trade-message-center/.trellis/tasks/09-07-onetalk-summary-internal-network/implement.md

Center 摘要内部网络入口实施计划

Preconditions

• Preserve the current dirty working tree. The existing summary-authorization diff is task-relevant input; make targeted replacements only and do not reset, checkout, or discard unrelated user work.
• Before changing any symbol, run GitNexus upstream impact for loadConfig, createApp, startServer, and installOneTalkReadRoutes. Report any HIGH/CRITICAL result before editing.
• Before code edits, load trellis-before-dev and the project/server specs it routes to; it must cover config/default handling, HTTP errors, module ownership, service foundation, and quality checks.

Implementation order

1. Replace the shared summary-authorization contract with a server-local summary-read purpose owned by the read model/service boundary. Remove its package export and all token/callback/credential modules and dependencies.
2. Simplify loadConfig and environment examples: remove the summary token configuration and validation, retain generic Mind authorization, and define the fixed internal listener contract without creating an environment-configurable fallback port.
3. Extract a runtime composition seam that owns one database/read-service/cutover-policy instance and can start/close both Fastify apps in deterministic order. Keep createApp compatible with existing direct tests and its existing database close behavior.
4. Make the public read-route installer use only the Cookie/Mind page authorization path; remove summary header/Bearer selection, summary callback diagnostics, and summary scope response handling.
5. Add the internal summary-only app and history route. It calls the same read service with server-selected summary purpose, accepts only the documented path/query contract, returns no authorization scope, and never installs public-only routes or CORS/origin authorization.
6. Change the entrypoint to bind public HOST:PORT and private 0.0.0.0:7777; make startup and SIGINT/SIGTERM close both safely, failing loudly if either bind fails.
7. Update Dockerfile.server and release deployment: document both container ports, remove token secret transfer and required checks, create/validate trade-message-center-summary as an internal network, attach Center after every launch/restore, and leave only 7878 published. Preserve atomic env/image rollback behavior.
8. Update public API documentation and create the Mind handoff document. State that Mind deployment must join the network, use trade-message-center:7777, omit the old headers/credentials, and coordinate rollback.
9. Remove or rewrite summary-specific tests and add focused public/private/runtime/release-contract tests. Do not change repository, cursor, projection, migration, WebSocket, or generic Mind authorization tests except for imports/expectations invalidated by the removed summary feature.
10. Run detect_changes() before any commit, inspect the diff for unintentional public exposure, duplicated history logic, ownership regressions, silent fallbacks, and secrets/log leaks.

Validation

1. Focused Node tests for config/app/entry/public HTTP/internal summary HTTP and summary-removal assertions, each with a 60-second timeout.
2. pnpm typecheck, pnpm build, pnpm test, pnpm format:check, and git diff --check.
3. Verify the release script's network creation/attachment branches and both rollback paths by static/unit coverage where possible; run workflow syntax validation if the available tooling supports it.
4. External production-like validation by the deployment owner: docker network inspect trade-message-center-summary, docker port trade-message-center, and an actual Mind-container request to http://trade-message-center:7777/.... Record Docker access as unverified if unavailable.

Rollback

• Revert Center image and its release workflow/env together. The old image has no internal 7777 handler, so the Mind owner must revert its base URL/headers in the same change window.
• Keep the named Docker network intact; it is shared infrastructure and deleting it is outside this task.