wangwensheng/AM516
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: stabilize API routing and simplify delivery reports

Browse Source
This commit is contained in:
zeroerr.th51
2026-10-16 11:02:03 +08:00
parent bc3dda55ff
commit d5eef9de57
9 changed files with 215 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
capabilities/am516-delivery-prediction/docs/runbook.md
View File

@@ -39,6 +39,28 @@ python3 capabilities/am516-delivery-prediction/scripts/delivery_prediction_query
Do not run this check until AR51 confirms the functional test and creates a separate trusted approval record explicitly covering `api.zeroerr-agent.com`, the AM516 use case, and API-key use.
## API Network Route
The controlled query script defaults to `ZEROERR_AGENT_PROXY_MODE=direct` for
`https://api.zeroerr-agent.com`. It uses a request-local opener with an empty
proxy map, so this API does not inherit macOS or environment proxy settings.
Feishu, Codex and other applications retain their existing network settings.
The bridge launches the script for each query, so script updates take effect on
the next query without restarting the bridge or clearing continuation context.
On 2026-10-16, the proxy log for the 08:51 failed query showed a default-proxy
connection timeout to this API. AR51-approved comparison queries with the fixed
sample both succeeded later: system proxy 20.04 seconds, direct 4.79 seconds.
These are individual observations, not an availability or latency guarantee.
If another approved runtime requires a company proxy, configure
`ZEROERR_AGENT_PROXY_MODE=system` in that runtime's environment (or the bridge's
local `.env`, followed by a bridge restart). This selects the configured proxy
route explicitly. It does not authorize a new destination. Invalid modes and
direct requests outside the approved HTTPS hostname stop before the request.
There is no automatic proxy fallback or extra API retry, and TLS certificate
verification remains enabled.
## Normal TLS Trust Configuration
The controlled query script injects `truststore` before making the request. Normal queries therefore keep TLS certificate verification enabled while using the macOS system trust store, including an AR51-approved company proxy root certificate installed and trusted in the system keychain.