Merge commit '7bcbbdb37684' into HEAD

Why: composition consistency - Dev pins agent-squad at the nested
native M5 bump; the backend container's nested copy must match
(check-pins).
Evidence: pin only.
Impact: nested gitlink pointer change.
Refs: feature/audit-followups-pin-gate-m5

.gitea/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
             echo "SUBMODULE_TOKEN is not configured" >&2
             exit 1
           fi
-          git config --global url."https://weichen:${SUBMODULE_TOKEN}@gitea.naitangbaobao.cn/".insteadOf "ssh://git@gitea.naitangbaobao.cn:52222/"
+          git config --global url."https://weichen:${SUBMODULE_TOKEN}@git-home.u1680832.nyat.app:30319/".insteadOf "ssh://git@git-ssh.u1680832.nyat.app:31411/"
           git -c fetch.recurseSubmodules=false submodule update --init --recursive
       - name: Install Go 1.27.1
         run: |

.gitea/workflows/governance.yml

@@ -31,7 +31,7 @@ jobs:
           parsed_server = urlsplit(SERVER)
           if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
               sys.exit("Checkout server must be the platform-injected http(s) URL")
-          SSH = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
+          SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
           # 审查过的白名单，独立于候选 .gitmodules：仅列出两个治理 gitlink。
           REPOSITORIES = {
               "deps/development-guidelines": "Development-Guidelines",

.gitmodules

@@ -1,30 +1,30 @@
 [submodule "deps/agent-system-core"]
 	path = deps/agent-system-core
-	url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-System-Core.git
+	url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Core.git
 [submodule "deps/agent-native"]
 	path = deps/agent-native
-	url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-Native.git
+	url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Native.git
 [submodule "deps/agent-intent"]
 	path = deps/agent-intent
-	url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-Intent.git
+	url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Intent.git
 [submodule "deps/logging-system"]
 	path = deps/logging-system
-	url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Logging-System.git
+	url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Logging-System.git
 [submodule "deps/error-code-system"]
 	path = deps/error-code-system
-	url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Error-Code-System.git
+	url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Error-Code-System.git
 [submodule "deps/agent-squad"]
 	path = deps/agent-squad
-	url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-Squad.git
+	url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Squad.git
 [submodule "deps/agent-command"]
 	path = deps/agent-command
-	url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-Command.git
+	url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Command.git
 [submodule "deps/agent-document-renderer"]
 	path = deps/agent-document-renderer
-	url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-Document-Renderer.git
+	url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Document-Renderer.git
 [submodule "deps/development-guidelines"]
 	path = deps/development-guidelines
-	url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Development-Guidelines.git
+	url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Development-Guidelines.git
 [submodule "deps/development-manager"]
 	path = deps/development-manager
-	url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Development-Manager.git
+	url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Development-Manager.git

AGENTS.md

@@ -23,9 +23,9 @@
 历史文档与旧链接里的 `git-panel.u1680832.nyat.app:30319` 已失效（TLS 握手失败），
 见到一律按过期处理，不要再试。当前权威通道：
 
-- **Web / API（HTTPS）**：`https://gitea.naitangbaobao.cn`（Gitea 1.27.3，
+- **Web / API（HTTPS）**：`https://git-home.u1680832.nyat.app:30319`（Gitea 1.27.3，
   API 前缀 `/api/v1`；偶发 broken pipe / 超时，重试即可）。
-- **Git over SSH**：`ssh://git@gitea.naitangbaobao.cn:52222/weichen/<Repo>.git`
+- **Git over SSH**：`ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/<Repo>.git`
   （各仓 origin 与 gitlink 均为此格式）。
 - **API token**：`~/.secrets/gitea`，两行键值 `URL_PREFIX=…` 与
   `ACCESS_TOKEN=<40 位 hex>`；取值 `grep ACCESS_TOKEN ~/.secrets/gitea | cut -d= -f2-`，
@@ -33,7 +33,7 @@
   （baseline 硬边界 2：只记录来源、字段与可用状态）。
 - **SSH key**：`~/.ssh/home_gitea`（ED25519，公钥指纹
   `SHA256:GYXaOXIMeloQ1fKSfdJ/ndgPQzs/Ix7Hk62ekfkfQ20`，Gitea 侧密钥名 GMKtec）；
-  `~/.ssh/config` 已有 `gitea.naitangbaobao.cn（端口 52222）` 主机条目，克隆/推送直接可用。
+  `~/.ssh/config` 已有 `git-ssh.u1680832.nyat.app` 主机条目，克隆/推送直接可用。
 
 ## Agent 执行与新项目准入（强制）
 

internal/docgen/renderer_identity_generated.go

@@ -2,6 +2,6 @@
 
 package docgen
 
-const rendererRevision = "40e5c671d1ef786ceba62bf784bf3aa53c5da26d"
+const rendererRevision = "3f259990b5d43ec0d318f39d496816140ab559b5"
 
 const RendererIdentity = "agent-document-renderer@" + rendererRevision

internal/docgen/renderer_integration_test.go

@@ -367,7 +367,7 @@ func TestPersistedControlledMetadataRoutesBeforeDefaultProfileLoad(t *testing.T)
 }
 
 func TestRendererIdentityMatchesPublishedPin(t *testing.T) {
-	const want = "agent-document-renderer@40e5c671d1ef786ceba62bf784bf3aa53c5da26d"
+	const want = "agent-document-renderer@3f259990b5d43ec0d318f39d496816140ab559b5"
 	if RendererIdentity != want {
 		t.Fatalf("RendererIdentity = %q, want %q", RendererIdentity, want)
 	}