Why: A step confirmation cancelled the whole run, approvals vanished on restart, and the HTTP server accepted anonymous and oversized requests.
Evidence: GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./... && GOWORK=off go test -race ./squad/... passed. scripts/submodule-consistency.sh ok. Covers TestStepApprovalApproveExecutes, TestStepApprovalSkipDoesNotCancel, TestApprovalSurvivesRestart, TestInterruptedRunningStepStaysHeld, TestTwoEnginesOneRunIsBusy, TestWakeupDoesNotApprovePermission, TestMissingTokenIsUnauthorized, TestPathTraversalRejected, TestOversizedBodyIs413.
Impact: Approve and skip apply to one step. runstate.json and a unix flock survive restart. Wakeup does not approve permission holds. serve defaults to 127.0.0.1:8090 and requires a token off loopback unless --insecure. Non-unix builds keep only the in-process lock. deps/agent-native is 694b08c and deps/agent-intent is 3130190.
Why: A step confirmation cancelled the whole run, approvals vanished on restart, and the HTTP server accepted anonymous and oversized requests.
Evidence: GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./... && GOWORK=off go test -race ./squad/... passed. scripts/submodule-consistency.sh ok. Covers TestStepApprovalApproveExecutes, TestStepApprovalSkipDoesNotCancel, TestApprovalSurvivesRestart, TestInterruptedRunningStepStaysHeld, TestTwoEnginesOneRunIsBusy, TestWakeupDoesNotApprovePermission, TestMissingTokenIsUnauthorized, TestPathTraversalRejected, TestOversizedBodyIs413.
Impact: Approve and skip apply to one step. runstate.json and a unix flock survive restart. Wakeup does not approve permission holds. serve defaults to 127.0.0.1:8090 and requires a token off loopback unless --insecure. Non-unix builds keep only the in-process lock. deps/agent-native is 694b08c and deps/agent-intent is 3130190.
Refs: Q1 Q2 Q3 Q4 Q5 Q8 Q9 Q14 Q15 Q16
合入顺序：Intent → Native → Squad → Backend → Dev。本 PR 不合入。
## 本轮收尾（2026-10-03）
并行组每个成员先过审批和权限；确认、权限、质检的自由文本写入 steering 并保持挂起；分派失败时恢复 pending。补了 AtomicWrite 与 listenGuard 测试。CI 去掉错误的 Agent-Native/go.mod 断言。钉住 native 91c1556、intent 7f7879b。头提交 e928ea3。
合入、发版、分支保护与 SUBMODULE_TOKEN 仍由所有者执行。
Why: A step confirmation cancelled the whole run, approvals and repair budget vanished on restart, and the HTTP server accepted anonymous and oversized requests.
Evidence: GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./... && GOWORK=off go test -race ./squad/... passed. scripts/submodule-consistency.sh ok.
Impact: Approve and skip apply to one step; runstate.json and unix flock survive restart; wakeup leaves permission holds pending; serve defaults to loopback and requires a token off-loopback.
Refs: Q1 Q2 Q3 Q4 Q5 Q8 Q9 Q14 Q15 Q16
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A parallel group only checked the first step, free text cancelled confirmation and permission holds, and a failed reply deleted the pending request before the decision ran.
Evidence: GOWORK=off go vet ./...; go test -count=1 ./squad/ ./cli/; go test -race -count=1 ./squad/. New tests cover the second parallel member, free-text holds, restored pending, AtomicWrite, and listenGuard.
Impact: Any member that needs approval or bash permission keeps the whole group suspended. Free text on confirmation, permission, and quality review is stored as steering and the same request stays pending. A dispatch error restores pending.json.
Refs: feature/agent-stack-r0-r1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: SSH submodule checkout failed on the runner, and the docker job required a path this repo does not have.
Evidence: vet-and-test uses recursive HTTPS checkout, setup-go 1.27, GOPROXY, and GOWORK=off vet, test, and race. The docker job only checks go.mod.
Impact: SUBMODULE_TOKEN must be set by the owner before checkout can succeed.
Refs: feature/agent-stack-r0-r1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Squad must execute the native and intent commits that this batch is asking to merge.
Evidence: deps/agent-native is 91c155618487e21edeb4f1d3cc27e985aae2b0d2 and deps/agent-intent is 7f7879b06b053f0a62746309b79e0e1b9a00f42d.
Impact: Both gitlinks match the open pull request heads. Nested guideline pins are unchanged.
Refs: feature/agent-stack-r0-r1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The runner cannot reach github.com, so cloning actions/checkout timed out before any test ran.
Evidence: The Go 1.27.1 tarball is available from mirrors.aliyun.com. Checkout uses the job token and GITHUB_SHA.
Impact: Submodule checkout still requires SUBMODULE_TOKEN. A missing secret fails the job with that message.
Refs: feature/agent-stack-r0-r1
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen
merged commit 8dc2c54adf into main2026-10-03 12:47:36 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why: A step confirmation cancelled the whole run, approvals vanished on restart, and the HTTP server accepted anonymous and oversized requests.
Evidence: GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./... && GOWORK=off go test -race ./squad/... passed. scripts/submodule-consistency.sh ok. Covers TestStepApprovalApproveExecutes, TestStepApprovalSkipDoesNotCancel, TestApprovalSurvivesRestart, TestInterruptedRunningStepStaysHeld, TestTwoEnginesOneRunIsBusy, TestWakeupDoesNotApprovePermission, TestMissingTokenIsUnauthorized, TestPathTraversalRejected, TestOversizedBodyIs413.
Impact: Approve and skip apply to one step. runstate.json and a unix flock survive restart. Wakeup does not approve permission holds. serve defaults to 127.0.0.1:8090 and requires a token off loopback unless --insecure. Non-unix builds keep only the in-process lock. deps/agent-native is 694b08c and deps/agent-intent is 3130190.
Refs: Q1 Q2 Q3 Q4 Q5 Q8 Q9 Q14 Q15 Q16
合入顺序：Intent → Native → Squad → Backend → Dev。本 PR 不合入。
本轮收尾（2026-10-03）
并行组每个成员先过审批和权限；确认、权限、质检的自由文本写入 steering 并保持挂起；分派失败时恢复 pending。补了 AtomicWrite 与 listenGuard 测试。CI 去掉错误的 Agent-Native/go.mod 断言。钉住 native 91c1556、intent 7f7879b。头提交 e928ea3。
合入、发版、分支保护与 SUBMODULE_TOKEN 仍由所有者执行。