Record the ECS dev 8788 update to the local dev build

Why: owner asked to bring the imc-tx-ecs service to the same version as the local dev service (dev@a706e9a+rdm@4b2473bed112). Evidence: task card evidence blocks (SELF) cover running binary sha, schema v35, backup checksums, row-level reconciliation and migrated secrets. Impact: ECS runtime only; repository change is limited to the task card. Refs: .task/feature-ecs-sync-local-dev.md Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-18 06:38:28 +00:00
parent ce3e7110f2
commit 4bbc6a9b12
1 changed files with 210 additions and 7 deletions
@@ -9,17 +9,17 @@
 - 分支类型：standalone；root_target：main；immediate_target：main；accepting_requirements：false
 - 需求分流：verdict=NEW；selected_initiative=无；requirement_sha256=9117e9fbaa296aa429645a2f370f4a442cadd5b1f80b04a87cf62bed311a5f64；triage_receipt=/tmp/ecs-sync-local-triage.json；receipt_sha256=0c6b0c064d573034e00194319ab9cdc1e9b10b610f79064b95c9e735297028e8

- 授权与交付终点：<本次允许的动作与终点；未授权事项写明>
+- 授权与交付终点：owner 2026-10-18 指令“将 imc-tx-ecs 上的服务更新到本机同样的版本”——ECS 唯一服务 dev 8788（systemd 用户服务 agent-system-dev.service）更新到本机 dev 当前版本 dev@a706e9a+rdm@4b2473bed112（二进制 sha256 1f45f640…），先备份、数据零丢失；终点为 ECS 运行该版本且数据对账通过，本仓仅任务卡。未授权：修改产品代码、改启动参数/插件激活/Caddy、签发登录 Key 或改账号凭据。
 - 交付模式：goal-first（目标、范围和交付终点一次确认；范围内连续推进）
 - 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md）
 - 合入执行：agent（已授权交付范围内，Review 通过、冲突解决且当前 HEAD 的 CI 通过后合入）
 - 人工决策点：仅限目标/范围/验收变更、重大取舍、高后果操作或无法自动判定的业务验收
- 当前阶段：需求拆解；当前增量：I1（待定义）
+- 当前阶段：合入核验与收口；当前增量：I1（ECS dev 8788 版本同步）
 - 流程依据：仓库根目录 policy/delivery.md（归档后仍按仓库根目录定位）

 ## 目标与非目标

-<预期结果、受影响入口/模块/契约；明确不做什么。>
+预期结果：ECS（imc-tx-ecs，imcrd-agent.imcbot.work → 127.0.0.1:8788）由 rdm@b8cdf01（组合二进制 792af245…，schema v34）更新为与本机 dev 相同的 dev@a706e9a+rdm@4b2473bed112（1f45f640…，schema v35），htdocs 同步为本机 release 内容；用户数据零丢失。受影响：ECS runtime/dev/bin/agent-system、htdocs、svc.env/svc.pid/history.jsonl 登记，以及新版启动时的自动迁移（schema v35 exec_env 表；settings 明文密钥迁入 secret_keys）。非目标：不改产品代码、systemd 单元参数、插件目录与 Caddy；不处理 agent-system-admin/cli 旧二进制。注意：a706e9a 位于 feature/auth-one-time-password，尚未合入 main（按 owner“与本机同版本”的指令执行）。

 ## Agent 实施收据

@@ -27,7 +27,7 @@

 | 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
 |---|---|---|---|---|---|---|---|---|---|---|
-| 待定义 | — | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | — |
+| 无（运维任务，无仓库代码单元；仓库写入仅 .task/** host 豁免） | — | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | — |

 ## 关联方向与规划

@@ -39,7 +39,8 @@

 | ID | 描述 | 项目符合度及依据 | 优先级 | 验收条件 | 依赖 | 结论 |
 |---|---|---|---|---|---|---|
-| R1 | 待填写 | 待评估 | 待定 | 待定义 | 待确认 | 待评审 |
+| R1 | ECS dev 8788 更新到本机 dev 同版本 | 符合（owner 指令） | P0 | 运行中进程 exe sha256=1f45f640…；服务与恢复定时器 active；本地与域名 HTTP 200；schema v35 | 无 | 达成 |
+| R2 | 先备份、数据零丢失 | 符合 | P0 | 停机冷备份 sha 校验 + 本机异地副本；冷备份 manifest ↔ 更新后逐行对账 problems=[]；迁出的明文密钥与 secret_keys 逐把一致 | R1 | 达成 |

 ## 方案与计划

@@ -90,9 +91,12 @@

 ## 结果与验证（完成后填写）

- 结果：
- 验证：<结论摘要 PASS/FAIL/SKIP/NOT_RUN 逐项；逐条证据由 make evidence 写入上方证据表>
+- 结果：2026-10-18 14:20:24–14:20:27（CST）切换完成，停机约 3 秒；ECS 8788 现由 systemd 运行 dev@a706e9a+rdm@4b2473bed112（pid 4080336，exe sha256 1f45f640…，schema v35），htdocs 与本机 release 一致，svc.env/svc.pid 已登记新 PID 与来源，history.jsonl 追加 deploy 事件。冷备份：ECS runtime/dev/backups/20261018T062018Z-cold-pre-a706e9a（data、bin-old、htdocs-old、systemd 单元、Caddyfile、MANIFEST.json、SHA256SUMS），本机异地副本 ~/backups/imc-tx-ecs/20261018T062018Z-cold-pre-a706e9a。切换脚本 ~/ecs-ops/cutover-a706e9a.sh（含健康检查失败自动回滚，本次未触发）。
+- 验证：运行版本/服务/HTTP（本地与域名 200）/schema v35 PASS；冷备份 sha 校验与异地副本 sha 校验 PASS；冷备份 manifest ↔ 更新后逐行对账 problems=[]（零缺失，新增行为切换后用户正常使用）PASS；settings 中 5 类明文密钥（user 与 system 两个 scope 共 10 把）由新版启动迁移移入 secret_keys，逐把与备份明文一致 PASS；启动日志无 error/warn PASS；切换后新对话正常进入推理 PASS；浏览器登录与插件列表界面核对 NOT_RUN（ECS 无可用 API key、未签发登录 Key）。全部来源 SELF。
 - 影响与剩余项：
+  - 回滚：v35 对旧读者兼容（migrate_compat 35=false），可将 bin-old/agent-system 放回并重启；但旧版 settings 读不到已迁入 secret_keys 的密钥，回滚需同时恢复冷备份 data（会丢失切换后的新数据）或重新写回明文密钥。
+  - 部署版本 a706e9a 位于未合入 main 的 feature/auth-one-time-password 分支，ECS 现运行未合入代码。
+  - 本机 ~/.secrets/gitea token 调 API 返回 invalid token（与本任务无关，仅记录）。

 ## 规划进展与下一步

@@ -152,3 +156,202 @@
  "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/128b1a86cd57436cd2c4179ba245bdcf71f8c498f2052582b377283ef0b0ff39.json"
 }
 ```
+
+<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
+```json
+{
+  "summary_schema": 1,
+  "source": "SELF",
+  "timestamp": "2026-10-18T06:20:42.275003+00:00",
+  "command": "ssh imc-tx-ecs 'P=$(systemctl --user show agent-system-dev.service -p MainPID --value); echo pid=$P; sha256sum /proc/$P/exe | cut -c1-64; systemctl --user is-active agent-system-dev.service agent-system-svc-recover.timer; grep -E \"^(pid|source|version)=\" ~/weichen/Agent-System-Dev/runtime/dev/svc.env; cat ~/weichen/Agent-System-Dev/runtime/dev/svc.pid; curl -sS -o /dev/null -w \"local=%{http_code}\\n\" http://127.0.0.1:8788/; curl -sS -o /dev/null -w \"domain=%{http_code}\\n\" https://imcrd-agent.imcbot.work/; python3 -c \"import sqlite3; print(\\\"schema_max\\\", sqlite3.connect(\\\"file:/home/ubuntu/weichen/Agent-System-Dev/runtime/dev/data/agent-system.db?mode=ro\\\",uri=True).execute(\\\"select max(version) from schema_migrations\\\").fetchone()[0])\"'",
+  "exit_code": 0,
+  "cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-sync-local-dev",
+  "before_head": "ce3e7110f25efc31ad1d925e3867bedb86d26014",
+  "after_head": "ce3e7110f25efc31ad1d925e3867bedb86d26014",
+  "branch": "feature/ecs-sync-local-dev",
+  "target_branch": "main",
+  "target_head": "26f3f050313aa4a96cabcca6bdddc29de63351e7",
+  "root_target": "main",
+  "immediate_target": "main",
+  "before_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "after_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "output_tail": [
+    "pid=4080336",
+    "1f45f64077b8dffd25d80513e3aaf5f06c71c8a09248c21af22f9d33eab516b9",
+    "active",
+    "active",
+    "pid=4080336",
+    "source=dev@a706e9a+rdm@4b2473bed112",
+    "version=agent-system 0.1.0-dev",
+    "4080336",
+    "local=200",
+    "domain=200",
+    "schema_max 35"
+  ],
+  "output_sha256": "2a2c0e09a38760fa0fb9fd78f59443251fdafebd3965ee49b92e3f16c72e22b8",
+  "receipt_sha256": "04e761ab05523603f8fe9e893eb84314267af2bb84ccee7b40ea742132c667a6",
+  "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/04e761ab05523603f8fe9e893eb84314267af2bb84ccee7b40ea742132c667a6.json"
+}
+```
+
+<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
+```json
+{
+  "summary_schema": 1,
+  "source": "SELF",
+  "timestamp": "2026-10-18T06:21:02.444374+00:00",
+  "command": "ssh imc-tx-ecs 'cd /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/backups/20261018T062018Z-cold-pre-a706e9a && python3 ~/ecs-dbsnap.py manifest /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/backups/20261018T062018Z-cold-pre-a706e9a/data /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/backups/20261018T062018Z-cold-pre-a706e9a/MANIFEST.json && find data bin-old htdocs-old config -type f -exec sha256sum {} + > SHA256SUMS && sha256sum -c --quiet SHA256SUMS && wc -l < SHA256SUMS && python3 ~/ecs-dbsnap.py compare /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/backups/20261018T062018Z-cold-pre-a706e9a/MANIFEST.json /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/data'",
+  "exit_code": 0,
+  "cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-sync-local-dev",
+  "before_head": "ce3e7110f25efc31ad1d925e3867bedb86d26014",
+  "after_head": "ce3e7110f25efc31ad1d925e3867bedb86d26014",
+  "branch": "feature/ecs-sync-local-dev",
+  "target_branch": "main",
+  "target_head": "26f3f050313aa4a96cabcca6bdddc29de63351e7",
+  "root_target": "main",
+  "immediate_target": "main",
+  "before_tracked_diff_sha256": "7a084c5790e15f97a41f5bca9dd14d4fc8da233e261f41465d64cfc9e8ba66e1",
+  "after_tracked_diff_sha256": "7a084c5790e15f97a41f5bca9dd14d4fc8da233e261f41465d64cfc9e8ba66e1",
+  "output_tail": [
+    " \"files\": {",
+    "  \"base\": 456,",
+    "  \"now\": 458,",
+    "  \"missing\": [],",
+    "  \"changed\": [",
+    "   \"workspaces/yuzhongde/cnv_3a5839f75104/.agentx/transcript.jsonl\",",
+    "   \"workspaces/yuzhongde/cnv_3a5839f75104/.agentx/transcript.jsonl.meta.json\"",
+    "  ],",
+    "  \"added\": [",
+    "   \"artifacts/blob_3702c5068ac7\",",
+    "   \"workspaces/yuzhongde/cnv_3a5839f75104/inputs/RDDHF0302-0095 冲击波治疗仪系统设计方案 V2.0.docx\"",
+    "  ]",
+    " },",
+    " \"problems\": []",
+    "}"
+  ],
+  "output_sha256": "325212538120481b1ce0223faf019bd200fdc5545ffb20e31b271103dbbb0e75",
+  "receipt_sha256": "66e6777c9f19df05df9f5d1240990973ba76bd809733ea461e18c5c2592c3f00",
+  "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/66e6777c9f19df05df9f5d1240990973ba76bd809733ea461e18c5c2592c3f00.json"
+}
+```
+
+<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
+```json
+{
+  "summary_schema": 1,
+  "source": "SELF",
+  "timestamp": "2026-10-18T06:23:40.506450+00:00",
+  "command": "ssh imc-tx-ecs 'python3 ~/ecs-ops/secret-check.py'",
+  "exit_code": 0,
+  "cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-sync-local-dev",
+  "before_head": "ce3e7110f25efc31ad1d925e3867bedb86d26014",
+  "after_head": "ce3e7110f25efc31ad1d925e3867bedb86d26014",
+  "branch": "feature/ecs-sync-local-dev",
+  "target_branch": "main",
+  "target_head": "26f3f050313aa4a96cabcca6bdddc29de63351e7",
+  "root_target": "main",
+  "immediate_target": "main",
+  "before_tracked_diff_sha256": "b0976d4b673b94153603b11ffbc854169ebe3c96c5ac5c56c34030c0f147f6f1",
+  "after_tracked_diff_sha256": "b0976d4b673b94153603b11ffbc854169ebe3c96c5ac5c56c34030c0f147f6f1",
+  "output_tail": [
+    "owner='weichen' scope=user models.chat -> secret_keys match=True",
+    "owner='weichen' scope=user models.lightweight -> secret_keys match=True",
+    "owner='weichen' scope=user models.embedding -> secret_keys match=True",
+    "owner='weichen' scope=user models.rerank -> secret_keys match=True",
+    "owner='weichen' scope=user tools.tavily -> secret_keys match=True",
+    "owner='' scope=system models.chat -> secret_keys match=True",
+    "owner='' scope=system models.lightweight -> secret_keys match=True",
+    "owner='' scope=system models.embedding -> secret_keys match=True",
+    "owner='' scope=system models.rerank -> secret_keys match=True",
+    "owner='' scope=system tools.tavily -> secret_keys match=True",
+    "settings_snapshots=9 mismatches=0"
+  ],
+  "output_sha256": "142d0810997be0a978e3a84084dce4bae4f11d17c3560d7651682facddd44f9f",
+  "receipt_sha256": "c4ee63cd7a13fd75c9329467ea5d162b91b190865c440934aa17aaa6d098b321",
+  "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/c4ee63cd7a13fd75c9329467ea5d162b91b190865c440934aa17aaa6d098b321.json"
+}
+```
+
+<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
+```json
+{
+  "summary_schema": 1,
+  "source": "SELF",
+  "timestamp": "2026-10-18T06:24:03.640459+00:00",
+  "command": "ssh imc-tx-ecs 'journalctl --user -u agent-system-dev.service --since \"2026-10-18 14:20:25\" --no-pager -o cat | grep -v \"genai span\" | grep -i -E \"plugin|error|panic|fatal|warn|listen|migrat\" | cut -c1-220 | head -30; python3 -c \"import sqlite3; d=sqlite3.connect(\\\"file:/home/ubuntu/weichen/Agent-System-Dev/runtime/dev/data/agent-system.db?mode=ro\\\",uri=True); print(d.execute(\\\"select status, count(*) from runs where started_at >= \\\\\\\"2026-10-18T06:20\\\\\\\" group by 1\\\").fetchall())\"'",
+  "exit_code": 1,
+  "cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-sync-local-dev",
+  "before_head": "ce3e7110f25efc31ad1d925e3867bedb86d26014",
+  "after_head": "ce3e7110f25efc31ad1d925e3867bedb86d26014",
+  "branch": "feature/ecs-sync-local-dev",
+  "target_branch": "main",
+  "target_head": "26f3f050313aa4a96cabcca6bdddc29de63351e7",
+  "root_target": "main",
+  "immediate_target": "main",
+  "before_tracked_diff_sha256": "b0426e3da3d17d6d9a6674e4e2b834ac69c0b3602b936faf03eb682448c68378",
+  "after_tracked_diff_sha256": "b0426e3da3d17d6d9a6674e4e2b834ac69c0b3602b936faf03eb682448c68378",
+  "output_tail": [
+    "2026/10/18 14:20:26 agent-system serving on http://0.0.0.0:8788 (data: /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/data, plugins: /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/plugins)",
+    "Traceback (most recent call last):",
+    "  File \"<string>\", line 1, in <module>",
+    "sqlite3.OperationalError: no such column: started_at"
+  ],
+  "output_sha256": "3fa6fa9adb451343793233e0c5f751bbd610bc1b1423c3159fb7c0a3f172b542",
+  "receipt_sha256": "3819a4e5825b1ec8fa2cad03ecfd2e51067c4601466963f02bef08e1c79516a1",
+  "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/3819a4e5825b1ec8fa2cad03ecfd2e51067c4601466963f02bef08e1c79516a1.json"
+}
+```
+
+<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
+```json
+{
+  "summary_schema": 1,
+  "source": "SELF",
+  "timestamp": "2026-10-18T06:24:29.656967+00:00",
+  "command": "ssh imc-tx-ecs 'python3 -c \"import sqlite3; d=sqlite3.connect(\\\"file:/home/ubuntu/weichen/Agent-System-Dev/runtime/dev/data/agent-system.db?mode=ro\\\",uri=True); print(d.execute(\\\"select created_at, status, phase, length(coalesce(error,\\\\\\\"\\\\\\\")) from runs order by rowid desc limit 3\\\").fetchall())\"'",
+  "exit_code": 0,
+  "cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-sync-local-dev",
+  "before_head": "ce3e7110f25efc31ad1d925e3867bedb86d26014",
+  "after_head": "ce3e7110f25efc31ad1d925e3867bedb86d26014",
+  "branch": "feature/ecs-sync-local-dev",
+  "target_branch": "main",
+  "target_head": "26f3f050313aa4a96cabcca6bdddc29de63351e7",
+  "root_target": "main",
+  "immediate_target": "main",
+  "before_tracked_diff_sha256": "2cffdb86d1706ca8576580b3591cfc63092115d8057561e07cd6e8582f1f4a54",
+  "after_tracked_diff_sha256": "2cffdb86d1706ca8576580b3591cfc63092115d8057561e07cd6e8582f1f4a54",
+  "output_tail": [
+    "[('2026-10-18T06:21:01.98880041Z', 'running', 'thinking', 4), ('2026-10-18T06:16:09.9173973Z', 'completed', 'done', 4), ('2026-10-18T06:13:16.808336756Z', 'completed', 'done', 4)]"
+  ],
+  "output_sha256": "55cea8240269ea6a829368012c22af253633bad4ac56821482ad476eac818a3e",
+  "receipt_sha256": "ddf9a748e13d976417d1dbac0604a8c89c885af61aa091ac8b613987e43940c9",
+  "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/ddf9a748e13d976417d1dbac0604a8c89c885af61aa091ac8b613987e43940c9.json"
+}
+```
+
+<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
+```json
+{
+  "summary_schema": 1,
+  "source": "SELF",
+  "timestamp": "2026-10-18T06:37:10.261787+00:00",
+  "command": "sh -c 'cd /home/weichen/backups/imc-tx-ecs/20261018T062018Z-cold-pre-a706e9a && sha256sum -c --quiet SHA256SUMS && echo OFFSITE_SHA_OK files=$(wc -l < SHA256SUMS)'",
+  "exit_code": 0,
+  "cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-sync-local-dev",
+  "before_head": "ce3e7110f25efc31ad1d925e3867bedb86d26014",
+  "after_head": "ce3e7110f25efc31ad1d925e3867bedb86d26014",
+  "branch": "feature/ecs-sync-local-dev",
+  "target_branch": "main",
+  "target_head": "26f3f050313aa4a96cabcca6bdddc29de63351e7",
+  "root_target": "main",
+  "immediate_target": "main",
+  "before_tracked_diff_sha256": "102b857bec8f2c3b3a9dafd7c5efc194570a362cd82590745a058c8d714f2f14",
+  "after_tracked_diff_sha256": "102b857bec8f2c3b3a9dafd7c5efc194570a362cd82590745a058c8d714f2f14",
+  "output_tail": [
+    "OFFSITE_SHA_OK files=476"
+  ],
+  "output_sha256": "ad933be8979c37a6294a0bbb7acc1718f01e1c925038eb30b779ee21e0115e90",
+  "receipt_sha256": "881202c15a5bc49bd3e277bdc24dac143ec5ed2ca6f6f93d9d3449bf39a6a3a1",
+  "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/881202c15a5bc49bd3e277bdc24dac143ec5ed2ca6f6f93d9d3449bf39a6a3a1.json"
+}
+```