6 Commits

Include renames

Author	SHA1	Message	Date
weichen	a5f0ca107d	Only count remote-unreachable commits as local work in finish guard ... Why: 本地 main 停在 origin/main 顶端（克隆默认态）在 pin 为 feature 顶端时不在 pin 历史内，--branches 直判仍会误阻（本 worktree 自身收尾实测踩到）。 Evidence: 第五例回归（本地默认分支+克隆 reflog 不阻）全绿；五例套件+全套治理回归 GOVERNANCE-SUITE-OK；worktree 实际 finish 通过即端到端自证。 Impact: local_work_outside 候选提交先过 --not --remotes 过滤（远端可达即已保全）； stash 仍恒算本地独有。	2026-10-05 15:05:54 +00:00
weichen	91d25a3ed1	Fix two finish-guard false positives: IDE locks and remote-only refs ... Why: 2026-10-05 两次实测踩到——①rglob("*.lock") 把 .git/cursor/ IDE 产物当 Git 锁 （五天陈锁阻断 worktree 回收）；②pinned-history 用 --all --reflog 把 refs/remotes 计入，pin 在 feature 顶端的子仓永远无法 finish（被迫删远端引用+清 reflog 损害现场）。 Evidence: FinishGuardFixTests 四例全绿（误报修复+真实锁仍拦+独有提交仍保）； 全套治理回归 91 例 OK；make test 全链证据入卡。 Impact: 仅 finish 模式两处判定；IDE 产物与远端引用不再误伤，本地独有工作保全语义不变。 Refs: 本仓 governance 收尾实录（EXT-1 与 governance-reliability 两轮）。	2026-10-05 15:00:20 +00:00
weichen	9374986b63	Lock CI checkout credential scope to the injected server and allowlist ... Why: 复核轮遗留的安全测试草稿按「常量=传输端点」设计，与 PR #213 已合入的 「注入基址=传输端点」语义相反，原样提交会红。适配为锁定真实不变量。 Evidence: python3 -m unittest tests.test_ci_credentials 8/8 OK（含新用例： 任一注入拼写检出成功、凭据仅落白名单路径且令牌分离、非 http(s) 注入 fail-closed）。 Impact: 仅测试文件；不改 ci.yaml 行为。 Refs: PR #213 run 950 诊断（GITHUB_SERVER_URL=http://172.17.0.1:3000）。	2026-10-05 13:45:58 +00:00
weichen	c1fdf0141c	Merge current main while preserving governance repairs ... Why: main advanced with merged-task-name and legacy evidence guards during this task. Evidence: SELF 44 lifecycle regressions pass after resolving both hunks; independent review repairs are recorded in the task card. Impact: retains both task-start protections and the stronger JSON/legacy receipt reader, without rewriting either branch history. Refs: Dev PR #211 and #212; .task/feature-governance-reliability.md	2026-10-05 13:11:50 +00:00
weichen	b84667a697	Close review gaps in cleanup and evidence handling ... Why: independent review found shared submodule metadata risk, quoted header leakage, stale JSON receipt blindness and missing abandon coverage. Evidence: SELF 92 governance regressions pass; the original review receipt and replay output are recorded in the task card. Impact: preserves external component worktrees, handles both evidence formats and adds targeted failure-path coverage; no product behavior changes. Refs: .task/feature-governance-reliability.md; .task/reviews/governance-reliability.json	2026-10-05 13:07:10 +00:00
weichen	8af945a1d5	Make development gates preserve work and verifiable evidence ... Why: cleanup, component synchronization, receipt recording and credential handling could contradict the documented development boundaries. Evidence: SELF 75 isolated governance tests and source checks are captured in .task/feature-governance-reliability.md; combination and CI verification follow. Impact: hardens local task and CI tooling, aligns policy and component documentation, and adds continuous regression tests without changing product behavior. Refs: .task/feature-governance-reliability.md; policy/governance.md; policy/platform-admission.md	2026-10-05 12:36:02 +00:00