Why: origin/main moved during CI by archiving an unrelated task card, so the branch had to include it before merge.
Evidence: make task-sync exit 0 via make evidence (SELF). sync_base=df5f8761ea tested_head=bb6b9877d4. The delta is that card archive only.
Impact: The earlier make test on afdf43e still covers the code. CI must go green on this new head before merge.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=df5f8761ea9e2fb20a4b5e3f20318d748a83fbb0.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: The pre-merge sync brought in a newer main, so the previous make test receipt no longer covers this head.
Evidence: make test exit 0 via make evidence (SELF) with before=afdf43e. CI on the pull request remains the GATE.
Impact: Frontend, UI, Python, and agent-command checks passed on the synced head. Drill verdicts are unchanged.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: origin/main moved before the pull request, so the branch had to take that baseline.
Evidence: make task-sync exit 0 via make evidence (SELF). sync_base=2c01693104 tested_head=9526d35f9c.
Impact: Frontend pin and release-directory uniqueness from main are now in the branch. Drill results stay bound to their measurement SHAs.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=2c016931044bebdc4a114c1ca1127d1b40d4ab17.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: The task card still said C4 and C5 had not run, which would make the pull request describe the wrong result.
Evidence: B6, C4, and C5 receipts already on the card (SELF). drill_driver tests pass after grouping the imports.
Impact: The card now states K4 failed and second-instance writes stay closed. No product code change.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Close this task after verified merge, CI and runtime acceptance.
Evidence: Original PR results, actor/runner and exact-head CI readbacks
are preserved in the archived record.
Impact: Archive this task only; no source, configuration or other card.
Refs: Dev #483; RDM #288; Frontend #71
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=2c016931044bebdc4a114c1ca1127d1b40d4ab17.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Preserve real merge results, current-head CI and runtime acceptance.
Evidence: Gitea admission/merge readbacks and independent/live replay
receipts in this task only.
Impact: Metadata only; no unrelated task closure.
Refs: Dev #483; Frontend #71/#72; RDM #288
Why: Fixed identity contract and current main must share one candidate.
Evidence: Saved final sync, real SQLite/PG replays and live public
recovery receipts; exact current-head CI will decide admission.
Impact: Task metadata only.
Refs: Dev #483/#485; Frontend #71/#72
Why: Policy requires a task-sync immediately before requesting review.
Evidence: make task-sync exit 0 via make evidence (SELF). origin/main was already contained; tested_head is 2eff856.
Impact: The branch stays aligned with authoritative main. Older drill receipts still predate the earlier main merge; the post-sync make test does not.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The acceptance sync merged main, so the earlier make test receipt predates those changes.
Evidence: make test exit 0 via make evidence (SELF) on 794e51b. CI on the pull request remains the GATE.
Impact: The local suite passed again on the synced head, including worktree, Python, frontend, UI, and agent-command checks.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The synchronization gate requires saved task evidence.
Evidence: Current product build and actual binary replay receipts are in
the canonical task record; subsequent sync uses an external receipt.
Impact: Evidence only.
Refs: Dev #483/#485
Why: Required lifecycle gates must follow the current identity contract.
Evidence: Real binary and temporary PostgreSQL replay, independent
review, and D1 synchronization records in the canonical task card.
Impact: Evidence only; application changes remain the approved recovery
and release collision protection with current main work preserved.
Refs: Dev #483/#485; Frontend #71/#72
Why: The branch had to contain authoritative main before acceptance, and that sync is part of the evidence.
Evidence: make task-sync exit 0 via make evidence (SELF). It merged origin/main and warned that the earlier make test predates the merge.
Impact: Backend pin moved with main. The combined test must be rerun on this head.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=cd61bbb112eea6a210a64e84f2cef00b0d64bfc1.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: The drill, handbook, and Documents pin need a combined test result before review.
Evidence: make test exit 0 via make evidence (SELF). CI on the pull request remains the GATE.
Impact: Local suite passed, including worktree, Python, frontend, UI, and agent-command checks.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Main D1 now shares the same explicit fixture initialization contract.
Evidence: Both real SQLite and temporary PostgreSQL initialization paths
were independently replayed; capabilities JSON assertions are preserved.
Impact: Resolve duplicate PG setup through the tested helper; preserve
all main lifecycle changes and the rollback directory protection.
Refs: Dev #483/#485; D1 existing-store identity contract
Why: Current RDM identity ensure/verify intentionally refuse missing
databases and schema; the old fixture invoked them on empty stores.
Evidence: Actual RDM red failure, real SQLite and isolated PostgreSQL
green replays, and independent review receipts in the task card.
Impact: Test setup only; normal serve initializes temporary stores and
is reaped before the unchanged identity/lifecycle assertions.
Refs: Dev #483/#484; current RDM D1 existing-store contract
Why: The drill report and storage plan r2.2 are on Documents main, and this repo still pointed at the previous pin.
Evidence: Documents PR https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Documents/pulls/90 merged as f76cce9 (SELF API merge, no CI statuses on that repo).
Impact: The gitlink moves from 3cc6438 to f76cce9. Second-instance writes stay closed.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The measured backup, PITR, and disconnect steps were only in the drill scripts, and the checklist still said those rows were not run.
Evidence: Results pgbench-20261012-131948, fault-20261012-142734, and backup-20261012-153441 (SELF). K4 stays failed.
Impact: Second-instance write traffic stays closed. The handbook records the upload panic and the short socket path.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The timed drill finished with a verdict for every criterion, including the upload failure.
Evidence: make evidence exit 1 because K4 failed; results tests/ops/results/backup-20261012-153441 (SELF). K1-K3 and K5-K7 passed. RPO 64s, RTO 4s.
Impact: Physical backup, WAL replay, and pg_dump restore are measured. Artifact upload panics when S3 is unset, so K4 is FAIL and product code was not changed.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: deploys need a side-effect-free identity probe, an isolated lifecycle child, and the release transaction already on main.
Evidence: GATE run 2667 jobs 3845 test, 3846 test-pg, 3847 svc-realcombo all success on b4eb3a814c.
Impact: update and recover run in a clean child; serve keeps the exec-tool kill switch; Backend pin is 0f192a4.
Refs: #485
Why: identity ensure no longer creates the schema, so the probe has to follow a real serve that applies migrations.
Evidence: SELF python3 -m py_compile tests/test_svc_realcombo.py. GATE run 2663 job 3839 failed on the previous head with identity table missing.
Impact: the PostgreSQL check still passes the DSN only through the environment, after serve has migrated.
Refs: #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The backup drill again refused to create an instance because the 1-minute load average was 18.23.
Evidence: make evidence exit 3, receipt on the task card (SELF).
Impact: No PostgreSQL instance was created.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: env -i dropped RDM_DISABLE_EXEC_TOOLS, so the real RDM binary exited immediately on runners without bwrap, and the capability probe now prints the JSON document.
Evidence: SELF bash -n scripts/svc.sh; python3 -m py_compile tests/test_svc_realcombo.py. GATE run 2656 job 3831 failed on the previous head before this fix.
Impact: serve and the lifecycle child forward that one switch; identity capabilities is checked as protocol 1 JSON.
Refs: #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The restored server promoted and the smoke check passed, then the drill stopped while reading artifact ids.
Evidence: make evidence exit 1, results tests/ops/results/backup-20261012-151951 (SELF). rto_s=3, smoke login/projects/conversation 200.
Impact: The instance was cleaned up. The next run records a full verdict, including a failed upload check.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A missing artifact id aborted the drill before recovery counts, the settle window, and the logical restore.
Evidence: backup-20261012-151951 reached promoted=1 and smoke 200, then StopIteration on an empty id (SELF). bash -n passed.
Impact: K4 stays failed when uploads do not return an id. The rest of the verdict is still written.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: main gained the real-combination CI gate after the previous sync, and this branch still has to carry that gate with the isolated identity calls.
Evidence: SELF python3 -m unittest recovery/identity/u2/deploy/pin/isolation — 100 tests OK (2 skipped); bash -n scripts/svc.sh.
Impact: identity ensure/verify still pass DSN only through the environment; stop waits for the port and can keep the desired state. CI keeps the lifecycle pin step and the svc-realcombo job.
Refs: #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Admit the recovery fix with the latest lifecycle guardrails.
Evidence: Independent replay on the synchronized combination and live
public recovery receipts; exact current-head CI is awaited next.
Impact: Evidence only; no further source changes.
Refs: Dev #483/#484; Frontend #71/#72
Why: pg_ctl could not start the restored server, so the drill exited before a verdict.
Evidence: make evidence exit 1, results tests/ops/results/backup-20261012-150713 (SELF). The log says the Unix socket path is too long.
Impact: Cleanup removed the instance. The rerun uses a short socket path.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The restored postmaster refused to start because the results-directory socket path exceeded the 107-byte Unix socket limit.
Evidence: restore/postgres.log from backup-20261012-150713 says the socket path is too long (SELF). bash -n passed.
Impact: The restored instance listens on /tmp/u7bk-18997, and cleanup removes that directory.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: env -i dropped SVC_STUB_*, so recovery tests saw an empty serve record even though the bound DSN was still passed.
Evidence: SELF python3 -m unittest tests.test_svc.SvcDbRecoveryTests tests.test_svc_lifecycle_isolation — 34 tests OK.
Impact: only SVC_STUB_* is added at launch; serve.env still omits them, and caller AGENT_SYSTEM_* stays out of the process.
Refs: #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=99048dda1f48bccb3d5d798050d7beeea2907177.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Final admission must include newly merged lifecycle validation.
Evidence: Full test/build and real local/public browser acceptance are
recorded; test and PostgreSQL CI passed on a8035bf.
Impact: Task record only; subsequent synchronization receives latest main.
Refs: Dev #483/#484; Frontend #71/#72
Why: main already has one release transaction, so this branch keeps that path and only isolates update and recover in a clean child.
Evidence: SELF bash -n scripts/svc.sh; python3 -m unittest identity/recover/deploy/u2/lifecycle pin 92 tests OK (2 skipped), then 66 tests OK after dropping the obsolete journal hook.
Impact: deploy uses releases/ and deploy.journal; the lifecycle child reconciles that journal before deploy or recover. Backend pin is 0f192a4.
Refs: #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The backup drill refused to create an instance because the 1-minute load average was 17.72.
Evidence: make evidence exit 3, receipt on the task card (SELF).
Impact: No PostgreSQL instance was created. The rerun waits until load is at or below 16.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-svc-u3-realcombo.md(PR#484) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: C4 evidence is recorded, and the next measured run is the backup and PITR drill.
Evidence: The increment line is the only change.
Impact: No runtime change.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
weichenandCursor