Why: The resumed task requires a fresh baseline before recording the approved implementation and formal checks.
Evidence: Startup identified SYNC_REQUIRED; Documents pointer conflict was resolved by merging the referenced upstream commit while preserving all three approved I1 documents byte-for-byte.
Impact: Workspace recovery only; retain incoming project-membership records and the fixed I1 approval objects. Formal checks remain pending.
Refs: User approval of I1 implementation; policy/governance.md startup and recovery
Why: The final base combination must reference actual reviewed main commits.
Evidence: Component PRs are merged, and each merged tree matches the independently tested candidate; whole review receipts remain unmodified.
Impact: Advance gitlinks and preserve acceptance evidence; new exact-head CI follows with no runtime changes.
Refs: Backend195 Frontend82 Documents97; feature/project-member-access
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=946cc13c9a10a2023a766b211e1148e625b62943.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Existing upload history must stay private after project adoption, and final object evidence must remain traceable.
Evidence: Original tool receipts and independent reports saved byte-for-byte; new fixed combination and CI remain pending.
Impact: Select Backend d26f3cf and proposal r1.1 with unchanged public downstream contracts; preserve workspaces and live data.
Refs: feature/project-member-access; Frontend PR82; Documents PR97
Why: Keep the reviewable contract and observed verification together in the fixed parent composition.
Evidence: Dev make test passed on 0ab70b0c and RDM make test passed on ef075bd1, recorded as complete SELF receipts. Final parent pin verification follows this metadata checkpoint.
Impact: Advance the text-only review record and save evidence; no implementation components changed.
Refs: IAM I1 U1-U2 local review
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=143e6367367760deceac91ac3de5ccb3ed6adebc.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Keep the accepted IAM direction and I1 review entry visible from the authoritative integration checkout.
Evidence: Full SELF document consistency receipts are recorded in the I1 task card. Final synchronized parent combination verification follows this checkpoint.
Impact: Advance Documents only and record I1 local authorization; backend, frontend and UI behavior pins remain unchanged.
Refs: Approved IAM plan r1; I1 U1-U2
Why: Final review and real composition exposed member upload rejection, private project cards and stale duty selection.
Evidence: Component correction receipts and fixed clean source SHAs; independent replays and final composition are in progress.
Impact: Select Backend d2f96e7 and Frontend 2ba275b with current UI, preserving private originals and verified project commands.
Refs: feature/project-member-access
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=86d975b822c2384e96edd75f9c3a2dca63593b3a.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Host-only project creation and domain membership must form one verified identity.
Evidence: Tool-imported SELF receipts and independent Backend and Frontend replay attestations; composed acceptance and final CI remain in progress.
Impact: Advance fixed component pins and record the authorized implementation and privacy boundaries without deployment or runtime changes.
Refs: .task/feature-project-member-access.md; system-project-membership proposal r1
Why: The remaining open items (API-key SSE closure, cross-instance
redeem backoff, U7 atomic bootstrap/create, CLI credential delivery)
landed in Backend #192; Dev pins it and closes the contract leftovers.
Evidence: Backend #192 CI success at head bc1e0a3 (GATE); composite CI
on this PR re-runs the suite incl. test-pg (GATE).
Impact: backend pin cfb8308; contract leftover section now records all
items closed; task card H1-H6 requirement table.
Refs: Backend #192; docs/svc-deploy/2026-10-13-login-recovery-contract.md.
Why: check-pins failed on the follow-up CI: the newly pinned backend
(741da4a) carries deps/agent-system-core at 0f94e4b while Dev's
modules/core stayed at ba289e7 - the three-layer pin rule requires the
top-level core pin to match.
Evidence: 0f94e4b verified as an ancestor of Core origin/main; this
PR's composite CI re-runs check-pins (GATE).
Impact: modules/core gitlink to 0f94e4b; no source changes.
Refs: check-pins failure on job 4204.
Why: The follow-up CI exposed that backend #188 broke the Dev
multi-instance suite: serve --mock seeded runtime.mock at the user
scope, which system-managed settings now reject, so instances never
became healthy. Backend #190 seeds the startup flag into the system
scope; this PR repins and drops the now-invalid alice user-scope write.
Evidence: Backend #190 CI success at head 0af1ebc (GATE); this PR's
composite CI re-runs make test-multi-instance (GATE for the fix).
Impact: backend pin 741da4a; multi-instance test comments updated to
the system-managed regime.
Refs: Backend #188, #190.
Why: The completion audit flagged four gaps over the merged login
recovery implementation: real-browser acceptance, the login-key e2e
spec, SSE stream invalidation, and the Documents write-back.
Evidence: Browser acceptance receipts be7ae9a2/b3a9e691 (SELF, bound to
Dev HEAD 268ef29); Backend #189 CI success at head 8b73afe (GATE);
Documents #94 merged; this PR's composite CI is the GATE for frontend
pin 44b9646.
Impact: Pins backend=349a47d (SSE close) and frontend=44b9646 (e2e
spec); contract doc leftovers updated; task card carries the follow-up
record for closure.
Refs: docs/svc-deploy/2026-10-13-login-recovery-contract.md; Documents
proposal r3; Backend #189; Frontend #77.
Why: The Dev composite must carry the exact backend (467718a) and
frontend (9fc7da2) commits implementing the login recovery contract.
Evidence: component branches pushed to their origins; make test runs in
this task worktree validate the composite (receipts in task card).
Impact: gitlink bump only; no other Dev tree changes.
Refs: docs/svc-deploy/2026-10-13-login-recovery-contract.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=6193db1b548b964ab3133557ddbb9d83a3643d31.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Dev has to follow the commits that landed on Backend and Documents main, which share trees with the drilled objects.
Evidence: Backend dc736e339d01 tree 498f61947564 equals 46073d30. Documents 05c13a42b14d tree equals 5335499. GATE run 2794 on 6d8b746 succeeded before this pin.
Impact: gitlinks move to the merge commits. Second-instance writes stay closed.
Refs: #186#92#497
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the restored drill passed artifact recovery, and the handbook, checklist, and collaboration plan have to say so without opening write traffic.
Evidence: backup-20261013-013354 on Dev a83588dd and backend 46073d30; K1-K7 true, RPO 65s, RTO 3s, five artifacts matched, cross-user access 404. SELF. Documents 5335499 is PR #92.
Impact: C5 is marked SELF-pass. Second-instance writes stay closed until REPLAY or CI and a second host exist.
Refs: docs/svc.md docs/release-multi-instance.md modules/documents
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: pick up Agent-System-Frontend dcd2699 (PR #75) so the Dev combined
CI validates the RDM roles panel rejected-state fix together with the
svc.sh rdm-admin recovery tooling in this task.
Evidence: gitlink 43d1933 -> dcd2699; merge-base --is-ancestor of the
reviewed head 0159f00 into frontend main OK (SELF).
Impact: gitlink bump only; combination validated by make test in this
worktree before PR.
Refs: task card feature-rdm-admin-lockout-recovery (R3/I2)
Why: an unset object store must keep artifact bytes available to the other process, which the store-level test does not execute.
Evidence: cross_artifact_roundtrip failed with EOF on backend c6fb130 and passed on 46073d30 (SELF, isolated u7drill-k4).
Impact: Dev now builds the fixed backend. Second-instance write traffic stays closed.
Refs: modules/backend tests/integration/multi-instance/multi_instance_test.go
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Keep exact component and verification progress recoverable before final integration gates.
Evidence: Full SELF receipts remain in the task card; independent replay and platform gates are separately identified.
Impact: Documentation and Documents version only.
Refs: feature/work-companion-ui U5
Why: Bind the final candidate to actual review fixes and stronger interface acceptance.
Evidence: Full SELF red/green receipts and original independent report identities are retained; GATE and final review remain separate.
Impact: Pin UI0da2e3a and Frontend43d1933; no Backend/Core or running service change.
Refs: UI01-UI13, ce-code-review UI and Frontend findings, work-companion-ui
Why: Keep a recoverable record of the current validated combination and honest planning status.
Evidence: Full SELF make build and isolated two-case HTTP browser receipts are retained in the task card.
Impact: Documentation and Documents pin only; no running service change.
Refs: feature/work-companion-ui, U5
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=2c016931044bebdc4a114c1ca1127d1b40d4ab17.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
# Conflicts:
# modules/documents
Why: verify the exact UI and Frontend combination under the approved design.
Evidence: imported startup plus SELF unit, type, build, fixture browser and real HTTP/MockRunner smoke receipts in the task card.
Impact: three-pane presentation rules and fixed component revisions; existing services remain untouched.
Refs: work-companion-ui design r0.2, plan r1 and UI01-UI13.
Why: Main D1 now shares the same explicit fixture initialization contract.
Evidence: Both real SQLite and temporary PostgreSQL initialization paths
were independently replayed; capabilities JSON assertions are preserved.
Impact: Resolve duplicate PG setup through the tested helper; preserve
all main lifecycle changes and the rollback directory protection.
Refs: Dev #483/#485; D1 existing-store identity contract
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=99048dda1f48bccb3d5d798050d7beeea2907177.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: main already has one release transaction, so this branch keeps that path and only isolates update and recover in a clean child.
Evidence: SELF bash -n scripts/svc.sh; python3 -m unittest identity/recover/deploy/u2/lifecycle pin 92 tests OK (2 skipped), then 66 tests OK after dropping the obsolete journal hook.
Impact: deploy uses releases/ and deploy.journal; the lifecycle child reconciles that journal before deploy or recover. Backend pin is 0f192a4.
Refs: #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: isolate the approved interface work and fix its component baseline.
Evidence: imported startup precheck SELF receipt; source requirements and plan recorded in Documents.
Impact: task metadata, project links and authoritative UI/Frontend baselines; existing service state is untouched.
Refs: UI01-UI13 and work-companion-ui implementation plan r1.
Why: Second-resolution release IDs let staging delete a previous release
when a same-source deployment ran within the same clock tick.
Evidence: Fixed-clock rollback regression fails before and passes after;
250 governance checks pass. Independent review replays collision and
copy-failure protection; receipts are in the primary task card.
Impact: Add invocation identity and exclusive directory creation; keep
old artifacts intact. Also retain the latest compatible frontend pointer.
Refs: User-approved I2; Dev #483; Frontend #71/#72
Why: an update that stops the old process and overwrites the binary cannot
get the previous version back, and a migration the old binary cannot read
must be refused before that stop. CI also had no fixed RDM SHA to build from.
Evidence: python3 -m unittest tests.test_svc_identity tests.test_svc_recover tests.test_svc_deploy_txn tests.test_lifecycle_pin passed. make test-lifecycle exits 2 when AGENT_PG_TEST_DSN is unset.
Impact: installs land in releases/<rid> and current switches with mv -T.
Deploy keeps the desired state and rolls back a non-terminal journal.
Schema compatFloor above the installed target is refused unless
--migrate-schema --confirm is paired with a backup. test-lifecycle fails
closed without PostgreSQL and an RDM checkout. Login stays NOT_RUN.
Refs: recovery plan r3.1 D2 and D3; Backend feature/d1-identity-open
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: stub suites proved the script logic but not real artifact
behavior (the 2026-10-12 incidents passed all stub tests); the report's
U3 requires real-combination gates, and realcombo dry-runs exposed two
real gaps: fresh deploys closed identity governance one lifecycle late,
and pg-bound identity calls put the DSN on the command line.
Evidence: make test exit 0; local realcombo dry-run 16 OK (rows in the
task card); CI adds svc-realcombo (SQLite, both real binaries, full RDM
track) and a real-PG identity step on test-pg with env-delivered DSN.
Impact: tests/test_svc_realcombo.py (SVC_TEST_REAL gate, explicit
NOT_RUN otherwise); ci.yaml new job + test-pg step (RDM clone via
trusted-base URL-scoped token header, allowlist addition reviewed in
this PR); svc.sh delivers identity DSN via AGENT_SYSTEM_DSN and runs
manifest adoption in the same deploy that first registers svc.env;
modules/backend pinned to main (env fallback, backend #182).
Refs: .task/feature-svc-u3-realcombo.md; user goal directive 2026-10-12
(U3); backend #182; RDM #285.
Why: Dev #452 selected a frontend pointer lacking the previously merged
SurfaceMeta hydration fix and blanked saved-page conversations.
Evidence: Independent review and regression red/green receipts are in
.task/feature-surface-black-screen-recovery.md; make test/build follow.
Impact: Pin the frontend that retains fast-slow and saved-page recovery;
no backend, UI token, storage or permission configuration change.
Refs: Frontend #68; Dev #454; Dev #452; surface-black-screen-recovery
Why: probing identity by running the subcommand still launched old RDM
builds, and ensure on a missing database created an empty one. A batch
update also inherited the caller's AGENT_SYSTEM_* variables.
Evidence: python3 -m unittest tests.test_svc_identity tests.test_svc_recover passed (41 tests, 1 skipped). tests.test_svc_lifecycle_isolation caller-env and restart cases passed.
Impact: capability probes use version --json only. Established instances
refuse a missing identity row until adopt --confirm. update and recover
run each service in a clean environment. serve reads a 0600 serve.env
and does not inherit the caller environment. Backend and documents pins
move to the D1 identity and recovery-plan commits.
Refs: recovery plan r3.1 D1; Backend feature/d1-identity-open; RDM feature/d1-version-json
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Backend #180 moved the identity CLI to pkg/identity (shared with
Agent-System-RDM per PR 276); Dev main should consume it so composed
binaries carry the same identity semantics and capabilities output.
Evidence: make test exit 0 (combined suite on the bumped pin);
make test-pins ok; rows in the task card.
Impact: gitlink only (bbe9773 -> acabb85, spans #177/#179/#180).
Refs: .task/feature-pin-backend-identity-cli.md; user goal directive
2026-10-12 (implement remaining U1/U2/U3 items in order).
weichen
