Why: main gained the RDM admin recovery after the previous CI, and this head has to contain it.
Evidence: make task-sync exit 0; sync_base=6193db1b54; merge e2e3d25418. SELF. No store-open change, so the K4 drill is not rerun.
Impact: task metadata plus the upstream frontend pin and svc admin tooling.
Refs: .task/fix-u7-k4-artifact-upload.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=6193db1b548b964ab3133557ddbb9d83a3643d31.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: the pinned head has to show it already contains origin/main before the final CI.
Evidence: make task-sync exit 0; already up to date; sync_base=5aebedebeb; tested_head=b35d9946bc. SELF.
Impact: task metadata only.
Refs: .task/fix-u7-k4-artifact-upload.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Dev has to follow the commits that landed on Backend and Documents main, which share trees with the drilled objects.
Evidence: Backend dc736e339d01 tree 498f61947564 equals 46073d30. Documents 05c13a42b14d tree equals 5335499. GATE run 2794 on 6d8b746 succeeded before this pin.
Impact: gitlinks move to the merge commits. Second-instance writes stay closed.
Refs: #186#92#497
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: acceptance has to record that this branch contains the current main before review.
Evidence: make task-sync exit 0; sync_base=5aebedebeb; merge d480b2d058; checkpoint 4a06bb4991. SELF.
Impact: task metadata only.
Refs: .task/fix-u7-k4-artifact-upload.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=5aebedebeb963b5c01f39fd9122ec60dbe6d34d3.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: the restored drill passed artifact recovery, and the handbook, checklist, and collaboration plan have to say so without opening write traffic.
Evidence: backup-20261013-013354 on Dev a83588dd and backend 46073d30; K1-K7 true, RPO 65s, RTO 3s, five artifacts matched, cross-user access 404. SELF. Documents 5335499 is PR #92.
Impact: C5 is marked SELF-pass. Second-instance writes stay closed until REPLAY or CI and a second host exist.
Refs: docs/svc.md docs/release-multi-instance.md modules/documents
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=5aebedebeb963b5c01f39fd9122ec60dbe6d34d3.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: pick up Agent-System-Frontend dcd2699 (PR #75) so the Dev combined
CI validates the RDM roles panel rejected-state fix together with the
svc.sh rdm-admin recovery tooling in this task.
Evidence: gitlink 43d1933 -> dcd2699; merge-base --is-ancestor of the
reviewed head 0159f00 into frontend main OK (SELF).
Impact: gitlink bump only; combination validated by make test in this
worktree before PR.
Refs: task card feature-rdm-admin-lockout-recovery (R3/I2)
Why: archive the D1 and D3 cards after their merges.
Evidence: GATE run 2787 jobs 4039/4040/4041 success on fef5a64462.
Impact: task cards only.
Refs: #496
Why: the pin needs a recorded local red/green roundtrip and a combination test before the backup drill.
Evidence: cross_artifact_roundtrip exited 1 on backend c6fb130 and 0 on 46073d30; make test exited 0 on ca0ab46. Backend vet-and-test run 2783 succeeded. All SELF.
Impact: task card only.
Refs: .task/fix-u7-k4-artifact-upload.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The archive move staged only the rename, so the completed status and merge record were still unstaged.
Evidence: The cards now cite merge cd61bbb (#485) and 6ecf903 (#495).
Impact: Task card text only.
Refs: Dev #485#495
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Those two branches are on main, and a global task-close would also mark unrelated in-progress cards complete.
Evidence: origin/main contains merge cd61bbb (#485) and 6ecf903 (#495).
Impact: Only .task/feature-svc-d1-identity-flow.md and .task/feature-svc-d3-lifecycle-gate.md move to .task/archive/ with status backfilled.
Refs: Dev #485#495
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: keep fault rollback and the real lifecycle gate on main.
Evidence: GATE run 2784 jobs 4032/4033/4034 success on c197b7565b.
Impact: test-pg runs make test-lifecycle. Login stays NOT_RUN.
Refs: #495
Why: U7 acceptance bootstrapped u7-admin into the shared dev runtime's
singleton rdm_admins ledger, locking the operator out of RDM admin pages
(rdm.role.list 400); recovery required forensics. KTD4 keeps base isAdmin
to audit-view only, so an operator-side trusted channel is needed.
Evidence: python3 -m unittest tests.test_svc_rdm_admin -v (25 OK, SELF);
live smoke on runtime/dev: show/status/typo-guard outputs verified.
Impact: new svc.sh <env> rdm-admin [show|transfer --to x] command, help
topic, status ledger line with stale-owner warning; no behavior change
for existing commands.
Refs: task card .task/feature-rdm-admin-lockout-recovery.md R1/R2
Why: an unset object store must keep artifact bytes available to the other process, which the store-level test does not execute.
Evidence: cross_artifact_roundtrip failed with EOF on backend c6fb130 and passed on 46073d30 (SELF, isolated u7drill-k4).
Impact: Dev now builds the fixed backend. Second-instance write traffic stays closed.
Refs: modules/backend tests/integration/multi-instance/multi_instance_test.go
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The release tests must be bound to the commit that contains the lifecycle changes, and the pre-merge sync has to be on the card.
Evidence: SELF make task-sync exit 0, receipt sha256 ef762f87ad785ef9a1759e2686a992353161e35c7a80b726e01133f1779329af. SELF python3 -m unittest tests.test_svc_u2.U2ReleaseTests -q exit 0 on 0dce930 (35 ok, 1 skipped), receipt sha256 cfe7aea9e6bb09f7a169a4caab3c1c89b4b3138c4e08fa11f53bf12d13caa46a.
Impact: Task metadata only. origin/main 5212fef was already contained.
Refs: Dev #495
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the typed-nil fallback needs a recorded local run before the component pull request.
Evidence: GOWORK=off go vet and go test ./... exited 0 against backend 46073d30; source SELF. The PostgreSQL-gated case was skipped locally.
Impact: task card only. The backend gitlink is not pinned in this commit.
Refs: .task/fix-u7-k4-artifact-upload.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-rdm-admin-lockout-recovery.md; R0=5212fef01e59b7f9e12fa7fc42cd987c6792a786.
Impact: task metadata only; the feature workspace starts at 5212fef01e.
Refs: .task/feature-rdm-admin-lockout-recovery.md
Why: the approved plan authorizes this increment through merge and close, and the task card is the record of that scope.
Evidence: stages 1-5 cite the 2026-10-13 plan approval; precheck receipt remains in the card.
Impact: task metadata only; no product code yet.
Refs: .task/fix-u7-k4-artifact-upload.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/fix-u7-k4-artifact-upload.md; R0=5212fef01e59b7f9e12fa7fc42cd987c6792a786.
Impact: task metadata only; the feature workspace starts at 5212fef01e.
Refs: .task/fix-u7-k4-artifact-upload.md
Why: The task card needs the pull request link and the decision not to move live instance data before review.
Evidence: SELF python3 /tmp/d1d3-ro-instances.py exit 0; receipt sha256 895676aabddf85c5b36966428204fde160846b70ac5a8b5eb90ab8037bb0897a. An earlier evidence attempt failed on a broken checker and is kept.
Impact: No runtime data was moved. Login and authenticated rdm.ping stay NOT_RUN.
Refs: Dev #495
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The live deploy journal never called fault injection, and test-lifecycle failed closed on login so CI could not require the real combination cases.
Evidence: SELF python3 -m unittest tests.test_svc_u2.U2ReleaseTests -q exit 0 (35 ok, 1 skipped) on 3602a87; receipt sha256 9b5785577751e8e9e7947cf9700fb8854b1c80142f34273ae25f3097ee4c9aa8.
Impact: test-pg builds the Dev binary and runs make test-lifecycle. Login and full-track deploy without SVC_RDM_ORIGIN stay NOT_RUN. No live data move and no account CLI.
Refs: recovery plan D2/D3; Dev #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-svc-d3-lifecycle-gate.md; R0=5212fef01e59b7f9e12fa7fc42cd987c6792a786.
Impact: task metadata only; the feature workspace starts at 5212fef01e.
Refs: .task/feature-svc-d3-lifecycle-gate.md
Why: close this merged task without touching other owners records.
Evidence: PR493 merge0001148 has the tested tree; exact833ea87 run2726 passed all three jobs; raw receipts retained.
Impact: only this task card is backfilled and archived; no code or component changes.
Refs: PR493, UI01-UI13, policy/delivery.md
Why: tie the delivery record to the latest authoritative main.
Evidence: task-sync passed at f6abba3865 with exact merged UI Frontend Documents objects.
Impact: card-only final candidate; implementation objects unchanged.
Refs: PR493, UI01-UI13
Why: verify the authoritative main before platform checks.
Evidence: task-sync synchronized f6abba3865 with unchanged component objects.
Impact: task record only.
Refs: UI01-UI13, U5
Why: retain raw validation receipts and platform identity before delivery.
Evidence: make evidence recorded the clean e6194a1 combination and UI run 2723.
Impact: task evidence only; component objects remain unchanged.
Refs: UI01-UI13, U5
Why: Keep exact component and verification progress recoverable before final integration gates.
Evidence: Full SELF receipts remain in the task card; independent replay and platform gates are separately identified.
Impact: Documentation and Documents version only.
Refs: feature/work-companion-ui U5
Why: Bind the final candidate to actual review fixes and stronger interface acceptance.
Evidence: Full SELF red/green receipts and original independent report identities are retained; GATE and final review remain separate.
Impact: Pin UI0da2e3a and Frontend43d1933; no Backend/Core or running service change.
Refs: UI01-UI13, ce-code-review UI and Frontend findings, work-companion-ui
weichenandCursor