Commit Graph
985 Commits
Author SHA1 Message Date
weichen 651f4e7c66 Merge pull request 'Fix two finish-guard false positives: IDE artifacts and remote-tracking refs' (#217) from feature/finish-guard-fixes into main
ci / test (push) Successful in 2m20s
2026-10-05 15:03:26 +00:00
weichen c62a410e5a Record make test evidence 2026-10-05 15:03:25 +00:00
weichen 91d25a3ed1 Fix two finish-guard false positives: IDE locks and remote-only refs
ci / test (pull_request) Successful in 2m21s
Why: 2026-10-05 两次实测踩到——①rglob("*.lock") 把 .git/cursor/ IDE 产物当 Git 锁
(五天陈锁阻断 worktree 回收);②pinned-history 用 --all --reflog 把 refs/remotes
计入,pin 在 feature 顶端的子仓永远无法 finish(被迫删远端引用+清 reflog 损害现场)。
Evidence: FinishGuardFixTests 四例全绿(误报修复+真实锁仍拦+独有提交仍保);
全套治理回归 91 例 OK;make test 全链证据入卡。
Impact: 仅 finish 模式两处判定;IDE 产物与远端引用不再误伤,本地独有工作保全语义不变。
Refs: 本仓 governance 收尾实录(EXT-1 与 governance-reliability 两轮)。
2026-10-05 15:00:20 +00:00
weichen df23fcab56 Record the finish-guard-fixes task card 2026-10-05 14:54:42 +00:00
weichen eb140545a4 Record the task card for feature-finish-guard-fixes
Why: establish the authorized task workspace and its initial baseline.

Evidence: preserved precheck receipt in .task/feature-finish-guard-fixes.md; R0=4edec763fff1b8239e203dc9106f16a241ca343d.

Impact: task metadata only; the feature workspace starts at 4edec763ff.

Refs: .task/feature-finish-guard-fixes.md
2026-10-05 14:53:45 +00:00
weichen 4edec763ff Merge pull request 'Close merged task cards (feature/card-close-20261005-135101Z)' (#216) from feature/card-close-20261005-135101Z into main
ci / test (push) Successful in 2m12s
2026-10-05 13:51:11 +00:00
weichen 7c00f4ad44 Close 1 merged task card(s) and archive them
ci / test (pull_request) Successful in 2m14s
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-governance-reliability.md(PR#213) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
2026-10-05 13:51:01 +00:00
weichen ec0fa4f8b8 Merge pull request 'Lock CI checkout credential scope to the injected server and allowlist' (#215) from fix/ci-checkout-credential-scope into main
ci / test (push) Successful in 2m11s
2026-10-05 13:50:07 +00:00
weichen 9374986b63 Lock CI checkout credential scope to the injected server and allowlist
ci / test (pull_request) Successful in 2m10s
Why: 复核轮遗留的安全测试草稿按「常量=传输端点」设计,与 PR #213 已合入的
「注入基址=传输端点」语义相反,原样提交会红。适配为锁定真实不变量。
Evidence: python3 -m unittest tests.test_ci_credentials 8/8 OK(含新用例:
任一注入拼写检出成功、凭据仅落白名单路径且令牌分离、非 http(s) 注入 fail-closed)。
Impact: 仅测试文件;不改 ci.yaml 行为。
Refs: PR #213 run 950 诊断(GITHUB_SERVER_URL=http://172.17.0.1:3000)。
2026-10-05 13:45:58 +00:00
weichen af7412a04e Merge pull request 'Harden development gates and align the governing rules' (#213) from feature/governance-reliability into main
ci / test (push) Successful in 2m7s
2026-10-05 13:43:15 +00:00
weichen a4e4f1cb69 Record reviewer replay evidence for the CI fix round
ci / test (pull_request) Successful in 2m33s
2026-10-05 13:40:14 +00:00
weichen 89468bba4c Allow the platform-injected internal http server URL in CI checkout
ci / test (pull_request) Successful in 2m11s
Why: 运行器注入 GITHUB_SERVER_URL='http://172.17.0.1:3000'(docker 网关直连宿主 Gitea,
run 950 诊断实测);https 限定与硬编码常量比对都会拒绝合法检出,GATE 无法变绿。
Evidence: 校验收宽为 http(s)+netloc;凭据仍仅附着于注入基址+仓库白名单 URL,固定 SHA/
路径/递归深度 fail-closed 语义不变。
Impact: 仅 ci.yaml checkout 一处。
2026-10-05 13:37:12 +00:00
weichen 017502f4cc Diagnose the runner-injected server URL in CI checkout
ci / test (pull_request) Failing after 1s
2026-10-05 13:35:42 +00:00
weichen a1fb67c569 Derive CI checkout server from the runner-injected URL
ci / test (pull_request) Failing after 1s
Why: 加固 checkout 把 GITHUB_SERVER_URL 与硬编码常量严格比对,运行器注入值与公网拼写
不一致时合法检出被拒(PR #213 run 948/job 1333:Checkout server is outside the
reviewed allowlist),GATE 无法变绿。
Evidence: 本地同树 make test exit 0(REPLAY 行已入卡);修复后凭据仍只附着于
「平台注入基址 + 仓库白名单」URL,路径/固定 SHA/递归深度校验全部保留。
Impact: 仅 ci.yaml checkout 脚本一处;仓库白名单与 fail-closed 语义不变。
Refs: .task/feature-governance-reliability.md 授权记录(2026-10-05 安全收尾授权)。
2026-10-05 13:34:22 +00:00
weichen 005e2a1bd5 Record merge authorization and final synchronized evidence
ci / test (pull_request) Failing after 0s
Why: the owner authorized conflict-free integration and safe worktree cleanup after verification.

Evidence: final fixed combination passes make test and make build; full outputs and review replay records are in the task card.

Impact: authorization and evidence metadata only; no source or component change.

Refs: .task/feature-governance-reliability.md
2026-10-05 13:29:31 +00:00
weichen d932828e8c Record the sync checkpoint
Why: bind the task validation checkpoint to the latest integration baseline.

Evidence: SELF recursive component checks; sync_base=fd442d933c051fe538b224e067c214c1976f6dd0; candidate=d96e4ae016def6ce4f93548a55e6b26de8924d37.

Impact: task metadata only.

Refs: .task/feature-governance-reliability.md
2026-10-05 13:16:46 +00:00
weichen d96e4ae016 Record final combination evidence and component review links
Why: bind the reviewable governance repair to the synchronized candidate and related component PRs.

Evidence: tool-generated SELF make test and make build output plus independent repair REPLAY records in the task card.

Impact: task metadata only; platform protection and deployment remain owner-controlled.

Refs: .task/feature-governance-reliability.md
2026-10-05 13:16:20 +00:00
weichen 1c79932714 Record the sync checkpoint
Why: bind the task validation checkpoint to the latest integration baseline.

Evidence: SELF recursive component checks; sync_base=fd442d933c051fe538b224e067c214c1976f6dd0; candidate=c1fdf0141ca4e833c5b391c1847ee53d953b1cf3.

Impact: task metadata only.

Refs: .task/feature-governance-reliability.md
2026-10-05 13:12:15 +00:00
weichen c1fdf0141c Merge current main while preserving governance repairs
Why: main advanced with merged-task-name and legacy evidence guards during this task.

Evidence: SELF 44 lifecycle regressions pass after resolving both hunks; independent review repairs are recorded in the task card.

Impact: retains both task-start protections and the stronger JSON/legacy receipt reader, without rewriting either branch history.

Refs: Dev PR #211 and #212; .task/feature-governance-reliability.md
2026-10-05 13:11:50 +00:00
weichen b84667a697 Close review gaps in cleanup and evidence handling
Why: independent review found shared submodule metadata risk, quoted header leakage, stale JSON receipt blindness and missing abandon coverage.

Evidence: SELF 92 governance regressions pass; the original review receipt and replay output are recorded in the task card.

Impact: preserves external component worktrees, handles both evidence formats and adds targeted failure-path coverage; no product behavior changes.

Refs: .task/feature-governance-reliability.md; .task/reviews/governance-reliability.json
2026-10-05 13:07:10 +00:00
weichen 976d2e8443 Record synchronized combination test and build evidence
Why: retain complete tool-generated local verification for the governance repair candidate.

Evidence: SELF task-sync, 75 governance tests, full make test, make build and syntax checks are recorded in the task card.

Impact: evidence metadata only; product and gate implementations are unchanged.

Refs: .task/feature-governance-reliability.md
2026-10-05 12:46:53 +00:00
weichen fd442d933c Merge pull request 'Close 1 merged task card(s) and archive them' (#212) from feature/card-close-20261005-123933Z into main
ci / test (push) Successful in 2m0s
2026-10-05 12:43:54 +00:00
weichen f05f92d31a Close 1 merged task card(s) and archive them
ci / test (pull_request) Successful in 2m2s
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-task-start-merged-guard.md(PR#211) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
2026-10-05 12:39:33 +00:00
weichen 04e07dea89 Merge pull request 'Guard task-start against merged branch names; harden sync evidence scan' (#211) from feature/task-start-merged-guard into main
ci / test (push) Successful in 2m3s
2026-10-05 12:39:32 +00:00
weichen c0abfb0250 Record the sync checkpoint
Why: bind the task validation checkpoint to the latest integration baseline.

Evidence: SELF recursive component checks; sync_base=43d33aa4921078bc202393b99cba017d7f731b98; candidate=8af945a1d53bd3aa934994070417c91508cba994.

Impact: task metadata only.

Refs: .task/feature-governance-reliability.md
2026-10-05 12:36:27 +00:00
weichen 8af945a1d5 Make development gates preserve work and verifiable evidence
Why: cleanup, component synchronization, receipt recording and credential handling could contradict the documented development boundaries.

Evidence: SELF 75 isolated governance tests and source checks are captured in .task/feature-governance-reliability.md; combination and CI verification follow.

Impact: hardens local task and CI tooling, aligns policy and component documentation, and adds continuous regression tests without changing product behavior.

Refs: .task/feature-governance-reliability.md; policy/governance.md; policy/platform-admission.md
2026-10-05 12:36:02 +00:00
weichen 151185d35f Record final-HEAD make test evidence and result summary
ci / test (pull_request) Successful in 2m4s
2026-10-05 12:34:51 +00:00
weichen de75f1ede9 Record the sync-fix verification evidence 2026-10-05 12:33:17 +00:00
weichen 0bad425a7d Record the sync checkpoint 2026-10-05 12:33:16 +00:00
weichen 9a3ebe6539 Record the sync checkpoint 2026-10-05 12:33:06 +00:00
weichen 1e0508e8a7 Skip non-hex cells in the sync evidence scan
Why: 证据命令含 || 时 evidence.sh 把表格单元格里的管道转义为 \|\|,cmd_sync 按裸 |
切行把碎片当 HEAD 传给 git diff,fatal 128 在 set -e 下杀死 sync(本卡功能负例行实测触发,
task-sync 门禁被卡死)。
Evidence: bash -n 通过;含转义管道行的本卡上 bash scripts/task.sh sync 正常完成(WARN 照发、
exit 0);修复后 make test 全链重跑。
Impact: 仅 cmd_sync 证据扫描加十六进制过滤;WARN 语义不变。
Refs: 本卡 12:30-12:32 五次 sync 中毒复现记录。
2026-10-05 12:33:06 +00:00
weichen 278bff9a31 Record the sync checkpoint 2026-10-05 12:32:00 +00:00
weichen 2fec8b4e82 Record the sync checkpoint 2026-10-05 12:31:59 +00:00
weichen b3a5a31d10 Record the sync checkpoint 2026-10-05 12:31:17 +00:00
weichen 9e30c5f656 Record the sync checkpoint 2026-10-05 12:31:08 +00:00
weichen 09aa6e59b0 Record the sync checkpoint 2026-10-05 12:30:49 +00:00
weichen 879bf64b94 Record the clean-tree task-sync checkpoint 2026-10-05 12:30:36 +00:00
weichen 6d82dfaabd Record the sync checkpoint 2026-10-05 12:30:36 +00:00
weichen e58035a8e4 Guard task-start against reusing a merged branch name
Why: 合入后再 task-start 同名分支会从新 main 长出第二段历史并覆盖已合入任务卡
(2026-10-05 EXT-1 复核轮实测,两轮证据差点丢失);原校验只看本地分支能否创建。
Evidence: bash -n 通过;功能负例——start feature/ext-1-inproc-handler 被拒且无
worktree 副作用;make test 全链 exit 0;task-sync 基线 43d33aa。
Impact: 仅 scripts/task.sh cmd_start 增加已合入同名分支检查,其余子命令行为不变。
Refs: EXT-1 任务卡复核轮记录(.task/archive/feature-ext-1-inproc-handler.md)。
2026-10-05 12:30:25 +00:00
weichen 94f8d4760b Record the task card for feature-task-start-merged-guard 2026-10-05 12:28:26 +00:00
weichen 46a1770798 Record the task card for feature-governance-reliability 2026-10-05 12:18:49 +00:00
weichen 43d33aa492 Merge pull request 'Close merged task cards (feature/card-close-20261005-120757Z)' (#210) from feature/card-close-20261005-120757Z into main
ci / test (push) Successful in 2m3s
2026-10-05 12:16:12 +00:00
weichen ea54f1108b Close 1 merged task card(s) and archive them
ci / test (pull_request) Successful in 1m59s
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-ext-1-inproc-handler.md(PR#209) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
2026-10-05 12:07:57 +00:00
weichen 15ec9bfbc5 Merge pull request 'Restore and complete the EXT-1 task card after branch recreation (verification round)' (#209) from feature/ext-1-inproc-handler into main
ci / test (push) Successful in 2m0s
2026-10-05 12:07:12 +00:00
weichen 4801a90319 Record the verification-round note and no-diff evidence on the restored card
ci / test (pull_request) Successful in 1m59s
Why: task-start 误在合入后重建同名分支覆盖原卡,3718f6c 已恢复;本提交补记复核轮
性质(仅复核、产品代码零差异)与 no-diff 证据行,避免归档卡丢失两轮记录。
Evidence: test -z git-diff 卡片外无差异,exit 0;复核轮 4 条证据行已在卡(c371815)。
Impact: 仅 .task 卡片。
Refs: PR #207;PR #208(旧闭卡分支,将按新卡重新生成)。
2026-10-05 12:04:29 +00:00
weichen 5aa1e093e5 Record the sync checkpoint 2026-10-05 11:59:03 +00:00
weichenandCursor e37e0cd139 Record the full test run on the restored branch
Why: the completion claim needs a make test evidence row whose tested HEAD is this branch, not the discarded template commit.
Evidence: make evidence captured make test exit 0.
Impact: task card only.
Refs: PR #207
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-05 11:59:02 +00:00
weichenandCursor dd75010738 Record the EXT-1 re-verification evidence
Why: the recreated branch needs its own evidence rows for the checks that already passed on the merged implementation.
Evidence: precheck, cmdbus/rag/app/extension tests, downstream example, and boundary lint, written by make evidence.
Impact: task card only.
Refs: PR #207
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-05 11:58:25 +00:00
weichenandCursor 3718f6c770 Restore the EXT-1 task card after branch recreation
Why: task-start recreated feature/ext-1-inproc-handler on main and replaced the card already merged in PR #207 with an empty template.
Evidence: restored content matches 63a62a79ac; no product code change.
Impact: this branch tip keeps the merged card instead of deleting it.
Refs: PR #207
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-05 11:58:13 +00:00
weichen c3718153c5 Record the task card for feature-ext-1-inproc-handler 2026-10-05 11:53:15 +00:00