---

name: bisheng description: "Use BiSheng's enterprise LLM application DevOps platform repository, including FastAPI backend, workflow/RAG/Linsight runtimes, permissions, dual React frontends, deployment, and maintainer workflows." disable-model-invocation: true metadata: disco-role: operating license: Apache 2.0

BiSheng

Use this repo skill when a task names BiSheng, 毕昇, dataelement/bisheng, or asks about this enterprise LLM application DevOps platform's backend, workflow engine, knowledge/RAG pipeline, Linsight agent, permissions/tenancy, dual React frontends, Docker deployment, or repository maintenance.

This root skill is a router. Read the focused sub-skill first, then return here for cross-cutting checks.

First checks

1. If you are checking whether this skill matches a checkout, read repo provenance.
2. For the monorepo and runtime topology, read architecture map.
3. references/repo-routing-metadata.json is structured metadata for managed repo-skill routing and import checks.
4. For cross-cutting install/config/runtime failures, read troubleshooting.
5. For a safe checkout inventory, run the bundled helper against a BiSheng checkout:

   python scripts/check_repo_surface.py --repo-root <bisheng-checkout>
   

Install and verify a checkout

For backend work, install from the backend root with the repository-supported lockfile:

cd <bisheng-checkout>/src/backend
uv sync --frozen
uv run python -c "import bisheng, bisheng_langchain; print(getattr(bisheng, '__version__', 'unknown'))"

For frontend work, install and test from the owning app directory only:

cd <bisheng-checkout>/src/frontend/platform && npm install && npm test
cd <bisheng-checkout>/src/frontend/client && npm install && npm run test:ci

Use narrower sub-skill commands before running broad suites; many integration/e2e paths require MySQL, Redis, Milvus, Elasticsearch, MinIO, OpenFGA, or the commercial gateway.

Route by task

User task	Read
Add or debug FastAPI routes, DDD modules, response envelopes, settings/context, SQLModel DAO/model behavior, backend tests, or error-code handling	backend-core
Work on workflow canvas execution, LangGraph graph compilation, node types, callbacks, interruption/resume, workflow Celery tasks, or new workflow nodes	workflow-engine
Work on knowledge libraries/spaces, file upload states, document parsing, Load → Transform → Ingest, Milvus + Elasticsearch recall, MinIO artifacts, QA libraries, or knowledge workers	knowledge-rag
Work on Linsight task mode, SOP/Skill migration, Redis worker queue, task/session state events, deepagents runtime, built-in tools, or MCP integrations	linsight-mcp
Work on JWT auth, RBAC/ReBAC/OpenFGA, PermissionService, tenant isolation, admin scope, approval center, org/SSO sync, commercial gateway, or cursor-pagination permission performance	identity-permissions-tenancy
Modify Platform or Client React apps, routes, stores, request wrappers, UI systems, i18n, brand theme, tests, or Vite config	frontend-apps
Install, run, deploy, configure, migrate, operate, or maintain the repo, Docker Compose stack, backend scripts, arch guard, uv/npm commands, or SDD workflow	deployment-maintenance

Cross-route decisions

• Backend versus frontend: API contract or permission semantics belong to backend/identity sub-skills; rendering, request wrappers, route guards, and state belong to frontend-apps.
• Workflow versus Linsight: visual flow DAGs and workflow nodes belong to workflow-engine; autonomous task-mode execution, SOP/Skill runtime, Redis Linsight worker, and MCP tool wrapping belong to linsight-mcp.
• Knowledge versus permissions: document ingestion/retrieval belongs to knowledge-rag; resource visibility, ReBAC checks, approval modes, tenant filters, and cursor permission performance belong to identity-permissions-tenancy.
• Deployment versus code change: runtime service wiring, Docker, config layering, migrations, and operational scripts belong to deployment-maintenance; feature implementation details route to the owning code sub-skill.

Non-negotiable repository laws

• Backend layering is Router → Endpoint → Service → Repository/DAO → DB. Do not bypass it for new work.
• Every resource authorization path goes through PermissionService/OpenFGA-aware services; do not query role-access tables as a new permission shortcut.
• Multi-tenancy is ContextVar-driven. ORM SELECTs are auto-filtered, but raw SQL and bulk update/delete need explicit tenant-safe design.
• MySQL and DM8 compatibility are both mandatory. Use dialect helpers for JSON, large text, timestamp defaults, and keyset predicates.
• The two frontends are separate SPAs. Do not mix Platform's Zustand/react-query v3/bs-ui stack with Client's Recoil/TanStack Query v4/shadcn stack.
• Never import axios directly in business frontend code; use the app's wrapped request layer.
• Do not write plaintext secrets into config files. Password fields in BiSheng config are Fernet-encrypted.

Verification and helper scope

The bundled scripts are read-only inspectors. They accept --repo-root so they can be used with any BiSheng checkout; they do not depend on the checkout used to create this skill.

Use repository-native tests only after selecting the focused surface. Many end-to-end and integration tests require MySQL, Redis, Milvus, Elasticsearch, MinIO, OpenFGA, frontend browsers, or the commercial gateway; prefer the narrow safe test listed by the owning sub-skill before running broad suites.