Source: Chapter 11 of the《建设方案评审报告 V10.0》— fifteen items plus one optional confirmation. Execution rule: don't wait for a reply, build and report as we go; engineering proceeds per the "report recommendation" column; the "current engineering position" is the concrete approach taken during implementation, and if the panel revises a decision the corresponding item is reworked per the new decision. The status column is filled in by the review panel.
| No. | Decision item | Report recommendation | Current engineering position | Status |
|---|---|---|---|---|
| 1 | Whether to adopt the self-written-business-layer, no-secondary-development route | Adopt | Already executing per this: no secondary development based on open-source IM, no integration of AGPL / SSPL components, the foundation uses open-source components (the third_party/ list) | Decided (retroactively confirmed 2026-10-08) |
| 2 | Whether the four-phase plan is endorsed | Endorsed; each phase is separately initiated after phase-one acceptance | Advancing in four phases, with todo.md carried to phase one at acceptable grain | Decided (endorsed 2026-10-08) |
| 3 | Whether audio/video meetings and collaborative documents are self-developed | Not self-developed; procured or integrated | Not scheduled; phase four recommends a separate item | Decided (not self-developed 2026-10-08) |
| 4 | Login policy: desktop single-point online, mobile coexists | Adopted | The server is designed as "only one online instance of the same terminal type" (T2.1) | Decided (retroactively confirmed 2026-10-08) |
| 5 | Whether logged-in users may communicate with not-logged-in colleagues | Allowed; departments with high archiving requirements can turn it off | Cross-state interoperability is implemented as allowed by default + the policy switch「允许与未登录设备通信」(T3.4) | Decided (endorsed 2026-10-08) |
| 6 | Chat record retention period | 6 months | Retention-period policy-ization is implemented (retention_policies configured per domain + retention_purges clean up traces, the CLI policy surface); the built-in default = 6 months (180 days) has been coded (store.cpp retention_resolve fallback, landed after the 2026-10-10 decision) — configurable override: retention set <days|indefinite> overrides (walking up the department chain level by level → the global row), whitelist 30/180/365/1095/indefinite |
Decided (authorized proxy decision 2026-10-10, effect reviewed afterward) |
| 7 | Single-machine centralized server deployment, no regional edge nodes | Adopted | The single-process single-database implementation is unchanged; storage sharding has gone from reserved to actually implemented — the R23-1 storage abstraction layer connects to S3-compatible object storage (--files-port explicitly enables the file surface, off by default; S3Storage is injected into the FileServer and the uplink surface, the storage compose CLI carries the --data-dir surface), and the client never directly connects to object storage (always proxied through the server); the gateway / database remain logical layering within a single process (2026-10-09 reconciliation update) |
Decided (authorized proxy decision 2026-10-10, effect reviewed afterward) |
| 8 | Interruption-period archiving rule | Hold locally; after recovery re-send with de-duplication by message identifier | Implemented per T2.5 as a staging queue + de-duplicated re-send (about 0.5–1 person-week already counted) | Decided (authorized proxy decision 2026-10-10, effect reviewed afterward) |
| 9 | Whether the model gateway allows external API endpoints | Not allowed by default; if allowed, limited to non-archived data with an audit trail | Implemented (2026-10-08): the gateway has landed; the "archived data only to local models" red line is hard-coded in model_gateway.cpp with no configuration exposed — memex_archive_scope:true routes only to is_local endpoints, and with no local endpoint returns 503 without the request ever leaving the box (tests pin zero external hits); call audit in model_calls writes one line per upstream attempt including archive_scope for traceability; external endpoints can be registered, but archived requests are never routed to them (the red line lives in code, not in configuration) | Decided (authorized proxy decision 2026-10-10, effect reviewed afterward) |
| 10 | Whether to start the GPU procurement assessment | Start the assessment alongside phase one | A non-software-engineering item, already listed in the standing-issues reminder | Decided (authorized proxy decision 2026-10-10, effect reviewed afterward) |
| 11 | Network-layer admission control | Implement | External dependency; the client side is written to fixed ports (UDP 2425–2436 / TCP 2426–2437) to cooperate with policy; settings batch four has landed client-side segment blacklist admission (the net_guard QSettings surface + the「网络与远程」settings dialog: switch + segment/mask list, a hit = direct-mode discovery does not respond + incoming connection is refused on the spot) and the remote-control pairing password surface; the server side has no segment admission (only the R23-5 file-surface extension blacklist) (2026-10-09 reconciliation update) | Decided (authorized proxy decision 2026-10-10, effect reviewed afterward) |
| 12 | Remote assistance scope | IT operations only, closed to ordinary staff by default | Implemented (phase-two close-out 2026-10-08): the department release switch defaults to deny and walks up the chain (scope is controllable), approve/deny belongs to the controlled party alone (the explicit-confirm consent red line), actual approvals ⊆ requests and can only shrink not expand, session ledger in reverse order + continuously visible in-sharing indicator + end at any time = revoke permission (process visible), the audits migration chain is readable by the parties involved (full traceability); the org-admin full-audit CLI surface already exists; the department-granularity configuration for "IT operations only" is exactly how the release switch is used, and its default of closed matches the recommendation | Decided (authorized proxy decision 2026-10-10, effect reviewed afterward) |
| 13 | Office location map visibility scope | Only one's own floor by default; cross-floor authorized on demand | Implemented (phase-two close-out 2026-10-08): visibility = same-floor mutual visibility for the floor of one's own occupied workstation (not derived from departments, no mapping fabricated), an empty map with no workstation; cross-floor only for org-admin (?floor= explicitly specified, editing rights cut server-side) — the current position on "cross-floor authorized on demand" = the org-admin role is the authorization position itself; a finer-granularity authorization surface is deferred and honestly noted | Decided (authorized proxy decision 2026-10-10, effect reviewed afterward) |
| 14 | Directory visibility policy | Visible to everyone by default, executive fields hidden on demand | Implemented per T4.6 (hidden departments / members, restrict to own department, field hiding) | Decided (authorized proxy decision 2026-10-10, effect reviewed afterward) |
| 15 | Direct superior data source | Manual maintenance in the admin console first + bulk import, no HR integration | Implemented per T2.6 (CSV bulk import + error validation) | Decided (authorized proxy decision 2026-10-10, effect reviewed afterward) |
| Annex | Whether to be compatible with existing FeiQ clients (IPMsg plaintext protocol) | Not compatible (when the installed base is small or has a retirement plan) | Direct mode uses a custom encrypted protocol, no IPMsg compatibility. 2026-10-11 user-order revision: FeiQ interoperability on the same segment is a real requirement, so it became bypass compatibility — a pure-function codec surface (client/engine/direct/ipmsg.{h,cpp}), the same port UDP 2425 dispatches on the first byte, and the switch net/ipmsg_enabled is off by default (the「飞秋兼容」switch is explicitly enabled on the「网络与远程」settings page); it does not change any behavior of Memex's direct / collaboration states, and advanced features such as file transfer, encryption, and broadcast mass-send are not implemented (landed 2026-10-12). The full position is in 飞秋/IPMSG 兼容 |
Decided (authorized proxy decision 2026-10-10, effect reviewed afterward; 2026-10-11 user-order revision to bypass compatibility, off by default) |
2026-10-08 user decision (recorded by engineering as authorized, effect reviewed afterward): items 1, 2, 3 were decided, the status column changed to「已拍板」in sync; all other items remain「待拍板」with the review panel.
- #1 Fully self-developed route: retroactive confirmation — no secondary development based on open-source IM, no AGPL / SSPL components; the foundation's open-source components follow the third_party/ list (vcpkg as the single source of truth).
- #2 Four-phase phasing: endorsed — after phase-one acceptance each phase is separately initiated; todo.md continues to advance phase one at acceptable grain.
- #3 Audio/video meetings and collaborative documents: not self-developed — procured or integrated; a separate item in phase four (consistent with the phase-four position in todo: not self-developed, separately initiated, with engineering only verifying the integration boundary).
2026-10-10 user decision (recorded by engineering as authorized, effect reviewed afterward): items 6–15 plus the annex, eleven items in total, all adopting the report's "recommendation" column (i.e., the same position as the current engineering position), with the status column changed to「已拍板」in sync; the configuration default for #6 has been coded.
- #6 Retention period: 6 months (180 days) — configurable override (
retention setoverrides, department chain → global row; whitelist 30/180/365/1095/indefinite); the built-in default has landed instore.cppretention_resolvefallback (pinned by tests). - #7 Centralized deployment: adopted — single machine centralized, no regional edge nodes; single-process single-database unchanged (storage sharding has gone from reserved to actually implemented; see the position column).
- #8 Interruption-period archiving: local staging + de-duplicated re-send — implemented in T2.5 (staging queue + de-duplicated re-send by message identifier).
- #9 External endpoints: not allowed by default — the "archived data only to local models" red line remains at the code level (hard-coded in
model_gateway.cpp, not exposed in configuration; external endpoints can be registered but archived requests are never routed to them). - #10 GPU procurement assessment: started — a non-software-engineering item, already listed in the standing-issues reminder, the assessment starting alongside.
- #11 Admission control: implemented — what has landed on the client side is the position (
net_guardsegment blacklist + the「网络与远程」settings surface); the server is not expanded (only the R23-5 file-surface extension blacklist). - #12 Remote assistance: IT operations only, closed to ordinary staff by default — the release switch defaults to deny and walks up the chain; approve/deny belongs to the controlled party alone (consent red line), actual approvals ⊆ requests and can only shrink not expand, full traceability.
- #13 Location map: only one's own floor by default — same-floor mutual visibility for the floor of one's own occupied workstation; cross-floor authorization on demand = the org-admin role is the authorization position itself (finer granularity deferred, honestly noted).
- #14 Directory: visible to everyone by default + executive field hiding — implemented in T4.6 (hidden departments / members, restrict to own department, field hiding).
- #15 Superior source: manual maintenance in the admin console first + bulk import, no HR integration — implemented in T2.6 (CSV bulk import + error validation).
- Annex FeiQ compatibility: not compatible — direct mode uses a custom encrypted protocol, no IPMsg (IPMsg plaintext protocol) compatibility. 2026-10-11 user-order revision: changed to bypass compatibility (same port UDP 2425, first-byte dispatch, not changing the behavior of either state), with the switch
net/ipmsg_enabledoff by default and explicitly enabled in settings — implemented and accepted (landed 2026-10-12, ctestipmsgleg); the full position is in 飞秋/IPMSG 兼容.
Copy note: t44 / t45 are shelved experimental worktrees (branches t44-screenshot, t45-emoji-favorites, HEAD frozen at 2026-10-04 and carrying uncommitted in-flight changes); their decisions.md copies are not synced by this decision round — the main repository prevails.
2026-10-10 engineering reconciliation re-verification (inspection round): the "current engineering position" for #1–#15 and the annex was checked against code item by item — single-point mutual kick (
session.cppsame-type mutual kick + KICK frame), cross-state interoperability switch (allow_cross_state), 180-day retention default (retention_resolvefallback), S3 file surface (--files-port+storage compose), staging re-send (collab engine +test_collab_resend), model-gateway red line (memex_archive_scope+ 503 with no local endpoint), client-side segment admission (net_guard) + no server expansion, remote-assistance consent red line (approve/deny belongs to the controlled party alone), location map same-floor mutual visibility (office_seatsfloor), directory field hiding, superior CSV import (org import) — all consistent with the implementation, with nothing stale and nothing to change in the "current engineering position" column.
| Item | Content | Landing spot |
|---|---|---|
| Addition 1 | The first mobile connection must initialize the domain / server address (the wizard's first step; only after filling it in can the main interface be entered) | R17 · todo T4.8 · prototype「移动端初始化」 |
| Addition 2 | No anonymous chat on mobile (direct mode / login-free exists only on desktop; mobile is entirely collaboration mode) | R18 · todo T4.8 · the full「移动端」prototype set |
| Addition 3 | The prototype mockups are a deliverable (7 desktop screens + 4 mobile screens) and enter the docs site's "UI preview" carousel | docs/design/prototypes · docs site |
Status note (2026-10-10): when Addition 3 was decided the desktop had 7 screens; after the「好友列表」screen was added by the 2026-10-08 layout-decree batch, the docs site's "UI preview" carousel is now 8 desktop screens + 4 mobile screens (live-replacement progress is in 界面原型与预览).