Why: I1 WP3 - chat routing and the HITL free-text pivot now share one
router consuming the library's command list, and both intent hosts
fold compatibility-equivalent input.
Evidence: go vet clean; go test ./... 30 packages ok, including the
existing workflow-route and server e2e suites unchanged (behavior
parity) and the new route package tests.
Impact: new internal/route package (unique router with explicit
priority rules); intentgate carries Commands and folds NFKC;
server.go and runmgr.go route through it; nested pins at intent
2554b50 and squad 6b7a991. Blueprint actions resolve to a squad
decision at the router level; per-run squad entry stays a recorded
follow-up (no silent misrouting).
Refs: Documents proposal 2026-10-07-agent-stack-n1q1i1-plans.md I1 WP3/WP4
Why: Agent-Squad PR #18 landed the nested agent-native WP5 bump;
backend must carry the same squad head or Dev check-pins fails.
Evidence: squad main head is the #18 merge; backend suite runs next.
Impact: Nested squad pin only.
Why: N1 WP5 host side - directRun.stop and the checklist reminders
now call the library gates package behind product ports, and the
nested native pin moves to the merged WP5 head.
Evidence: go vet clean; go test ./... 29 packages ok, including the
characterization suite unmodified and the new wp5_ab_test.go
(verify-cap continuation counts and gate-reason text parity).
Impact: llm.go drops the local regex family and deliverableGate;
verify.go drops checkDeliverables/parseVerdict/stripFence and the
local caps; workflow.go switches to gates.Verdict; reminders run
through gates.ProgressReminder. Behavior is pinned identical by the
existing suite plus the A/B tests. Squad reminders stay out of this
increment (adapter lacks per-member tool-turn signals - recorded as
WP6b).
Refs: Documents proposal 2026-10-07-agent-stack-n1q1i1-plans.md WP5/WP6
Why: N1 increment three host side - plugin agent assets must reject
hooks/mcp/permissionMode declarations (WP1 acceptance), and squad
members need the kernel ask port wired to the HITL card (WP4).
Evidence: go vet clean; go test ./... 29 packages ok, including new
agent-asset tests (banned keys located to the field, unknown keys,
missing id) and the V2 asset suite. Nested pins at native c5b9dca
(PR #18) and squad fc9620e (PR #17).
Impact: plugins agents/ assets now parse via parseAgentAsset
(strict JSON with banned-key rejection); PermissionAskOf exported
and takes any host with the optional method; app.go wires
cfg.PermissionAsk for the squad path. Legacy behavior unchanged when
nothing registers the port.
Refs: Documents proposal 2026-10-07-agent-stack-n1q1i1-plans.md WP1/WP4
Why: Agent-Squad PR #16 landed the nested agent-native bump; backend
must carry the same squad head or Dev check-pins fails.
Evidence: squad main head is the #16 merge; backend test suite runs
next.
Impact: Nested squad pin only.
Why: Library PR #17 landed on agent-native main as c2befaf; backend
compiles with the merged combination, not the pre-merge branch head.
Evidence: go vet and full go test run next; native main ancestry of
9758a8d verified before the pin bump.
Impact: Nested agent-native pin only.
Why: N1 WP2/WP3 host side - the kernel ask loop must reach the HITL
confirm card, and tool gating should run through the typed Policy with
the session-allow store port instead of a hand-built Request.
Evidence: go vet clean; go test ./... all packages ok, including new
TestConvAllowStoreKeysByName, TestPermissionAskRoutesToHITL, and
permissionAskOf tests. Nested agent-native pin at 9758a8d (PR #17).
Impact: runmgr.ExecuteTool decides via agentpolicy.Policy with
convAllowStore (keying unchanged: conversation x tool name);
runCtx.PermissionAsk routes kernel asks to the shared toolConfirmCard
HITL; direct and subagent loops pass PermissionAsk into the kernel
config (nil for hosts without the method, preserving legacy ask=reject).
Refs: Documents proposal 2026-10-07-agent-stack-n1q1i1-plans.md WP2/WP3; Agent-Native PR #17
Why: review of EXT-5 found a column-cap cell (common styled XFD cells) wrongly reported the 200k-cell cap and aborted every remaining worksheet; malformed sheet XML was also dropped silently, contradicting the explicit-failure contract; the legacy-office parser id was missing from the registry.
Evidence: local GOWORK=off go test ./... 29 packages pass with new regressions (wide column keeps later sheets, bad sheet XML warns, registry maps doc/xls/ppt); go vet clean; recorded as SELF on the Dev task card.
Impact: xlsxSheetBlocks returns wide/badXML signals; wide cells skip with a per-sheet warning, cell-cap truncation unchanged; builtin:legacy-office added to ParsersDescription.
Refs: review of backend 727f370; documents proposal 2026-10-06-ext-5-host-parse-document sect.2.
Why: downstream parsers are unreachable via extension.Host and the base lacked xlsx/pptx parsers; MS1 needs Excel and PPT ingest (EXT-5 request, documents proposal 2026-10-06-ext-5-host-parse-document).
Evidence: local GOWORK=off go test ./... all 29 packages pass incl. new ooxml_test (hand-built parts), ooxml_python_test (openpyxl/python-pptx round-trip), inproc owner-scope and limit tests, xlsx upload e2e; go vet clean; recorded as SELF on the Dev task card, PR CI to confirm.
Impact: Host gains ParseDocument (pure compute; errors only on ctx cancel or >100MiB input); builtin:xlsx (sheet order via workbook.xml rels, rich-text shared strings, formula cache, 1900/1904 dates, sparse cells) and builtin:pptx (sldIdLst order, titles, group shapes, AlternateContent Choice, tables, notes) added with 200k-cell/64MiB-part caps; legacy doc/xls/ppt get an actionable hint; ParsersDescription gains xlsx/pptx and the missing text ext; surface snapshot now records exported interface methods; docx part reads share the 64MiB cap.
Refs: documents 2026-10-06-ext-5-host-parse-document.md; EXT-1 host.go precedent.
Why: GET /api/conversations on the default unarchived view appended
AND archived=0. PostgreSQL stores conversations.archived as BOOLEAN
and rejects boolean = integer (42883), so listTasks returned 500.
The previous dialect fix bound parameters and scans but left this literal.
Evidence: before the change, TestConversationFlagsAndTaskList against
pg1 failed with SQLSTATE 42883. After: AGENT_PG_TEST_DSN set to pg1,
go test ./internal/store -count=1 passed; go vet ./... && go test ./...
passed on SQLite.
Impact: the default task list works on the postgres tier. SQLite still
binds the bool as 0/1. openTestStore accepts URL and keyword DSNs and
keeps public on search_path so an existing pg_trgm extension stays visible.
Refs: Agent-System-Dev feature/store-pg-archived-literal
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: user create/reset-password and conversation flag updates wrote 1/0
literals and boolInt ints into BOOLEAN columns; SQLite tolerates it,
PostgreSQL rejects with 42804. The 10-04 user create on pg1 failed midway
(empty password_hash, is_admin=f), and password reset, user list (bool
scanned into int) and login (GetUserAuthState scan) were all broken on
the postgres tier.
Evidence: store tests green; against the live pg1 the fixed CLI completes
user reset-password and user list (isAdmin=true, mustChangePassword=true,
hasPassword=true).
Impact: auth/account management and conversation list/flag paths work on
postgres; SQLite unchanged (0/1 converts via driver.Bool). No schema
changes.
Refs: dev-repo PR for gitlink bump (feature/store-pg-bool-dialect)
Why: Dev and the backend checkout must name the same core commit, and the section type is no longer a separate export.
Evidence: modules/core is 0b5c774. The nested checkout is detached at that commit.
Impact: Backend still compiles the same Go observation type. Only the TypeScript export changed.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The pin check requires Backend's squad gitlink to match Dev, and that squad commit must itself pin the message-shaping agent-native.
Evidence: Squad commit 5a57636 points agent-native at 3a110a7.
Impact: Backend and Dev resolve the same squad and native trees.
Refs: docs/records/2026-10-04-sillytavern-review.md
Why: Masks must not be the only copy of a key, and personal instructions, lore hits, and candidate replies have to reach the model without rewriting the system prefix or deleting history.
Evidence: go test ./internal/store ./internal/ctxasm ./internal/settings ./internal/runtime ./internal/server. Migration v16 upgrades and rolls back. Startup snapshots settings before moving raw keys.
Impact: One labeled key is active per service. Excluding a message hides its whole run from the model. Regenerating appends another candidate and rewinds files to the user turn. User slash commands expand to prompt text and do not fire on their own.
Refs: docs/records/2026-10-04-sillytavern-review.md
Why: The embedded tier starts without auth, and nothing checked Origin or Host, so a public bind or a foreign page could call write APIs.
Evidence: go test ./internal/config ./internal/server covering listen policy, origin rejection, and response headers.
Impact: Non-loopback without auth exits before opening the database. HTML artifacts get a sandbox CSP. Reverse proxies must list their public host in allowedHosts.
Refs: feature/sillytavern-review
Co-authored-by: Cursor <cursoragent@cursor.com>
Why:
The dev runtime switched to the PostgreSQL tier and every conversation
endpoint started returning 500. Migrations define
conversations.pinned/archived/allow_cross_read/cross_private and
users.must_change_password/is_admin as BOOLEAN on PostgreSQL but
INTEGER on SQLite, while the store layer compared them with 0/1
literals, scanned them into int, and wrote them via boolInt().
Under pgx these fail with 42883 (operator does not exist: boolean =
integer), bool encode errors, or 42804 (column is of type boolean but
expression is of type integer).
Evidence:
- parent-repo main 4fd03ee with AGENT_PG_TEST_DSN:
TestConversationFlagsAndTaskList and TestAdminAccountsAndSessions
fail with the errors above; live GET /api/conversations returned
"operator does not exist: boolean = integer (SQLSTATE 42883)".
- this branch: full ./internal/store suite green on the PostgreSQL
tier (AGENT_PG_TEST_DSN against a scratch database), pgbus green,
make test-backend green on the SQLite tier.
- scan into *bool and Go bool parameters are cross-dialect: pgx encodes
bool natively; database/sql converts bool<->0/1 for SQLite.
- pre-existing and out of scope: ./internal/runmgr PG integration tests
fail on main too (gin_trgm_ops invisible inside the search_path
isolation schema, 42704).
Impact:
Conversations list/detail/flags and user auth-state reads/writes now
work identically on both storage tiers; SQLite behavior is unchanged.
Refs: Dev task .task/fix-pg-boolean-columns.md
Why: A dotted-key PUT was stored beside the nested object and never read, so replacing a key kept the old pool. GET also returned tools.tavily.apiKeys in clear text, and saving settings would write the mask placeholder back over a real key.
Evidence: go test ./...
Impact: Dotted writes take effect on the next read. Startup expands stored dotted keys, and the existing nested value wins when both forms exist. GET masks schema secrets, including apiKeys. Writing the mask placeholder no longer overwrites a stored secret.
Refs: fix/settings-dotted-keys
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: workflow scripts and run_tool_script should share one Python host, while a slow MCP server must not block the first prompt.
Evidence: GOWORK=off go test ./internal/runtime/ ./internal/app/ ./internal/settings/ ./internal/tools/ ./internal/runmgr/
Impact: runtime.codeOrchestration defaults to false, so the tool stays hidden. Workflow script confirmation and its longer timeout cap stay as they were.
Refs: feature/code-orchestration
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: workspace writes had no checkpoint, and a 5xx before any output stopped the turn instead of trying the next configured model.
Evidence: GOWORK=off go test ./internal/runtime/ ./internal/runmgr/ ./internal/tools/ ./internal/settings/ ./internal/server/ ./internal/app/
Impact: models.chat.fallbacks defaults to empty, so existing runs keep their model. Rewind restores only tracked writes and appends a system note. Usage records the model that served.
Refs: feature/durable-rewind
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Those three branches were replayed onto origin/main after the first pin.
Evidence: native 0a52d9f, squad beea97e, and core cf7df54 each contain origin/main.
Impact: The backend build uses the same commits that will be merged.
Refs: feature/permission-hooks
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Plan mode has to block writes, confirmations dropped the argument preview, and direct chat did not share its stop gate with squad members.
Evidence: GOWORK=off go test ./internal/store/ ./internal/tools/ ./internal/runmgr/ ./internal/runtime/ ./internal/server/ passed. Default mode still runs write_artifact; plan mode rejects it.
Impact: Empty permission mode keeps the profile allow, deny, and confirm lists. High-risk shell commands now ask. There is no bypass-all mode.
Refs: feature/permission-hooks
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A dropped subscription had no retry hint, and a reconnect had no test that the gap is filled from the cursor.
Evidence: The stream starts with retry: 1000. A live publish is delivered, and Last-Event-ID after an overflow replay skips events the client already has.
Impact: EventSource waits one second before reconnecting. Persisted events are unchanged.
Refs: feature/runstate-shell
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The pin check requires backend's squad gitlink to match the Dev pin, and that squad commit carries the native context-engineering loop.
Evidence: deps/agent-squad is 4d53450, whose agent-native gitlink is 6fd1d44.
Impact: No backend behavior change beyond the shared native loop.
Refs: feature/context-engineering
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Byte truncation split UTF-8, subagent results could return unbounded text, and a write could overwrite a file that changed after it was read.
Evidence: cutRunes keeps a two-character Chinese prefix; tool selection honors -name; checklist reminders go through the reminder bus.
Impact: Tool output limits count characters. A subagent result over 32000 characters is stored as an artifact and the parent sees the path. fs_write_file rejects an existing file that was not read in this run.
Refs: feature/context-engineering
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The direct path never retried provider timeouts, so a single 429 failed the run.
Evidence: go test ./internal/settings/ ./internal/runtime/ passed. Default runtime.llmRetries is 2.
Impact: Retries happen only when the stream has not forwarded a delta. Injected test streams are not wrapped.
Refs: feature/llm-robustness
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen
