weichen
8b73afeef6
ci / vet-and-test (pull_request) Successful in 55s
Why: The 2026-10-13 login recovery contract (Dev docs/svc-deploy/ 2026-10-13-login-recovery-contract.md, plan item 6.7) requires that established SSE connections stop receiving private events once a password write destroys their session. Evidence: go test ./... green; TestSSESessionInvalidationClosesStream streams over a real HTTP server, invalidates the session via AdminResetUserPassword, and asserts the stream terminates with the session-expired marker within the recheck window (SELF, worktree run). Impact: Session-authenticated event streams revalidate at a 15s heartbeat cadence (package var, shortened in tests) and terminate on invalidation; API-key streams are unchanged (key revocation is separate). EventSource reconnects are rejected by the auth middleware. Refs: Dev PR #504; login recovery contract section 6.7.
Agent-System-Backend
对话系统后端：Go 模块化单体，默认构建为单二进制（go:embed 内嵌前端与嵌入式 SQLite 存储）。组合 Agent-Native / Agent-Squad / Agent-Intent 生态，依赖 agent-system-core 契约。
契约与架构见 Agent-System-Documents 设计方案与架构文档；开发规范见 development-guidelines（Dev 仓 development/guidelines）。本仓为 Agent-System 多仓组合的组成部分。