From f8dc724862ab838c709ff1f1ff8b6b8d8b857856 Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 30 Sep 2026 04:04:26 +0000 Subject: [PATCH 1/4] Record the task card for feature-hardening-batch --- .task/feature-hardening-batch.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .task/feature-hardening-batch.md diff --git a/.task/feature-hardening-batch.md b/.task/feature-hardening-batch.md new file mode 100644 index 00000000..8b6fac16 --- /dev/null +++ b/.task/feature-hardening-batch.md @@ -0,0 +1,25 @@ +# feature/hardening-batch 任务卡 + +任务主记录：；状态：进行中；owner：weichen + +## 基线与授权 + +- 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= 05a5ae1e1ac8ef8d341170c236e9b38570e48947 +- 工作区：/home/weichen/projects/Agent-System-Dev-wt-feature-hardening-batch（worktree）；分支：feature/hardening-batch +- 授权与交付终点：<本次允许的动作与终点；未授权事项写明> + +## 目标与非目标 + +<预期结果、受影响入口/模块/契约；明确不做什么。> + +## 同步记录 + +| 节点 | sync_base_sha | tested_head_sha | checked_at | +|---|---|---|---| +| 启动 | 05a5ae1e1ac8ef8d341170c236e9b38570e48947 | 05a5ae1e1ac8ef8d341170c236e9b38570e48947 | 2026-09-30T04:04:26Z | + +## 结果与验证（完成后填写） + +- 结果： +- 验证： +- 影响与剩余项： From 8252363c040c30f05b799b01928b08c78288581e Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 30 Sep 2026 04:05:42 +0000 Subject: [PATCH 2/4] Add CI, version stamping, and the high-consequence two-key rule Why: PR test evidence depended on the agent's word (single point); the running binary could not answer what combination it was built from; and irreversible operations lacked an explicit agent-stops-here boundary. Evidence: Gitea runner online (home-runner, ubuntu-latest+docker); make version prints describe+component SHAs; two-key line maps to baseline hard boundary 1. CI first run observed on this PR before merge (see Actions tab). Impact: .gitea/workflows/ci.yaml runs make test + make build on PR/push; Makefile injects main.version (make version / agent-system version); AGENTS.md and adoption register the two-key rule. No product code change. Refs: policy/adoption.md; release-operations requirements --- .gitea/workflows/ci.yaml | 27 +++++++++++++++++++++++++++ AGENTS.md | 2 ++ Makefile | 12 +++++++++--- policy/adoption.md | 4 ++++ 4 files changed, 42 insertions(+), 3 deletions(-) create mode 100644 .gitea/workflows/ci.yaml diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml new file mode 100644 index 00000000..62e678ec --- /dev/null +++ b/.gitea/workflows/ci.yaml @@ -0,0 +1,27 @@ +name: ci +on: + pull_request: + branches: [main] + push: + branches: [main] + +jobs: + test: + runs-on: ubuntu-latest + steps: + - name: Configure submodule auth over HTTPS + run: git config --global url."https://weichen:${{ secrets.GITEA_TOKEN }}@git-home.u1680832.nyat.app:30319/".insteadOf "ssh://git@git-ssh.u1680832.nyat.app:31411/" + - uses: actions/checkout@v4 + with: + submodules: recursive + fetch-depth: 0 + - uses: actions/setup-go@v5 + with: + go-version: "1.27" + - uses: actions/setup-node@v4 + with: + node-version: "22" + - name: Combination test (core + backend + frontend) + run: make test + - name: Build the single binary + run: make build diff --git a/AGENTS.md b/AGENTS.md index 878de0d8..b342beef 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -19,6 +19,8 @@ - 主题行：英文祈使句一行（≤100 列，不以句点结尾）；body 写 `Why: / Evidence: / Impact: / Refs:` 四段；任务卡与 PR 描述为同一份文档。 - 跨仓 gitlink 变更须经组合验证（`make test`）后在 Dev 仓推进；受保护分支经 PR 合入。 +- **高后果操作双钥匙**：改写历史、解除/变更分支保护、删除归档引用、发布版本——Agent 只准备 + 方案与命令，由用户确认并亲手执行；Agent 不得自行实施（baseline 硬边界 1 的授权范围要求）。 - 模块边界、公开契约与隔离档位见 `policy/modules/`（如有）与 PROJECT.md。 - 验证命令见 PROJECT.md「验证」节；完成声明须附实际命令输出证据。 - 首次克隆本仓后运行 `make setup` 启用本地 pre-commit 钩子。 diff --git a/Makefile b/Makefile index b09432d8..91300e7e 100644 --- a/Makefile +++ b/Makefile @@ -8,8 +8,14 @@ FRONTEND := modules/frontend BIN := bin/agent-system EMBED_DIR := $(BACKEND)/web/dist PLUGINS := plugins +# 版本溯源（release-operations：运行制品须可对上固定组合）。无 tag 时 --always 给短 SHA。 +COMBO := core=$(shell git -C $(CORE) rev-parse --short HEAD 2>/dev/null)+backend=$(shell git -C $(BACKEND) rev-parse --short HEAD 2>/dev/null)+frontend=$(shell git -C $(FRONTEND) rev-parse --short HEAD 2>/dev/null)+documents=$(shell git -C modules/documents rev-parse --short HEAD 2>/dev/null) +VERSION := $(shell git describe --tags --always --dirty 2>/dev/null)+$(COMBO) -.PHONY: help sync status build frontend test test-backend test-frontend test-core dev pin clean setup precheck task-start task-sync task-finish +.PHONY: help sync status build frontend test test-backend test-frontend test-core dev pin clean setup precheck task-start task-sync task-finish version + +version: + @echo "agent-system $(VERSION)" TASK := scripts/task.sh @@ -56,8 +62,8 @@ frontend: contracts rm -rf $(EMBED_DIR) && mkdir -p $(EMBED_DIR) && cp -r $(FRONTEND)/dist/* $(EMBED_DIR)/ && touch $(EMBED_DIR)/.gitkeep build: frontend - cd $(BACKEND) && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o ../../$(BIN) ./cmd/agent-system - @echo "OK: $(BIN)（单二进制；随附插件目录 $(PLUGINS)/）" + cd $(BACKEND) && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.version=$(VERSION)" -o ../../$(BIN) ./cmd/agent-system + @echo "OK: $(BIN)（版本 $(VERSION)；随附插件目录 $(PLUGINS)/）" test-core: cd $(CORE) && go test ./... diff --git a/policy/adoption.md b/policy/adoption.md index 3be6c280..b26dea49 100644 --- a/policy/adoption.md +++ b/policy/adoption.md @@ -22,4 +22,8 @@ ## 项目差异 +| 原规则/章节 | 项目采用方式 | 原因与风险 | 负责人/复查条件 | +|---|---|---|---| +| baseline 硬边界 1（授权范围） | 高后果双钥匙：改写历史/解除分支保护/删归档/发布——Agent 只准备，用户执行（AGENTS.md 条文） | 单人+Agent 场景下消除单点；风险=用户不在场时高后果操作排队 | weichen；首次触发时复查 | + - Gitea 分支保护已启用（2026-09-30）：11 个组合仓 main 禁直推、拒绝陈旧候选；负例：直推被 pre-receive hook declined。平台层 A3 升级为 enforced。 From 51d9e92b88c86411d5195d7fe05139b06573bb93 Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 30 Sep 2026 04:06:02 +0000 Subject: [PATCH 3/4] Record the sync checkpoint --- .task/delivery-mechanism.md | 1 + 1 file changed, 1 insertion(+) diff --git a/.task/delivery-mechanism.md b/.task/delivery-mechanism.md index 16513427..c1bc4721 100644 --- a/.task/delivery-mechanism.md +++ b/.task/delivery-mechanism.md @@ -29,3 +29,4 @@ | 同步前验收 | 20727a8fd3adeafee6fb37383948e2a9c5a004b0 | c2da46e4d2afbf41bce34dece2d04d2bcaa59b98 | 2026-09-30T03:47:24Z | | 同步前验收 | 8f7cf2d9b9f45ab7c498b753e436e38fbc7726b1 | 7856d980dae4ee37e0661ce1917a722a41fd2c14 | 2026-09-30T03:49:32Z | | 同步前验收 | e85d1ee49f5fb6659d83a3ed3c17ba42a93d5926 | dacef643b2ceee328e929b45874574c5e6b7cd4b | 2026-09-30T03:56:11Z | +| 同步前验收 | 05a5ae1e1ac8ef8d341170c236e9b38570e48947 | 8252363c040c30f05b799b01928b08c78288581e | 2026-09-30T04:06:02Z | From 4bd0803c51e3e6216a389ce1488b40d32e7567b1 Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 30 Sep 2026 04:07:22 +0000 Subject: [PATCH 4/4] Use a repo-scoped PAT secret for private submodule clones in CI MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Why: the job token only authorizes the event repository; sibling private submodules (Development-Guidelines et al.) returned 404 on the first run. Evidence: run 194 log — clone of deps/development-guidelines failed with repository not found despite the insteadOf rewrite. Impact: ci.yaml reads secrets.SUBMODULE_TOKEN (stored via API, never in tree or chat); no other change. Refs: run 194; PR#11 --- .gitea/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 62e678ec..3c750cef 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Configure submodule auth over HTTPS - run: git config --global url."https://weichen:${{ secrets.GITEA_TOKEN }}@git-home.u1680832.nyat.app:30319/".insteadOf "ssh://git@git-ssh.u1680832.nyat.app:31411/" + run: git config --global url."https://weichen:${{ secrets.SUBMODULE_TOKEN }}@git-home.u1680832.nyat.app:30319/".insteadOf "ssh://git@git-ssh.u1680832.nyat.app:31411/" - uses: actions/checkout@v4 with: submodules: recursive