6 Commits

Include renames

Author	SHA1	Message	Date
weichenandCursor	20a4733152	Treat zombie PIDs as dead in batch update regression ... Why: CI containers leave unreaped zombies; os.kill(0) still succeeds and falsely failed the old-process-stopped assertion. Evidence: local unittest of the batch update case. Impact: assertion matches svc.sh/recover zombie semantics. Refs: .task/feature-svc-pidcheck-leak.md; PR #457 Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-12 09:35:27 +00:00
weichenandCursor	442251c35e	Reset per-service runtime state in svc.sh env_config ... Why: Batch update --all left SVC_PIDCHECK from the prior service in memory, so pid_alive/reclaim_own_port misclassified the next service's process as dead/foreign, deleted svc.pid, and failed start on a still- occupied port (genui/rdm1/rdmcand after successful dev). Evidence: make test-governance (SELF; receipt /tmp/svc-pidcheck-gov.json); new test_batch_update_stops_second_service_despite_prior_pidcheck + SVC_PIDCHECK ratchet in test_svc_precheck. Impact: env_config clears SVC_PIDCHECK/EXEC/VERSION/SOURCE per service; batch update correctly stops and restarts each agent. After merge: restore genui/rdm1/rdmcand and move rdmcand to its own data dir. Refs: .task/feature-svc-pidcheck-leak.md; complements #456 reclaim_own_port Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-12 09:25:33 +00:00
weichenandCursor	6056838b48	Fix static fresh-start pidcheck so health loop stays alive ... Why: write_static_reg omitted pidcheck and pid_alive ignored in-memory SVC_PIDCHECK, so first-boot curl probes fell back to agent-system and misread python http.server as exited. Evidence: python3 -m unittest tests.test_svc -v (17/17, new static case) Impact: Static --dir deploy survives the pre-record_state health loop. Refs: fix/svc-static-pidcheck-fresh-start Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-12 08:35:44 +00:00
weichen	419380187d	Add an rdm deploy source to svc (downstream composite binary) ... Why: RDM capabilities (two-trees-one-net, rdm.* trace-audit command face) only exist in the downstream Agent-System-RDM composite binary; svc's three existing sources all produce the Dev binary, so none of it could be deployed or lifecycle-managed. This adds --from rdm[@<sha>] with the same isolated source-repo semantics as the dev source. Evidence: make test-governance 138/138 (two new stub cases: deploy E2E and commits/update track); real deployment rdm@2aef3fc recorded in the task card (pins materialized, pure-Go build, web workbench to htdocs, serve health OK, rdm.ping/rdm.inspect.capabilities committed, update --check reports latest); make test full suite exit=0. All segments written by make evidence. Impact: scripts/svc.sh (rdm source resolution/materialization/deploy/update/ commits, probe timeouts, rdm seed skip, ELF env-DSN evidence fallback), docs/svc.md 5.4, tests/test_svc.py. RDM-side CLI alignment landed as RDM PR #228; no base submodules touched. Refs: task card .task/feature-svc-rdm-source.md; RDM PR #228/#229.	2026-10-11 20:46:03 +00:00
weichen	4b98e25687	Seed settings with an auto-minted temporary key when auth is on ... Why: seed_settings PUTs /api/settings/user without credentials, so under the PG tier's always-on auth the seed always 401s and model config silently never lands (reproduced on the dev instance 2026-10-11; settings had to be written by hand). Evidence: make test-governance && make test exit=0 (receipt 8ffc3a89); tests/test_svc.py adds three stub-based cases - auth-on seeds with a Bearer header and create/revoke around the PUT, --seed-owner skips account lookup, auth-off stays credential-free; 14/14 svc tests green. Impact: deployments that pass SVC_MODEL_*/SVC_TAVILY_KEYS now seed reliably regardless of auth mode; a temporary apikey (name=svc-seed) is minted for the first admin (or --seed-owner/SVC_SEED_OWNER) and revoked right after; auth-off path unchanged. Refs: task card feature-svc-seed-auth.	2026-10-11 14:58:36 +00:00
weichen	3b8fef7fad	Recover svc.sh database config across restarts and refuse on invalid binding ... Why: the exec= reuse path stripped --dsn into the process environment (G1-7) and record_state then persisted a DSN-less exec=, while the dbref fallback only existed in the explicit-rebuild branch - the second bare restart after a rebind silently dropped the database (SQLite fallback on loopback). Auth preflight also matched --dsn on the command line only, so env-delivered DSN with auth=auto was misjudged as unauthenticated. Evidence: bash -n OK; make test-governance 115 tests OK (new tests/test_svc.py 11 cases; 10/11 fail against the pre-fix script); make test green; make build OK; isolated real PostgreSQL 18.6 + real binary validation 27/27 (consecutive restarts/deploy keep binding, psql-verified database identity, DB-down restart fails without SQLite fallback or config loss, no credential leakage) - all recorded via make evidence in the task card. Impact: svc.env gains db=/dbref=/dsn= recovery keys (atomic 0600 writes); start/restart/deploy/update/db share one resolver; invalid bindings, config conflicts, mock coexistence and env-DSN-incapable binaries now refuse to start instead of silently downgrading; legacy exec= DSN migrates idempotently; docs/svc.md and script help updated. Refs: task card .task/feature-svc-db-config-recover.md; user-approved plan (2026-10-11 session message); AGENTS.md evidence gates.	2026-10-11 09:16:54 +00:00