Why: include the current integration baseline before verification.
Evidence: fetched origin/main=d40579ed7fe3bbca68d3c6fcd1bce6707688d59e.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: F2 token extraction predates the two-section (HOME/IMC) layout of
~/.secrets/gitea so it concatenated both tokens and always failed; F6
registered a grep BRE alternation that facts-verify unescapes into a
literal pipe, failing re-verification and misaligning precheck's naive
pipe split into a spurious F6 date-format expiry warning, while both
underlying facts still hold.
Evidence: make facts-verify now 6/6 PASS with last_verified refreshed
to 2026-10-14; new regression test for escaped pipes in facts rows;
full governance suite 342 tests OK (18 skipped); precheck [facts] line
reports all facts fresh on the fixed parser.
Impact: policy/facts.md F2 (HOME-section awk extraction) and F6
(negated pipe-free grep); scripts/task.sh precheck neutralizes escaped
pipes the same way facts-verify does; tests/test_task.py covers it.
Refs: precheck WARN 过期事实 F6(日期格式); AGENTS.md 证据与验证门禁.
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=4f84c2e1630cd0311643529fae1c3a99f1dd5d64.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: pipefail treated a recent merged-card match as a failed git log after grep exited early, hiding completed cards from precheck and task-close.
Evidence: A disposable long-history regression failed before the fix and passed after it; make test-governance passed 341 cases. Git history confirms PR #489/#488/#486 merge SHAs.
Impact: Detect merged cards reliably and archive only the three authorized trial cards; four unrelated eligible cards remain untouched.
Refs: Dev merge queue #518; Dev #489, #488, #486
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=415f9ac58ece9d9b63bd9b3fea39978bb847fcce.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: The approved r0.3 plan must run against the current project member and IAM mainline.
Evidence: First task-sync conflict receipt was imported; Backend full Go tests and Frontend test/build passed after resolving component interactions; git diff --cached --check passed.
Impact: Combine current main with the existing U3 draft, preserving both planning entries and the Backend private project event proof transaction.
Refs: Dev PR #512; Backend PR #193; Frontend PR #79; Documents PR #95
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=5aae47ebca20ad1f3add3b080212cca7e1c6edf9.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: with the four-repo v0.4.0 release live, the account.list query/name
passthrough (RDM #356) enables the deferred full assertion of scenario 2; the
harness also needed v0.4.0 adaptations discovered on the combo instance.
Evidence: tool-written rows on the card - full ten-scenario run on a disposable
rdm@84ca64f combo instance (25/25 PASS incl. 2b name-substring, 2c
case-insensitive owner filter, 2d limit truncation), and dev service status
(rdm@84ca64f running against the live dev database, auth gate 401).
Harness fixes: rdm.project.member.setRole renamed to set-role (RDM #350);
command envelope parsed via payload; re-login after the password gate (base
#195 revokes sessions on password change); RDM world provisioning via
rdm.project.create + bind with the domain admin self-removing so owner2 is the
sole owner (creator is seeded as owner); scenario 8b asserts allow:true in the
current response shape; scenario 10b now meaningful (base #195 admits member
conversations through RDM project membership).
Impact: integration script and task card only; no product code.
Refs: task feature/rdm-increment-settings-duties; RDM #356; base v0.4.0 tags.
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=20e086e48b9cec7f300feba5342db7a0661a4d4e.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=d5428c5f05fc5f625e6232ab3156b17f13e14d6a.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: A LOCAL_READY receipt must permit normal target advancement without accepting a rewind or divergent target history after its observation.
Evidence: Two disposable real Git regressions reproduced erroneous successful recovery before the guard; all 18 task recovery tests pass afterward. Raw SELF receipts are in the task card.
Impact: Reject abnormal target ancestry before receipt import; preserve normal local recovery and strict delivery defaults. Correct stale implementation-stage documentation without activating the queue.
Refs: Documents implementation plan ba4044d U2; independent review R1 and R2; .task/feature-merge-queue-policy-draft.md
Why: waiting branches should keep their work while one candidate syncs and merges, and a conflict must not block unrelated healthy work.
Evidence: SELF three Git scenarios and governance suite captured by make evidence; real CI and three-business-task acceptance remain NOT_RUN.
Impact: local regression scenarios only; no automatic queue mutex, production merge or measured CI savings are claimed.
Refs: U6; tests/test_merge_queue_trial.py; .task/feature-merge-queue-policy-draft.md
Why: agents need consistent entrypoints and recording defaults to avoid retrying synchronization and CI outside the final delivery window.
Evidence: SELF generated-task-card red-green regression and governance suite recorded through make evidence; pending shared record created as Issue #518.
Impact: rules, task template and capability matrix stay explicit about pending activation, default strict startup, manual coordination and unchanged CI triggers.
Refs: U4; policy/merge-queue.md; .task/feature-merge-queue-policy-draft.md
Why: recording checks in a frozen task card can change the candidate and invalidate current-head CI.
Evidence: SELF fixed-candidate capture regression and all 33 evidence tests passed; actual output and object digests are preserved by make evidence.
Impact: document preparation, external receipts and post-phase import using existing schema 1; no filesystem freeze or trust upgrade is introduced.
Refs: U3; policy/governance.md; .task/feature-merge-queue-policy-draft.md
Why: an existing authorized task should not merge a moving target merely to resume local work, while new task startup and delivery remain strict.
Evidence: SELF red-green recovery and environment regressions; task, recovery, evidence and local-mode write-guard suites passed through make evidence.
Impact: add explicit LOCAL_READY and task-resume, validate worktree/card/baseline and receipt purpose, preserve schema 1 and prevent local receipts from starting or releasing tasks.
Refs: U2; policy/merge-queue.md; .task/feature-merge-queue-policy-draft.md
Why: repeated task-sync calls changed HEAD and invalidated CI even when main had not advanced.
Evidence: SELF red-green regression and 58 task lifecycle tests recorded through make evidence in the task card.
Impact: sync still fetches and validates components, creates records only for an actual merge, and reports the complete final source SHA.
Refs: U1; policy/merge-queue.md; .task/feature-merge-queue-policy-draft.md
Why: Preserve authoritative main and both backend histories before draft review.
Evidence: Exact incoming cfb8308 merged without source conflicts; current combination and PG checks follow.
Impact: Keep session/account fixes and U2/U3 task authority in the same candidate; model gate remains failed.
Refs: Dev main aa6364f and U2/U3 task card
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=719bfe945f46d43a22d7ac7025d2313faa4bf0e4.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: The follow-up CI exposed that backend #188 broke the Dev
multi-instance suite: serve --mock seeded runtime.mock at the user
scope, which system-managed settings now reject, so instances never
became healthy. Backend #190 seeds the startup flag into the system
scope; this PR repins and drops the now-invalid alice user-scope write.
Evidence: Backend #190 CI success at head 0af1ebc (GATE); this PR's
composite CI re-runs make test-multi-instance (GATE for the fix).
Impact: backend pin 741da4a; multi-instance test comments updated to
the system-managed regime.
Refs: Backend #188, #190.
Why: Complete the approved U2/U3 fix pass and prevent shared host fixture collisions.
Evidence: Native SELF receipts record complete Backend suite, Frontend 221 tests, meaningful startup regression failures and the bounded baseline model batch.
Impact: Pin the corrected Backend and Frontend and allocate owned recovery fixture ports; no existing service deployment.
Refs: modules/documents/docs/proposals/2026-10-13-fast-slow-u2-u3-plan.md
Why: A fixed regression port collided with another task-owned preview and blocked full verification.
Evidence: SELF full-suite failure identified port 18795; the isolated fixture replays without stopping the unrelated process.
Impact: Changes one test fixture and records actual HTTP/browser acceptance; no service operations or production settings changed.
Refs: fast-slow-u2-u3 final verification
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=3fb8210f6495a78e70a67af3661bdfe9c00fb9de.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: test-pg only cloned the default branch, so prev_sha and legacy_sha were never built or attested.
Evidence: SELF python3 -m unittest tests.test_ci_credentials tests.test_lifecycle_pin (11 tests, exit 0).
Impact: the lifecycle suite prints the combination inventory and keeps login and rdm.ping as NOT_RUN.
Refs: .task/feature-svc-d3-real-scenarios.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A real process must not keep the caller DSN in its command line, environment, log, history, or svc.env. Domain events written by -bootstrap have to survive a later pin deploy.
Evidence: SELF unittest of the two new LifecycleRealTests methods exited 0.
Impact: The scan uses a sentinel that is not a live database password. Login and rdm.ping stay NOT_RUN.
Refs: tests/integration/lifecycle/test_lifecycle_real.py
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A static dev deploy deleted the worktree before copying dist, so a mixed batch could not update the workbench. Missing manifests and a second instance on the same Postgres database must fail closed the same way on real artifacts.
Evidence: SELF unittest of the mixed batch, the three-entry manifest-loss case, and the PG cross-instance case exited 0. The PG case used a temporary cluster.
Impact: static dev deploys copy dist before recycling the worktree. Login and rdm.ping stay NOT_RUN.
Refs: tests/integration/lifecycle/test_lifecycle_real.py
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Stub journals do not prove that a real RDM binary rolls back after a switched fault, a failed build, or a candidate that exits on serve.
Evidence: SELF unittest of the three new LifecycleRealTests methods exited 0. Staging leaves the old pid and release in place; the next start clears that journal. Switched and an immediate serve exit both restore the previous real binary.
Impact: The crash candidate delegates version and identity to the real binary so the gate still sees a capable artifact. Login and rdm.ping stay NOT_RUN.
Refs: tests/integration/lifecycle/test_lifecycle_real.py
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The lifecycle gate only ran four realcombo cases. A legacy candidate and a missing or mismatched identity row must be refused before the old process stops, and the prev/sha pins must switch without changing the identity row.
Evidence: SELF unittest of the four LifecycleRealTests methods exited 0 against a private RDM clone. The pin moved to the identity merge and a later commit on the same backend pin, because the previous card-close SHAs build a binary with no ensure/verify.
Impact: make test still skips this class unless SVC_TEST_REAL, SVC_RDM_SRC_DIR and SVC_REAL_RDM_BIN are set. make test-lifecycle now runs the module. Login and rdm.ping stay NOT_RUN.
Refs: tests/integration/lifecycle/rdm.pin
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=6193db1b548b964ab3133557ddbb9d83a3643d31.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=5aebedebeb963b5c01f39fd9122ec60dbe6d34d3.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=5aebedebeb963b5c01f39fd9122ec60dbe6d34d3.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: U7 acceptance bootstrapped u7-admin into the shared dev runtime's
singleton rdm_admins ledger, locking the operator out of RDM admin pages
(rdm.role.list 400); recovery required forensics. KTD4 keeps base isAdmin
to audit-view only, so an operator-side trusted channel is needed.
Evidence: python3 -m unittest tests.test_svc_rdm_admin -v (25 OK, SELF);
live smoke on runtime/dev: show/status/typo-guard outputs verified.
Impact: new svc.sh <env> rdm-admin [show|transfer --to x] command, help
topic, status ledger line with stale-owner warning; no behavior change
for existing commands.
Refs: task card .task/feature-rdm-admin-lockout-recovery.md R1/R2
Why: an unset object store must keep artifact bytes available to the other process, which the store-level test does not execute.
Evidence: cross_artifact_roundtrip failed with EOF on backend c6fb130 and passed on 46073d30 (SELF, isolated u7drill-k4).
Impact: Dev now builds the fixed backend. Second-instance write traffic stays closed.
Refs: modules/backend tests/integration/multi-instance/multi_instance_test.go
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The live deploy journal never called fault injection, and test-lifecycle failed closed on login so CI could not require the real combination cases.
Evidence: SELF python3 -m unittest tests.test_svc_u2.U2ReleaseTests -q exit 0 (35 ok, 1 skipped) on 3602a87; receipt sha256 9b5785577751e8e9e7947cf9700fb8854b1c80142f34273ae25f3097ee4c9aa8.
Impact: test-pg builds the Dev binary and runs make test-lifecycle. Login and full-track deploy without SVC_RDM_ORIGIN stay NOT_RUN. No live data move and no account CLI.
Refs: recovery plan D2/D3; Dev #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=2c016931044bebdc4a114c1ca1127d1b40d4ab17.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: The task card still said C4 and C5 had not run, which would make the pull request describe the wrong result.
Evidence: B6, C4, and C5 receipts already on the card (SELF). drill_driver tests pass after grouping the imports.
Impact: The card now states K4 failed and second-instance writes stay closed. No product code change.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=cd61bbb112eea6a210a64e84f2cef00b0d64bfc1.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Main D1 now shares the same explicit fixture initialization contract.
Evidence: Both real SQLite and temporary PostgreSQL initialization paths
were independently replayed; capabilities JSON assertions are preserved.
Impact: Resolve duplicate PG setup through the tested helper; preserve
all main lifecycle changes and the rollback directory protection.
Refs: Dev #483/#485; D1 existing-store identity contract
Why: Current RDM identity ensure/verify intentionally refuse missing
databases and schema; the old fixture invoked them on empty stores.
Evidence: Actual RDM red failure, real SQLite and isolated PostgreSQL
green replays, and independent review receipts in the task card.
Impact: Test setup only; normal serve initializes temporary stores and
is reaped before the unchanged identity/lifecycle assertions.
Refs: Dev #483/#484; current RDM D1 existing-store contract
Why: identity ensure no longer creates the schema, so the probe has to follow a real serve that applies migrations.
Evidence: SELF python3 -m py_compile tests/test_svc_realcombo.py. GATE run 2663 job 3839 failed on the previous head with identity table missing.
Impact: the PostgreSQL check still passes the DSN only through the environment, after serve has migrated.
Refs: #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: env -i dropped RDM_DISABLE_EXEC_TOOLS, so the real RDM binary exited immediately on runners without bwrap, and the capability probe now prints the JSON document.
Evidence: SELF bash -n scripts/svc.sh; python3 -m py_compile tests/test_svc_realcombo.py. GATE run 2656 job 3831 failed on the previous head before this fix.
Impact: serve and the lifecycle child forward that one switch; identity capabilities is checked as protocol 1 JSON.
Refs: #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A missing artifact id aborted the drill before recovery counts, the settle window, and the logical restore.
Evidence: backup-20261012-151951 reached promoted=1 and smoke 200, then StopIteration on an empty id (SELF). bash -n passed.
Impact: K4 stays failed when uploads do not return an id. The rest of the verdict is still written.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: main gained the real-combination CI gate after the previous sync, and this branch still has to carry that gate with the isolated identity calls.
Evidence: SELF python3 -m unittest recovery/identity/u2/deploy/pin/isolation — 100 tests OK (2 skipped); bash -n scripts/svc.sh.
Impact: identity ensure/verify still pass DSN only through the environment; stop waits for the port and can keep the desired state. CI keeps the lifecycle pin step and the svc-realcombo job.
Refs: #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The restored postmaster refused to start because the results-directory socket path exceeded the 107-byte Unix socket limit.
Evidence: restore/postgres.log from backup-20261012-150713 says the socket path is too long (SELF). bash -n passed.
Impact: The restored instance listens on /tmp/u7bk-18997, and cleanup removes that directory.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=99048dda1f48bccb3d5d798050d7beeea2907177.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: main already has one release transaction, so this branch keeps that path and only isolates update and recover in a clean child.
Evidence: SELF bash -n scripts/svc.sh; python3 -m unittest identity/recover/deploy/u2/lifecycle pin 92 tests OK (2 skipped), then 66 tests OK after dropping the obsolete journal hook.
Impact: deploy uses releases/ and deploy.journal; the lifecycle child reconciles that journal before deploy or recover. Backend pin is 0f192a4.
Refs: #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The checklist had no measured restore path for a physical backup, WAL archive, or pg_dump onto a new target.
Evidence: bash -n, go test in tests/ops/drill_driver, and run_backup_drill.sh --self-check passed locally (SELF). The timed run is recorded separately.
Impact: Isolated u7bk only. Upload responses keep artifactId so the restore check can download the same objects.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Second-resolution release IDs let staging delete a previous release
when a same-source deployment ran within the same clock tick.
Evidence: Fixed-clock rollback regression fails before and passes after;
250 governance checks pass. Independent review replays collision and
copy-failure protection; receipts are in the primary task card.
Impact: Add invocation identity and exclusive directory creation; keep
old artifacts intact. Also retain the latest compatible frontend pointer.
Refs: User-approved I2; Dev #483; Frontend #71/#72
weichen
