From 9269986bfe55ceb7fff73cb2b27788cb99e421fa Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 30 Sep 2026 16:58:24 +0000 Subject: [PATCH 1/4] Record the task card for fix-followup-hardening --- .task/fix-followup-hardening.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .task/fix-followup-hardening.md diff --git a/.task/fix-followup-hardening.md b/.task/fix-followup-hardening.md new file mode 100644 index 00000000..5c50ec53 --- /dev/null +++ b/.task/fix-followup-hardening.md @@ -0,0 +1,25 @@ +# fix/followup-hardening 任务卡 + +任务主记录：；状态：进行中；owner：weichen + +## 基线与授权 + +- 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= 48c3da846f801c53164b93a9c79affb98689f791 +- 工作区：/home/weichen/projects/Agent-System-Dev-wt-fix-followup-hardening（worktree）；分支：fix/followup-hardening +- 授权与交付终点：<本次允许的动作与终点；未授权事项写明> + +## 目标与非目标 + +<预期结果、受影响入口/模块/契约；明确不做什么。> + +## 同步记录 + +| 节点 | sync_base_sha | tested_head_sha | checked_at | +|---|---|---|---| +| 启动 | 48c3da846f801c53164b93a9c79affb98689f791 | 48c3da846f801c53164b93a9c79affb98689f791 | 2026-09-30T16:58:24Z | + +## 结果与验证（完成后填写） + +- 结果： +- 验证： +- 影响与剩余项： From aeb9a6a8eaf4068fa62ea97ab76cb19d3e19f93b Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 30 Sep 2026 17:11:40 +0000 Subject: [PATCH 2/4] Harden task.sh materialization check and close push retry MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Why: two recurring papercuts from 2026-09-30 sessions — (1) task-start treated a zero-exit submodule update as complete, but a worktree could still carry 12 drifted/uninitialized nested submodules that only surfaced at build time; (2) close ran a single git push, so a tunnel hiccup left the card-close branch unpushed and the auto-PR never created (hand-patched twice that day). Evidence: bash -n clean; smoke start of a throwaway task measured nested drift count explicitly and abandon-path finish recycled worktree and branch cleanly (both PASS); fresh-clone commit identity probe also PASS after setting the global identity outside this repo. Impact: scripts/task.sh cmd_start (+3-line status check) and cmd_close (one retry on push); no interface change. Refs: .task/fix-followup-hardening.md --- scripts/task.sh | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/scripts/task.sh b/scripts/task.sh index 02cd67c6..84c1617a 100755 --- a/scripts/task.sh +++ b/scripts/task.sh @@ -72,7 +72,14 @@ cmd_start() { wt="$(dirname "$mainroot")/$(basename "$mainroot")-wt-${slug}" [ -e "$wt" ] && die "worktree path exists: $wt" git worktree add -q "$wt" -b "$name" "$rmain" - (cd "$wt" && git submodule update --init --recursive >/dev/null 2>&1 || echo "[warn] submodule init incomplete in worktree") + # 物化后按 submodule status 实际状态核对，不只信退出码：网络抖动或嵌套指针 + # 漂移时 update 可能静默留坑（2026-09-30 实测深嵌套层带病通过，构建期才炸）。 + (cd "$wt" && git submodule update --init --recursive >/dev/null 2>&1) \ + || echo "[warn] submodule update 非零退出，见下方状态核对" + local sub_drift + sub_drift=$(git -C "$wt" submodule status --recursive 2>/dev/null | grep -cE '^[-+U]' || true) + [ "${sub_drift:-0}" -gt 0 ] \ + && echo "[warn] worktree 子模块物化不完整：${sub_drift} 项漂移/未初始化——构建前先核对（git -C $wt submodule status --recursive）" local card="$wt/.task/${slug}.md" mkdir -p "$wt/.task" cat > "$card" < "$msg" git add .task git commit -q -F "$msg"; rm -f "$msg" - git push -q -u origin HEAD + # push 失败重试一次：家服隧道间歇抖动，单次尝试曾让钩子闭合半途而废（2026-09-30）。 + git push -q -u origin HEAD || { sleep 5; git push -q -u origin HEAD; } local headbr pr_url="" headbr=$(git rev-parse --abbrev-ref HEAD) if [ -n "${GITEA_TOKEN:-}" ]; then From 1381b826ecf4a2235e91ce1b240ba96b25bcce61 Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 30 Sep 2026 17:16:28 +0000 Subject: [PATCH 3/4] Pin backend and core gitlinks and record follow-up hardening MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Why: two strands land together — (1) the remaining 20 module-level govulncheck advisories against x/crypto v0.37.0 clear to the upstream floor via Backend#25 (19 fixed, GO-2026-5932 unfixed upstream); (2) backend main (daddac8) and core main (cafd9a5) from the parallel cardflow merge were not yet pinned, and backend main no longer built against the Dev-pinned core — pinning the coherent pair keeps main verifiable. Evidence: combined make test exit 0 at backend daddac8 + core cafd9a5 (backend packages ok, frontend 33/33, ui 37/37, agentcmd ok); backend go test green and govulncheck 0 affected / 0 import-level / 1 module-level; task.sh hardening smoke-verified (drift measurement, identity probe, abandon cleanup all PASS). Impact: two gitlink pins + task card; no Dev-repo source change; remote branch hygiene (55 merged branches deleted) and global git identity were environment fixes outside the repo. Refs: .task/fix-followup-hardening.md, Backend PR #25 --- .task/fix-followup-hardening.md | 14 +++++++++++++- modules/backend | 2 +- modules/core | 2 +- 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/.task/fix-followup-hardening.md b/.task/fix-followup-hardening.md index 5c50ec53..ef636208 100644 --- a/.task/fix-followup-hardening.md +++ b/.task/fix-followup-hardening.md @@ -6,7 +6,13 @@ - 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= 48c3da846f801c53164b93a9c79affb98689f791 - 工作区：/home/weichen/projects/Agent-System-Dev-wt-fix-followup-hardening（worktree）；分支：fix/followup-hardening -- 授权与交付终点：<本次允许的动作与终点；未授权事项写明> +- 授权与交付终点：修复过程遗留小坑（全局 git 身份、远端已合入分支残留、task-start 物化静默失败、close push 无重试）并将 backend 剩余 20 条 module 级依赖通告清至地板；终点为 backend PR 与 Dev PR 合入后回收 worktree。 + +## 目标与非目标 + +- 目标：①设全局 git 身份（修新克隆提交失败）；②清理远端已合入分支；③task.sh start 物化后按 submodule status 实测核对（不只信退出码）+ close push 失败重试一次；④backend x/crypto→v0.56.0 清 19 条 module 级通告；⑤Dev 钉 backend daddac8 + core cafd9a5（并行会话已合入未钉的配套对，随本卡一并收敛）。 +- 非目标：不动 GO-2026-5932（上游无修复版，地板）；不处理 frontend/ui（audit 已清零）；不重写 precheck 判脏口径。 +- <本次允许的动作与终点；未授权事项写明> ## 目标与非目标 @@ -23,3 +29,9 @@ - 结果： - 验证： - 影响与剩余项： + +## 结果与验证 + +- 结果：全局身份已设（weichen ）；远端 55 条已合入分支全删（剩 main + 活跃 cardflow-r1）；task.sh 两处小修提交 aeb9a6a；backend PR #25（5a01b0e）合入，backend main=daddac8；Dev 双 gitlink 钉入。 +- 验证：冒烟——throwaway 任务 start（嵌套物化漂移实测计数）+ 新克隆空提交探测（身份生效）+ FORCE_ABANDON finish 干净回收，全部 PASS；backend go build/go test 绿且 govulncheck 报 0 affected / 0 import / 1 module（GO-2026-5932 上游无修复）；Dev make test exit 0（backend 全包 ok、frontend 33/33、ui 37/37、agentcmd ok）。 +- 影响与剩余项：无阻断项；GO-2026-5932 待上游发修复版后随 routine bump 消化；close push 重试的真实链路验证随本卡收尾的卡片自动闭合完成。 diff --git a/modules/backend b/modules/backend index 41cebd3b..daddac8e 160000 --- a/modules/backend +++ b/modules/backend @@ -1 +1 @@ -Subproject commit 41cebd3b65e539d74b6d0cd4122b80657688642e +Subproject commit daddac8e472d9dc6e263ba706499962bd22d1361 diff --git a/modules/core b/modules/core index c9aff06e..cafd9a54 160000 --- a/modules/core +++ b/modules/core @@ -1 +1 @@ -Subproject commit c9aff06ed585726aacb190ba1a6f3ba046a36d67 +Subproject commit cafd9a54e5f23ae1744750f1e6e97e0a505f8d81 From 7e657c4b47253ee24ba09483a6fb39c6523ee5f5 Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 30 Sep 2026 17:17:46 +0000 Subject: [PATCH 4/4] Record the sync checkpoint --- .task/feature-duplication-lesson-records.md | 1 + 1 file changed, 1 insertion(+) diff --git a/.task/feature-duplication-lesson-records.md b/.task/feature-duplication-lesson-records.md index 6e4925a2..0dbeb565 100644 --- a/.task/feature-duplication-lesson-records.md +++ b/.task/feature-duplication-lesson-records.md @@ -50,3 +50,4 @@ | 同步前验收 | a612361b98879f4679cab503035e2111c593bf9b | 290b9bbd26077ae4320783d3b24b6cef0c2e6e05 | 2026-09-30T16:38:22Z | | 同步前验收 | 0b0540e2d251ed6bee77e63fb1ed174dda3ddd41 | 888aa9471c0a6f6917eef1d4801e87b5c411cf6a | 2026-09-30T16:47:54Z | | 同步前验收 | 9f2a7fb4b806bb63f43c3ee759bdbb1ab1f97720 | 21a92441dce7787b8c3eaeaf731aad9a58215836 | 2026-09-30T16:49:57Z | +| 同步前验收 | bb7f541d42dc6bd2609e59fed6760f22ed5c213e | dcb5bc0f727b5ceaf95b73b5ea514e63d9a89ae0 | 2026-09-30T17:17:46Z |