Backend consumes canonical versioned Go modules and supplies fixed application source to the Dev composer. This branch now includes upstream account-transaction PR #185 without changing its business Go code after import translation. Two test-only corrections keep the migration's required checks bound to their own fixtures and completed workers.
This is the Backend component of Dev dependency-workspace PR #537. Current source HEAD: 48649a37ee92373c639a384a2c5a9dfaa2ec4bbb; upstream main included: 8e80e2618eb7471dd12d5f172ff3cd23622b7d2f.
Evidence
Upstream preservation: All 343 upstream Go files match this branch after canonical import translation, except the two named test files. SELF parity receipt: /tmp/dependency-backend-after-185-parity-20261014-01a1345f.json. Full Go test and vet of the merged source passed: /tmp/dependency-backend-after-185-all-go-20261014-01a1345f.json, /tmp/dependency-backend-after-185-vet-20261014-01a1345f.json.
Recovery test: The old test returned while ResumeInterruptedChildren could still write to its temporary workspace and SQLite store. The test now waits for its own background slot to drain before cleanup; its target passed 100 repetitions. Production recovery behavior is unchanged.
Sandbox test: The old host-wide s.sh count failed with one deliberately unrelated host script running. The corrected check tracks only the script started by this test. The unrelated-script RED and scoped GREEN are captured in /tmp/dependency-sandbox-host-collision-{red,green}-20261014-01a1345f.json; a positive control still detects the test's own script. Production sandbox setup and the own-orphan failure condition are unchanged.
Backend run 3066, job 4643 vet-and-test, completed successfully at this exact HEAD (actor weichen/id1, home-runner/id3; checkout, Go 1.27.1, module prefetch, house-style package install, vet and test steps all success). Dev has selected this source in a local fixed lock and is rerunning the complete combination; its final current-head CI, formal stage 7 human acceptance and integration remain pending. This PR is work in progress.
Merge Danger
Door: two-way. Preserve consumed source commits in ordinary merges and revert version selection through a reviewed PR if needed.
Blast Radius: Go module consumption, Backend application source and reliability of two existing test gates. No account-data migration, service deployment, release, history rewrite or branch-protection change is executed by this PR.
## Summary
Backend consumes canonical versioned Go modules and supplies fixed application source to the Dev composer. This branch now includes [upstream account-transaction PR #185](https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Backend/pulls/185) without changing its business Go code after import translation. Two test-only corrections keep the migration's required checks bound to their own fixtures and completed workers.
This is the Backend component of [Dev dependency-workspace PR #537](https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/537). Current source HEAD: `48649a37ee92373c639a384a2c5a9dfaa2ec4bbb`; upstream main included: `8e80e2618eb7471dd12d5f172ff3cd23622b7d2f`.
## Evidence
- **Upstream preservation:** All 343 upstream Go files match this branch after canonical import translation, except the two named test files. SELF parity receipt: `/tmp/dependency-backend-after-185-parity-20261014-01a1345f.json`. Full Go test and vet of the merged source passed: `/tmp/dependency-backend-after-185-all-go-20261014-01a1345f.json`, `/tmp/dependency-backend-after-185-vet-20261014-01a1345f.json`.
- **Recovery test:** The old test returned while `ResumeInterruptedChildren` could still write to its temporary workspace and SQLite store. The test now waits for its own background slot to drain before cleanup; its target passed 100 repetitions. Production recovery behavior is unchanged.
- **Sandbox test:** The old host-wide `s.sh` count failed with one deliberately unrelated host script running. The corrected check tracks only the script started by this test. The unrelated-script RED and scoped GREEN are captured in `/tmp/dependency-sandbox-host-collision-{red,green}-20261014-01a1345f.json`; a positive control still detects the test's own script. Production sandbox setup and the own-orphan failure condition are unchanged.
[Backend run 3066](https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Backend/actions/runs/3066), job 4643 `vet-and-test`, completed successfully at this exact HEAD (actor weichen/id1, home-runner/id3; checkout, Go 1.27.1, module prefetch, house-style package install, vet and test steps all success). Dev has selected this source in a local fixed lock and is rerunning the complete combination; its final current-head CI, formal stage 7 human acceptance and integration remain pending. This PR is work in progress.
## Merge Danger
**Door:** two-way. Preserve consumed source commits in ordinary merges and revert version selection through a reviewed PR if needed.
**Blast Radius:** Go module consumption, Backend application source and reliability of two existing test gates. No account-data migration, service deployment, release, history rewrite or branch-protection change is executed by this PR.
Why: Allow consumers to download an immutable module revision without nested source checkouts or local path replacements.
Evidence: SELF package tests and the prior canonical-path rejection are recorded in the Dev dependency-workspace task card; remote consumption is replayed against the committed candidate.
Impact: Change the module identity and its Go imports while preserving API behavior. Existing historical submodule revisions remain buildable.
Refs: Versioned dependencies U1/U3; feature/dependency-workspace
Why:
Make independent version consumption work from ordinary clones while retaining historical commits and existing branch workspaces.
Evidence:
SELF Dev task receipts record 24 CI boundary cases, all workflow syntax checks, readonly private-source prefetch in clean exports, provider tests and package installation without acquisition scripts. Platform CI remains pending.
Impact:
Remove only replaced index links, preserve old physical checkouts, and update dependency guidance. Library consumers retain their immutable versions until an explicit dependency update.
Refs:
Agent-System-Dev feature/dependency-workspace; approved versioned-dependency r1, U3-U7 and R15.
Why: ResumeInterruptedChildren starts a background worker; the recovery-hold test returned while it could still write to a temporary workspace and SQLite store, causing cleanup races.
Evidence: SELF Root e3a full combination exposed the TempDir/database-close race; the corrected target passed 100 repetitions and full Backend Go tests passed in /tmp/dependency-recovery-hold-wait-green-20261014-01a1345f.json and /tmp/dependency-backend-test-repair-all-go-green-20261014-01a1345f.json.
Impact: Test teardown synchronization only; no production recovery behavior changes.
Refs: Backend PR #196; Dev PR #537; R14/R15
Why: The host-wide s.sh grep counted unrelated host scripts as sandbox escapes and failed the fixed combination even when its sandbox script had exited.
Evidence: SELF unrelated sentinel produced the exact original RED, while the scoped probe stayed GREEN under the same sentinel and detected its own positive-control script; full Backend Go tests passed. Receipts: /tmp/dependency-sandbox-host-collision-{red,green}-20261014-01a1345f.json and /tmp/dependency-backend-test-repair-all-go-green-20261014-01a1345f.json.
Impact: Test process identity check only; the sandbox process isolation implementation and failure condition for its own script are unchanged.
Refs: Backend PR #196; Dev PR #537; R8/R14
Why: Backend PR #185 merged while the dependency migration was open. Its account transactions, audit behavior and migration tests must remain intact when this branch adopts the new main.
Evidence: SELF 343 upstream Go files match after canonical import translation except the two bounded test-reliability corrections; complete Go test and vet passed in /tmp/dependency-backend-after-185-{parity,all-go,vet}-20261014-01a1345f.json.
Impact: Disposable integration fixture first; the actual Backend branch can fast-forward to this tested merge without rewriting other task history. No production account logic is changed relative to the new main.
Refs: Backend PR #196; upstream Backend PR #185; Dev PR #537; R15
Why: Home and sibling isolation tests could pass after a Bubblewrap startup failure, hiding an untested security boundary.
Evidence: Isolated fake-Bubblewrap replay changed both target tests from PASS to FAIL; SELF receipt /tmp/dependency-task1-fake-green-20261014-01a1345f.json. Native positive replay remains NOT_RUN.
Impact: Test assertions only; production execution behavior is unchanged.
Refs: Backend PR #196; Documents design 1790cf8
Why: The test replaced PYTHONPATH with the house-style source path, hiding the fixed Python wheels installed inside the candidate sandbox.
Evidence: Isolated Backend TestLintErrorContinues replay passed with locked wheel acquisition and no host site-packages; SELF receipt /tmp/dependency-task3-backend-lint-probe-20261014-01a1345f.json.
Impact: Test environment composition only; production runtime behavior is unchanged.
Refs: Backend PR #196; Dev PR #537; Documents plan 5099e12
Why: Test-local PYTHONPATH overrides and an exact-value assertion hid the fixed wheel directory used by isolated composition.
Evidence: Three affected Backend tests passed under local Bubblewrap with an 8-wheel offline install; SELF receipt /tmp/dependency-task3-backend-three-tests-20261014-01a1345f.json.
Impact: Test environment and assertion changes only; production lint path behavior is unchanged.
Refs: Backend PR #196; Dev PR #537; Documents plan 5099e12
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Backend consumes canonical versioned Go modules and supplies fixed application source to the Dev composer. This branch now includes upstream account-transaction PR #185 without changing its business Go code after import translation. Two test-only corrections keep the migration's required checks bound to their own fixtures and completed workers.
This is the Backend component of Dev dependency-workspace PR #537. Current source HEAD:
48649a37ee92373c639a384a2c5a9dfaa2ec4bbb; upstream main included:8e80e2618eb7471dd12d5f172ff3cd23622b7d2f.Evidence
/tmp/dependency-backend-after-185-parity-20261014-01a1345f.json. Full Go test and vet of the merged source passed:/tmp/dependency-backend-after-185-all-go-20261014-01a1345f.json,/tmp/dependency-backend-after-185-vet-20261014-01a1345f.json.ResumeInterruptedChildrencould still write to its temporary workspace and SQLite store. The test now waits for its own background slot to drain before cleanup; its target passed 100 repetitions. Production recovery behavior is unchanged.s.shcount failed with one deliberately unrelated host script running. The corrected check tracks only the script started by this test. The unrelated-script RED and scoped GREEN are captured in/tmp/dependency-sandbox-host-collision-{red,green}-20261014-01a1345f.json; a positive control still detects the test's own script. Production sandbox setup and the own-orphan failure condition are unchanged.Backend run 3066, job 4643
vet-and-test, completed successfully at this exact HEAD (actor weichen/id1, home-runner/id3; checkout, Go 1.27.1, module prefetch, house-style package install, vet and test steps all success). Dev has selected this source in a local fixed lock and is rerunning the complete combination; its final current-head CI, formal stage 7 human acceptance and integration remain pending. This PR is work in progress.Merge Danger
Door: two-way. Preserve consumed source commits in ordinary merges and revert version selection through a reviewed PR if needed.
Blast Radius: Go module consumption, Backend application source and reliability of two existing test gates. No account-data migration, service deployment, release, history rewrite or branch-protection change is executed by this PR.
Why: The host-wide s.sh grep counted unrelated host scripts as sandbox escapes and failed the fixed combination even when its sandbox script had exited. Evidence: SELF unrelated sentinel produced the exact original RED, while the scoped probe stayed GREEN under the same sentinel and detected its own positive-control script; full Backend Go tests passed. Receipts: /tmp/dependency-sandbox-host-collision-{red,green}-20261014-01a1345f.json and /tmp/dependency-backend-test-repair-all-go-green-20261014-01a1345f.json. Impact: Test process identity check only; the sandbox process isolation implementation and failure condition for its own script are unchanged. Refs: Backend PR #196; Dev PR #537; R8/R14Pull request closed