Why: composition consistency - the squad container advanced with the
frame-order repair; backend's nested copy (and its nested native) must
match so the composed chain carries the new event fields.
Evidence: pin only; squad and native verified per-unit.
Impact: nested gitlink pointer changes.
Refs: feature/agent-stack-audit-remediation-b2
Why: the U11C concurrent event plumbing exposed a data race between
runToolCtx writes and callback reads; -race failed the package on
fc0a050 but passed on its parent.
Evidence: full-package race run green (verify-u11cr.json, exit=0).
Impact: synchronization only; no behavior change.
Refs: feature/agent-stack-audit-remediation-b2 U11c repair
Why: F14 backend half - tool events used the tool name as the call id
and hardcoded status ok, so same-named tools could not be paired and
failures displayed as success; parallel callbacks shared artifact state.
Evidence: squad runner event tests pass (verify-u11c.json); pairing,
error mapping and legacy passthrough cases added; artifact list locked.
Impact: legacy empty-field events keep byte-identical output.
Refs: feature/agent-stack-audit-remediation-b2 U11c
Why: U11C consumes the new ProcessEvent CallID/Status/ErrorReason
fields; the backend container's nested copies must match the Dev pins
for U11c and check-pins.
Evidence: pin only; both libraries verified per-unit.
Impact: nested gitlink pointer changes.
Refs: feature/agent-stack-audit-remediation-b2
Why: composition consistency - Dev pins agent-native at the U3A tip
and agent-squad at the U3B/U4 tip; the backend container's nested
copies must match (check-pins).
Evidence: pin only; all libraries verified per-unit.
Impact: nested gitlink pointer changes.
Refs: feature/agent-stack-audit-remediation-b1
Why: the U6 admission test imported agent-intent directly from
internal/server, which lint-boundaries forbids (only intentgate,
intentsem and the squad intent adapter may import it).
Evidence: repair receipt success; server/intentgate/route tests pass
(verify-u6r.json); fixtures moved behind intentgate helpers.
Impact: test-only rework plus a small intentgate fixture helper.
Refs: feature/agent-stack-audit-remediation-b1 U6 repair
Why: F10 - any handler error became a no-side-effect rejected receipt
and an audit-store failure dropped the generated operation ID, losing
the reconciliation handle and inviting unsafe retries.
Evidence: cmdbus tests pass (verify-u7b.json); post-execution-unknown,
audit-failure-keeps-ID and confirmation-idempotency cases added.
Impact: unknown receipts now carry the trusted operation ID via the
U7A constructor; rejected stays ID-free; no auto-replay anywhere.
Refs: feature/agent-stack-audit-remediation-b1 U7B
Why: F09 - invalid slot information was dropped at the gate, the router
saw only Start, and the command entrance passed untyped text, so
invalid-slot recognitions could still reach business execution paths.
Evidence: intentgate/route/server tests pass (verify-u6.json);
admission regression cases added.
Impact: invalid or missing slots never start executable actions;
clarification flows unchanged; cmdbus confirmation untouched.
Refs: feature/agent-stack-audit-remediation-b1 U6
Why: U6 needs the authoritative recognition result with full slot
validation and isolated snapshots landed by U5.
Evidence: pin only; library verified in deps/agent-intent (verify-u5).
Impact: nested gitlink pointer change.
Refs: feature/agent-stack-audit-remediation-b1
Why: F13 - the squad factory read the default account with an empty
project, pairing the run user's model name with another account's
endpoint and credentials; direct and squad paths disagreed on
reasoning split and route contract.
Evidence: app/runtime/squadadapter tests pass (verify-u10b.json);
run-scoped snapshot, project override, profile override and
fail-closed cases added with synthetic keys.
Impact: squad execution now uses the same effective-config rules as
the direct path; default setups unchanged.
Refs: feature/agent-stack-audit-remediation-b1 U10
POST /api/surfaces with an empty surfaceId now requires a conversationId
that belongs to the caller: empty returns 400, missing or another owner's
conversation returns 404. Revisions keep the previous behavior. Without
this check a direct API caller could create a project-less surface and
skip the project lifecycle gate on actions.
Why: an empty conversationId produced surfaces with no project ownership.
Evidence: agent-exec unit backend-surface-submit-conversation-required (pi, attempt 1 after authorized rerun, terminal=success); go test ./internal/server/... ./internal/surfacesvc/... .
Impact: HTTP create-surface validation only.
Refs: Dev task fix/svc-superadmin-envfile-surface-conv.
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the three cards whose PRs are merged (Backend #212, #226, #237) were
still sitting at .task/ top level, which keeps the main checkout reporting
card debt. Only the status line and the merge fact were added; the historical
record inside each card is untouched.
Evidence: Gitea API for PRs 212/226/237 all report state=closed merged=true
(merge commits 56a7f9f440, 508288fbed, f084d10aa5); triage receipt
/tmp/be-triage-cardclose-20261021.json (verdict NEW).
Impact: .task bookkeeping only; no code change, no submodule pin change.
Refs: fix/close-merged-task-cards
Why: the card must record the scope, the (r1 scope-expansion -> granted
expansion -> r2 success) trajectory, and the rebase onto 241e1b3 before delivery.
Evidence: /tmp/be-runhitl-impl-r2-20261021.json (pi, success, transport 789f67f);
no PR/merge facts yet.
Impact: card metadata only; no behaviour change.
Refs: fix/resolve-hitl-run-status-ordering
Why: the project access and lifecycle units (U1 role narrowing to a single
project-access boolean, U2 creator authority, U3 member history, U4 project
work states) were implemented and pushed on this line but never landed on
Backend main, so Dev's pinned Backend does not contain them.
Evidence: merge is conflict-free against current origin/main; full
vet-and-test runs on the merge commit.
Impact: Backend only. RDM side is delivered separately.
Refs: Dev PR #634.
weichen
