Why: the approved collaboration plan U2 requires CI to run the backend suite against real PostgreSQL+pgvector and Redis and fail when the services are missing, instead of silently skipping the tier.
Evidence: local gate green twice against PostgreSQL 18.6+pgvector and Redis 8.10.2 (isolated svc.sh instance); the target fails fast when AGENT_PG_TEST_DSN/AGENT_REDIS_TEST_ADDR are unset.
Impact: new make target test-backend-pg (env-guarded) and a required test-pg job (apt postgresql-16-pgvector + redis-server, ephemeral per-run services); existing test job unchanged.
Refs: proposals/2026-10-11-collaboration-storage-and-distribution.md U2; docs/guides/team-storage.md section 5.
Why: cleanup, component synchronization, receipt recording and credential handling could contradict the documented development boundaries.
Evidence: SELF 75 isolated governance tests and source checks are captured in .task/feature-governance-reliability.md; combination and CI verification follow.
Impact: hardens local task and CI tooling, aligns policy and component documentation, and adds continuous regression tests without changing product behavior.
Refs: .task/feature-governance-reliability.md; policy/governance.md; policy/platform-admission.md
Why: lint.py imports python-pptx and openpyxl at import time, so installing only python-docx still skipped the layout finding.
Evidence: actions run 680 failed TestLintErrorContinues with lint reason missing after python-docx was present.
Impact: CI installs python-docx, python-pptx, and openpyxl from the Tsinghua index.
Refs: feature/agent-stack-r0-r1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The runner image has Python but not python-docx, so TestLintErrorContinues failed after checkout succeeded.
Evidence: Agent-System-Dev actions job 1012 reported ModuleNotFoundError: No module named docx.
Impact: The package comes from the Tsinghua PyPI mirror. Library CI still stops until SUBMODULE_TOKEN is set.
Refs: feature/agent-stack-r0-r1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The runner cannot reach github.com, so actions/checkout and setup-node would time out before make test.
Evidence: Go 1.27.1 comes from mirrors.aliyun.com and Node 22.23.3 from npmmirror. Checkout uses the job token and GITHUB_SHA.
Impact: Submodule checkout still requires SUBMODULE_TOKEN. A missing secret fails the job with that message.
Refs: feature/agent-stack-r0-r1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: make test downloads Go modules, and the runner cannot reach proxy.golang.org.
Evidence: The test job sets GOPROXY=https://goproxy.cn,direct. The step name lists boundaries, pins, libs, core, backend, frontend, ui, and agent-command.
Impact: npm still uses the default registry; add the npmmirror only if npm ci times out.
Refs: feature/agent-stack-r0-r1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the job token only authorizes the event repository; sibling private
submodules (Development-Guidelines et al.) returned 404 on the first run.
Evidence: run 194 log — clone of deps/development-guidelines failed with
repository not found despite the insteadOf rewrite.
Impact: ci.yaml reads secrets.SUBMODULE_TOKEN (stored via API, never in
tree or chat); no other change.
Refs: run 194; PR#11
Why: PR test evidence depended on the agent's word (single point); the
running binary could not answer what combination it was built from; and
irreversible operations lacked an explicit agent-stops-here boundary.
Evidence: Gitea runner online (home-runner, ubuntu-latest+docker); make
version prints describe+component SHAs; two-key line maps to baseline hard
boundary 1. CI first run observed on this PR before merge (see Actions tab).
Impact: .gitea/workflows/ci.yaml runs make test + make build on PR/push;
Makefile injects main.version (make version / agent-system version);
AGENTS.md and adoption register the two-key rule. No product code change.
Refs: policy/adoption.md; release-operations requirements
weichen
