key is (family, id), not bare id.
5. Grandchild-off-grandparent is pinned by (family, id) even when F(core) is empty.

Follow-up from adversarial review of c626bf8

Planted artifacts.jsonl titles that look like a path, URL, or credential are blanked on read (_decode_artifact and project_artifact use the same reject list as _artifact_title). Artifact ids reject a .. substring, so hand-listed foo..bar is not listed. Generic planted-row pins in tests/test_families.py.

Non-goals (unchanged)

Page still cannot merge / push / --yes / change Task status. No media stream. No third-party chart library. No version bump. No line-merge --push --dry-run expansion.

Tests

Focused pins plus ruff on edited Python: overlay list/get, path jail, video card-only, missing artifact_id, no sidecar scan, Host/bearer, worker mutation reject, the five P2 leftovers, colliding msg_1 family-scoping, planted path title blanked, foo..bar id rejected, asset digest/manifest, and version 0.7.7.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dyro	Error		Aug 20, 2026 7:10pm
dyro-engineering-flow	Error		Aug 20, 2026 7:10pm