Why: a freshly deployed environment boots with an empty settings store,
so the first run dies with "main model unconfigured" and the user has
to open the settings UI before anything works - the opposite of
one-command bring-up.
Evidence: live matrix - full seed (chat+lightweight+tavily) lands in
the settings store (API view shows baseUrl/model with the key masked),
restart without flags does not re-seed and the settings persist,
.svc.env sourcing seeds a fresh environment from the one-time config
file, and a no-flag start stays silent. Also wrapped a /proc read race
in pid_alive that printed tr noise during stop.
Impact: --model-base/--model-key/--model-name, --light-base/-key/
-name, --tavily-keys on start/deploy (idempotent, only provided
fields); SVC_MODEL_*/SVC_LIGHT_*/SVC_TAVILY_KEYS env vars; <repo>/
.svc.env one-time config file (gitignored) makes every future deploy
self-configuring; auth-protected instances fall back to a clear hint.
Refs: feature/svc-auto-seed task card.
Why: merged card needs its PR link backfilled and archived per the
no-bookkeeping-debt rule.
Evidence: Dev PR #47 merged; card records the live flag matrix.
Impact: card archived with link; no code change.
Why: the manager only took configuration from SVC_* environment
variables; binding a public interface or pointing at a database meant
exporting vars first, which is awkward for one-off deploys and
invisible in shell history review.
Evidence: live matrix on the worktree - --port (8801), --host 0.0.0.0
(bind verified via ss, health probe auto-maps to 127.0.0.1), --addr
whole-form, CLI-over-env precedence (--port beats SVC_DEV_ADDR),
--mock reaching the server cmdline, --dsn passthrough proven by the
postgres connect attempt in the log, -- passthrough (--artifacts), and
make svc ARGS passthrough. A set -e silent-exit trap in env_config was
caught by the first run and fixed (condition-as-last-statement).
Impact: scripts/svc.sh <env> [action] [--addr|--host|--port|--data|
--dsn|--auth|--mock|--plugins| -- <extra>]; precedence CLI > env vars >
defaults; help rewritten with examples; make svc gains ARGS; logs keeps
the positional line-count form. The real-world port guard held: a dev
instance started from the main checkout was refused with owner info,
untouched.
Refs: feature/svc-cli-args task card.
Why: merged card needs its PR link backfilled and archived per the
no-bookkeeping-debt rule.
Evidence: Dev PR #45 merged; card records the live test matrix.
Impact: card archived with link; no code change.
Why: deploying a new build meant manually finding and killing the old
process, rebuilding and re-launching with the right flags; dev and prod
instances could collide on ports, data dirs or kill each other.
Evidence: live matrix on the worktree - dev deploy (stop -> make build
-> start with health check), redeploy swaps the pid and keeps seeded
data, prod deploys alongside dev on separate port/data with fully
isolated /api/projects, port takeover is refused with the owning
process named while the running env stays up, stop clears pidfile and
frees the port. A pid-capture bug (compound-background subshell wrote
the wrapper pid instead of the server) was caught and fixed during the
first live run.
Impact: scripts/svc.sh <dev|prod> [deploy|stop|start|restart|status|
logs]; runtime/<env>/{data,svc.pid,svc.log,svc.env} isolation; defaults
dev 127.0.0.1:8788 / prod 127.0.0.1:8787 overridable via SVC_* env
vars (incl. SVC_PROD_DSN for the PG tier); make svc ENV=... shortcut;
runtime/ gitignored. Safety: only processes started by the script are
stopped (pidfile + /proc cmdline double check).
Refs: feature/svc-env-script task card.
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-auth-admin-accounts.md(PR#43) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: R2 spans backend (migration v10, auth/session APIs, CLI user
subcommands), frontend (login page, forced change gate, admin user
management), documents (decision record).
Evidence: make test full suite green on this head (exit 0); headless
journey on the real binary with --auth on covers admin bootstrap,
first-login forced change for created and reset passwords, non-admin
menu gating, API-key login, logout.
Impact: auth-enabled deployments gain password login and admin account
management; embedded no-auth mode unchanged. Merge order: backend ->
frontend -> documents -> this PR.
Refs: proposal 2026-09-30-ui-redesign-and-auth.md (R2 admin-issued)
Why: merged combo card needs its PR link backfilled and the card
archived per the no-bookkeeping-debt rule.
Evidence: Dev PR #41 merged; card records both boot-state checks.
Impact: card archived with link; no code change.
Why: give the catalog's WebSearch prompt a carrier by registering
Agent-Native's Tavily tools behind settings, with library copy on top.
Evidence: backend 16 packages green incl. 4 new search tests; live
boot checks for both unconfigured and configured states.
Impact: pins backend 0d55ebb, documents b4546fe.
Refs: feature/tavily-search-tool task card.
Why: merged combo card needs its PR link backfilled and the card
archived per the no-bookkeeping-debt rule.
Evidence: Dev PR #38 merged; card carries the coverage test records.
Impact: card moved to .task/archive/ with the link filled; no code
change.
Why: close the coverage gap against the user's take-everything-portable
bar and record the porting rule.
Evidence: backend 16 packages green at 44-module floor; documents guide
section 9 carries the full disposition table.
Impact: pins backend ed036cb, documents 60bb2ed.
Refs: feature/prompt-catalog-coverage task card.
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-task-sidebar-r1.md(PR#37) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: the previous close commit archived the card but the link edit
landed only in the working tree; the archived copy still had the
placeholder.
Evidence: Dev PR #34 merged as 5c95c5f.
Impact: one-line card fix; no code change.
Why: R1 implementation spans core (Conversation flags), backend
(migration v8, task list APIs, /api/me), frontend (TaskSidebar rebuild),
ui (contracts mirror), documents (proposal acceptance record); the Dev
repo advances the pointers and the task record.
Evidence:
- make test full suite green on this head (core+backend+frontend+ui+
agent-command, exit 0) before advancing gitlinks.
- Headless walk on the built binary: cross-project task open, pinned-
first ordering, archive hide/show/restore, new-task flow, account
footer identity, zero console errors.
Impact: UI restructure per approved option A; no mid-column or inbox
changes (D25/D26/D31 intact). Merge order: core -> backend -> ui ->
frontend -> documents -> this PR.
Refs: proposal docs/proposals/2026-09-30-ui-redesign-and-auth.md (option A, R1)
Why: merged combo card needs its main-record PR link backfilled and the
card archived per the no-bookkeeping-debt rule.
Evidence: Dev PR #34 merged as 5c95c5f; card carries test and runtime
verification records.
Impact: .task/feature-prompt-library.md moved to .task/archive/ with the
PR link filled; no code change.
weichen