What the documents look like
Livestream after-sales work arrives in bursts after a single traffic session, and refund requests are tightly coupled to what the host promised on air. Four document types carry most of the daily load: livestream order lists, refund applications, reshipment orders, and script templates. During an operations handover, these materials do not carry an authorization state. A refund application sitting at pending review does not mean the operator already holds permission to execute the refund. A reshipment order that has been created does not mean the warehouse has scheduled dispatch. The deployment and upgrade step therefore has to record material state, operator request, and authorization boundary as three separate things, because the upgrade scripts and environment changes described for this version touch the same services that hold those records.
Constraints at the upgrades step
Before and after an upgrade, an old configuration name cannot be used to infer current behavior. For App and Admin, AIPROXY_API_ENDPOINT and AIPROXY_API_TOKEN are both required; missing either one causes startup validation to fail. FILE_TOKEN_KEY, AES256_SECRET_KEY, and INVOKE_TOKEN_SECRET are required at runtime. Version V4.17.2 contains two manually triggered upgrade scripts: 20261008_migrate_chunk_training and 20261009_migrate_dataset_rebuild_status. The second depends on the first having completed, and neither blocks service startup. Before running them, confirm that all old-version App and Pro instances have fully stopped and that old task leases have expired. Since 4.15.0, the open-source edition no longer reads config.json; an old volume mount must be removed and the settings moved to environment variables.
Hypothetical paper exercise sample: a livestream after-sales team's handover record reads, "Refund application R-0712 status is pending review. Applicant: agent A. Reviewer: not assigned. Reshipment order B-0712 created; warehouse has not confirmed dispatch." The proposed sentence under review is, "Agent A already holds refund execution permission and can complete refund R-0712 directly." The source text states only pending review and an unassigned reviewer, and states no authorization clause. The proposed sentence is not supported by the source and remains to be verified.
Configuration and implementation checks
| Configuration item | Value or checkpoint relevant to this page | How it is compared against the sample |
|---|---|---|
AIPROXY_API_ENDPOINT | Required; AI Proxy root address without /v1 appended | After upgrade, check whether startup validation passes |
AIPROXY_API_TOKEN | Required; non-empty and consistent with the server | Compare character by character with the AI Proxy server configuration |
FILE_TOKEN_KEY | Required; length at least 6 characters | Check whether file authorization works |
AES256_SECRET_KEY | Required; length at least 6 characters | Check the encryption and decryption path |
INVOKE_TOKEN_SECRET | Required; length at least 32 characters | Check reverse-invocation JWT handling |
| Manual upgrade scripts | 20261008 before 20261009 | Confirm old instances stopped and leases expired |
Hypothetical trial starting point for this page: set FILE_TOKEN_KEY to a 12-character random string. The reason for this choice is that it satisfies the documented minimum of 6 characters while leaving margin. The comparison object is the documented length floor. This is not an official default and was not tested.
Three common errors
- Treating "pending review" as granted authorization. In the sample, R-0712 has status pending review and an unassigned reviewer. If the handover record is written to say agent A can execute the refund directly, the input is the handover record text, the comparison object is whether an authorization clause exists, and the observed result is that the source text contains no authorization statement, so the claim is not supported.
- Treating "reshipment order created" as warehouse dispatch. In the sample, B-0712 has no warehouse dispatch confirmation. The input is the reshipment order status, the comparison object is a dispatch confirmation record, and the observed result is that the confirmation is absent, so the state remains to be verified.
- Inferring current behavior from an old configuration name. The input is an old
config.jsonfield, the comparison object is the environment-variable mapping that applies from 4.15.0 onward, and the observed result is that the old file is no longer read and the setting must be moved to an environment variable.
How to verify the setup
- Input the sample source text and the proposed sentence. Compare whether the proposed sentence exceeds the subject, state, and authorization scope stated in the source. The observed result is that the proposed sentence is not supported, and the evidence gap is recorded.
- Input the R-0712 entry showing "pending review, reviewer not assigned." Compare whether a review-approval record exists. The observed result is that no approval record was found, so the state remains to be verified and is not recorded as a denial.
- Input the post-upgrade environment variable list. Compare whether
AIPROXY_API_ENDPOINTandAIPROXY_API_TOKENare both non-empty and consistent. If both conditions hold, startup validation passes; if either is missing, record the result as not passed. Do not claim zero downtime.