GLMChat V2.2.1 — AUTHORITATIVE FEATURE AND FUNCTION MAP ======================================================= STATUS AND SCOPE - Deployable runtime root: app/ - Deterministic reconstructed frontend source: source/frontend/*.js - Runtime helper source copies: source/runtime/*.js - Stylesheet source copy: source/styles/app.css - Production backend source: app/server/**/*.php - Source lineage: source_lineage/ - Feature lock: FEATURE_LOCK.json - The reconstructed frontend modules reproduce app/assets/index-5aa4ab81f41a.js byte-for-byte. - Live-host, live-provider and physical-device acceptance remain separate target-environment gates. ARCHITECTURE - React PWA source modules: source/frontend/00-core.js through source/frontend/50-bootstrap.js - Deterministic build: scripts/build.mjs - Source lint: scripts/lint.mjs - Release verification: scripts/verify.mjs - Release metadata regeneration: scripts/refresh_release_metadata.py - PHP 8.2+ backend: app/server/bootstrap.php; app/server/index.php; app/server/routes/*.php - SQLite persistence/migrations: app/server/lib/Database.php; app/server/lib/Migrations.php; app/server/migrations/*.sql - LiteSpeed/Apache security/deployment: app/.htaccess; app/server/.htaccess; app/storage/.htaccess - Offline PWA: source/runtime/offline-runtime.js; app/sw.js; app/manifest.webmanifest SETUP, AUTHENTICATION AND SECURITY - Install gate and standalone transitions: source/frontend/30-screens.js; source/runtime/native-android.js. - First-use six-digit PIN and Together key validation: app/server/routes/auth.php; Auth.php; Crypto.php; setup screens. - Session, CSRF, lockout and recent-PIN reauthentication: Auth.php; auth/data/project/template/tool routes. - Authenticated encryption and secret-safe failure/logging: Crypto.php; Logger.php; Api.php; bootstrap environment preflight. CHAT AND MULTIMODAL - Conversations/history/pinning: conversations routes and Chat/History screens. - Streaming chat, stop, retry/regenerate and copy/share controls: chat routes, Together.php and ChatScreen. - Visible project/file context and project instructions: Projects.php; ContextBudget.php; chat route/UI selectors. - Image attachments and separate vision model: chat route; Together vision request; message_attachments persistence. - Per-turn reasoning, preserved reasoning and structured output: AgenticDefinition.php; Together.php; chat UI. - Cost preflight and conversion to prompt/agent/workflow: cost/chat/prompt/automation APIs and ChatScreen. - TTS voices/generation/playback: tts routes and VoiceScreen. PROJECT WORKSPACES - Project CRUD, ZIP import/export and path-safe file handling: Projects.php; ZipGuard.php; projects routes. - Overview/Chat/Files/Automations/Activity tabs: ProjectDetailScreen. - Metadata, instructions, budget, permissions, retention and revision: migration 012; Projects::updateMetadata. - Linked runs, outputs and activity: workflow/automation APIs and project screens. TYPED AGENTIC DEFINITIONS - Versioned agent/team/workflow validation: AgenticDefinition.php. - Server CRUD and schema-validated request payloads: automation.php; templates.php; frontend wizards. - Immutable execution snapshots: workflow_snapshots and WorkflowEngine::start. - IndexedDB wizard drafts/local records: source/frontend/00-core.js and source/frontend/20-wizards.js. WORKERS, TEAMS AND ORCHESTRATION - Persistent workers, assignments, events, outputs and telemetry: migration 011; WorkflowEngine.php. - Manager-led, sequential, parallel and consensus policies: team definitions and execution engine. - Delegation, memory guidance, checkpoints and worker-scoped controls: WorkflowEngine events/checkpoints/interventions. - Custom stages, dependencies, optional stages and parallel groups: workflow definition schema and instantiation. - Pause/resume/cancel, retry/skip, reassignment, tool revoke and branch checkpoint: workflow routes/engine and RunDetailScreen. FUNCTION CALLING AND PHP TOOLS - Authoritative allowlisted registry and JSON schemas: ToolRegistry.php. - Schema validation, project confinement, timeout/output limits and secret redaction: ToolExecutor.php. - Together tool-call request/continuation loop and structured responses: Together.php; WorkflowEngine.php. - Read/write/destructive approval policy and recent-PIN controls: tool_calls/tool_approvals tables and routes. - Tool catalogue, exact scope review, approvals and audit timeline: tool and run screens. TEMPLATES, PROMPTS AND LIBRARY - Server automation templates: migration 012; templates.php. - Search, pin, duplicate, import/export, edit and protected delete: LibraryScreen and template API. - Prompt CRUD/reset and save-from-chat: Prompts.php; prompts routes; library/chat UI. OFFLINE, SYNC AND CONFLICTS - Encrypted IndexedDB state and ordered mutation queue: source/runtime/offline-runtime.js. - UUID idempotency, request hashes, retries, authentication pause and conflicts: sync route/runtime. - Offline drafts are retained and never silently submitted: chat and wizard persistence. - Pending/conflict/exhausted/auth-required inspection and manual recovery: OfflineScreen. - Conflict resolution through sync API: OfflineScreen and sync route. - Shell-only Cache Storage and controlled updates preserving IndexedDB/queues: app/sw.js; platform-enhancements.js. COST, SETTINGS, PRIVACY AND DIAGNOSTICS - Provider/model/reasoning/output/vision settings: settings route and SettingsScreen. - Daily/workflow/agent/stage limits and currency-aware display: Cost.php; settings/cost APIs and screens. - Export, selected delete, full reset and offline revoke: DataManagement.php; PrivacyScreen. - Safe diagnostics and stable error recovery: platform-enhancements.js; ErrorBoundary. ACCESSIBILITY AND ANDROID - 320–600px, short landscape, 200% text, 48px targets and reduced motion: source/styles/app.css. - Focus trap/restoration, logical headings, restrained live regions and keyboard navigation: components/screens. - Safe areas, Android Back overlays and standalone PWA install/update: native-android.js; app shell. VERIFICATION OWNERS - Deterministic build: npm run build - TypeScript compatibility check: npm run type-check - Source lint: npm run lint - Portable test suite: npm test - PHP static contracts: tests/php_static_contracts.php - Frontend, PWA and feature-lock contracts: tests/node/release-contracts.test.mjs - Migration clone/rollback/upgrade contracts: tests/python/test_migrations.py - Real PHP front-controller preflight: tests/python/test_http_preflight.py - Package/SBOM/manifest/PWA validation: tools/validate_package_22072026154516.py - Non-destructive target-host acceptance: tools/target_host_acceptance_22072026163824.py - Complete verification: npm run verify TARGET-ENVIRONMENT ACCEPTANCE OWNERS - Live LiteSpeed root and nested deployments: hosting operator. - Live Together text, vision, function calling and TTS: authorised provider-key holder. - Physical Chrome, Samsung Internet and TalkBack: Android acceptance tester. - Real production-data migration and rollback: data owner on a private cloned staging environment.