Why: backend main advanced to 528e3a4 (surface conversation required,
card backfills); the backend task branch merges it into the batch-1
line and the Dev pin follows.
Evidence: integration transport success (gitlink5-run.json); backend
build green on the merge; full make test re-run follows.
Impact: one component gitlink.
Refs: feature/agent-stack-audit-remediation-b1
Why: close out the batch-1 audit trail before review and PR.
Evidence: make test exit=0 on the fully repinned combination
(verify-combo-make-test4.json).
Impact: task metadata only.
Refs: feature/agent-stack-audit-remediation-b1
Why: the U3B sqlite repair advanced the squad container to 0f1daa8 and
backend's nested-squad pin follow-up moved backend to 1f61131.
Evidence: integration transport success (gitlink4-run.json); full
make test re-run follows on this branch.
Impact: two component gitlinks.
Refs: feature/agent-stack-audit-remediation-b1
Why: check-pins requires each container's nested gitlinks to equal the
Dev top-level pins; the batch-1 bumps left native/squad/backend
containers pinned at pre-batch sibling versions.
Evidence: integration transport success (gitlink3-run.json); full
make test re-run follows on this branch.
Impact: three component gitlinks.
Refs: feature/agent-stack-audit-remediation-b1
Why: the backend branch advanced to 49c1259 with the U6 boundary
repair (admission test reworked behind intentgate helpers).
Evidence: repair receipt success; verify-u6r2 exit=0; combination
make test re-run follows on this branch.
Impact: one component gitlink.
Refs: feature/agent-stack-audit-remediation-b1
Why: land U1-U7 and U10 across agent-native (5c0d2d8), agent-squad
(23f161b), agent-intent (765a7e7), agent-command (fe7987d) and
modules/backend (4030449) per the approved remediation plan.
Evidence: per-unit SELF receipts under /tmp/agent-stack-b1 all exit=0;
combination verification (make test) recorded next on this branch.
Impact: five component gitlinks; no other Dev paths.
Refs: docs/superpowers/plans/2026-10-21-agent-stack-audit-remediation-plan.md
Why: all ten batch-1 units implemented and individually verified.
Evidence: verify-u3b exit=0 (race).
Impact: task metadata only.
Refs: feature/agent-stack-audit-remediation-b1
Why: keep the per-unit audit trail current.
Evidence: verify-u6 exit=0; U3B first run failed-unknown on a
pre-session cursor TLS failure (553B log, zero changes, workspace
preserved), reconciled as environmental and re-dispatched.
Impact: task metadata only.
Refs: feature/agent-stack-audit-remediation-b1
Why: keep the per-unit audit trail; U10 first run failed-unknown
(pi attempt exited 0 without a decodable terminal record), workspace
preserved for reconciliation and the unit re-dispatched with a corrected
packet (nested deps gitlinks materialized).
Evidence: verify-u2/u4/u4b exit=0; no code change.
Impact: task metadata only.
Refs: feature/agent-stack-audit-remediation-b1
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=5a907f42944af56dbca68b6a058cc4f0bc2681d7.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: carry authorization, scope, wave plan and receipt tables for the
agent-per-unit implementation of U1-U7 and U10.
Evidence: card + receipts under /tmp; no code change.
Impact: task metadata only (exempt path).
Refs: docs/superpowers/plans/2026-10-21-agent-stack-audit-remediation-plan.md
Why: record the audited findings and the batched remediation contract
(U1-U11) that subsequent implementation units must satisfy.
Evidence: document-only change; no code paths touched.
Impact: docs only; plan is the scope authority for the remediation task.
Refs: feature/agent-stack-audit-remediation-b1
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-agent-stack-audit-remediation-b1.md; R0=d9e9c0560a2767539f4415b579adbeff86a22ba6.
Impact: task metadata only; the feature workspace starts at d9e9c0560a.
Refs: .task/feature-agent-stack-audit-remediation-b1.md
Why: close the task card inside its own PR so landing it needs no post-merge backfill or separate close PR.
Evidence: .task/fix-svc-superadmin-envfile-surface-conv.md -> .task/archive/fix-svc-superadmin-envfile-surface-conv.md; status 已完成（合入前闭合）; PR #683https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/683.
Impact: task metadata only; the card is archived within PR #683 and lands with its merge commit.
Refs: task.sh close --self
Why: the card must carry results, evidence and the authorized rerun receipts before closing.
Evidence: make evidence for svc unittest suite (51 OK, 1 skipped) on HEAD 3c0faf76.
Impact: task card only.
Refs: fix/svc-superadmin-envfile-surface-conv.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move modules/backend to 528e3a4 (Backend #239), which rejects empty or
foreign conversationId when creating a surface via POST /api/surfaces.
Why: Dev must carry the Backend conversation-required fix.
Evidence: Backend #239 CI success at 954e744; agent-exec unit
dev-svc-superadmin-surface-backend-repin (cursor, authorized fresh rerun,
terminal=success).
Impact: documentation pin / gitlink only.
Refs: Dev task fix/svc-superadmin-envfile-surface-conv.
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the pin materialization fix did its job - all three pins now build and the
missing-go.sum error is gone - so the failure relocated to the real combination
lifecycle gate, where svc.sh cannot git fetch from CI's shallow RDM clone.
That is a different component's concern and outside this pin advance.
Evidence: run 4714 job 7830 - svc-realcombo and test green; three lifecycle
cases fail on svc.sh's git fetch against the shallow RDM source clone.
Impact: task card only.
Refs: PR #682
Why: the card must state authorization, goals and unit receipts including the failed-unknown and authorized Backend rerun.
Evidence: agent-exec receipts under /tmp/svc-sa-surface-20261021.
Impact: task card only.
Refs: fix/svc-superadmin-envfile-surface-conv.
Co-authored-by: Cursor <cursoragent@cursor.com>
Auth-on agent services need super-admin credentials at every launch, but
svc only forwarded them from the current environment, and recover/watchdog
relaunch with a cleared environment, so a bare restart or recovery failed
closed. svc now records only the absolute path of AGENT_SYSTEM_ENV_FILE as
superadmin_envfile= after checking it is a regular, owner-only (0600) file
before stopping anything, and forwards that path when no explicit
credentials are set. An empty AGENT_SYSTEM_ENV_FILE clears the record. The
file content is never read, copied or printed.
Why: prod restarts and recovery required re-exporting AGENT_SYSTEM_ENV_FILE.
Evidence: agent-exec unit dev-svc-superadmin-envfile-persist (cursor, attempt 1, terminal=success); unittest test_svc_superadmin_envfile + test_svc_recover + test_svc_identity: 51 OK (1 skipped).
Impact: svc.sh agent launch and svc.env gain superadmin_envfile; docs/svc.md 4.2 note.
Refs: Dev task fix/svc-superadmin-envfile-surface-conv.
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the fail-loud assertion worked as intended and named the real cause -
RDM's pins set grew from four to six, so the CI step that checks out and builds
all three pins no longer sees a consistent layout. My prev_sha choice was
wrong and I did not check layout consistency when writing the unit.
Evidence: run 4711 job 7821 - 'rdm pin c6304224 的 pins/agent-system-frontend
未落地：缺少 go.mod'; pin layouts verified across all five commits; local
build-product.sh on the delivered head succeeds.
Impact: task card only.
Refs: PR #682
Why: advancing the RDM pin red-lights test-pg on a real composition problem
that make test cannot see, and the card must say so plainly instead of showing
a green combination run.
Evidence: run 4707 job 7812 — the combination build reports missing go.sum
entries for agent-document-renderer packages. RDM bc8db88 replaces that module
with a local path and therefore carries no go.sum entries for it, while the
Dev-side build redirects the backend replace to modules/backend (f084d10),
which imports those packages directly.
Impact: task card only.
Refs: PR #682
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/fix-svc-superadmin-envfile-surface-conv.md; R0=d9e9c0560a2767539f4415b579adbeff86a22ba6.
Impact: task metadata only; the feature workspace starts at d9e9c0560a.
Refs: .task/fix-svc-superadmin-envfile-surface-conv.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=a736d5a420370cff052bd946f6d6397d4c354547.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: an independent review caught that the card asserted the two delivery
branches were red at their tips as a verified conclusion, and that the figures
I quoted matched no natural measurement. Both are session-local observations,
not evidence this repo can reproduce.
Evidence: the card now separates a checkable claim (Dev's gates never exercise
the delivery branches) from a SELF observation with the exact commits and
method, marks it as not admissible as GATE evidence, and voids the imprecise
numbers from commit 537bf66.
Impact: task card only.
Refs: RDM PR #460, Development-Manager PR #32
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=a736d5a420370cff052bd946f6d6397d4c354547.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: close the task card inside its own PR so landing it needs no post-merge backfill or separate close PR.
Evidence: .task/fix-genui-prod-upgrade-followups.md -> .task/archive/fix-genui-prod-upgrade-followups.md; status 已完成（合入前闭合）; PR #681https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/681.
Impact: task metadata only; the card is archived within PR #681 and lands with its merge commit.
Refs: task.sh close --self
Why: the card must carry results, evidence and review before closing.
Evidence: make evidence entry for tests.test_svc_identity (31 OK, 1 skipped).
Impact: task card only.
Refs: fix/genui-prod-upgrade-followups.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move modules/documents to 75e43e1 (Documents #120), which replaces the
NOT_RUN GenUI acceptance note with the 2026-10-21 prod rerun result and
records that admin cannot create projects until a role is assigned.
Why: the Dev pin should carry the updated GenUI prod record.
Evidence: Documents #120 CI success at f5417fb; agent-exec unit dev-genui-prod-followups-repin (cursor, attempt 1, terminal=success).
Impact: documentation pin only.
Refs: Dev task fix/genui-prod-upgrade-followups.
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the card must state authorization, goals and unit receipts.
Evidence: agent-exec receipts under /tmp/genui-followups-20261021.
Impact: task card only.
Refs: fix/genui-prod-upgrade-followups.
Co-authored-by: Cursor <cursoragent@cursor.com>
svc.sh adopt always printed db_marker=established, even when the installed
artifact lacked identity capability and the marker stayed pending. It now
reads the marker back and warns when identity was not established.
The deploy identity gate reported a pre-v27 database (identity table
missing) as a foreign row or mismatch. It now explains that the schema
predates the identity table and gives the backup, stop, migrate and
redeploy steps. It still refuses before stopping the old service and never
migrates on its own.
Why: both messages misled the 2026-10-21 GenUI prod upgrade.
Evidence: agent-exec unit dev-svc-identity-adopt-gate-messages (cursor, attempt 1, terminal=success); python3 -m unittest tests.test_svc_identity: 31 tests OK (1 skipped).
Impact: svc.sh operator messages for adopt and the deploy identity gate; no change to success paths.
Refs: Dev task fix/genui-prod-upgrade-followups.
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/fix-genui-prod-upgrade-followups.md; R0=ccb6dfaa9cdf7e69eb15d7df024dee55f37b8df1.
Impact: task metadata only; the feature workspace starts at ccb6dfaa9c.
Refs: .task/fix-genui-prod-upgrade-followups.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=ccb6dfaa9cdf7e69eb15d7df024dee55f37b8df1.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: both components have landed, the delivery branch red-at-tip finding and
the six authorization defects it exposed are the substantive result, and the
admit baseline-recognition change is what unblocked the merge at all. None of
that was recorded.
Evidence: Backend 7158bea (Dev pin f084d10 already contains it); RDM bc8db88
via PR #460, five review rounds ending PASS, CI green; Development-Manager
2c2e372 via PR #32.
Impact: task card only.
Refs: Backend PR #234, RDM PR #460, Development-Manager PR #32, Dev PR #634
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=ccb6dfaa9cdf7e69eb15d7df024dee55f37b8df1.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
weichen
agent-exec-transport