From 8252363c040c30f05b799b01928b08c78288581e Mon Sep 17 00:00:00 2001
From: weichen <weichen@local>
Date: Wed, 30 Sep 2026 04:05:42 +0000
Subject: [PATCH] Add CI, version stamping, and the high-consequence two-key
 rule

Why: PR test evidence depended on the agent's word (single point); the
running binary could not answer what combination it was built from; and
irreversible operations lacked an explicit agent-stops-here boundary.
Evidence: Gitea runner online (home-runner, ubuntu-latest+docker); make
version prints describe+component SHAs; two-key line maps to baseline hard
boundary 1. CI first run observed on this PR before merge (see Actions tab).
Impact: .gitea/workflows/ci.yaml runs make test + make build on PR/push;
Makefile injects main.version (make version / agent-system version);
AGENTS.md and adoption register the two-key rule. No product code change.
Refs: policy/adoption.md; release-operations requirements
---
 .gitea/workflows/ci.yaml | 27 +++++++++++++++++++++++++++
 AGENTS.md                |  2 ++
 Makefile                 | 12 +++++++++---
 policy/adoption.md       |  4 ++++
 4 files changed, 42 insertions(+), 3 deletions(-)
 create mode 100644 .gitea/workflows/ci.yaml

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
new file mode 100644
index 00000000..62e678ec
--- /dev/null
+++ b/.gitea/workflows/ci.yaml
@@ -0,0 +1,27 @@
+name: ci
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Configure submodule auth over HTTPS
+        run: git config --global url."https://weichen:${{ secrets.GITEA_TOKEN }}@git-home.u1680832.nyat.app:30319/".insteadOf "ssh://git@git-ssh.u1680832.nyat.app:31411/"
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          fetch-depth: 0
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.27"
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - name: Combination test (core + backend + frontend)
+        run: make test
+      - name: Build the single binary
+        run: make build
diff --git a/AGENTS.md b/AGENTS.md
index 878de0d8..b342beef 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -19,6 +19,8 @@
 - 主题行：英文祈使句一行（≤100 列，不以句点结尾）；body 写 `Why: / Evidence: / Impact: / Refs:`
   四段；任务卡与 PR 描述为同一份文档。
 - 跨仓 gitlink 变更须经组合验证（`make test`）后在 Dev 仓推进；受保护分支经 PR 合入。
+- **高后果操作双钥匙**：改写历史、解除/变更分支保护、删除归档引用、发布版本——Agent 只准备
+  方案与命令，由用户确认并亲手执行；Agent 不得自行实施（baseline 硬边界 1 的授权范围要求）。
 - 模块边界、公开契约与隔离档位见 `policy/modules/`（如有）与 PROJECT.md。
 - 验证命令见 PROJECT.md「验证」节；完成声明须附实际命令输出证据。
 - 首次克隆本仓后运行 `make setup` 启用本地 pre-commit 钩子。
diff --git a/Makefile b/Makefile
index b09432d8..91300e7e 100644
--- a/Makefile
+++ b/Makefile
@@ -8,8 +8,14 @@ FRONTEND   := modules/frontend
 BIN        := bin/agent-system
 EMBED_DIR  := $(BACKEND)/web/dist
 PLUGINS    := plugins
+# 版本溯源（release-operations：运行制品须可对上固定组合）。无 tag 时 --always 给短 SHA。
+COMBO      := core=$(shell git -C $(CORE) rev-parse --short HEAD 2>/dev/null)+backend=$(shell git -C $(BACKEND) rev-parse --short HEAD 2>/dev/null)+frontend=$(shell git -C $(FRONTEND) rev-parse --short HEAD 2>/dev/null)+documents=$(shell git -C modules/documents rev-parse --short HEAD 2>/dev/null)
+VERSION    := $(shell git describe --tags --always --dirty 2>/dev/null)+$(COMBO)
 
-.PHONY: help sync status build frontend test test-backend test-frontend test-core dev pin clean setup precheck task-start task-sync task-finish
+.PHONY: help sync status build frontend test test-backend test-frontend test-core dev pin clean setup precheck task-start task-sync task-finish version
+
+version:
+	@echo "agent-system $(VERSION)"
 
 TASK := scripts/task.sh
 
@@ -56,8 +62,8 @@ frontend: contracts
 	rm -rf $(EMBED_DIR) && mkdir -p $(EMBED_DIR) && cp -r $(FRONTEND)/dist/* $(EMBED_DIR)/ && touch $(EMBED_DIR)/.gitkeep
 
 build: frontend
-	cd $(BACKEND) && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o ../../$(BIN) ./cmd/agent-system
-	@echo "OK: $(BIN)（单二进制；随附插件目录 $(PLUGINS)/）"
+	cd $(BACKEND) && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.version=$(VERSION)" -o ../../$(BIN) ./cmd/agent-system
+	@echo "OK: $(BIN)（版本 $(VERSION)；随附插件目录 $(PLUGINS)/）"
 
 test-core:
 	cd $(CORE) && go test ./...
diff --git a/policy/adoption.md b/policy/adoption.md
index 3be6c280..b26dea49 100644
--- a/policy/adoption.md
+++ b/policy/adoption.md
@@ -22,4 +22,8 @@
 
 ## 项目差异
 
+| 原规则/章节 | 项目采用方式 | 原因与风险 | 负责人/复查条件 |
+|---|---|---|---|
+| baseline 硬边界 1（授权范围） | 高后果双钥匙：改写历史/解除分支保护/删归档/发布——Agent 只准备，用户执行（AGENTS.md 条文） | 单人+Agent 场景下消除单点；风险=用户不在场时高后果操作排队 | weichen；首次触发时复查 |
+
 - Gitea 分支保护已启用（2026-09-30）：11 个组合仓 main 禁直推、拒绝陈旧候选；负例：直推被 pre-receive hook declined。平台层 A3 升级为 enforced。