Why: adjust_args_for_bin strips the leading space of its return while the
rebuilt args keep it, so every rebuild carrying --dsn/--auth compared
unequal and warned that the legacy binary had the flags dropped even when
nothing was dropped — misleading during incident triage.
Evidence: bash -n clean; against the real dev binary the normalized
comparison reports no drop and the flags survive intact; make test green.
Impact: warning now fires only when flags are actually filtered; no
behavioral change to start/deploy.
Refs: PR #188
Why: the 2026-10-05 dev outage — a restart with an explicit --addr rebuilt
the start args, and the rebuild branch dropped the persisted --dsn for the
dev env, so the binary resolved auth=auto to off on 0.0.0.0 and the new
listen guard refused to spawn; record_state then persisted the broken exec=
before the health probe, so bare starts kept failing.
Evidence: bash -n clean; sandbox registry with stub binaries — dbref DSN is
re-derived on rebuild (priority CLI > env > dbref), the pre-flight blocks
non-loopback without auth with actionable remedies, immediate-death starts
leave the previous exec= intact, and DSN masking covers all start-path log
lines; make test green.
Impact: dev/prod agent starts keep their DB binding across explicit-arg
rebuilds; failed starts no longer corrupt the registry; static/pg paths get
the same persist-after-probe ordering (pg already had it); no change to
deploy materialization or the binary guard semantics.
Refs: backend 8eda35f (listen guard), runtime/dev history.jsonl 01:23 fail
Why: The feature branch is on main, and the open task card would stay as bookkeeping debt.
Evidence: Dev pull request 186 merged as 090be2404e. The merge subject does not contain the from-branch line, so the automatic scan skipped it.
Impact: The card moves to .task/archive with status filled in. No product code changes.
Refs: .task/archive/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The task card is the pull request description, and it has to name the child merges and the checks that already passed.
Evidence: Documents 37, UI 34, Core 21, Frontend 43, Native 16, Squad 15, and Backend 63 are merged. Dev is still open.
Impact: The card stays in progress until the Dev pull request merges.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The task card has to name the commits and the gates that already passed before sync.
Evidence: make test and make build exited 0. config explain refuses 0.0.0.0:8788. serve on 0.0.0.0:18799 exited 1 and left no database directory.
Impact: The card still says the work is in progress until the pull requests merge.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The incremental build info commit has to be the gitlink Dev records.
Evidence: modules/frontend is eb6502f. make build produced bin/agent-system.
Impact: The parent branch names the same frontend commit the worktree built.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The shared types dropped a spare export so the knip ratchet stays at its baseline, and every container must name those commits.
Evidence: core 0b5c774, ui 6b2589c, frontend 13a1c63, backend c05832d. UI knip 55 and frontend knip 43.
Impact: Gitlinks move together. JSON field names are unchanged.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The listen guard reads auth and host policy from config before the database opens, so app depending on config is a real edge.
Evidence: make test stopped in lint-boundaries on backend/app backend/config. The edge is now in the baseline.
Impact: New imports still fail the ratchet. This one records the startup guard's dependency.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Dev's agent-native moved for message shaping, so squad and backend have to follow or check-pins fails.
Evidence: Squad 5a57636 and backend include that pin. make test previously stopped at test-pins on this mismatch.
Impact: The parent, backend, and squad all resolve agent-native 3a110a7.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Empty innerHTML clears were flagged because the space matcher could backtrack past the quotes. The child tests now keep that whitespace inside the lookahead.
Evidence: Frontend vitest 78 passed. UI html-sinks passed. Child commits are ui 5f8308a and frontend 02cebc0.
Impact: The parent pins match the ratchet that allows clearing a node before appending sanitized children.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The card still had placeholders for authorization, scope, and the compatibility note that reverse proxies need allowedHosts.
Evidence: The card names the new message and observation fields and the items that stay out of this task.
Impact: Reviewers can use the card as the PR description without reconstructing the scope.
Refs: docs/records/2026-10-04-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The research record, HTML cleaning, listen guard, secret store, and context controls land together, and the parent pointers have to name those commits.
Evidence: Child commits are core bd63223, agent-native 3a110a7, ui d76a8e6, frontend 36b92ed, documents f3f823e, backend 42cca8f. svc.sh forwards the listen switches and info prints them.
Impact: A reverse proxy or a LAN hostname needs allowedHosts or an unauthenticated host check returns 403. Startup moves raw API keys into the secret table after a settings snapshot.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: fix-settings-dotted-keys.md(PR#181) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: the task card must show that Backend #61 is on main and the Dev branch was retested after syncing.
Evidence: make test exited 0 at 2026-10-04T13:45:06Z on the pin of fd17011.
Impact: documentation only.
Refs: fix/settings-dotted-keys
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the Dev branch must record the Backend main commit that contains the settings fix, not the unmerged feature tip.
Evidence: Backend #61 merged as fd17011.
Impact: modules/backend gitlink moves from d90b9c0 to fd17011. Behavior is the merged fix.
Refs: fix/settings-dotted-keys
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-svc-db-bind.md(PR#182) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: completion statement carries precheck/task-sync/test evidence.
Evidence: make test exit 0 at head ecfed7b; functional evidence in the card.
Impact: card-only; PR description mirrors this card.
Refs: .task/feature-svc-db-bind.md
Why: beyond database binding, services needed a way to switch the JSON config
file they run with and have the new config take effect promptly; hand-editing
exec= risks restarting a service into an invalid config.
Evidence: in the task worktree with a real agent binary -- a config with an
unknown key is rejected by the binary's strict schema check before any state
change; a valid file binds via --config in exec= + conffile= (survives
record_state rewrites), restarts the running service, and the config's dsn
verifiably drives the process (wrong-password variant failed PG auth in the
log; correct variant connected and created 21 tables); editing the file and
re-running 'config <same file>' re-validates and restarts (pid changes);
'--clear' removes both the flag and conffile; db and config coexist in exec=;
view mode shows masked JSON content plus 'config explain' effective values
with masked dsn; list DB column also resolves dsns that live only inside the
config file. Full log in the task card.
Impact: new service-level action 'svc.sh <name> config [file | --clear]
[--no-restart]' for agent services; config-file content snapshots (masked,
--reveal to show) in info; a config-file line in status; conffile persisted
in svc.env. No agent binary changes.
Refs: task card .task/feature-svc-db-bind.md (same doc as PR #182);
docs/svc.md sections 2/4.5/4.6/6/10.1
Why: acceptance of the settings fix is the deploy log and the live key checks, and that evidence belongs on the task card.
Evidence: dev@8b63e2b logged normalized 4 dotted keys in 2 scopes and registered 1 Tavily key. The web_search probe returned ok.
Impact: documentation only. The backend pin is unchanged. Merging stays with the owner.
Refs: fix/settings-dotted-keys
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: info showed services and postgres instances but no service-to-database
correspondence, and switching an agent service to another database required
redeploying with a hand-built DSN. While wiring this up, adjust_args_for_bin
was found matching Go flag help with '--dsn' although Go prints '-dsn', so
deploy-built --dsn/--auth args were silently dropped on current binaries.
Evidence: full E2E in the task worktree with a real agent binary and a real
PostgreSQL 18 instance -- 't-app db bpg' persisted exec=/dbref, auto-restarted
(dbref survives record_state rewrites), and the agent created 21 tables in the
bound database; 'db bpg --db t2' auto-created and switched databases (21
tables in t2); '--clear' returned the service to embedded SQLite; --no-restart
and error paths behave; list gains a DB column, status a database line, info a
reverse bound-services line; legacy deployments without dbref resolve by DSN
host:port; single-dash detection proven with positive and negative cases;
regressions list/db dsn/db ls/info/history/--help pass; make test exit 0.
Full log in the task card.
Impact: new service-level action 'svc.sh <name> db [pg [--db X] | --clear]
[--no-restart]' for agent services (bind/switch/unbind/view), DB column in
list, binding lines in status/info, dbref persisted in svc.env, auto database
creation when the instance runs, and the adjust_args_for_bin fix restoring
deploy --dsn/--auth on current binaries. No agent binary changes.
Refs: task card .task/feature-svc-db-bind.md (same doc as the PR); docs/svc.md
sections 4.5/6.1/6.2/10.1
Why: the task card is the review record and needs the Dev and Backend PR links.
Evidence: Dev #181 and Backend #61 exist.
Impact: documentation only.
Refs: fix/settings-dotted-keys
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the acceptance sync needs the verification result on the task card before review.
Evidence: make test exited 0 after task-sync onto 3836ea88e3.
Impact: documentation only. The backend pin is unchanged.
Refs: fix/settings-dotted-keys
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: dotted setting writes were stored as unread keys, and secret pools were returned in clear text.
Evidence: Backend go test ./... at d90b9c0. Dev make test follows this pin.
Impact: the dev branch tracks Backend fix/settings-dotted-keys until that PR merges, then the pin moves to main.
Refs: fix/settings-dotted-keys
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen
