Why: the parent sync needs a backend commit that contains both vision routing and the current main pin.
Evidence: incoming pin 80bb123 is an ancestor of origin/main; merge keeps cfde38d.
Impact: backend gitlink can record one resolved commit.
Refs: feature/four-model-vision
Why: waitRunTerminal can return before run.completed is stored, so that event may land between the appended tool output and the child events.
Evidence: CI run 3274 failed twice on TestRunProcessEventsAreOrderedAndBoundToConversation with run.completed ahead of the child progress and result. Local go test of that test passed after this assertion.
Impact: the test still rejects leaked child tool output and still requires child progress then result, in that order.
Refs: Agent-System-Backend pulls/201
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The new confirmation table is additive, and the compatibility ledger must name that fact or the store suite rejects the schema.
Evidence: SELF go test ./internal/store/ -run TestMigrationCompatRegistered passed after the registration.
Impact: Old readers keep their current floor. They do not need to understand human decision rows.
Refs: W4b human confirmation design r1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A model-visible flag cannot prove that a person confirmed one proposal revision and payload hash.
Evidence: go test ./pkg/extension ./internal/app ./internal/server -run 'HumanDecision|SurfaceSnapshot|ResolveHuman|NaturalLanguage' passed locally.
Impact: SurfaceVersion 2.22.0-experimental adds HumanDecisionVerifier. Existing Host methods stay unchanged, and the base does not consume the proof.
Refs: W4b human confirmation design r1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Independent review found delegated account actions, stale resource policy, and role migration cutover gaps in the initial U4 implementation.
Evidence: Backend full SQLite suite passed; isolated PostgreSQL role and migration suite passed; independent final review found no remaining findings.
Impact: Enforces transactional system grants, current role snapshots, staged role import with v36 migration, and fail-closed activation.
Refs: feature/iam-u4-role-authority
Why: A second broken pptx passed the shipped gate despite being unopenable
in Office: parts were all present but presentation.xml and the master used
an undeclared xmlns:r prefix, sldIdLst listed 12 slides while the rels file
wired only one, and [Content_Types].xml overrode only slide1. The prior
part-existence checks cannot see any of these; the generating instance also
predated the first gate deployment.
Evidence: The upgraded gate rejects the real broken file (undeclared
xmlns:r) and 16 synthetic break cases spanning both incident classes, while
passing the manually repaired package and kit output; python round-trip on
the repaired deck extracts all 12 slides. Full-suite receipt follows on the
task card.
Impact: register_artifact now enforces strict namespace declarations across
every XML part, bidirectional consistency between id-lists and relationships
(presentation and masters), and per-part content-type overrides. Error
messages name the broken reference. run_python prompt v3 adds that failed
kit attempts must retry through the kit, never fall back to hand assembly.
Refs: Dev task feature/pptx-gate-reference-integrity
Why: Uploaded images never reached the model, so a text-only chat model could be asked to read a picture it cannot see.
Evidence: go test ./internal/... passed locally before this commit. Image-link rejection is covered by vision package tests.
Impact: Current-turn attachments and fetched image links become image input. History keeps a text placeholder. Image turns swap to the configured vision model when the chat model is not in the capable list, and fallbacks are filtered the same way.
Refs: Agent-System-Dev feature/four-model-vision
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Non-root managers need the system-management entry and controls to follow their explicit grants.
Evidence: The full Backend test suite passed and /api/me action projection is covered by the grant-isolation test.
Impact: /api/me now returns only the current actor system actions evaluated by the same authorizer.
Refs: Focused role and permission system task 7
Why: Existing RDM role commands must reach the Backend authority during UI and migration cutover without dual-writing RDM role tables.
Evidence: The full Backend suite passed, including actor-bound role administration, owner compatibility, provider, and public-surface tests.
Impact: Adds temporary trusted Host administration methods and completes the project-action catalog used by RDM.
Refs: Focused role and permission system task 5
Why: RDM needs a trusted, non-secret view of Backend-owned role policy without importing Backend internals or accepting a caller-supplied actor.
Evidence: The full Backend test suite passed, including public-surface and provider contract tests.
Impact: Adds optional extension surface 2.14 with actor-bound role snapshots and action decisions.
Refs: Focused role and permission system task 4
Why: System, role, and project entry permissions need explicit actions instead of a single administrator flag or unrestricted project creation.
Evidence: The full Backend test suite passed, including role APIs, action isolation, project.create denial/allow, storage migration coverage, and account write fences.
Impact: Adds versioned role and grant endpoints, maps account actions to explicit permissions, and requires project.create authority.
Refs: Focused role and permission system task 3
Why: Project messages, retrieved evidence, tool results, and final replies must not affect model work or reach users before the domain risk decision is complete.
Evidence: RED tests proved the runner, final reply, and message deltas advanced before the gate; focused tests, go test -p 1 ./..., go build ./..., and isolated PostgreSQL runtime tests now pass.
Impact: Wire the optional RDM observer into project run start, retrieval, tool-result, HITL clarification, and final reply buffering; hosts without the optional provider keep existing behavior.
Refs: TT-N03, TT-R01; approved work-observation design and stage-five plan
Why: Role assignment and permission changes must preserve one active position, version conflicts, idempotency, and the final policy manager.
Evidence: The full Store suite passed on SQLite and focused role/policy tests passed on isolated PostgreSQL.
Impact: Adds transactional role mutations and seeds explicit system grants for existing administrators.
Refs: Focused role and permission system task 2
Why: Backend needs a single trusted catalog and durable role authority before RDM can stop owning position data.
Evidence: Authz catalog tests and the full store suite passed on SQLite; migration rollback and one-active-role constraints are covered.
Impact: Adds schema v35 and stable role/binding types without changing existing authorization callers.
Refs: Focused role and permission system task 1
Why: Project retrieval hits, tool results, and saved visible analysis must be individually traceable and fully analyzed before later project actions consume them.
Evidence: RED tests first showed missing run-source capture, tool-result capture, and run-wide preflight; go test -p 1 ./... and go build ./... passed; isolated PostgreSQL source, migration, audit, and context tests passed.
Impact: Persist actual run-bound sources with current-status checks and exact manifests behind the disabled X3 assembly gate; no live product path, migration, deployment, or release is enabled.
Refs: TT-N03, TT-R01; approved X3 stage-five plan r1
Why: A durable observation receipt must not be mistaken for completed risk analysis or permission to execute a project action.
Evidence: Exact-source preflight tests cover pending versus proceed, partial attachment, post-ACK source tampering, current authorization, and receipt idempotency; go test -p 1 ./... and go build ./... passed.
Impact: Add a fail-closed host preflight helper and per-message manifest read, still unwired to the public product path pending recovery and four-route coverage.
Refs: TT-N03, TT-R01; approved X3 design r1
Why: Project user messages and final assistant replies need exact, replayable source parts before a domain observer can safely analyze them.
Evidence: go test -p 1 ./... passed; isolated PostgreSQL outbox, audit, migration, and work-context tests passed against a temporary cluster; request dedup, fenced settlement rollback, authorization recheck, and receipt idempotency tests passed.
Impact: Add migration 44 and a private host outbox for committed message parts; actual observer delivery and action preflight are not yet wired into the product path.
Refs: TT-N03, TT-R01; approved X3 stage-five plan r1
Why: X3 must share one Backend surface with the X1 context and X2 audit candidates while current main now owns account migrations 32-34.
Evidence: go test -p 1 ./... and go build ./... passed on the merged tree; isolated PostgreSQL project audit, migration, and work-context tests passed against a temporary instance. Default parallel go test ./... had only the unrelated sandbox orphan timing test fail; its isolated ten-run replay passed.
Impact: Preserve account migrations 32-34, place X1/X2 migrations at 35-43, and retain account-effective write guards alongside project audit/context behavior. X3 observer remains a contract only.
Refs: TT-C01-TT-C04, TT-A01-TT-A04, TT-N03, TT-R01; combination probe d9b00c2
Why: Real project messages and retrieved material need a scoped observer and preflight decision contract before they can become governed project candidates.
Evidence: Registration denial test was RED before the implementation; go test ./... passed on Backend origin/main 2716b9e.
Impact: Add public X3 types and trusted single-provider registration; the production observer slot is deliberately not wired yet, so no project observation behavior is claimed.
Refs: TT-N03, TT-R01; approved work observation stage-five plan r1
Why: RDM's sandbox policy must run after HostOptions are merged and be able to refuse startup when bwrap is missing.
Evidence: go test ./pkg/extension/ ./cmd/agent-system/ -count=1 passed on this tree (SELF).
Impact: InProc.Prepare and PrepareCompiled; serve applies plugin rewrites before app.Run.
Refs: feature/svc-plugin-host-options
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: a composed base binary must apply plugin startup defaults and plugin-owned flags without a downstream main.
Evidence: go test ./pkg/extension/ ./cmd/agent-system/ -count=1 (SELF, this commit's parent tree plus these files).
Impact: blank-imported plugins can set HostOptions and a CLI hook; GET /api/registry gains a compiled id list; explicit serve flags still win.
Refs: plugins/registry compose deploy
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The previous endpoint regression used an SQLite-only server fixture even when isolated PostgreSQL was configured.
Evidence: The revised HTTP test passed with dialect=sqlite and dialect=postgres; it creates data through one Store and reads through another before and after disabling the local account.
Impact: U3 effective-state checks for the new process replay route now have a direct two-store PostgreSQL regression without changing production behavior.
Refs: IAM U3 affected Stage 7 review; Backend PR #198
Why: Merging run-process visibility introduced a read endpoint that bypassed U3 effective-account checks when authentication was off.
Evidence: A new regression first returned HTTP 200 for disabled local; with entry and final response checks it passed, and the event pagination test passed ten repeated runs after anchoring to its appended event sequence.
Impact: Explicitly disabled local accounts cannot read stored process events; missing implicit local remains compatible.
Refs: IAM U3 Stage 8 integration review; Backend PR #198; main PR #199
Why: The SSE test canceled after 200 ms while filtering more than a thousand private events; CI and race builds stopped before the shared frame.
Evidence: The failure reproduced under go test -race with HTTP 200, no private leak, and no shared frame; after a two-second deadline the race case passed three times and the Server package passed.
Impact: The privacy assertion is unchanged and now reports which condition failed, while slower replay still reaches the event under test.
Refs: IAM U3 Stage 7; Backend PR #198; CI run 3170
Why: Spawned agent progress disappeared when the parent reply settled.
Evidence: go test ./...; run-event route test covers child status and raw-output exclusion.
Impact: Return child progress and result events in parent history without exposing child raw tool streams.
Refs: Agent-System-Dev feature/work-companion-visibility UI1
Why: The user asked to bring proven external skills for document
beautification and content enrichment into the system. Surveying GitHub,
skills.sh and ClawHub found the popular document-editing skills are
proprietary (Anthropic document skills forbid extraction and derivatives),
so the compliant picks are the permissively-licensed leaders: frontend-
design (Apache-2.0, 985.7K installs), canvas-design (Apache-2.0, official
example skill with bundled OFL fonts), copywriting and copy-editing (MIT,
54.7K stars).
Evidence: Seed-time open-spec validation passes for all four vendored
SKILL.md frontmatters (dogfooded by the existing seed tests); anthropic
skill bodies verified byte-identical to the pinned upstream snapshot
(dbd4588f); marketing skills trimmed only of unvendored sibling pointers
and eval artifacts, recorded in per-skill UPSTREAM.md with pinned SHAs;
new provenance test guards license files.
Impact: Built-in skills grow from four to eight and the binary embeds
about 6 MB of font assets; prompt library base.deliverables v9 exposes
the entry points. House-style stays authoritative for Office themes; the
new skills add visual direction, poster/infographic rendering and
copywriting craft. Seeds upgrade existing deployments on next start.
Refs: Dev task feature/vendor-popular-skills
Why: The U3 migration must replace the target schema seed with the source directory revision and cursor key.
Evidence: Isolated PostgreSQL TestMigrateEndToEndAndIdempotent passed with field-by-field source and target comparison.
Impact: Migration regressions that lose directory cursor identity now fail the existing end-to-end test.
Refs: IAM U3 Stage 7; docs/proposals/2026-10-14-iam-u3-account-contract-and-plan.md §10
Why: Completed replies currently drop access to streamed thinking and tool output.
Evidence: go test ./...; isolated run-event pagination and conversation binding test.
Impact: Add owner-scoped paginated event reading for a single conversation run.
Refs: Agent-System-Dev feature/work-companion-visibility UI1
Why: U3 seeds a directory revision in every new target database, which made an empty PostgreSQL target look occupied to the migration guard.
Evidence: Isolated PostgreSQL cmd/storage-migrate integration tests passed after the previously failing cases reproduced the error.
Impact: A fresh target remains eligible for migration; existing business rows and foreign migration identities still block it.
Refs: IAM U3 Stage 7; docs/proposals/2026-10-14-iam-u3-account-contract-and-plan.md §10
Why: The stage-6 browser proof must cover the real queued and failed-start user states.
Evidence: Two Playwright paths failed before fixture support, then passed; full Backend vet and Go tests passed.
Impact: Adds only task-owned mechanism fixture behavior under the live test tag.
Refs: U3 r0.5 independent review finding
Why: A provider-controlled finish reason could leak arbitrary content into the supposed content-free audit file.
Evidence: Red then green terminal-label regression and full Backend vet/Go test in Dev receipts.
Impact: Only evaluation records map unknown terminal labels to a finite class; tool execution rules are unchanged.
Refs: U3 r0.5 independent review finding
Why: The Backend composition must use the same Agent-Native revision through Squad.
Evidence: Dev task receipt for full Backend vet and Go test with pinned dependencies.
Impact: Updates only the Agent-Squad gitlink.
Refs: U3 r0.5 implementation plan Task 5
Why: The safe acknowledgement must be observed before fake findings arrive.
Evidence: Dev evidence receipt for ten browser scenarios and isolated PostgreSQL/Redis tests.
Impact: Changes only the task-owned zero-paid fixture delay.
Refs: U3 r0.5 implementation plan Task 4
Why: The controlled A01 record retained raw prompt/tool payload while lacking enough transport classification to explain the rejected tool terminal.
Evidence: TestEvaluationRecordsContentFreeTerminal and error-bearing terminal regressions failed before the change and passed after; full Backend vet/Go and selected zero-paid live-tag SELF receipt /tmp/fast-slow-u3-r05-task3-backend-full.json exited 0.
Impact: Pin Agent-Native 6a1dcdd, retain per-call Usage and safe terminal facts, remove future raw messages/tool declarations/terminal snapshots, and clear tools on an error terminal before forwarding. Historical trial artifacts remain untouched.
Refs: U3 r0.5 approved design and plan; Backend PR #193
Why: The first material reply could stream an unsupported numeric relationship before the sourced background card had any verified finding.
Evidence: Task 2 red/green SQLite run tests cover parent provider suppression, queue/reuse, completed source binding, focus retention, squad entry, failed/unknown state, and attempt ordering; full Backend vet/Go/race SELF receipt /tmp/fast-slow-u3-r05-task2-backend-final-v2.json exited 0.
Impact: Prestarted material sends receive one server-owned status message with zero parent model calls; small-text and explicit completed follow-up paths retain their existing runner. No public contract or model budget increases.
Refs: U3 r0.5 approved design and plan; Backend PR #193
Why: RDM delegated rename rebuilt the creator Host and could commit a Backend project rename after the delegated operator was disabled.
Evidence: SQLite and isolated PostgreSQL targeted checks cover operator/creator disable order, two processes, sorted locks, auth-off local compatibility, and HTTP/command Host wiring; exact committed-head replay remains pending.
Impact: Adds a request-bound single-project extension capability and checks operator plus creator in the final Backend transaction. Global ScopedHost cannot derive delegated authority; RDM cross-database atomicity remains outside the promise.
Refs: Approved Documents delegated-projection amendment 5783940, U3 A1-A4 candidate adcd8fe, Dev feature/iam-u3-account-directory-recovery.
weichen
weichen