Why: The stage-6 browser proof must cover the real queued and failed-start user states.
Evidence: Two Playwright paths failed before fixture support, then passed; full Backend vet and Go tests passed.
Impact: Adds only task-owned mechanism fixture behavior under the live test tag.
Refs: U3 r0.5 independent review finding
Why: A provider-controlled finish reason could leak arbitrary content into the supposed content-free audit file.
Evidence: Red then green terminal-label regression and full Backend vet/Go test in Dev receipts.
Impact: Only evaluation records map unknown terminal labels to a finite class; tool execution rules are unchanged.
Refs: U3 r0.5 independent review finding
Why: The safe acknowledgement must be observed before fake findings arrive.
Evidence: Dev evidence receipt for ten browser scenarios and isolated PostgreSQL/Redis tests.
Impact: Changes only the task-owned zero-paid fixture delay.
Refs: U3 r0.5 implementation plan Task 4
Why: The controlled A01 record retained raw prompt/tool payload while lacking enough transport classification to explain the rejected tool terminal.
Evidence: TestEvaluationRecordsContentFreeTerminal and error-bearing terminal regressions failed before the change and passed after; full Backend vet/Go and selected zero-paid live-tag SELF receipt /tmp/fast-slow-u3-r05-task3-backend-full.json exited 0.
Impact: Pin Agent-Native 6a1dcdd, retain per-call Usage and safe terminal facts, remove future raw messages/tool declarations/terminal snapshots, and clear tools on an error terminal before forwarding. Historical trial artifacts remain untouched.
Refs: U3 r0.5 approved design and plan; Backend PR #193
Why: The separately approved r0.4 trial must use its own bounded authorization label and output file, without reusing exhausted r0.3 artifacts.
Evidence: Both new label tests failed before the change and passed afterward; full Backend vet/Go suite and selected zero-paid live-tag budget/evaluation tests passed. No real provider call was made.
Impact: Evaluation-only selector and output name; production model routing, budgets and runtime behavior unchanged. Trial remains gated on fixed Dev CI and preflight.
Refs: U3 r0.4 one-time A01 resource approval in this conversation; Dev PR #512
Why: Preserve the accepted U7 account transaction and identity safeguards while retaining U3 material checkpoint startup ordering and runtime fixes.
Evidence: The shared app.go edits are in separate startup/account-maintenance sections; full Go and parent composition checks will be rerun after this merge.
Impact: Includes mainline account changes without changing U3 public contracts or model-call budget.
Refs: U3 r0.4 resource-preparation sync; Dev main 05b997b
Why: Missing Usage must stop a paid sequence before a tool terminal is executable; exact attachment names and host-owned choices must also remain reliable.
Evidence: Each reported behavior had a failing regression before its fix. Full Backend vet/Go tests, live-tag budget tests, ten race replays, and six task-owned HTTP/Playwright scenarios passed with the aligned Agent-Native and Agent-Squad pins.
Impact: Evaluation terminal accounting becomes durable before delivery; material fallback matches bounded filenames; ready choices use host options without redundant model fields. No new model calls or budget authorization.
Refs: U3 r0.4 independent review Critical 1 and Important 3-4
Why: Deliver U7 account transactions and audit without losing main auth_version, restricted-session, project or migration behavior.
Evidence: SELF go vet and all Go tests passed; isolated PostgreSQL store tests, 20 repeated two-process admission rounds, and real SIGTERM/SIGKILL persistence passed. Original failures remain in receipts; exact-head CI and independent Review follow.
Impact: Adds schema v31, noncreating account CLI opens, preflight credential output, same-transaction audit, and bootstrap admission guards. No live database touched.
Refs: Backend PR #185; Dev PR #486; original U7 r2 account specification; 2026-10-14 Root takeover
Why: The task-owned mechanism must reproduce stage progress, partial and empty failures, and source-bound choices without a paid provider call.
Evidence: Backend vet/full Go tests and live-tag terminal tests passed; six task-owned HTTP/Playwright cases passed with this fixture.
Impact: Evaluation fixture only; model comparison still disables notice turns unless the explicit mechanism browser flag is set.
Refs: U3 r0.4 Task 6
Why: the controlled A01 wrapper still allowed another paid request after a malformed tool terminal with returned Usage.
Evidence: local SSE RED→GREEN tests cover invalid JSON, missing DONE, late errors, missing Usage, rejected checkpoints, cross-run stop and record-write failure; live-tag fake tests and full Backend vet/tests pass.
Impact: diagnostic metadata and batch-wide fail-closed stop only; no new paid authorization or production route change.
Refs: U3 r0.4 design; internal/server/work_checkpoint_eval_test.go
Why: A future separately approved model trial must not reuse the consumed r0.2 label or overwrite its raw result.
Evidence: New label/output and 30000-token guard tests failed before implementation, then selected live-tag tests and Backend full Go suite passed.
Impact: Zero-paid evaluation entry only; its name does not grant resource approval or issue provider requests.
Refs: Dev task feature/fast-slow-u2-u3-plan; r0.3 plan Task 5
Why: Browser-level U3 validation must render a real host-normalized needs_user finding, not only source records.
Evidence: The new Playwright assertion failed against the previous fixture; selected live-tag mechanism and stop-rule tests pass.
Impact: Test-only fake stream adds an unsupported membership claim with source-indexed premises; no provider call.
Refs: Dev task feature/fast-slow-u2-u3-plan; r0.3 plan Task 4
Why: The current main adds private project member event handling that must coexist with U3 task projections.
Evidence: Resolved cardsvc and SSE conflicts; corrected atomic project-event proof placement after a compile RED; go test ./... -count=1 passed.
Impact: Preserve both private project visibility and task checkpoint behavior; no real-model rerun.
Refs: Backend PR #193; Dev task feature/fast-slow-u2-u3-plan
Why: One paid A01 run split into multiple prompt-fingerprint groups, and persisted Usage omitted real checkpoint tool calls.
Evidence: Stable-run grouping, missing-ID refusal and tool-call usage regressions failed before and passed after; full Go, race and live-fixture checks passed.
Impact: Future controlled evaluations count per-run calls and deadlines by host run identity and persist tool-call usage. The failed r0.2 A01 record is unchanged.
Refs: U3 r0.2 A01 independent replay, Task 6
Why:
Legacy project streams replayed upload filenames and parser metadata to newly
authorized members even though the underlying cards remained owner-only.
Evidence:
SELF real HTTP red regressions exposed legacy replay, spoofed sharing claims,
private-history pagination, and live delivery after membership removal. The
affected packages, uncached full Backend suite, isolated PostgreSQL Store suite,
and agent-system build pass after applying the event boundary.
Impact:
Registered lifecycle streams resolve trusted resource ownership and require an
internal publication proof for cross-owner delivery. Event and proof commit in
one transaction; v30 adds an additive SQLite/PostgreSQL sidecar without granting
access to historical events. Seen and visible cursors remain separate, revoked
members leave live streams, and unregistered base behavior remains compatible.
The storage migration tool preserves the new proof rows.
Refs:
project-member-access-implementation-plan.md Task 1 / R5; authorized legacy SSE
privacy follow-up; project-member-composed-legacy-project-history.json
Why: Reusing an exhausted authorization label would overwrite or misattribute the next controlled quality sample.
Evidence: New label/output and 30000-token guarded-run tests failed before implementation and passed after; full Backend Go suite passed.
Impact: The r0.2 A01 harness can be used only after separate resource approval, with an independent output name and existing two-run guard.
Refs: U3 quality implementation plan r0.2, Task 6 preparation
Why: The isolated fixture passed integer settings to a float64-only reader, so the intended output cap and retry policy were ineffective.
Evidence: numeric-settings regression failed before and passed after; go test ./... -count=1 and live-tag fixture tests passed.
Impact: Mechanism and future explicitly approved model evaluations use their stated per-call output cap and disabled retries.
Refs: U3 quality revision r0.2, browser mechanism failure
Why:
Nested unchanged credential masks left empty parents that looked like managed
subtree overwrites. Shared members also hit an owner-only upload guard, while
upload ingestion cards could disclose private filenames and parser metadata.
Evidence:
SELF independent nested-mask probe, HTTP nested/mixed writeback, member upload,
project card privacy and authorization-change regressions failed before each fix
and passed after it. Affected settings/server suite passed; exact final-object
build and independent replay remain delivery gates owned by the task coordinator.
Impact:
Prune only parents emptied by ignored masks; explicit empty/real managed writes
stay rejected. Registered uploads check live work and trusted project existence,
keep originals owned by the actor, and recheck before persistence. Suppress only
upload project cards when no private stream exists; explicit structure cards and
unregistered upload behavior remain available.
Refs:
Dev project-member-access plan r1 Task 1/R5; independent nested mask P2;
2026-10-13 composed member-upload and private project-stream acceptance findings
Why: The old source index repeated most of a three-document input and its test fixture depended on that duplicate layout.
Evidence: Source prefix, ID scope, parser revision, table, truncation and mechanism tests failed before the change and pass after; full runmgr tests pass.
Impact: Compact the material prompt without widening quote authority, and version the recipe so old results are not reused.
Refs: Agent-System-Backend#193; Agent-System-Dev#512
Why:
Legacy project metadata can contain credentials outside the settings scope table.
Sharing raw projection settings exposed them, and generic project PATCH bypassed
the system-managed path guard already enforced by project settings endpoints.
Evidence:
SELF member Host regression failed before the fix. The fixed 4f72aaf server
baseline overlay reproduced HTTP metadata leakage and managed PATCH returning 200.
SELF shared Host-to-HTTP, immutable mask, dotted/schema/fallback, public mutation
and atomic managed-write regressions passed; uncached full suite, isolated PG
Store suite and static build passed. Independent delta replay remains a gate.
Impact:
Registered lifecycle metadata returns detached credential-masked views while
preserving service/configuration keys and persisted data. Generic project PATCH
shares the existing managed validator before rename or settings mutation; allowed
metadata key shapes and raw owner-only management lookups remain available.
Refs:
Dev project-member-access plan r1 Task 1 and R5; approved hard secret boundary;
2026-10-13 shared project metadata review follow-up
Why:
Shared project reads previously doubled as write permission, project mutations
bypassed the domain lifecycle, and coarse retrieval shared private resources.
Evidence:
SELF red-before-implementation logs cover projection, lifecycle, private work,
resource filtering, canonical retrieval scope, publication source and namespace.
SELF go test ./..., isolated PostgreSQL go test ./internal/store -count=1,
and CGO_ENABLED=0 go build ./cmd/agent-system passed; task owner owns replay/CI.
Impact:
Add optional actor-scoped projection/lifecycle capabilities; registered providers
control public lifecycle and live work. Preserve owned conversation history and
ordinary unregistered behavior. Authorize knowledge by stored ID/source, map
current host scopes through trusted service metadata, and filter artifact lists.
Refs:
Dev project-member-access implementation plan r1 Task 1; approved design r0.1;
2026-10-13 trusted publication Source hardening ruling
Why: A rejected checkpoint did not stop a later paid request, and a history-only fix could miss JSON errors or other active runs.
Evidence: Source and JSON rejection fixtures failed before the instance-level guard, then passed with fail-closed and unrelated-tool checks; independent replay matched both real failed databases.
Impact: Read-only event correlation blocks future provider requests after a checkpoint rejection; original sample failure and stop-rule deviation remain recorded.
Refs: Agent-System-Backend#193; Agent-System-Dev#512
Why: An approved one-shot sample continued to a paid model call after a nonliteral quote was rejected, contrary to its stop rule.
Evidence: A zero-paid provider fixture failed before the guard and passed afterward; the original 14231-token deviation remains recorded.
Impact: Future controlled evaluations refuse subsequent provider requests after a checkpoint tool error; this does not reclassify the failed sample.
Refs: Agent-System-Backend#193; Agent-System-Dev#512
Why: The prior one-shot A01 result failed and its resource approval is exhausted.
Evidence: Follow-up authorization tests failed before the change and pass after; full Backend suite passes.
Impact: Only live evaluation harness gains a separate one-shot result and 30000-token run budget; production validation remains strict.
Refs: Agent-System-Backend#193; Agent-System-Dev#512
Why: Preserve the newest protected main for the combined review candidate.
Evidence: Exact incoming object fetched; affected checks will replay.
Impact: Retain both histories without relaxing source or task authority.
Refs: Dev main aa6364f
Why: The login recovery contract leftovers and KTD12/KTD14 require:
concurrent same-name account creation must not overwrite the winner,
first-admin bootstrap must serialize across processes, the redeem
endpoint backoff must be shared across instances, revoked API keys
must close established SSE streams, and CLI credentials need an
env-DSN path plus a non-interactive 0600 file delivery mode.
Evidence: go test ./... green; new tests cover 16-way concurrent
create (1 win/15 conflict, winner credentials intact), 8-way
concurrent bootstrap (single admin, refuse takeover after), redeem
guard shared across two store handles on one DB, SSE stream closed
after key revocation within the recheck window, and HTTP 429 after
the failure cap (SELF worktree run; CI is the GATE, PG via test-pg).
Impact: Migration v29 (redeem_attempts); CreateAccount becomes a
single-row INSERT with unique-violation conflict; BootstrapFirstAdmin
advisory-locks (PG) / rechecks (SQLite) and commits admin+key+audit in
one transaction; SSE revalidation covers API-key streams; redeem
backoff moves to the shared DB; CLI gains AGENT_SYSTEM_DSN fallback
and --out file delivery for create/reset-password/issue-login-key/
bootstrap-admin.
Refs: docs/svc-deploy/2026-10-13-login-recovery-contract.md leftovers;
proposal r2 KTD12/KTD14/R5/R11.
Why: Upstream now reserves model and mock settings for system authority.
Evidence: Complete merged Backend suite and live resource/cap guards pass.
Impact: Fixture-only startup configuration, same effective route and profile; no further paid calls.
Refs: Upstream scoped settings contract; U2/U3 evaluation
Why: Resolve the component conflict using the tested combined Core lineage.
Evidence: Both exact Core histories are included in beafd753; no source conflict in App or Server.
Impact: Preserve TaskSnapshot and upstream managed settings/session checks; composition replay follows.
Refs: Core beafd753; Backend main 741da4a0
Why: The user approved one additional A01 sample after the original six-case batch failed its quality gate.
Evidence: Live fixture tests preserve the production output cap and reject paid requests when a third actual run exists.
Impact: Evaluation-only case selection and resource guard; no production behavior changes, no automatic replay.
Refs: User approval 2026-10-13; reported token target 60000
Why: The 2026-10-13 login recovery contract (Dev docs/svc-deploy/
2026-10-13-login-recovery-contract.md, plan item 6.7) requires that
established SSE connections stop receiving private events once a
password write destroys their session.
Evidence: go test ./... green; TestSSESessionInvalidationClosesStream
streams over a real HTTP server, invalidates the session via
AdminResetUserPassword, and asserts the stream terminates with the
session-expired marker within the recheck window (SELF, worktree run).
Impact: Session-authenticated event streams revalidate at a 15s
heartbeat cadence (package var, shortened in tests) and terminate on
invalidation; API-key streams are unchanged (key revocation is separate).
EventSource reconnects are rejected by the auth middleware.
Refs: Dev PR #504; login recovery contract section 6.7.
Why: A reconciled task must not retain the old queue or running next step after becoming interrupted.
Evidence: Owned queue recovery failed before the fix; RunMgr, actual App startup and evaluation output-cap checks now pass.
Impact: Recovery uses the stopped-task next step, and the mechanism fixture quotes the actual acceptance source text.
Refs: Approved recovery contract; independent terminal-state review
Why: Authentic quotes do not establish an unstated approval, and the evaluation wrapper must honor tighter production output limits.
Evidence: Approval-overstatement and 780-token-cap regressions failed first; complete Backend suite and fixture cap checks now pass.
Impact: Render material records from trusted labels and validated quotations, reserve interpretation for explicit finding kinds, bump recipe identity and cap the fixture without overriding smaller limits.
Refs: Approved R05; independent model assessment; original failed samples preserved
Why: The first real-model sample batched discoveries, overcalled scope differences and exposed process chatter as a terminal conclusion.
Evidence: Preserve the failed A01 sample; process-text regression failed before the fix, then complete Backend and focused runtime checks passed.
Impact: Bump recipe identity, qualify quantities and approvals, exclude Process parts from canonical results and capture independent historical evaluation snapshots.
Refs: Approved U2/U3 plan; independent model review and native SELF receipts
Why: Delayed notices, plugin name collisions and startup recovery exposed stale sources or silently created new attempts; deletion lost search index cleanup.
Evidence: Meaningful red regressions and the corrected complete Backend suite passed; production startup was exercised through an isolated subprocess.
Impact: Revalidate notices at delivery, retain plugin dispatch, restore index cleanup and complete all service wiring before recovery and public intake. Scope fixture processes and wait for owned transcript writes.
Refs: Agent-System-Dev feature-fast-slow-u2-u3-plan; independent review findings 1-3 and startup supplement
Why: The login recovery contract (2026-10-13) requires admin-issued
one-time keys, in-transaction revalidation of restricted sessions, a
login race guard, and audited password writes; the previous
implementation validated sessions outside the change-password
transaction and let stale password verifications create sessions.
Evidence: go test ./... green (SQLite); store tests switch to
openTestStore so the CI test-pg job covers real PostgreSQL, including
100-way concurrent redeem single-winner and auth-version race cases
(SELF, local run).
Impact: New migration v28 (users/sessions.auth_version,
account_events). New admin endpoints POST/GET
/api/admin/users/{owner}/login-keys and DELETE
.../login-keys/{id}. Login binds session creation to the verified
auth version and creates restricted sessions for must-change accounts;
redeem gains per-IP backoff; cookies gain Secure under TLS; active
change-password and admin/CLI resets become single transactions that
bump auth_version, revoke keys and sessions, and write audit events.
Refs: modules/documents/docs/proposals/2026-10-12-svc-unified-deploy-and-login-key.md r2; Dev task feature/svc-login-recovery-flow
Why: Text with short attachments previously completed without starting the intended background material task.
Evidence: SELF real HTTP/browser reproduction shows the absent second task; runtime, manager and server regressions pass with the existing optional port connected.
Impact: Preserves dispatch timing and makes deferred intake observable; comparison records the baseline gap without rerunning a sample.
Refs: fast-slow-u2-u3 A02 and reading acceptance
Why: Opening a processed source must not show changed current bytes as the quoted version.
Evidence: SELF TaskSourceContent regression fails before and passes after expected-hash enforcement; artifact regressions and live compilation pass.
Impact: Optional content hash narrows the existing authorized artifact read; controlled fixtures select a genuinely provided quotation.
Refs: fast-slow-u2-u3 source-version acceptance
Why: Baseline and candidate must exercise their actual default prompts with identical route and resource limits.
Evidence: SELF live-tag compilation passes.
Impact: Evaluation harness only; normal automatic notice quality remains outside the controlled comparison.
Refs: fast-slow-u2-u3 Task 7
Why: The live harness must use the actual client constructor and preserve MiniMax reasoning separation.
Evidence: SELF live-tag compilation passes without provider calls.
Impact: Test harness only; no production route changes.
Refs: fast-slow-u2-u3 Task 7
Why: Real source-backed discoveries should reach the same task card before the slow channel completes.
Evidence: SELF receipts record runtime and manager checkpoint red-green tests, scoped source/version checks, privacy filtering, quota corrections, and SQLite/PG regressions; fixed composition and live comparison follow.
Impact: Adds a local material-only checkpoint sink with no summary model calls, uses version witnesses for source commits, and preserves existing reading and notification paths.
Refs: fast-slow-u2-u3 Tasks 6 and 7; test-only live HTTP harness bounds shared provider requests without approving HITL
Why: Background work needs consistent cards, events, and user reading state.
Evidence: SELF make evidence records SQLite rollback, projection, pin, and regression checks; PostgreSQL replay is pending the composition gate.
Impact: Adds an optional atomic task path and a consistent card replay cursor without schema changes.
Refs: Agent-System-Dev fast-slow-u2-u3 plan Task 3
Why: equal-length edits and parser changes must not reuse prior results.
Evidence: content identity and provided-source tests RED to GREEN; backend suite recorded through evidence.
Impact: trusted optional document origins, content keys and source catalog; no new routing or DB schema.
Refs: U2/U3 Task2
Why: creating an account and its activation key, and changing a password, were separate commits, so a crash could leave a user without a key or a new password with a still-valid login key.
Evidence: SELF go test ./internal/store including TestConcurrentCreateOneWinner, TestPasswordChangeIsAtomic, TestOpenExistingDoesNotMigrateOrCreate, and TestBootstrapRefusesExistingBusiness. PostgreSQL cases are NOT_RUN locally.
Impact: strict insert returns ErrConflict instead of overwriting. Account CLI opens an existing database without migrating. --dsn and --password still work and warn. capabilities --json does not touch the database.
Refs: docs/svc-deploy/u7-account-tx-audit.md
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen
