diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 51c880a2..a46b0b12 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -35,7 +35,7 @@ jobs: parsed_server = urlsplit(SERVER) if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc: sys.exit("Checkout server must be the platform-injected http(s) URL") - SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/" + SSH = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/" # Reviewed allowlist, independent of candidate .gitmodules. Add repositories # here only with an explicit review of the checkout credential's scope. REPOSITORIES = { @@ -219,7 +219,7 @@ jobs: parsed_server = urlsplit(SERVER) if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc: sys.exit("Checkout server must be the platform-injected http(s) URL") - SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/" + SSH = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/" # Reviewed allowlist, independent of candidate .gitmodules. Add repositories # here only with an explicit review of the checkout credential's scope. REPOSITORIES = { @@ -410,7 +410,7 @@ jobs: export GIT_CONFIG_KEY_1="http.$SERVER/.extraheader" export GIT_CONFIG_VALUE_1="AUTHORIZATION: token $SUBMODULE_TOKEN" export GIT_CONFIG_KEY_2="url.$SERVER/weichen/.insteadOf" - export GIT_CONFIG_VALUE_2="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/" + export GIT_CONFIG_VALUE_2="ssh://git@gitea.naitangbaobao.cn:52222/weichen/" export GIT_CONFIG_KEY_3="core.hooksPath" export GIT_CONFIG_VALUE_3="/dev/null" git clone --depth=1 "$SERVER/weichen/Agent-System-RDM.git" rdm @@ -544,7 +544,7 @@ jobs: parsed_server = urlsplit(SERVER) if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc: sys.exit("Checkout server must be the platform-injected http(s) URL") - SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/" + SSH = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/" # Reviewed allowlist, independent of candidate .gitmodules. Add repositories # here only with an explicit review of the checkout credential's scope. REPOSITORIES = { @@ -698,7 +698,7 @@ jobs: export GIT_CONFIG_KEY_1="http.$SERVER/.extraheader" export GIT_CONFIG_VALUE_1="AUTHORIZATION: token $SUBMODULE_TOKEN" export GIT_CONFIG_KEY_2="url.$SERVER/weichen/.insteadOf" - export GIT_CONFIG_VALUE_2="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/" + export GIT_CONFIG_VALUE_2="ssh://git@gitea.naitangbaobao.cn:52222/weichen/" export GIT_CONFIG_KEY_3="core.hooksPath" export GIT_CONFIG_VALUE_3="/dev/null" git clone --depth=1 "$SERVER/weichen/Agent-System-RDM.git" rdm diff --git a/.gitmodules b/.gitmodules index e5b0f4e6..cbf20c06 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,42 +1,42 @@ [submodule "modules/core"] path = modules/core - url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Core.git + url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-System-Core.git [submodule "modules/backend"] path = modules/backend - url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Backend.git + url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-System-Backend.git [submodule "modules/frontend"] path = modules/frontend - url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Frontend.git + url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-System-Frontend.git [submodule "modules/documents"] path = modules/documents - url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Documents.git + url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-System-Documents.git [submodule "deps/development-guidelines"] path = deps/development-guidelines - url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Development-Guidelines.git + url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Development-Guidelines.git [submodule "deps/agent-native"] path = deps/agent-native - url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Native.git + url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-Native.git [submodule "deps/agent-squad"] path = deps/agent-squad - url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Squad.git + url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-Squad.git [submodule "deps/agent-intent"] path = deps/agent-intent - url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Intent.git + url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-Intent.git [submodule "deps/error-code-system"] path = deps/error-code-system - url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Error-Code-System.git + url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Error-Code-System.git [submodule "deps/logging-system"] path = deps/logging-system - url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Logging-System.git + url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Logging-System.git [submodule "modules/ui"] path = modules/ui - url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-UI.git + url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-System-UI.git [submodule "deps/agent-command"] path = deps/agent-command - url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Command.git + url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-Command.git [submodule "deps/development-manager"] path = deps/development-manager - url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Development-Manager.git + url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Development-Manager.git [submodule "deps/agent-document-renderer"] path = deps/agent-document-renderer - url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-Document-Renderer.git + url = ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-Document-Renderer.git diff --git a/policy/delivery.md b/policy/delivery.md index abf76bdd..48daa5e7 100644 --- a/policy/delivery.md +++ b/policy/delivery.md @@ -381,7 +381,7 @@ Review 只将阻塞项列为必修；非阻塞意见标明后续建议，不得 解决冲突和重跑最终 CI。本节只安排 Dev `refs/heads/main` 的最终交付顺序；需求、授权、阶段状态和 证据仍在原任务卡，受保护分支的最终准入仍由 Gitea 执行。 -- **队列**：Dev main 只用一份[合入队列 #518](https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/issues/518)， +- **队列**：Dev main 只用一份[合入队列 #518](https://gitea.naitangbaobao.cn/weichen/Agent-System-Dev/issues/518)， 只记录顺序和当前窗口：任务/PR、owner、依赖、就绪状态、当前 base/head、CI、合入结果。 - **职责**：协调智能体维护顺序和窗口；任务 owner 负责分支内容和必要整改；窗口内的同步、冲突处置、 Review、当前 HEAD CI 核验和所有 PR 合入由智能体执行。 diff --git a/policy/facts.md b/policy/facts.md index 3fcf83fa..808da8ef 100644 --- a/policy/facts.md +++ b/policy/facts.md @@ -15,9 +15,9 @@ | ID | 事实 | 验证命令 | last_verified | TTL(天) | |---|---|---|---|---| -| F1 | Gitea Web/API 可达：https://git-home.u1680832.nyat.app:30319（1.27.3） | `curl -fsS -m 10 https://git-home.u1680832.nyat.app:30319/api/v1/version` | 2026-10-14 | 30 | -| F2 | API token 存在且可用（值在 ~/.secrets/gitea，HOME/IMC 两段各一组 `- ACCESS_TOKEN=…`，本条取 HOME 段；不入仓不回显，不进子进程 argv） | `bash scripts/facts-verify.sh api-token https://git-home.u1680832.nyat.app:30319/api/v1/user` | 2026-10-14 | 30 | -| F3 | Git over SSH 可达：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/<Repo>.git（key ~/.ssh/home_gitea） | `GIT_SSH_COMMAND="ssh -i ~/.ssh/home_gitea -o BatchMode=yes" git ls-remote ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Development-Guidelines.git HEAD` | 2026-10-14 | 30 | +| F1 | Gitea Web/API 可达：https://gitea.naitangbaobao.cn（1.27.3） | `curl -fsS -m 10 https://gitea.naitangbaobao.cn/api/v1/version` | 2026-10-22 | 30 | +| F2 | API token 存在且可用（值在 ~/.secrets/gitea，HOME/IMC 两段各一组 `- ACCESS_TOKEN=…`，本条取 HOME 段；不入仓不回显，不进子进程 argv） | `bash scripts/facts-verify.sh api-token https://gitea.naitangbaobao.cn/api/v1/user` | 2026-10-22 | 30 | +| F3 | Git over SSH 可达：ssh://git@gitea.naitangbaobao.cn:52222/weichen/<Repo>.git（key ~/.ssh/home_gitea） | `GIT_SSH_COMMAND="ssh -i ~/.ssh/home_gitea -o BatchMode=yes" git ls-remote ssh://git@gitea.naitangbaobao.cn:52222/weichen/Development-Guidelines.git HEAD` | 2026-10-22 | 30 | | F4 | 旧端点 git-panel.u1680832.nyat.app:30319 TCP 可连通但 TLS 握手失败（仅 TLS 层握手错误判 PASS） | `bash scripts/facts-verify.sh tls-handshake-fails git-panel.u1680832.nyat.app 30319` | 2026-10-14 | 180 | | F5 | 基座 users 表存有姓名（name 列，CreateAccount/ListUsersAdmin 读写；EXT-19 目录自 P3 起向授权管理读面下发） | `cd modules/backend && go test ./internal/app/ -run TestInprocHostSearchAccounts -count=1` | 2026-10-14 | 180 | | F6 | 基座账号无停用位（users 表无 disabled；EXT-19 Valid 恒为存在性）——停用机制未实现，不得当已具备 | `cd modules/backend && ! grep -rn -e disabled -e Disabled internal/store/auth.go pkg/extension/extension.go` | 2026-10-14 | 180 | diff --git a/scripts/facts-verify.sh b/scripts/facts-verify.sh index 61d4200c..5a8d24f4 100755 --- a/scripts/facts-verify.sh +++ b/scripts/facts-verify.sh @@ -4,7 +4,7 @@ # 用法：make facts-verify [ARGS=--update] （--update：把 PASS 项 last_verified 刷为当天并写回） # 表内验证命令约定不含竖线；含 "\|" 转义时按字面还原后执行。 # 登记表引用的探针子命令（单独运行时在 stderr 说明判定，不输出凭据）： -# api-token URL URL 须逐字等于登记端点 https://git-home.u1680832.nyat.app:30319/api/v1/user， +# api-token URL URL 须逐字等于登记端点 https://gitea.naitangbaobao.cn/api/v1/user， # 校验通过后才进程内读 ~/.secrets/gitea HOME 段 ACCESS_TOKEN 并 GET（不跟随重定向）； # 0=接受 3=缺失 4=格式不符 5=请求失败/被拒/重定向 6=非登记端点 # tls-handshake-fails HOST PORT 仅当 TCP 已连通且 TLS 层握手报错时 0； @@ -20,7 +20,7 @@ import sys, urllib.request sys.path.insert(0, sys.argv[1]) import task_triage -ENDPOINT = "https://git-home.u1680832.nyat.app:30319/api/v1/user" +ENDPOINT = "https://gitea.naitangbaobao.cn/api/v1/user" if sys.argv[2] != ENDPOINT: print("api-token: URL 不是 policy/facts.md F2 登记端点，拒绝发送凭据", file=sys.stderr) sys.exit(6) diff --git a/scripts/svc.sh b/scripts/svc.sh index 546c41e5..a082ab6a 100755 --- a/scripts/svc.sh +++ b/scripts/svc.sh @@ -144,7 +144,7 @@ SRC_DIR="${SVC_SRC_DIR:-${XDG_CACHE_HOME:-$HOME/.cache}/agent-system-svc/src}" # 独立 RDM 源仓（下游组合仓 Agent-System-RDM 的干净克隆；SVC_RDM_SRC_DIR 覆盖路径， # SVC_RDM_ORIGIN 覆盖克隆来源）。rdm 源的解析/列举/物化全部基于它，语义与 SRC_DIR 一致。 RDM_SRC_DIR="${SVC_RDM_SRC_DIR:-${XDG_CACHE_HOME:-$HOME/.cache}/agent-system-svc/rdm-src}" -RDM_ORIGIN_DEFAULT="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-RDM.git" +RDM_ORIGIN_DEFAULT="ssh://git@gitea.naitangbaobao.cn:52222/weichen/Agent-System-RDM.git" # 提示信息走 stderr：stdout 只留给数据（提交表/服务表/DSN），便于 $( ) 捕获组合。 c_info() { [ "${CLI_QUIET:-0}" = 1 ] && return 0; printf '\033[1;34m[svc]\033[0m %s\n' "$*" >&2; } diff --git a/scripts/task.sh b/scripts/task.sh index c88d46ce..62589e5a 100755 --- a/scripts/task.sh +++ b/scripts/task.sh @@ -813,7 +813,7 @@ card_merge_squash() { # $1=branch $2=ref → squash/rebase 落地没有 merge # 仅查最近 5 页（250 条）：card_merge 的 merge 提交路径仍是主路径，此兜底面向新近任务卡。 local token="${GITEA_TOKEN:-}" web_base url repo owner api payload pg found sha [ -n "$token" ] || return 1 - web_base="${TASK_CARD_WEB_BASE:-https://git-home.u1680832.nyat.app:30319}" + web_base="${TASK_CARD_WEB_BASE:-https://gitea.naitangbaobao.cn}" url=$(git remote get-url origin 2>/dev/null) || return 1 url="${url%.git}" repo=$(basename "$url"); owner=$(basename "$(dirname "$url")") @@ -951,7 +951,7 @@ cmd_close_self() { esac pr="$nums" fi - web_base="${TASK_CARD_WEB_BASE:-https://git-home.u1680832.nyat.app:30319}" + web_base="${TASK_CARD_WEB_BASE:-https://gitea.naitangbaobao.cn}" url=$(git remote get-url origin); url="${url%.git}" repo=$(basename "$url"); owner=$(basename "$(dirname "$url")") link="${web_base}/${owner}/${repo}/pulls/${pr}" @@ -981,7 +981,7 @@ cmd_close() { fetch_target # 默认值取远端通告的 Web 面（git push 输出的 PR 建议链接）；可用 TASK_CARD_WEB_BASE 覆盖。 # git-panel 前缀已失效（TLS 握手失败），默认值改为实测可用的 git-home（AGENTS.md 访问事实节）。 - local web_base="${TASK_CARD_WEB_BASE:-https://git-home.u1680832.nyat.app:30319}" + local web_base="${TASK_CARD_WEB_BASE:-https://gitea.naitangbaobao.cn}" local url owner repo url=$(git remote get-url origin); url="${url%.git}" repo=$(basename "$url"); owner=$(basename "$(dirname "$url")") diff --git a/scripts/task_triage.py b/scripts/task_triage.py index c77742c4..7dca33dd 100644 --- a/scripts/task_triage.py +++ b/scripts/task_triage.py @@ -29,7 +29,7 @@ import urllib.parse import urllib.request SCHEMA = "agent-system/task-triage/v1" -DEFAULT_API = "https://git-home.u1680832.nyat.app:30319/api/v1" +DEFAULT_API = "https://gitea.naitangbaobao.cn/api/v1" DEFAULT_TARGET = "main" DEFAULT_MAX_AGE = 14400 PAGE_LIMIT = 50 diff --git a/tests/test_ci_credentials.py b/tests/test_ci_credentials.py index e29b24b9..c72b33ac 100644 --- a/tests/test_ci_credentials.py +++ b/tests/test_ci_credentials.py @@ -11,8 +11,8 @@ from urllib.parse import urlsplit WORKFLOW = Path(__file__).resolve().parents[1] / ".gitea/workflows/ci.yaml" -SERVER = "https://git-home.u1680832.nyat.app:30319" -SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/" +SERVER = "https://gitea.naitangbaobao.cn" +SSH = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/" ROOT_TOKEN = "synthetic-root-token-not-a-real-secret" SUB_TOKEN = "synthetic-component-token-not-a-real-secret" diff --git a/tests/test_facts_verify.py b/tests/test_facts_verify.py index 5b3d9d2a..a341bf83 100644 --- a/tests/test_facts_verify.py +++ b/tests/test_facts_verify.py @@ -256,7 +256,7 @@ class FactsVerifyTests(unittest.TestCase): self.assert_status(result.stdout, "F2", "PASS") requests = self.stub_events("http") self.assertEqual(len(requests), 1, requests) - self.assertEqual(requests[0]["url"], "https://git-home.u1680832.nyat.app:30319/api/v1/user") + self.assertEqual(requests[0]["url"], "https://gitea.naitangbaobao.cn/api/v1/user") self.assertEqual(requests[0]["authorization"], "token " + HOME_TOKEN) self.assertEqual(self.dates(), {"F2": self.today, "F8": self.today, "F9": OLD_DATE}) self.assertTrue(receipt.exists(), result.stderr) @@ -285,7 +285,7 @@ class FactsVerifyTests(unittest.TestCase): self.assert_status(result.stdout, "F2", "FAIL") self.assertEqual(self.stub_events("http"), [], "no request without a valid HOME token") self.assertEqual(self.dates()["F2"], OLD_DATE) - direct = self.run_script("api-token", "https://git-home.u1680832.nyat.app:30319/api/v1/user") + direct = self.run_script("api-token", "https://gitea.naitangbaobao.cn/api/v1/user") self.assertNotEqual(direct.returncode, 0) self.assertIn("ACCESS_TOKEN", direct.stderr) self.assert_no_secrets(result.stdout, result.stderr, direct.stdout, direct.stderr, @@ -299,7 +299,7 @@ class FactsVerifyTests(unittest.TestCase): result = self.run_script("--update", http=http) self.assert_status(result.stdout, "F2", "FAIL") self.assertEqual(self.dates(), {"F2": OLD_DATE, "F8": self.today, "F9": OLD_DATE}) - direct = self.run_script("api-token", "https://git-home.u1680832.nyat.app:30319/api/v1/user", + direct = self.run_script("api-token", "https://gitea.naitangbaobao.cn/api/v1/user", http=http) self.assertNotEqual(direct.returncode, 0) self.assertNotIn("Authorization", direct.stderr) @@ -307,17 +307,17 @@ class FactsVerifyTests(unittest.TestCase): def test_f2_rejects_unregistered_destination_before_reading_credentials(self): bad_urls = [ - "http://git-home.u1680832.nyat.app:30319/api/v1/user", + "http://gitea.naitangbaobao.cn/api/v1/user", "https://evil.invalid/api/v1/user", - "https://git-home.u1680832.nyat.app:30320/api/v1/user", - "https://git-home.u1680832.nyat.app/api/v1/user", - "https://user:pw@git-home.u1680832.nyat.app:30319/api/v1/user", - "https://git-home.u1680832.nyat.app:30319@evil.invalid/api/v1/user", - "https://git-home.u1680832.nyat.app:30319/api/v1/user#frag", - "https://git-home.u1680832.nyat.app:30319/api/v1/user?next=https://evil.invalid", - "https://git-home.u1680832.nyat.app:30319/api/v1/users", - "https://git-home.u1680832.nyat.app:30319/api/v1/user/../admin", - "https://git-home.u1680832.nyat.app:30319/api/v1/user ", + "https://gitea.naitangbaobao.cn:30320/api/v1/user", + "https://gitea.naitangbaobao.cn:443/api/v1/user", + "https://user:pw@gitea.naitangbaobao.cn/api/v1/user", + "https://gitea.naitangbaobao.cn@evil.invalid/api/v1/user", + "https://gitea.naitangbaobao.cn/api/v1/user#frag", + "https://gitea.naitangbaobao.cn/api/v1/user?next=https://evil.invalid", + "https://gitea.naitangbaobao.cn/api/v1/users", + "https://gitea.naitangbaobao.cn/api/v1/user/../admin", + "https://gitea.naitangbaobao.cn/api/v1/user ", ] for secrets_present in (True, False): if not secrets_present: @@ -337,12 +337,12 @@ class FactsVerifyTests(unittest.TestCase): for code in ("301", "302", "303", "307", "308"): with self.subTest(code): self.stub_log.unlink(missing_ok=True) - direct = self.run_script("api-token", "https://git-home.u1680832.nyat.app:30319/api/v1/user", + direct = self.run_script("api-token", "https://gitea.naitangbaobao.cn/api/v1/user", http=code) self.assertEqual(direct.returncode, 5, direct.stderr) requests = self.stub_events("http") self.assertEqual([r["url"] for r in requests], - ["https://git-home.u1680832.nyat.app:30319/api/v1/user"], "no follow-up request") + ["https://gitea.naitangbaobao.cn/api/v1/user"], "no follow-up request") self.assertNotIn("redirect-target", direct.stdout + direct.stderr) self.assert_no_secrets(direct.stdout, direct.stderr) diff --git a/tests/test_svc_realcombo.py b/tests/test_svc_realcombo.py index 9e01c195..02d69bcb 100644 --- a/tests/test_svc_realcombo.py +++ b/tests/test_svc_realcombo.py @@ -56,7 +56,7 @@ def ci_git_env(): "GIT_CONFIG_KEY_1": "http.%s/.extraheader" % CI_SERVER, "GIT_CONFIG_VALUE_1": "AUTHORIZATION: token " + CI_TOKEN, "GIT_CONFIG_KEY_2": "url.%s/weichen/.insteadOf" % CI_SERVER, - "GIT_CONFIG_VALUE_2": "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/", + "GIT_CONFIG_VALUE_2": "ssh://git@gitea.naitangbaobao.cn:52222/weichen/", "GIT_CONFIG_KEY_3": "core.hooksPath", "GIT_CONFIG_VALUE_3": "/dev/null", }