Why: U9 base public contract for the regulations knowledge base.
Evidence: CI success on f3d2698d (after syncing main) (ci/vet-and-test, governance).
Impact: Additive optional capability; SurfaceVersion 2.15.0-experimental.
Refs: .task/feature-regulations-kb-ext20.md
Why: the sandbox hides /home and only remounts the resolved Python prefix, so executing python/current/bin/python3 failed before the base layer could be imported.
Evidence: go test ./internal/tools/ -run TestResolveInterpreterFollowsManagedSymlink passed, and env doctor against the built base layer printed doctor ok (SELF).
Impact: run_python and env doctor follow the symlink into the mounted prefix or /usr/bin/python3. The layer and the prefix mount stay the same.
Refs: Agent-System-Backend PR 207
Co-authored-by: Cursor <cursoragent@cursor.com>
(cherry picked from commit 28544cfe5d)
Why: the sandbox hides /home and only remounts the resolved Python prefix, so executing python/current/bin/python3 failed before the base layer could be imported.
Evidence: go test ./internal/tools/ -run TestResolveInterpreterFollowsManagedSymlink passed, and env doctor against the built base layer printed doctor ok (SELF).
Impact: run_python and env doctor follow the symlink into the mounted prefix or /usr/bin/python3. The layer and the prefix mount stay the same.
Refs: Agent-System-Backend PR 207
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: pip --report - mixes Collecting progress and the JSON document on stdout, so the first base-layer resolve failed before any wheel was stored.
Evidence: go test ./internal/execenv/ passed on this worktree (SELF). A live dry-run of python-docx showed the progress text before the JSON object.
Impact: resolve reads report.json and ignores the progress stream. Package selection is unchanged.
Refs: Agent-System-Backend PR 207
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: RDM starts the server through extension.Main, which dropped ExecDepsDir, ExecWorkspace, and ExecEnvRoot, so a deployed product ignored the layered Python environment.
Evidence: go test ./pkg/extension/link/ passed on this worktree (SELF).
Impact: a product binary reads the same AGENT_SYSTEM_EXEC_* variables as the base CLI when its own flags are empty; explicit Options still win.
Refs: Agent-System-Dev PR 570
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Schema 35 adds exec_env_requests and exec_env_bindings. The SQLite-to-Postgres copier refuses to run when a business table is missing from its ordered list.
Evidence: SELF go test ./cmd/storage-migrate -run TestCopyOrderCoversAllFixtureTables. CI run 3343 failed on this exact check.
Impact: Those two tables move with the rest of the database. They have no foreign keys, so they can follow the existing recovery tables.
Refs: pull 206
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The sandbox hides the host home directory and has no network, so pip install --user cannot supply python-docx, and the service PATH resolved python3 to a linuxbrew path that does not exist inside the sandbox.
Evidence: SELF go test of execenv, tools, store, app, server, runmgr, config, and cmd/agent-system on this worktree. CI has not run.
Impact: Sessions inherit a read-only base layer. Extra packages are requested through python_env, auto-approved only from the allowlist, and mounted per conversation. Schema 35 adds the request and binding tables.
Refs: .task/feature-layered-python-env.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: a stale secret row was winning over a newly seeded chat key.
Evidence: CI run 3337 job vet-and-test success on 24bbb7b777.
Impact: system settings adopt a changed secret; conflicting plaintext is kept.
Refs: fix/model-key-secret-overlay
Why: The active secret_keys row overrides settings plaintext, so a replaced chat key kept returning 401. Migration also mutated the settings map in place, so clearing a matching plaintext never reached the database.
Evidence: go test ./internal/settings/ ./internal/runtime/ -count=1 (SELF, worktree).
Impact: System settings writes adopt a changed secret; conflicting plaintext is kept and logged; 401 errors name the key layer and an 8-hex fingerprint.
Refs: fix/model-key-secret-overlay
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Card registration or transcript persistence failures must not orphan paid work or discard a generated result, and ordinary questions must not match summary requests.
Evidence: Registration/promote and message-insert fault regressions, implicit-question checks and scoped race tests pass; legacy projection caching preserves historical times.
Impact: Fail before execution when tracking is unavailable, preserve full public final text with an explicit failure state, cache legacy projections once, and repair the concurrent material test fixture.
Refs: feature/workbench-flow-completion independent review closure
Why: A failed completion-card write could strand durable results, and routed messages could discard a selected result reference.
Evidence: Regressions cover missing projection recovery without execution, unavailable saved runs, pre-child dispatch failures and existing work/authorization paths.
Impact: Reconcile terminal saved results on authorized reads, keep known failures visible, and route explicit references through the conversation context.
Refs: feature/workbench-flow-completion review reliability and API findings
Why: A fresh question referencing an earlier result could be mistaken for a duplicate background request.
Evidence: The new English-summary reference regression failed with the old receipt branch and passes with the explicit-reference distinction.
Impact: Deduplicate inferred pending choices while allowing explicit new requests to use the saved result.
Refs: feature/workbench-flow-completion review P1
Why: Background notice runs blocked chat, truncated results, and duplicated deliverable execution.
Evidence: Focused run manager, card, server, recovery and race regressions pass locally; final combination checks are tracked in Dev.
Impact: Persist full results and optional choices, fence dispatch by run identity, retain public child process, and repair legacy projections without a schema change. No paid model trial was run.
Refs: feature/workbench-flow-completion
Why: land current-turn image routing on backend main.
Evidence: vet-and-test success on 629c2502ad02e33708fe7ee39afd4b45d1b25483; parent pin 6532fad remains an ancestor.
Impact: vision routing is on backend main.
Refs: #203
Why: the backend pull request cannot merge while its head is behind main.
Evidence: origin/main 9fd0793 is one commit ahead of the pin already contained in 6532fad.
Impact: the parent gitlink stays on 6532fad, which remains reachable.
Refs: #203
Why: the parent sync needs a backend commit that contains both vision routing and the current main pin.
Evidence: incoming pin 80bb123 is an ancestor of origin/main; merge keeps cfde38d.
Impact: backend gitlink can record one resolved commit.
Refs: feature/four-model-vision
Why: waitRunTerminal can return before run.completed is stored, so that event may land between the appended tool output and the child events.
Evidence: CI run 3274 failed twice on TestRunProcessEventsAreOrderedAndBoundToConversation with run.completed ahead of the child progress and result. Local go test of that test passed after this assertion.
Impact: the test still rejects leaked child tool output and still requires child progress then result, in that order.
Refs: Agent-System-Backend pulls/201
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A second broken pptx passed the shipped gate despite being unopenable
in Office: parts were all present but presentation.xml and the master used
an undeclared xmlns:r prefix, sldIdLst listed 12 slides while the rels file
wired only one, and [Content_Types].xml overrode only slide1. The prior
part-existence checks cannot see any of these; the generating instance also
predated the first gate deployment.
Evidence: The upgraded gate rejects the real broken file (undeclared
xmlns:r) and 16 synthetic break cases spanning both incident classes, while
passing the manually repaired package and kit output; python round-trip on
the repaired deck extracts all 12 slides. Full-suite receipt follows on the
task card.
Impact: register_artifact now enforces strict namespace declarations across
every XML part, bidirectional consistency between id-lists and relationships
(presentation and masters), and per-part content-type overrides. Error
messages name the broken reference. run_python prompt v3 adds that failed
kit attempts must retry through the kit, never fall back to hand assembly.
Refs: Dev task feature/pptx-gate-reference-integrity
Why: Uploaded images never reached the model, so a text-only chat model could be asked to read a picture it cannot see.
Evidence: go test ./internal/... passed locally before this commit. Image-link rejection is covered by vision package tests.
Impact: Current-turn attachments and fetched image links become image input. History keeps a text placeholder. Image turns swap to the configured vision model when the chat model is not in the capable list, and fallbacks are filtered the same way.
Refs: Agent-System-Dev feature/four-model-vision
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: RDM's sandbox policy must run after HostOptions are merged and be able to refuse startup when bwrap is missing.
Evidence: go test ./pkg/extension/ ./cmd/agent-system/ -count=1 passed on this tree (SELF).
Impact: InProc.Prepare and PrepareCompiled; serve applies plugin rewrites before app.Run.
Refs: feature/svc-plugin-host-options
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: a composed base binary must apply plugin startup defaults and plugin-owned flags without a downstream main.
Evidence: go test ./pkg/extension/ ./cmd/agent-system/ -count=1 (SELF, this commit's parent tree plus these files).
Impact: blank-imported plugins can set HostOptions and a CLI hook; GET /api/registry gains a compiled id list; explicit serve flags still win.
Refs: plugins/registry compose deploy
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The previous endpoint regression used an SQLite-only server fixture even when isolated PostgreSQL was configured.
Evidence: The revised HTTP test passed with dialect=sqlite and dialect=postgres; it creates data through one Store and reads through another before and after disabling the local account.
Impact: U3 effective-state checks for the new process replay route now have a direct two-store PostgreSQL regression without changing production behavior.
Refs: IAM U3 affected Stage 7 review; Backend PR #198
Why: Merging run-process visibility introduced a read endpoint that bypassed U3 effective-account checks when authentication was off.
Evidence: A new regression first returned HTTP 200 for disabled local; with entry and final response checks it passed, and the event pagination test passed ten repeated runs after anchoring to its appended event sequence.
Impact: Explicitly disabled local accounts cannot read stored process events; missing implicit local remains compatible.
Refs: IAM U3 Stage 8 integration review; Backend PR #198; main PR #199
Why: The SSE test canceled after 200 ms while filtering more than a thousand private events; CI and race builds stopped before the shared frame.
Evidence: The failure reproduced under go test -race with HTTP 200, no private leak, and no shared frame; after a two-second deadline the race case passed three times and the Server package passed.
Impact: The privacy assertion is unchanged and now reports which condition failed, while slower replay still reaches the event under test.
Refs: IAM U3 Stage 7; Backend PR #198; CI run 3170
Why: Spawned agent progress disappeared when the parent reply settled.
Evidence: go test ./...; run-event route test covers child status and raw-output exclusion.
Impact: Return child progress and result events in parent history without exposing child raw tool streams.
Refs: Agent-System-Dev feature/work-companion-visibility UI1
Why: The user asked to bring proven external skills for document
beautification and content enrichment into the system. Surveying GitHub,
skills.sh and ClawHub found the popular document-editing skills are
proprietary (Anthropic document skills forbid extraction and derivatives),
so the compliant picks are the permissively-licensed leaders: frontend-
design (Apache-2.0, 985.7K installs), canvas-design (Apache-2.0, official
example skill with bundled OFL fonts), copywriting and copy-editing (MIT,
54.7K stars).
Evidence: Seed-time open-spec validation passes for all four vendored
SKILL.md frontmatters (dogfooded by the existing seed tests); anthropic
skill bodies verified byte-identical to the pinned upstream snapshot
(dbd4588f); marketing skills trimmed only of unvendored sibling pointers
and eval artifacts, recorded in per-skill UPSTREAM.md with pinned SHAs;
new provenance test guards license files.
Impact: Built-in skills grow from four to eight and the binary embeds
about 6 MB of font assets; prompt library base.deliverables v9 exposes
the entry points. House-style stays authoritative for Office themes; the
new skills add visual direction, poster/infographic rendering and
copywriting craft. Seeds upgrade existing deployments on next start.
Refs: Dev task feature/vendor-popular-skills
Why: The U3 migration must replace the target schema seed with the source directory revision and cursor key.
Evidence: Isolated PostgreSQL TestMigrateEndToEndAndIdempotent passed with field-by-field source and target comparison.
Impact: Migration regressions that lose directory cursor identity now fail the existing end-to-end test.
Refs: IAM U3 Stage 7; docs/proposals/2026-10-14-iam-u3-account-contract-and-plan.md §10
Why: Completed replies currently drop access to streamed thinking and tool output.
Evidence: go test ./...; isolated run-event pagination and conversation binding test.
Impact: Add owner-scoped paginated event reading for a single conversation run.
Refs: Agent-System-Dev feature/work-companion-visibility UI1
Why: U3 seeds a directory revision in every new target database, which made an empty PostgreSQL target look occupied to the migration guard.
Evidence: Isolated PostgreSQL cmd/storage-migrate integration tests passed after the previously failing cases reproduced the error.
Impact: A fresh target remains eligible for migration; existing business rows and foreign migration identities still block it.
Refs: IAM U3 Stage 7; docs/proposals/2026-10-14-iam-u3-account-contract-and-plan.md §10
Why: RDM delegated rename rebuilt the creator Host and could commit a Backend project rename after the delegated operator was disabled.
Evidence: SQLite and isolated PostgreSQL targeted checks cover operator/creator disable order, two processes, sorted locks, auth-off local compatibility, and HTTP/command Host wiring; exact committed-head replay remains pending.
Impact: Adds a request-bound single-project extension capability and checks operator plus creator in the final Backend transaction. Global ScopedHost cannot derive delegated authority; RDM cross-database atomicity remains outside the promise.
Refs: Approved Documents delegated-projection amendment 5783940, U3 A1-A4 candidate adcd8fe, Dev feature/iam-u3-account-directory-recovery.
Why: The backfill contract test used a fake PK-magic docx as its fixture;
the new registration structural gate correctly refuses that shape, so the
contract was no longer exercised.
Evidence: The three affected runmgr tests pass locally with -count=1;
the full combined suite receipt follows on the task card.
Impact: Test fixture only; the gate behavior under test is unchanged.
Refs: Dev task feature/pptx-register-structural-gate
Why: An agent bypassing the housestyle kit hand-assembled OOXML with
zipfile; the resulting pptx lacked masters, theme and docProps. Text
extraction succeeded and every existing check passed, so a package that
Office refuses to open reached the user as a deliverable.
Evidence: Focused Go suite covers a valid minimal pptx, the incident-
shaped package, nine chain-break variants and register-level integration;
the housestyle python suite adds BrokenPptxTests for masterless, kit-made
and unopenable files. Full combined suite receipt follows on the task
card before review.
Impact: register_artifact now runs a pure-Go OPC structural check for
docx/xlsx/pptx and refuses broken packages with a kit rebuild hint;
lint_pptx gains structure-broken assertions (master/theme/layout chain,
open-failure fallback) that template mode cannot downgrade; prompts
forbid hand-assembled OOXML and specify the missing-library fallback.
Refs: Dev task feature/pptx-register-structural-gate
Why: Account disable could be followed by late Backend business writes, API key creation could implicitly create users, account bootstrap locks could invert, and directory cursors were process-local or leaked out-of-scope changes.
Evidence: Local go test ./... and isolated PostgreSQL package suites passed on the staged candidate; exact committed-head SELF replay and stage 6 human review remain pending.
Impact: Adds final account transactions and external-effect checks across HTTP, Host, Bus and run manager; tightens API key issuance and persists versioned cursor signing. Delegated RDM rename still needs the separately proposed real-operator contract, so A1 and stage 6 are not complete.
Refs: Documents U3 r1, approved A1-A4 amendment fb3a821, pending delegated-projection amendment 5783940, Dev feature/iam-u3-account-directory-recovery.
Why: U7 account audit and identity gates advanced on main while U3 account initialization and recovery were in progress.
Evidence: SELF merge-tree checks passed with go test ./... and isolated PostgreSQL store/server tests; exact-head replay follows.
Impact: Preserve pending-account grants, proof-linked recovery, protected CLI delivery, account serialization, and atomic audit.
Refs: IAM U3 r1; U7 PR #185
Why: Historical full sessions could reach self-profile actions, and a lost recovery response had no safe idempotent retry contract.
Evidence: SELF receipts /tmp/iam-u3-full-password-profile.json, /tmp/iam-u3-recovery-idempotent-sqlite.json, /tmp/iam-u3-recovery-idempotent-pg.json, /tmp/iam-u3-account-sse-pass.json, /tmp/iam-u3-backend-idempotent-all.json, and /tmp/iam-u3-backend-idempotent-pg.json.
Impact: Profile actions require a password-authenticated full cookie; duplicate owner confirmation or rotation returns status without plaintext; an active SSE stream stops before its next business frame after disable.
Refs: IAM U3 r1 stages 4-5; Dev feature/iam-u3-account-directory-recovery
Why: A disable could commit after the run manager checked account state but before its final business message was stored.
Evidence: SELF receipts /tmp/iam-u3-final-settle-sqlite.json, /tmp/iam-u3-final-settle-pg.json, /tmp/iam-u3-backend-settle-all.json, /tmp/iam-u3-backend-settle-pg.json, and /tmp/iam-u3-http-two-instance-pg.json.
Impact: The final run transaction locks and rechecks the account, rejects post-disable business output, and permits only an account-denial failure record. Auth-off implicit local ownership remains explicit.
Refs: IAM U3 r1 stages 4-5; Dev feature/iam-u3-account-directory-recovery
Why: Administrator-issued password and login-key paths could take over target accounts, while old credentials and plugin handles ignored current account state.
Evidence: SELF receipts /tmp/iam-u3-backend-all-replay.json, /tmp/iam-u3-backend-final-pg-core.json, /tmp/iam-u3-backend-build.json, and focused HTTP/concurrency receipts in /tmp/iam-u3-*.json.
Impact: Adds trusted pending-account initialization and reissue, preexisting owner-session proof, proposal/rotation/grant transactions, server-side admin search, current Host guards, and legacy HTTP/CLI closure. Production cutover and downstream pins remain pending.
Refs: IAM U3 r1 stages 4-5; Dev feature/iam-u3-account-directory-recovery
Why: Concurrent password changes, recovery key reissue, and session admission could accept retired credentials or omit rejected audits.
Evidence: Local Go vet and full tests passed; real PostgreSQL store suite, deterministic interleavings, and two-process contention passed with SELF receipts.
Impact: Account writes and session admission serialize per owner; stale sessions fail closed; checked rejections carry an audit row.
Refs: Agent-System-Dev #486; Agent-System-Backend #185; merge queue Issue #518
Why: API-key issuance shares the account maintenance no-create and credential-output contract; the old CLI printed its key and lacked --out-file.
Evidence: The new subprocess test failed before the flag existed, then passed for private output and pre-mutation collision refusal; current go vet and all Go tests pass.
Impact: apikey create accepts protected --dsn-file and --out-file, preserves stdout default, and never overwrites an existing destination.
Refs: Backend PR #185; Dev PR #486; U7 KTD14
Why: The safe open requirement covers user, apikey and identity verify, including default CLI paths.
Evidence: All three paths use private missing directories; previous full Go and PostgreSQL receipts cover the implementation, with a focused recheck before push.
Impact: Test coverage only; no runtime behavior or migration changes.
Refs: Backend PR #185; Dev PR #486
Why: Deliver U7 account transactions and audit without losing main auth_version, restricted-session, project or migration behavior.
Evidence: SELF go vet and all Go tests passed; isolated PostgreSQL store tests, 20 repeated two-process admission rounds, and real SIGTERM/SIGKILL persistence passed. Original failures remain in receipts; exact-head CI and independent Review follow.
Impact: Adds schema v31, noncreating account CLI opens, preflight credential output, same-transaction audit, and bootstrap admission guards. No live database touched.
Refs: Backend PR #185; Dev PR #486; original U7 r2 account specification; 2026-10-14 Root takeover
Why: The old account lister exposed a global, always-valid directory without a domain locator or field authorization.
Evidence: SELF receipts /tmp/iam-u3-u3-backend-sqlite.json and /tmp/iam-u3-u3-backend-pg.json.
Impact: Adds versioned optional query and exact lookup, trusted RDM scope registration, visible-field cursor binding, and restricts legacy EXT-19 to effective system administrators. RDM consumption remains a separate U3-5 unit.
Refs: IAM U3 r1 stages 4-5; Dev feature/iam-u3-account-directory-recovery
Why: Disabled accounts and mixed credentials could continue to authenticate, while web creation accepted passwords and administrator privileges.
Evidence: SELF receipts /tmp/iam-u3-u2-store-sqlite-green.json, /tmp/iam-u3-u2-store-pg-regression.json, and /tmp/iam-u3-u2-server-sqlite-green.json.
Impact: Adds versioned enable/disable, revokes existing handles, protects the last operable manager, and exposes pending-account/profile APIs. Recovery proposal and legacy-entry closure remain in U3-4.
Refs: IAM U3 r1 stages 4-5; Dev feature/iam-u3-account-directory-recovery
Why: Disabling an account must stop in-flight work as well as new HTTP requests.
Evidence: SELF receipts /tmp/iam-u3-u2-runtime-regression.json and /tmp/iam-u3-u2-app-compile.json.
Impact: Run start, tools, HITL, streaming output, child runs and final settlement recheck the account independently of project authorization.
Refs: IAM U3 r1 stages 4-5; Dev feature/iam-u3-account-directory-recovery
Why: preserve identity while supporting optional profiles and controlled account lifecycle.
Evidence: SELF complete SQLite store tests and real PostgreSQL account-model regressions; red receipts retained.
Impact: additive account schema with a security compatibility floor; no production migration executed.
Refs: IAM U3-1; approved Documents c236d3099dd3e20f7bdd35caf162e0be9a7d52eb
Why:
Legacy project streams replayed upload filenames and parser metadata to newly
authorized members even though the underlying cards remained owner-only.
Evidence:
SELF real HTTP red regressions exposed legacy replay, spoofed sharing claims,
private-history pagination, and live delivery after membership removal. The
affected packages, uncached full Backend suite, isolated PostgreSQL Store suite,
and agent-system build pass after applying the event boundary.
Impact:
Registered lifecycle streams resolve trusted resource ownership and require an
internal publication proof for cross-owner delivery. Event and proof commit in
one transaction; v30 adds an additive SQLite/PostgreSQL sidecar without granting
access to historical events. Seen and visible cursors remain separate, revoked
members leave live streams, and unregistered base behavior remains compatible.
The storage migration tool preserves the new proof rows.
Refs:
project-member-access-implementation-plan.md Task 1 / R5; authorized legacy SSE
privacy follow-up; project-member-composed-legacy-project-history.json
Why:
Nested unchanged credential masks left empty parents that looked like managed
subtree overwrites. Shared members also hit an owner-only upload guard, while
upload ingestion cards could disclose private filenames and parser metadata.
Evidence:
SELF independent nested-mask probe, HTTP nested/mixed writeback, member upload,
project card privacy and authorization-change regressions failed before each fix
and passed after it. Affected settings/server suite passed; exact final-object
build and independent replay remain delivery gates owned by the task coordinator.
Impact:
Prune only parents emptied by ignored masks; explicit empty/real managed writes
stay rejected. Registered uploads check live work and trusted project existence,
keep originals owned by the actor, and recheck before persistence. Suppress only
upload project cards when no private stream exists; explicit structure cards and
unregistered upload behavior remain available.
Refs:
Dev project-member-access plan r1 Task 1/R5; independent nested mask P2;
2026-10-13 composed member-upload and private project-stream acceptance findings
Why:
Legacy project metadata can contain credentials outside the settings scope table.
Sharing raw projection settings exposed them, and generic project PATCH bypassed
the system-managed path guard already enforced by project settings endpoints.
Evidence:
SELF member Host regression failed before the fix. The fixed 4f72aaf server
baseline overlay reproduced HTTP metadata leakage and managed PATCH returning 200.
SELF shared Host-to-HTTP, immutable mask, dotted/schema/fallback, public mutation
and atomic managed-write regressions passed; uncached full suite, isolated PG
Store suite and static build passed. Independent delta replay remains a gate.
Impact:
Registered lifecycle metadata returns detached credential-masked views while
preserving service/configuration keys and persisted data. Generic project PATCH
shares the existing managed validator before rename or settings mutation; allowed
metadata key shapes and raw owner-only management lookups remain available.
Refs:
Dev project-member-access plan r1 Task 1 and R5; approved hard secret boundary;
2026-10-13 shared project metadata review follow-up
Why:
Membership could be revoked while a tool waited for confirmation or a queued
HITL reply waited for consumption. Publication replacement also crossed an
empty project scope or another plugin's source namespace for the same Ref.
Evidence:
SELF replay of all four independent review reproductions failed before the
fix and passed unchanged afterward. Committed regressions cover direct and
queued HITL, yes/session confirmation, direct artifact writes, protected vectors,
exact empty project scopes, literal wildcard IDs and unregistered compatibility.
SELF uncached go test ./..., isolated PostgreSQL Store tests and static build passed.
Impact:
Recheck trusted live owner/project authorization when HITL resumes and at write
boundaries. Registered publishers replace only exact owner/project/ref/plugin
rows and vectors; ordinary unregistered publication semantics are preserved.
Refs:
Dev project-member-access implementation plan r1 Task 1; independent Backend
review findings against b9bea5bee0
Why:
Higher-ranked private rows could exhaust SQL candidate limits and hide an
otherwise authorized published slice from a member's current-project search.
Evidence:
SELF TestAuthorizedKnowledgeFiltersBeforeTopK failed with no shared hits before
the change and passed after it. SELF go test ./... and the isolated PostgreSQL
Store suite passed; independent replay and current-HEAD CI remain owner gates.
Impact:
Scan the resource-authorized shared fulltext path until enough allowed results
are found. Preserve ordinary legacy retrieval candidate limits and semantics.
Refs:
Dev project-member-access plan r1 Task 1; R5 published knowledge availability
Why:
Shared project reads previously doubled as write permission, project mutations
bypassed the domain lifecycle, and coarse retrieval shared private resources.
Evidence:
SELF red-before-implementation logs cover projection, lifecycle, private work,
resource filtering, canonical retrieval scope, publication source and namespace.
SELF go test ./..., isolated PostgreSQL go test ./internal/store -count=1,
and CGO_ENABLED=0 go build ./cmd/agent-system passed; task owner owns replay/CI.
Impact:
Add optional actor-scoped projection/lifecycle capabilities; registered providers
control public lifecycle and live work. Preserve owned conversation history and
ordinary unregistered behavior. Authorize knowledge by stored ID/source, map
current host scopes through trusted service metadata, and filter artifact lists.
Refs:
Dev project-member-access implementation plan r1 Task 1; approved design r0.1;
2026-10-13 trusted publication Source hardening ruling
Why: The login recovery contract leftovers and KTD12/KTD14 require:
concurrent same-name account creation must not overwrite the winner,
first-admin bootstrap must serialize across processes, the redeem
endpoint backoff must be shared across instances, revoked API keys
must close established SSE streams, and CLI credentials need an
env-DSN path plus a non-interactive 0600 file delivery mode.
Evidence: go test ./... green; new tests cover 16-way concurrent
create (1 win/15 conflict, winner credentials intact), 8-way
concurrent bootstrap (single admin, refuse takeover after), redeem
guard shared across two store handles on one DB, SSE stream closed
after key revocation within the recheck window, and HTTP 429 after
the failure cap (SELF worktree run; CI is the GATE, PG via test-pg).
Impact: Migration v29 (redeem_attempts); CreateAccount becomes a
single-row INSERT with unique-violation conflict; BootstrapFirstAdmin
advisory-locks (PG) / rechecks (SQLite) and commits admin+key+audit in
one transaction; SSE revalidation covers API-key streams; redeem
backoff moves to the shared DB; CLI gains AGENT_SYSTEM_DSN fallback
and --out file delivery for create/reset-password/issue-login-key/
bootstrap-admin.
Refs: docs/svc-deploy/2026-10-13-login-recovery-contract.md leftovers;
proposal r2 KTD12/KTD14/R5/R11.
Why: Since the system-managed settings change (#188), runtime.* writes
at the user scope are rejected, so the mock startup flag failed with
"system-managed settings require admin" and the serve process never
became healthy - the Dev multi-instance integration regression.
Evidence: go build ok; internal/app and internal/settings suites green
(SELF); the Dev composite CI on the follow-up PR re-runs
make test-multi-instance against this fix (GATE).
Impact: The mock startup flag now seeds runtime.mock via MergeSystem
(trusted operator input, effective for every tenant through the
Effective merge chain); no HTTP surface changes.
Refs: Dev PR #508; backend #188.
Why: The 2026-10-13 login recovery contract (Dev docs/svc-deploy/
2026-10-13-login-recovery-contract.md, plan item 6.7) requires that
established SSE connections stop receiving private events once a
password write destroys their session.
Evidence: go test ./... green; TestSSESessionInvalidationClosesStream
streams over a real HTTP server, invalidates the session via
AdminResetUserPassword, and asserts the stream terminates with the
session-expired marker within the recheck window (SELF, worktree run).
Impact: Session-authenticated event streams revalidate at a 15s
heartbeat cadence (package var, shortened in tests) and terminate on
invalidation; API-key streams are unchanged (key revocation is separate).
EventSource reconnects are rejected by the auth middleware.
Refs: Dev PR #504; login recovery contract section 6.7.
Why: The login recovery contract (2026-10-13) requires admin-issued
one-time keys, in-transaction revalidation of restricted sessions, a
login race guard, and audited password writes; the previous
implementation validated sessions outside the change-password
transaction and let stale password verifications create sessions.
Evidence: go test ./... green (SQLite); store tests switch to
openTestStore so the CI test-pg job covers real PostgreSQL, including
100-way concurrent redeem single-winner and auth-version race cases
(SELF, local run).
Impact: New migration v28 (users/sessions.auth_version,
account_events). New admin endpoints POST/GET
/api/admin/users/{owner}/login-keys and DELETE
.../login-keys/{id}. Login binds session creation to the verified
auth version and creates restricted sessions for must-change accounts;
redeem gains per-IP backoff; cookies gain Secure under TLS; active
change-password and admin/CLI resets become single transactions that
bump auth_version, revoke keys and sessions, and write audit events.
Refs: modules/documents/docs/proposals/2026-10-12-svc-unified-deploy-and-login-key.md r2; Dev task feature/svc-login-recovery-flow
Why: an unset object-storage endpoint passed a typed nil into the store and artifact upload panicked.
Evidence: GATE vet-and-test run 2783 job 4031 success on 46073d30a5. Independent review approved with no blockers.
Impact: unconfigured stores fall back to the local artifacts directory. Configured S3 is unchanged.
Refs: #186
Why: an unset S3 client passed through the Store interface is not a nil interface, so uploads panic instead of using the local artifact directory.
Evidence: TestIsNil and TestFinishOpenTypedNilS3UsesLocalArtifacts failed before this change and pass after it. The PostgreSQL case skips unless AGENT_PG_TEST_DSN is set.
Impact: only an unset blob store falls back; a constructed S3 or local store is unchanged.
Refs: internal/blobstore/blobstore.go internal/store/store.go
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: identity open and the unknown-subcommand check landed on main, and this branch still has to refuse account migration while advertising capabilities.
Evidence: go test ./internal/store ./internal/app ./cmd/agent-system ./pkg/identity passed after the merge.
Impact: identity verify uses the no-migrate opener and returns the schema version. Account open still does not migrate. v28 is registered as readable by older artifacts.
Refs: cmd/agent-system/main.go, internal/app/app.go, internal/store/store.go, internal/store/migrate_compat.go
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: identity probes must open an existing database without creating or migrating it, and DSN must stay out of argv.
Evidence: GATE ci / vet-and-test success on 0f192a4813, run 2625 job 3782.
Impact: version --json carries schema target and compat floor; unknown top-level commands exit 2.
Refs: #184
weichen
