Why: R4 spans ui (token scale) and frontend (icon set + restyle); the
Dev repo advances pointers and the task record.
Evidence: make test full suite green on this head (exit 0); headless
journey on the real binary across both themes with zero console errors
and zero leftover emoji glyphs.
Impact: pure visual layer. Merge order: ui -> frontend -> this PR.
Refs: proposal 2026-09-30-ui-redesign-and-auth.md (R4)
Why: merged card needs its PR link backfilled and archived per the
no-bookkeeping-debt rule.
Evidence: Dev PR #51 merged; card records the env-file test matrix.
Impact: card archived with link; no code change.
Why: per-environment bring-up needs a persistent file for the SVC_*
knobs (model keys, addresses, tavily pool) instead of relying on shell
history or the single global .svc.env; CLI flags must still win for
one-off overrides like a different port.
Evidence: live matrix - .env.dev parsed (comments, paired quotes,
export prefix) with its address and model values applied and seeded;
--port 8831 overrode the file's port while keeping its 0.0.0.0 host;
missing file fails fast; .svc.env and --env layer correctly (overlap
keys resolve to --env, disjoint keys merge).
Impact: --env FILE / --env=FILE anywhere on the command line; dotenv
parsed safely line-by-line (valid identifiers only, never sourced);
precedence CLI > --env file > .svc.env > OS env > defaults; help and
make svc ARGS examples updated.
Refs: feature/svc-envfile task card.
Why: merged card needs its PR link backfilled and archived per the
no-bookkeeping-debt rule.
Evidence: Dev PR #49 merged; card records the seeding test matrix.
Impact: card archived with link; no code change.
Why: a freshly deployed environment boots with an empty settings store,
so the first run dies with "main model unconfigured" and the user has
to open the settings UI before anything works - the opposite of
one-command bring-up.
Evidence: live matrix - full seed (chat+lightweight+tavily) lands in
the settings store (API view shows baseUrl/model with the key masked),
restart without flags does not re-seed and the settings persist,
.svc.env sourcing seeds a fresh environment from the one-time config
file, and a no-flag start stays silent. Also wrapped a /proc read race
in pid_alive that printed tr noise during stop.
Impact: --model-base/--model-key/--model-name, --light-base/-key/
-name, --tavily-keys on start/deploy (idempotent, only provided
fields); SVC_MODEL_*/SVC_LIGHT_*/SVC_TAVILY_KEYS env vars; <repo>/
.svc.env one-time config file (gitignored) makes every future deploy
self-configuring; auth-protected instances fall back to a clear hint.
Refs: feature/svc-auto-seed task card.
Why: merged card needs its PR link backfilled and archived per the
no-bookkeeping-debt rule.
Evidence: Dev PR #47 merged; card records the live flag matrix.
Impact: card archived with link; no code change.
Why: the manager only took configuration from SVC_* environment
variables; binding a public interface or pointing at a database meant
exporting vars first, which is awkward for one-off deploys and
invisible in shell history review.
Evidence: live matrix on the worktree - --port (8801), --host 0.0.0.0
(bind verified via ss, health probe auto-maps to 127.0.0.1), --addr
whole-form, CLI-over-env precedence (--port beats SVC_DEV_ADDR),
--mock reaching the server cmdline, --dsn passthrough proven by the
postgres connect attempt in the log, -- passthrough (--artifacts), and
make svc ARGS passthrough. A set -e silent-exit trap in env_config was
caught by the first run and fixed (condition-as-last-statement).
Impact: scripts/svc.sh <env> [action] [--addr|--host|--port|--data|
--dsn|--auth|--mock|--plugins| -- <extra>]; precedence CLI > env vars >
defaults; help rewritten with examples; make svc gains ARGS; logs keeps
the positional line-count form. The real-world port guard held: a dev
instance started from the main checkout was refused with owner info,
untouched.
Refs: feature/svc-cli-args task card.
Why: merged card needs its PR link backfilled and archived per the
no-bookkeeping-debt rule.
Evidence: Dev PR #45 merged; card records the live test matrix.
Impact: card archived with link; no code change.
Why: deploying a new build meant manually finding and killing the old
process, rebuilding and re-launching with the right flags; dev and prod
instances could collide on ports, data dirs or kill each other.
Evidence: live matrix on the worktree - dev deploy (stop -> make build
-> start with health check), redeploy swaps the pid and keeps seeded
data, prod deploys alongside dev on separate port/data with fully
isolated /api/projects, port takeover is refused with the owning
process named while the running env stays up, stop clears pidfile and
frees the port. A pid-capture bug (compound-background subshell wrote
the wrapper pid instead of the server) was caught and fixed during the
first live run.
Impact: scripts/svc.sh <dev|prod> [deploy|stop|start|restart|status|
logs]; runtime/<env>/{data,svc.pid,svc.log,svc.env} isolation; defaults
dev 127.0.0.1:8788 / prod 127.0.0.1:8787 overridable via SVC_* env
vars (incl. SVC_PROD_DSN for the PG tier); make svc ENV=... shortcut;
runtime/ gitignored. Safety: only processes started by the script are
stopped (pidfile + /proc cmdline double check).
Refs: feature/svc-env-script task card.
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-auth-admin-accounts.md(PR#43) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: R2 spans backend (migration v10, auth/session APIs, CLI user
subcommands), frontend (login page, forced change gate, admin user
management), documents (decision record).
Evidence: make test full suite green on this head (exit 0); headless
journey on the real binary with --auth on covers admin bootstrap,
first-login forced change for created and reset passwords, non-admin
menu gating, API-key login, logout.
Impact: auth-enabled deployments gain password login and admin account
management; embedded no-auth mode unchanged. Merge order: backend ->
frontend -> documents -> this PR.
Refs: proposal 2026-09-30-ui-redesign-and-auth.md (R2 admin-issued)
Why: merged combo card needs its PR link backfilled and the card
archived per the no-bookkeeping-debt rule.
Evidence: Dev PR #41 merged; card records both boot-state checks.
Impact: card archived with link; no code change.
Why: give the catalog's WebSearch prompt a carrier by registering
Agent-Native's Tavily tools behind settings, with library copy on top.
Evidence: backend 16 packages green incl. 4 new search tests; live
boot checks for both unconfigured and configured states.
Impact: pins backend 0d55ebb, documents b4546fe.
Refs: feature/tavily-search-tool task card.
Why: merged combo card needs its PR link backfilled and the card
archived per the no-bookkeeping-debt rule.
Evidence: Dev PR #38 merged; card carries the coverage test records.
Impact: card moved to .task/archive/ with the link filled; no code
change.
Why: close the coverage gap against the user's take-everything-portable
bar and record the porting rule.
Evidence: backend 16 packages green at 44-module floor; documents guide
section 9 carries the full disposition table.
Impact: pins backend ed036cb, documents 60bb2ed.
Refs: feature/prompt-catalog-coverage task card.
weichen