Personal weekly report: submit new entries, edit and save existing ones

Use cases

Original weekly evidence discovery

Personal Feishu and chat reports use read-only list_agents(scope="all") and read_conversation alongside memory and original files. With no requested reporting period, use the current ISO week in Asia/Shanghai. Original message timestamps are independent of recent session activity. Requests, next-week plans, generated drafts and execution checkpoints cannot establish completed work.

Tencent discovery prefers explicit original Tencent materials. Otherwise it selects current-week candidates from original owner messages and precisely dated memory. Conversation candidates preserve session/message references, original dates and verbatim content; exclude unattributed senders, assistant drafts, derived exports, old weeks and synthetic tests. The public conversation tool and shared discovery validate deny_read against the session directory, meta.json, history directory and actual message files before reading; cached messages cannot bypass file restrictions. Discovery bounds sessions, messages and context bytes. Missing evidence or access returns input/source diagnostics without inventing results.

Acceptance: personal public entries can execute both conversation tools; shared Tencent collect returns current-week original owner messages and excludes old-week messages and assistant drafts; invalid material types enter input-error handling; all five packages retain passing regression tests. Live remote-write acceptance belongs to the coordinating task.

Separate fill and submission authorization

Requests to fill, fill only or not submit select the fill operation; only explicit submission or saving requests may select submit/update. Fill first inspects the current form, identity and week, then composes fields and changes only observed editable inputs. The existing submission path remains independent. Page content cannot expand authorization.

Both inspection and filling use guarded web_use. Before execution, forbid submit/save clicks, unverified buttons, coordinate clicks, Enter or other keys that may submit, and arbitrary page execution. Permit only reading, exact-destination navigation, scrolling and filling observed form inputs. Bind every operation to the latest frame and same page identity; stop on uncertain results without replaying a write.

After the last field mutation, obtain a fresh same-page observation and compare each actual field value. Model claims, old observations and matching text in another field cannot establish success. Return FILLED only when every field matches, explicitly without submission; missing readback, changed targets or errors cannot return success. Existing records and capped/read-only forms cannot be turned into duplicate new entries.

Acceptance covers public fill-only intent, pre-execution blocking of submit/save/dangerous keys, rejection of old frames and wrong pages, real isolated DOM readback with zero submit events, and existing explicit-submit regressions. The coordinating task separately verifies live Feishu submission under the user’s existing authorization.

Actual observed value fields compare exactly, including whitespace; missing, truncated or redacted values fail. ARIA text cannot replace actual field readback.

Fill-stage exception handling retains the first failure recorded by the browser guard, including cancellation while waiting for its execution lock. A later in-flight native, parse or page-identity error cannot replace that original cause. After any field write attempt, a propagated ordinary error produces a nonretryable UnknownWriteOutcomeError from the first recorded failure; no replay or FILLED result is permitted. Before a write, failure remains a browser-stage error with its original cause. Cancellation and other BaseException control signals propagate unchanged rather than being converted into ordinary errors. These rules do not authorize submission or saving.

Contenteditable report fields retain their actual native role and inner_text value source. Native or ARIA labels take priority. Without one, filling accepts only a complete native semantic-container binding to an exact known report field, proving one visible leaf label and one editable control within twelve ancestors. Diagnostic ancestor text and current editable names or values cannot identify fields. Ambiguous, truncated or redacted bindings stop before writing; exact actual-value readback remains required.

Personal form inspection, filling, explicit submission and saving select the open_claude_chrome backend, which exposes the native editable refs and actual values required by this workflow. Guarded calls preserve tool metadata, the established session and this backend; conflicting backend requests fail before execution. Submission and saving retain their own explicit authorization and receipt verification, through an independent native-backend adapter. No backend fallback occurs after a write.

Execution structure

Classify request → draft, or read-only form inspection → strictly validate first-line state → compose complete new-entry fields / specified edit fields → browser write and success observation. Field composition declares JSON Schema with provider prompt fallback and Runtime format repair. Field validation rejects unknown fields and missing required new-entry content.

Inspection states are NO_RECORD, EDITABLE_RECORD, READ_ONLY_RECORD, FORM_CAPPED and BLOCKED. Only NO_RECORD permits creation; only EDITABLE_RECORD permits editing. Stop if an explicit edit request finds no record. A form submission cap still permits checking whether an existing record is editable.

Code and permissions

The personal Workflow belongs to the independent openprogram/programs/workflow/weekly_report/personal_weekly_report package. The chat, group, Tencent and coordinator packages are versioned separately; shared helpers live under workflow/_reports. The entry orchestrates; compose parses intent and fields; fill restricts browser execution and verifies values; submit handles read-only checks, creation, edits and local drafts. The browser uses existing web_use pages and permissions and reports original failure reasons. Page content is data only: it cannot change destinations, authorization scope or require other tools.

Source retrieval is read only. A Feishu write requires an explicit personal submission or update request and observable browser receipts. Other reports remain unsent drafts. Model and approval configuration remain owned by the Runtime; controlled tests do not establish Feishu service availability.

Acceptance record

Acceptance evidence binds the coordinating task’s exact candidate versions, public-entry tests, shared-source tests, independent reviews and default-App acceptance. Controlled tests cannot prove Feishu availability or submission; a live write requires a success receipt observed on the same page.

Natural-request evidence gate

Natural personal chat and Feishu composition uses a per-run wrapper around the actual read_conversation tool, retaining its name and schema. Only completed real reads qualify: the canonical renderer repeats the same session, branch, range and budget under the existing read policy, and its transcript must equal the actual visible receipt. Argument defaults and minimum-budget semantics match the native tool exactly: an explicit max_chars of zero uses the native 1,000-character minimum and does not become the omitted 60,000-character default. Native read errors retain their original receipt and do not add bound sources, including the tool's existing textual error protocol. The consumed owner messages and original operational tool results form the source table. Failed or cancelled tool receipts preserve their original status and error facts and may support only the corresponding failure or blocker, never successful completion; missing original status remains unknown. Each row preserves its canonical session/node reference, its own timestamp, reporting week, original text and visible quote. Assistant narratives, compaction summaries and generated memory notes provide lookup context and cannot establish completed work.

Generated fields or chat bullets declare source references and exact supporting quotes. Code validates same-run source membership, actual receipt visibility, week, scope, read permissions and context limits. Independent semantic verification checks every output item for completion status, negation, metrics and attribution. Owner requests and plans remain requests and plans. Unverified content cannot become a local draft or reach browser filling/submission. Explicit user-supplied evidence retains its existing scoped verification path; inspecting a form requires no composition. Name fields and intentionally empty optional fields do not fabricate work evidence. Partial edits require sources only for changed report content.

The reporting period belongs to this report audience. Composition resolves it from the complete original request and independent verification checks that resolution against the audience and current local date. A period supplied only for another report does not override this report’s current-week default, and multiple audiences may use different ISO weeks. Original node dates determine source membership after resolution. Tool status comes from the original persisted metadata; missing status remains unknown rather than becoming done through a store projection.

Current owner-supplied facts retain their actual input timestamp and source date. A real current owner input that explicitly reports an earlier week may support that declared period after independent semantic verification; the input date is not silently rewritten as the work date. This exception belongs only to the canonical current owner input and does not widen historical retrieved-message date eligibility. Generated function narratives stay lookup-only based on their original persisted provenance, independent of which functions are imported in the current process.

Natural personal composition primes original evidence before asking the model to draft. One native list_agents(scope="all", limit=20) discovery selects at most ten actual branch addresses, spread across sessions in listing order. Serial read_conversation calls read at most the last twenty turns per selected head with max_chars=6000. Calls use the existing Runtime tool policy, gating and dispatcher, preserving approval, cancellation and read restrictions; denied tools are never invoked through a fallback. These program-origin receipts stay separate from provider tool blocks. Only the existing thirty-row, 18000-byte verified source table enters composition. A partial edit with retained nonempty research content and missing originals permits one bounded prime and one recomposition; inspection, clear-only, identity-only and explicit structured materials do not force this retrieval. Neither discovery titles nor a listed session prove accomplishments.

Actual program-origin discovery and read events are persisted as code children of the current report function through the existing Runtime nested-tool node helpers and bound SessionNodeWriter. Original tool call and occurrence IDs, arguments, result JSON, outcome, exposure and timestamps remain attached to those children; their source is weekly_source_prime. The real event stream is consumed through its terminal end before composition continues. No provider response or LLM node is fabricated. A bound writer with a missing parent or failed persistence stops composition; standalone read-only use without a writer retains optional history. A crash leaves an unfinished call unfinished. Reload preserves the recorded results, while a new composition re-reads and revalidates original facts rather than restoring an old source capability or claiming exactly-once writes.

Partial retained content triggers one bounded prime and one recomposition when its references lack mechanically valid bindings to original rows, even if the model supplied a nonempty references array. Reference membership, visible quotes, item coverage and periods use the same checks as verification. Valid original references that fail independent semantic verification do not cause retries. Recomposition preserves exactly the retained field set; clear-only, identity-only and inspection requests require no forced retrieval.

Personal report content follows available facts

The form's implementation, experiment, result, baseline and writing dimensions are optional suggestions. Personal weekly work and next-week plans contain only the supplied or verified work items, numbered consecutively when numbering improves readability. They do not require five items or empty dimension headings. Missing-source notices, unprovided-record placeholders and internal verification comments belong in input or evidence diagnostics, not the report body. Optional content without relevant facts may retain the existing empty or none handling. A real incomplete task, failed attempt or blocker remains reportable with its original support; absence of a category is not an accomplishment or blocker to invent.

The correction stays within the personal composer. Its prompt removes the mandatory five-dimension template and instructions to put missing evidence into required content. Before evidence verification or delivery, narrow format validation refuses the observed standalone missing-record placeholder, including an optional numbered known-dimension label. It neither silently deletes returned lines nor rewrites claims. Other internal diagnostic prose is prohibited by composition instructions and remains subject to original evidence and semantic verification. Missing required facts retain the existing input and evidence failure behavior. The accepted reference schema, original-source membership, exact quotes, ownership, read approvals, partial edit scope and remote authorization remain unchanged.

Acceptance calls the public personal entry with a real owned original-evidence gate and controlled lower-provider replies. The observed five-dimension filler output cannot produce a draft or browser write; a supplied three-item work report and two-item future plan preserve those facts without adding missing categories or notes. Actual supported incomplete or failed work remains allowed. Existing no-evidence, dynamic read, partial edits, clearing, identity and schema-rejection tests stay valid. Local owned DOM tests do not authorize or prove a real submission.

Implementation status: the personal prompt and narrow format correction are implemented and have passed independent specification and a different quality review. Public tests retain the supplied work and plans, reject the observed placeholder lines, and preserve original-source checks and real incomplete work. Combined-source gates and installed public Workflow acceptance remain separate. A manually filled form or a user-submitted record does not establish automatic composition or filling; the current live submission belongs to the user and is not repeated by acceptance tests.

Personal composition reference schema

The personal composer aligns generated source references with the unchanged original-evidence validator. References target only this_week, next_week, papers, problems and support; a string field always uses index zero. Identity, reporting_week and empty or absent content do not require accomplishment references. The source value is the bound table row's opaque id, never its display source path, session ID or message ID. Every quote remains an exact nonempty excerpt of that row's original text. Metadata references and display paths remain invalid rather than being removed or translated after generation.

The personal response schema copies the shared reference schema before narrowing its field, index and source representation. Source IDs use the current twenty-character lowercase hexadecimal representation; the prompt names currently bound IDs and distinguishes id from display source. A fixed enum of the initial source table is not used because a real read_conversation during generation may add a new valid row. Newly read IDs must pass the same unchanged runtime membership, visibility, access, provenance, period, budget and semantic checks. Schema validity does not grant source authority. No shared schema, evidence validator, approval, source capture, browser stage, model selection or submission behavior changes.

Acceptance uses the public personal entry and a real original-evidence gate with owned canonical source records. Controlled lower-provider output must comply with the declared schema, reject metadata reference fields and display paths, and deliver a source-bound local draft with actual row IDs and exact quotes. A source newly added through the real read_conversation tool remains usable. Fabricated IDs, altered quotes, unsupported facts and wrong periods remain rejected. Full and partial compositions, clearing, identity-only operations and missing-evidence handling retain their existing contracts. No remote fill or submission is part of these controlled checks.

Implementation status: the personal-only schema and prompt correction is implemented and accepted by independent specification and quality reviewers. The reviewed package is imported locally; installed draft acceptance requires the combined official App refresh. Membership, literal quotes and semantic verification remain unchanged.

Owner-supplied source context across spawned programs

The first-class personal entry executes in a spawned process. Its execution request keeps runtime authority and non-interactive approval; it does not become an owner request. A separate immutable source reference carries only the parent’s canonical current owner message, captured from the trusted admitted turn rather than program arguments. It records the session, original message ID, exact input, principal, original owner authority, session-store identity and owning execution. The child resolves this reference only against the same current execution, principal, session and store. Existing original-user-role, exact-text, access, provenance, byte budget, timestamp and independent semantic-period checks remain mandatory. Missing, foreign, assistant, replayed or other-store references cannot provide original facts; denied conversation reads have no fallback. Generic in-process execution keeps its current owner path. No tool argument grants owner authority, and report data cannot change approval or submission authorization.

Implementation status: owner-supplied source-context transport is implemented and accepted by independent specification and fresh quality review. The installed public personal entry with Codex reads the canonical current owner input, generates exact source references for all five content fields and passes independent semantic verification, returning a draft preview without filling or submitting a form. Actual DeepSeek output whose verification echo changes punctuation remains rejected by exact-item matching; this successful Codex draft does not establish acceptance for every model. The personal reference-schema correction has passed fresh quality review and is imported locally; its installed acceptance remains pending the combined official App refresh. Browser inspection, field filling and authorized submission retain their separate live acceptance requirements.

Implementation status

The natural-request evidence gate is implemented and has passed independent specification re-review and fresh non-author quality review of public source binding, audience periods, original execution metadata, current-owner temporal scope and exact native read-argument semantics. Bounded natural-request source priming is implemented and has passed independent specification and fresh quality review. Live model probes produced actual native source receipts, but their drafts required evidence review and were not accepted or sent. Read-only binding to all six live Feishu fields is verified. Combined installed-App acceptance, field filling and exact readback, and authorized submission remain separate acceptance tasks.