Lowcode AI Real Chain Runner

Lowcode AI Real-Chain Runner

Execute an existing lowcode-server real-chain command only after a complete, explicit, bounded authorization package passes the bundled validator. Treat provider calls and database writes as separate high-risk effects; environment variables, a Work Item, a requested action, or an eligible candidate never supplies authorization by itself.

Do not use this skill for bounded product-discovery experiments that explicitly prohibit DB writes and run-record persistence. Use the repository's native product chain under the current project risk envelope instead.

Do not use this skill for code fixes, prompt/spec rewrites, visual review, run-record diagnosis, or issue classification. Use lowcode-ai-run-review for review.

This skill protects the retained persisted Phase 2a/manual regression path. A successful persisted run does not qualify the current Phase 2b-3 product UI chain, import/Renderer closure, interaction behavior, or page quality. Use lowcode-ai-product-loop for a non-persistent product-page loop.

Boundaries

• Work from /Users/lvxuyang/Projects/lowcode-server unless the authorization package names another cwd.
• Use existing project scripts only. Do not create or modify project scripts or product code during a run.
• Do not hardcode visual rules or repair logic during a run.
• Never place API keys, credentials, connection strings, or other secrets in the authorization package or report.

Authorization hard gate

Before inspecting provider/DB environment variables, invoking a provider, opening a DB connection, or starting a command that can do either, require a JSON authorization package and run:

node ~/.codex/skills/lowcode-ai-real-chain-runner/scripts/validate-authorization.mjs <authorization.json>

The package must include all of:

• decisionRef and authorizedBy for the explicit decision and authorizing subject.
• scope.runTypes, scope.models, and scope.samples for the allowed run, model, and sample scope.
• Positive numeric limits.maxCalls, maxInputTokens, maxOutputTokens, maxTotalTokens, and maxCost.amount, plus maxCost.currency.
• targetDb.environment, targetDb.database, and non-empty targetDb.writeTables.
• Non-empty stopConditions.
• continuation.onSuccess, continuation.onFailure, and boolean continuation.renewalRequired; continuations may only be stop or continue-within-remaining-bounds.

If validation fails, hard stop. Report only the validator's sorted missing list. Do not ask for or report env values, propose a command, inspect credentials, call a provider, connect to the DB, write a result JSON, or continue with other run preparation.

After validation passes, freeze the validated package as run evidence. Confirm the selected run type, model, sample, target DB/table, and projected calls/tokens/cost are within it. Any mismatch or exhaustion is a hard stop requiring a new explicit authorization package. Never infer permission to exceed one bound from unused capacity in another bound.

Apply the stop conditions after every call and before every DB write. On success or failure, obey the frozen continuation rule. If renewalRequired=true, do not continue even when numerical budget remains until a new package with a new decisionRef passes validation.

Status consistency

Before running, confirm the script derives evaluationStatus with deriveEvaluationStatus({ importStatus, evaluationValidationError, report }) and calls assertEvaluationStatusConsistency({ importStatus, evaluationStatus }) before persistence. If not, stop and route to the status-consistency implementation thread.

importStatus=failed may keep an evaluation report for diagnosis, but the persisted evaluationStatus must be failed.

Provider network policy

After authorization validation passes but before the first provider dispatch, inspect the existing runner and its read-only preflight. Require all of the following:

• The runner uses the shared provider HTTP boundary rather than an ad hoc direct Axios call.
• The configured base URL is resolved to the provider's full request URL before dispatch, and the actual transport target matches that effective URL.
• Redirect following and endpoint fallback are disabled. Record exact status plus a redacted Location identity when a redirect is rejected.
• maxCalls counts HTTP dispatch attempts. Reserve a call immediately before dispatch; 3xx, 401/403, timeout, DNS, and network failures retain that count. Missing usage or cost remains unavailable and stops the run rather than becoming zero.

When HTTP_PROXY, HTTPS_PROXY, or equivalent proxy variables are present, freeze an explicit proxy decision before dispatch:

• For an endpoint already validated as an official DashScope Beijing shared or workspace-dedicated host, require either per-request Axios proxy: false or an exact matching NO_PROXY/no_proxy entry.
• Prefer per-request proxy: false in the shared provider client so the policy does not depend on a user's global Codex environment.
• If environment bypass is used, prefer exact hosts or the narrow workspace suffix. Do not add broad entries such as .aliyuncs.com.
• Do not infer bypass from host intent. If a proxy is configured and neither code nor environment proves the bypass, stop before dispatch.
• Do not mutate global proxy environment for unrelated providers, silently switch endpoints, follow a redirect, or retry through another network path.

The evidence report must include the configured and effective endpoint host/path, proxyPolicy=direct|environment-proxy, whether the bypass came from per-request config or NO_PROXY, redirect policy, and attempted/completed/usage-accounted call totals. Never include proxy credentials or full environment values.

Run workflow

1. Pass and freeze the authorization gate.
2. Identify the authorized run type and locate the existing command in project docs or package scripts.
3. Verify the concrete execution plan stays within every frozen scope and bound.
4. Pass the provider network policy, including endpoint normalization, proxy decision, redirect policy, and dispatch-attempt accounting.
5. Run from lowcode-server with the authorized provider/model and sample.
6. Capture runId, workId, provider/model, page type, input mode, result JSON path, budget consumption, and errors.
7. Verify only the authorized MySQL target/table using runId, or workId plus timestamp ordering when needed.
8. Confirm result JSON linkage and final status.
9. Stop or continue exactly as authorized, then produce an evidence-focused report.

Prefer rg for discovery and existing package scripts over ad hoc commands. Report network or environment blockers without exposing secret values.

If the requested work starts from the product UI, does not require run-record persistence/MySQL verification, or needs visible/editable Renderer and interaction evidence, stop routing through this skill and use lowcode-ai-product-loop.

Evidence and report

Capture the authorization decisionRef, authorizing subject, frozen scope/bounds, actual calls/tokens/cost, stop reason, continuation decision, run identifiers, provider/model, result path, authorized DB table/row, final status, and evaluation summary when available.

Only update apps/lowcode-server/src/ai/REAL_CHAIN_CASE_MATRIX.md when explicitly requested or when the current thread owns matrix maintenance.

End with:

结论：<success / partial / failed / authorization missing>
授权：<decisionRef, subject, frozen bounds, stop/continuation outcome>
运行信息：<run type, sample, provider/model, workId, runId, result JSON>
持久化验证：<authorized MySQL target/row and result JSON status>
结果摘要：<outcome, evaluation, blocker>
下一步：<one authorized or approval-needed action>