Why: Task 10 requires Backend to consume the reviewed canonical renderer and its embedded organization-default candidate without copying assets.
Evidence: Fresh GOMODCACHE resolution loaded agent-document-renderer/profiles and passed its package tests at d449b9f779f2f968f8ac556b89940a6c9aaf3fdc.
Impact: Adds one immutable Renderer gitlink plus the local Go module require/replace; no production path changes yet.
Refs: Unified Document Renderer Task 10; Renderer d449b9f779f2f968f8ac556b89940a6c9aaf3fdc
Why: Integrate Backend origin/main 7aa6243 while retaining the product's mandatory trusted project-context startup contract.
Evidence: go test ./pkg/extension/... ./internal/app -count=1; go vet ./...; go test ./... -count=1; go build ./...; CGO_ENABLED=0 go build ./cmd/agent-system.
Impact: Keep the appOptions helper and exec-environment fallbacks while forwarding RequireProjectContext without loss.
Refs: 92f9286e6c4004074f014902f8b04554287ddfb2; 7aa624370a
Why: Integrate the exact Dev main pin while preserving trusted project context, vision routing, work-result context, and distinct migration identities.
Evidence: go vet ./...; go test ./... -count=1; go build ./...; CGO_ENABLED=0 go build ./cmd/agent-system; isolated PostgreSQL migration history tests.
Impact: Keep exec_env_layers at schema v35, move the feature migrations to v36-v46 in order, and fail closed on the old unpublished numbering.
Refs: 14e780c6fa32fdd4742b6232150c5efcb0d766ff; ab12fea474
Why: the sandbox hides /home and only remounts the resolved Python prefix, so executing python/current/bin/python3 failed before the base layer could be imported.
Evidence: go test ./internal/tools/ -run TestResolveInterpreterFollowsManagedSymlink passed, and env doctor against the built base layer printed doctor ok (SELF).
Impact: run_python and env doctor follow the symlink into the mounted prefix or /usr/bin/python3. The layer and the prefix mount stay the same.
Refs: Agent-System-Backend PR 207
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: pip --report - mixes Collecting progress and the JSON document on stdout, so the first base-layer resolve failed before any wheel was stored.
Evidence: go test ./internal/execenv/ passed on this worktree (SELF). A live dry-run of python-docx showed the progress text before the JSON object.
Impact: resolve reads report.json and ignores the progress stream. Package selection is unchanged.
Refs: Agent-System-Backend PR 207
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: RDM starts the server through extension.Main, which dropped ExecDepsDir, ExecWorkspace, and ExecEnvRoot, so a deployed product ignored the layered Python environment.
Evidence: go test ./pkg/extension/link/ passed on this worktree (SELF).
Impact: a product binary reads the same AGENT_SYSTEM_EXEC_* variables as the base CLI when its own flags are empty; explicit Options still win.
Refs: Agent-System-Dev PR 570
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Schema 35 adds exec_env_requests and exec_env_bindings. The SQLite-to-Postgres copier refuses to run when a business table is missing from its ordered list.
Evidence: SELF go test ./cmd/storage-migrate -run TestCopyOrderCoversAllFixtureTables. CI run 3343 failed on this exact check.
Impact: Those two tables move with the rest of the database. They have no foreign keys, so they can follow the existing recovery tables.
Refs: pull 206
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The sandbox hides the host home directory and has no network, so pip install --user cannot supply python-docx, and the service PATH resolved python3 to a linuxbrew path that does not exist inside the sandbox.
Evidence: SELF go test of execenv, tools, store, app, server, runmgr, config, and cmd/agent-system on this worktree. CI has not run.
Impact: Sessions inherit a read-only base layer. Extra packages are requested through python_env, auto-approved only from the allowlist, and mounted per conversation. Schema 35 adds the request and binding tables.
Refs: .task/feature-layered-python-env.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: a stale secret row was winning over a newly seeded chat key.
Evidence: CI run 3337 job vet-and-test success on 24bbb7b777.
Impact: system settings adopt a changed secret; conflicting plaintext is kept.
Refs: fix/model-key-secret-overlay
Why: The active secret_keys row overrides settings plaintext, so a replaced chat key kept returning 401. Migration also mutated the settings map in place, so clearing a matching plaintext never reached the database.
Evidence: go test ./internal/settings/ ./internal/runtime/ -count=1 (SELF, worktree).
Impact: System settings writes adopt a changed secret; conflicting plaintext is kept and logged; 401 errors name the key layer and an 8-hex fingerprint.
Refs: fix/model-key-secret-overlay
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Card registration or transcript persistence failures must not orphan paid work or discard a generated result, and ordinary questions must not match summary requests.
Evidence: Registration/promote and message-insert fault regressions, implicit-question checks and scoped race tests pass; legacy projection caching preserves historical times.
Impact: Fail before execution when tracking is unavailable, preserve full public final text with an explicit failure state, cache legacy projections once, and repair the concurrent material test fixture.
Refs: feature/workbench-flow-completion independent review closure
Why: A failed completion-card write could strand durable results, and routed messages could discard a selected result reference.
Evidence: Regressions cover missing projection recovery without execution, unavailable saved runs, pre-child dispatch failures and existing work/authorization paths.
Impact: Reconcile terminal saved results on authorized reads, keep known failures visible, and route explicit references through the conversation context.
Refs: feature/workbench-flow-completion review reliability and API findings
Why: A fresh question referencing an earlier result could be mistaken for a duplicate background request.
Evidence: The new English-summary reference regression failed with the old receipt branch and passes with the explicit-reference distinction.
Impact: Deduplicate inferred pending choices while allowing explicit new requests to use the saved result.
Refs: feature/workbench-flow-completion review P1
Why: Background notice runs blocked chat, truncated results, and duplicated deliverable execution.
Evidence: Focused run manager, card, server, recovery and race regressions pass locally; final combination checks are tracked in Dev.
Impact: Persist full results and optional choices, fence dispatch by run identity, retain public child process, and repair legacy projections without a schema change. No paid model trial was run.
Refs: feature/workbench-flow-completion
Why: The real local-mode product has authoritative project access without an enabled account-model row.
Evidence: The app suite passes; non-local missing or disabled accounts still fail closed.
Impact: Auth-off local acceptance can record a nonempty authorization epoch while authenticated deployments retain account-version binding.
Refs: TT-N03
Why: land current-turn image routing on backend main.
Evidence: vet-and-test success on 629c2502ad02e33708fe7ee39afd4b45d1b25483; parent pin 6532fad remains an ancestor.
Impact: vision routing is on backend main.
Refs: #203
Why: A generic conflict response hid whether source intake, authorization, or risk analysis blocked a formal command.
Evidence: The server suite passes with bounded domain reasons included in the conflict response.
Impact: Clients can present the actionable gate reason without exposing source contents.
Refs: TT-N03 TT-R01
Why: the backend pull request cannot merge while its head is behind main.
Evidence: origin/main 9fd0793 is one commit ahead of the pin already contained in 6532fad.
Impact: the parent gitlink stays on 6532fad, which remains reachable.
Refs: #203
Why: Direct HTTP and surface command dispatch could mutate RDM project facts without an analyzed committed-message manifest.
Evidence: Command-bus, server, and app suites pass with a classification regression for formal writes and read/proof exceptions.
Impact: Formal HTTP writes require a conversation anchor and committed proceed decision; surface writes fail closed until they can carry the same proof.
Refs: TT-N03 TT-R01
Why: Direct search, exec, fetch, and MCP providers could return project-driving results without entering the trusted source observation gate.
Evidence: App and run-manager suites pass with project runs confined to the audited runCtx tool path.
Impact: Non-project native runs retain configured tools; project runs fail closed until native result hooks can prove durable observation.
Refs: TT-N03 TT-R01
Why: Accepted retrieval and tool sources could become stale, and a pending HITL answer could release a changed source set.
Evidence: App and run-manager suites cover per-preflight resource verification, authorization epochs, and a second exact-source preflight after HITL.
Impact: Project work fails closed when authorization, source bytes, run binding, or the source watermark changes.
Refs: TT-N03 TT-R01
Why: The W4b verifier branch must include the current compiled-plugin host option surface before review.
Evidence: Focused extension, app, server, and command-bus tests pass after preserving both public API additions.
Impact: The public surface advances to 2.23.0-experimental and exposes both human-decision and compiled-plugin capabilities.
Refs: W4b human decision verifier
Why: An interrupted import cleanup removed the cmdbus core import while two human-decision files used an explicit alias.
Evidence: go test ./internal/cmdbus ./internal/server passes.
Impact: The backend worktree is buildable and consistently names the core package without behavior changes.
Refs: W4b human decision verifier
Why: the parent sync needs a backend commit that contains both vision routing and the current main pin.
Evidence: incoming pin 80bb123 is an ancestor of origin/main; merge keeps cfde38d.
Impact: backend gitlink can record one resolved commit.
Refs: feature/four-model-vision
Why: waitRunTerminal can return before run.completed is stored, so that event may land between the appended tool output and the child events.
Evidence: CI run 3274 failed twice on TestRunProcessEventsAreOrderedAndBoundToConversation with run.completed ahead of the child progress and result. Local go test of that test passed after this assertion.
Impact: the test still rejects leaked child tool output and still requires child progress then result, in that order.
Refs: Agent-System-Backend pulls/201
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The new confirmation table is additive, and the compatibility ledger must name that fact or the store suite rejects the schema.
Evidence: SELF go test ./internal/store/ -run TestMigrationCompatRegistered passed after the registration.
Impact: Old readers keep their current floor. They do not need to understand human decision rows.
Refs: W4b human confirmation design r1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A model-visible flag cannot prove that a person confirmed one proposal revision and payload hash.
Evidence: go test ./pkg/extension ./internal/app ./internal/server -run 'HumanDecision|SurfaceSnapshot|ResolveHuman|NaturalLanguage' passed locally.
Impact: SurfaceVersion 2.22.0-experimental adds HumanDecisionVerifier. Existing Host methods stay unchanged, and the base does not consume the proof.
Refs: W4b human confirmation design r1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A second broken pptx passed the shipped gate despite being unopenable
in Office: parts were all present but presentation.xml and the master used
an undeclared xmlns:r prefix, sldIdLst listed 12 slides while the rels file
wired only one, and [Content_Types].xml overrode only slide1. The prior
part-existence checks cannot see any of these; the generating instance also
predated the first gate deployment.
Evidence: The upgraded gate rejects the real broken file (undeclared
xmlns:r) and 16 synthetic break cases spanning both incident classes, while
passing the manually repaired package and kit output; python round-trip on
the repaired deck extracts all 12 slides. Full-suite receipt follows on the
task card.
Impact: register_artifact now enforces strict namespace declarations across
every XML part, bidirectional consistency between id-lists and relationships
(presentation and masters), and per-part content-type overrides. Error
messages name the broken reference. run_python prompt v3 adds that failed
kit attempts must retry through the kit, never fall back to hand assembly.
Refs: Dev task feature/pptx-gate-reference-integrity
Why: Uploaded images never reached the model, so a text-only chat model could be asked to read a picture it cannot see.
Evidence: go test ./internal/... passed locally before this commit. Image-link rejection is covered by vision package tests.
Impact: Current-turn attachments and fetched image links become image input. History keeps a text placeholder. Image turns swap to the configured vision model when the chat model is not in the capable list, and fallbacks are filtered the same way.
Refs: Agent-System-Dev feature/four-model-vision
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Project messages, retrieved evidence, tool results, and final replies must not affect model work or reach users before the domain risk decision is complete.
Evidence: RED tests proved the runner, final reply, and message deltas advanced before the gate; focused tests, go test -p 1 ./..., go build ./..., and isolated PostgreSQL runtime tests now pass.
Impact: Wire the optional RDM observer into project run start, retrieval, tool-result, HITL clarification, and final reply buffering; hosts without the optional provider keep existing behavior.
Refs: TT-N03, TT-R01; approved work-observation design and stage-five plan
Why: Project retrieval hits, tool results, and saved visible analysis must be individually traceable and fully analyzed before later project actions consume them.
Evidence: RED tests first showed missing run-source capture, tool-result capture, and run-wide preflight; go test -p 1 ./... and go build ./... passed; isolated PostgreSQL source, migration, audit, and context tests passed.
Impact: Persist actual run-bound sources with current-status checks and exact manifests behind the disabled X3 assembly gate; no live product path, migration, deployment, or release is enabled.
Refs: TT-N03, TT-R01; approved X3 stage-five plan r1
Why: A durable observation receipt must not be mistaken for completed risk analysis or permission to execute a project action.
Evidence: Exact-source preflight tests cover pending versus proceed, partial attachment, post-ACK source tampering, current authorization, and receipt idempotency; go test -p 1 ./... and go build ./... passed.
Impact: Add a fail-closed host preflight helper and per-message manifest read, still unwired to the public product path pending recovery and four-route coverage.
Refs: TT-N03, TT-R01; approved X3 design r1
Why: Project user messages and final assistant replies need exact, replayable source parts before a domain observer can safely analyze them.
Evidence: go test -p 1 ./... passed; isolated PostgreSQL outbox, audit, migration, and work-context tests passed against a temporary cluster; request dedup, fenced settlement rollback, authorization recheck, and receipt idempotency tests passed.
Impact: Add migration 44 and a private host outbox for committed message parts; actual observer delivery and action preflight are not yet wired into the product path.
Refs: TT-N03, TT-R01; approved X3 stage-five plan r1
Why: X3 must share one Backend surface with the X1 context and X2 audit candidates while current main now owns account migrations 32-34.
Evidence: go test -p 1 ./... and go build ./... passed on the merged tree; isolated PostgreSQL project audit, migration, and work-context tests passed against a temporary instance. Default parallel go test ./... had only the unrelated sandbox orphan timing test fail; its isolated ten-run replay passed.
Impact: Preserve account migrations 32-34, place X1/X2 migrations at 35-43, and retain account-effective write guards alongside project audit/context behavior. X3 observer remains a contract only.
Refs: TT-C01-TT-C04, TT-A01-TT-A04, TT-N03, TT-R01; combination probe d9b00c2
Why: Real project messages and retrieved material need a scoped observer and preflight decision contract before they can become governed project candidates.
Evidence: Registration denial test was RED before the implementation; go test ./... passed on Backend origin/main 2716b9e.
Impact: Add public X3 types and trusted single-provider registration; the production observer slot is deliberately not wired yet, so no project observation behavior is claimed.
Refs: TT-N03, TT-R01; approved work observation stage-five plan r1
Why: RDM's sandbox policy must run after HostOptions are merged and be able to refuse startup when bwrap is missing.
Evidence: go test ./pkg/extension/ ./cmd/agent-system/ -count=1 passed on this tree (SELF).
Impact: InProc.Prepare and PrepareCompiled; serve applies plugin rewrites before app.Run.
Refs: feature/svc-plugin-host-options
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: a composed base binary must apply plugin startup defaults and plugin-owned flags without a downstream main.
Evidence: go test ./pkg/extension/ ./cmd/agent-system/ -count=1 (SELF, this commit's parent tree plus these files).
Impact: blank-imported plugins can set HostOptions and a CLI hook; GET /api/registry gains a compiled id list; explicit serve flags still win.
Refs: plugins/registry compose deploy
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen
weichen