Why: composition consistency - Dev pins agent-native at the U3A tip
and agent-squad at the U3B/U4 tip; the backend container's nested
copies must match (check-pins).
Evidence: pin only; all libraries verified per-unit.
Impact: nested gitlink pointer changes.
Refs: feature/agent-stack-audit-remediation-b1
Why: the U6 admission test imported agent-intent directly from
internal/server, which lint-boundaries forbids (only intentgate,
intentsem and the squad intent adapter may import it).
Evidence: repair receipt success; server/intentgate/route tests pass
(verify-u6r.json); fixtures moved behind intentgate helpers.
Impact: test-only rework plus a small intentgate fixture helper.
Refs: feature/agent-stack-audit-remediation-b1 U6 repair
Why: F10 - any handler error became a no-side-effect rejected receipt
and an audit-store failure dropped the generated operation ID, losing
the reconciliation handle and inviting unsafe retries.
Evidence: cmdbus tests pass (verify-u7b.json); post-execution-unknown,
audit-failure-keeps-ID and confirmation-idempotency cases added.
Impact: unknown receipts now carry the trusted operation ID via the
U7A constructor; rejected stays ID-free; no auto-replay anywhere.
Refs: feature/agent-stack-audit-remediation-b1 U7B
Why: F09 - invalid slot information was dropped at the gate, the router
saw only Start, and the command entrance passed untyped text, so
invalid-slot recognitions could still reach business execution paths.
Evidence: intentgate/route/server tests pass (verify-u6.json);
admission regression cases added.
Impact: invalid or missing slots never start executable actions;
clarification flows unchanged; cmdbus confirmation untouched.
Refs: feature/agent-stack-audit-remediation-b1 U6
Why: U6 needs the authoritative recognition result with full slot
validation and isolated snapshots landed by U5.
Evidence: pin only; library verified in deps/agent-intent (verify-u5).
Impact: nested gitlink pointer change.
Refs: feature/agent-stack-audit-remediation-b1
Why: F13 - the squad factory read the default account with an empty
project, pairing the run user's model name with another account's
endpoint and credentials; direct and squad paths disagreed on
reasoning split and route contract.
Evidence: app/runtime/squadadapter tests pass (verify-u10b.json);
run-scoped snapshot, project override, profile override and
fail-closed cases added with synthetic keys.
Impact: squad execution now uses the same effective-config rules as
the direct path; default setups unchanged.
Refs: feature/agent-stack-audit-remediation-b1 U10
Why: the port's authorization boundary, the build correction and the review
verdict must be recorded before delivery.
Evidence:
/tmp/be-iam-perm-ux-impl-r1-20261021.json: pi, success (port)
/tmp/be-iam-perm-ux-buildfix-r2-20261021.json: pi, success (build fix;
r1 failed-unknown produced no record so nothing was imported)
/tmp/be-iam-perm-ux-review-r1-20261021.json: pi, PASS, no blockers
Host-side checks on the final head: gofmt -l clean; go build ./... and
go vet on store/server/authz silent; go test on those packages green.
Impact: card metadata only.
Refs: fix/iam-perm-ux-port; backup /home/weichen/projects/backups/iam-perm-ux-20261021T140345Z
POST /api/surfaces with an empty surfaceId now requires a conversationId
that belongs to the caller: empty returns 400, missing or another owner's
conversation returns 404. Revisions keep the previous behavior. Without
this check a direct API caller could create a project-less surface and
skip the project lifecycle gate on actions.
Why: an empty conversationId produced surfaces with no project ownership.
Evidence: agent-exec unit backend-surface-submit-conversation-required (pi, attempt 1 after authorized rerun, terminal=success); go test ./internal/server/... ./internal/surfacesvc/... .
Impact: HTTP create-surface validation only.
Refs: Dev task fix/svc-superadmin-envfile-surface-conv.
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the three cards whose PRs are merged (Backend #212, #226, #237) were
still sitting at .task/ top level, which keeps the main checkout reporting
card debt. Only the status line and the merge fact were added; the historical
record inside each card is untouched.
Evidence: Gitea API for PRs 212/226/237 all report state=closed merged=true
(merge commits 56a7f9f440, 508288fbed, f084d10aa5); triage receipt
/tmp/be-triage-cardclose-20261021.json (verdict NEW).
Impact: .task bookkeeping only; no code change, no submodule pin change.
Refs: fix/close-merged-task-cards
Why: the card must record the scope, the (r1 scope-expansion -> granted
expansion -> r2 success) trajectory, and the rebase onto 241e1b3 before delivery.
Evidence: /tmp/be-runhitl-impl-r2-20261021.json (pi, success, transport 789f67f);
no PR/merge facts yet.
Impact: card metadata only; no behaviour change.
Refs: fix/resolve-hitl-run-status-ordering
Why: the project access and lifecycle units (U1 role narrowing to a single
project-access boolean, U2 creator authority, U3 member history, U4 project
work states) were implemented and pushed on this line but never landed on
Backend main, so Dev's pinned Backend does not contain them.
Evidence: merge is conflict-free against current origin/main; full
vet-and-test runs on the merge commit.
Impact: Backend only. RDM side is delivered separately.
Refs: Dev PR #634.
weichen
agent-exec-transport