Why:
Preserve approval, active-branch integration and the cold-cache repair without conflating local evidence with final acceptance.
Evidence:
Link complete SELF and independent REPLAY records, and fixed-head component platform runs; leave pending gates explicit.
Impact:
Prepare the final candidate record and WIP component PR links before freezing source-external stage-7 evidence.
Refs:
R1-R15; dependency-workspace U1-U8; policy/delivery.md
Why:
An immutable npm lock caches tarballs but packed consumers also require resolver metadata before candidate execution.
Evidence:
SELF host replay passed 57 composition and CI credential cases; real npm 10 and 11 cold-cache consumers passed without lock changes.
Impact:
Acquire only installed exact-version npmjs metadata with clean config, preserve cache paths for offline execution, adopt the repaired Frontend source and record immutable CI fixtures.
Refs:
R6-R8, R14; dependency-workspace U4/U5; UI 63d289e and Frontend 5467517
Why:
The user approved the fixed implementation and self-check handoff.
Evidence:
Import the complete startup receipt through task-resume; preserve the fixed 0676 candidate's original receipts and independent review scope.
Impact:
Advance stage 6 to approved and prepare stage 7 verification without claiming formal acceptance, trusted CI, integration or deployment.
Refs:
R1-R15; dependency-workspace U1-U8; policy/delivery.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=add097d06137c4912a4ed9279e98ca353e4e4cf1.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why:
Keep implementation, independent review, formal acceptance and main integration distinct.
Evidence:
Reference immutable early-review scope and actual SELF receipts without upgrading their provenance.
Impact:
Prepare a source-external final evidence entry while preserving current branches and pending acceptance gates.
Refs:
R1-R15; dependency-workspace U1-U8; policy/delivery.md
Why:
Later authenticated source acquisition must never follow a frontend build or provider test.
Evidence:
SELF host replay passed all 23 real composition fixtures; both acquisition-order regressions failed before the repair.
Impact:
Prepare fixed sources and Go/npm caches before execution; retain committed tooling checks and RDM-selected Backend versions.
Refs:
R7, R8, R11, R14; dependency-workspace U5
Why:
An interrupted multi-component transition must retain original staged, ignored and external-worktree data after some independent copies have completed.
Evidence:
SELF scratch fixture interrupts a real nested copy after App is saved and Logging is partially copied; originals and external Git metadata remain identical, recorded partial data persists and retry refuses to discard it.
Impact:
Add failure-path coverage and clarify reachability checks before component branch cleanup; no transition implementation change.
Refs:
Dependency-workspace R9/R15 and independent reliability coverage followup.
Why:
The lifecycle pin verification step executes candidate Python and shell code even when its YAML run value is inline.
Evidence:
SELF regression observes three credential-order failures on the prior candidate, then passes after moving pin verification behind all privileged acquisition and recognizing inline run entries.
Impact:
Retain the pin verification gate while ending credential use before every candidate entry point.
Refs:
Dependency-workspace independent security and standards validation; R8 and CI phase boundary.
Why:
A dirty composer could change artifacts under a committed Dev identity, and two CI jobs reacquired credentials after executing candidate build code.
Evidence:
SELF regressions reproduce both issues before the fixes; all22 real composition cases and21 dependency/CI cases pass after. CI syntax checked; full exact committed replay follows this checkpoint.
Impact:
Verify executing composer/transport bytes before import and publication, record explicit tooling provenance, order all privileged acquisition first, and model CGO correctly in the nested component race fixture. Existing product and required CI gates remain.
Refs:
Dependency-workspace early code review; correctness/standards/security P1 findings and R7-R8/R14.
Why:
Formal root tests cannot read ignored migration clones, so provider CI regressions failed despite the product and source gates passing.
Evidence:
SELF receipts record 18 missing-source errors, then all 29 credential cases passing from a real source archive without .migration and with exact host Git-source validation.
Impact:
Use committed test-only workflow snapshots with full source commits and SHA256 provenance. Real acquisition still executes trusted inline workflows and never reads these fixtures.
Refs:
Dependency-workspace U5/U7; archive receipt66f01970885b34bbb0f9a2dfb244e4a58618b725e600f85fe765099cf2f3bd36.
Why:
Preserve work merged by concurrent tasks while adopting versioned dependency workspaces.
Evidence:
SELF task receipts record conflict detection, all 96 task/recovery/cutover cases, all 33 evidence cases and 5 component identity cases. Documents links and requirements were replayed after preserving both planning entries.
Impact:
Keep upstream idempotent sync, local resume and source-external receipt rules; adapt fixed-guidelines readiness and ignored component identity validation. Remove only obsolete index links and retain their physical Git metadata.
Refs:
Authoritative main57bcb17ea212a531186b6e21617a7f3bea65a791; Documents4a26798000c39cc59ba0c2cc6328f5c8f10dcb32; dependency-workspace R15.
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=57bcb17ea212a531186b6e21617a7f3bea65a791.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why:
An attempted shared digest import introduced a workspace package requirement in standalone fixed-root product fixtures.
Evidence:
SELF task receipts record the actual ModuleNotFoundError followed by all 20 real Git/Go/npm composition cases passing after restoring the local helper.
Impact:
Preserve standalone operation and retain the behavior-preserving unused parameter/import cleanup.
Refs:
Agent-System-Dev dependency-workspace U5; SELF composition receipt 5b7c224d67ab248b685da436ebee56638c1945a1dca3666f40e763621c1b8003.
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-merge-queue-policy-draft.md(PR#519) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why:
Replace repeated submodule source pointers with consumer-owned language versions and fixed application sources, keeping independent repository edits and existing branches intact.
Evidence:
SELF task receipts contain startup/sync evidence, real Go and npm consumption, Native overlay/unlink, safe transition/ref preservation, credential boundary and historical build regressions. Exact committed full composition and RDM checks follow this checkpoint; formal acceptance and GATE CI remain pending.
Impact:
Add isolated build/test composition, source provenance and safe owner refresh, adapt governance and service build callers, remove replaced index links while retaining original Git metadata, and adopt reusable dependency standards.
Refs:
Documents approved dependency-workspace r1/R1-R15 and U1-U7 implementation plan; feature/dependency-workspace task card.
Why: The user requires all merges to follow agent-run synchronization, review, current-head CI and platform admission.
Evidence: Existing delivery stages and owner-only protection boundary reviewed; exact current Gitea Chinese labels verified from runtime resources.
Impact: Strengthen the merge executor rule only; retain human stage reviews, owner protection actions and actual CI requirements.
Refs: User instruction; merge-queue implementation plan U4/U5; Dev PR #519; Issue #518
Why: Close the delivered I1 task without modifying unrelated task records or shared workspaces.
Evidence: Dev PR 534 merged after all three exact-head CI jobs passed; RDM 360/362 and Documents 98/99 actual results and independent reviews are retained.
Impact: Archive this task card and preserve original receipts only; leave all worktrees, branches, production services and later IAM increments unchanged.
Refs: Dev PR 534; policy/delivery.md task closure authorization; IAM I1.
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=e793e9804a1f5ecf49b29a40b4baac90ceb04e55.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Preserve independent final review and current-source equivalence before platform admission.
Evidence: Final document and integration metadata review has zero findings; full composition test and source equivalence receipts are retained with precise SELF object boundaries.
Impact: Delivery evidence only; no production, provider, guideline or document changes from the reviewed candidate.
Refs: IAM I1 integration task; Documents 98/99; RDM 360/362.
Why: Preserve actual component merge results and current delivery authorization before integration CI.
Evidence: RDM PR 360 merged at exact successful CI head; new Dev make test passed and independent metadata checks preserved approved digests and pins.
Impact: Clarify historical task records and current approved repair scope; preserve documentation and delivery evidence only.
Refs: Documents PRs 98 and 99; RDM PRs 360 and 362; IAM I1 task record.
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=1e5c6b9c10ba77ed34663fd670138621a17342bd.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Carry the actual merged contract and approved permission implementation boundary into the integration composition.
Evidence: Documents PR 99 merged as a7ff466d9ae91fc67a53d2bf4991f47fc63a2a4c after independent review and verified source digest; RDM PR 360 preserves actual-actor projection semantics.
Impact: Update documentation pin, navigation and delivery records only; new composition tests and final-head CI remain required.
Refs: IAM I1 permission contract section 8; Documents PRs 98 and 99; RDM PR 360.
Why: the user confirmed acceptance in conversation on 2026-10-13; the archived
card should carry the verdict with an honest source label.
Evidence: user confirmation (conversation reply); automated ten-scenario replay
25/25 PASS rows on this card and PR #529.
Impact: archived task card note only.
Refs: task feature/rdm-increment-settings-duties (archived via #532).
Why: Preserve a single Dev entry and independent repository ownership while allowing active feature branches to migrate without losing source or Git state.
Evidence: SELF 29 real Git/Go workspace tests and ordinary component evidence/lock tests passed; detailed RED/GREEN runs are recorded by make evidence in the task card.
Impact: Add fixed cloning, selected-version baselines, development overlays, npm source resolution, and independently preserved legacy snapshots. No other active worktree is modified.
Refs: Versioned dependencies U2/U5; R15; feature/dependency-workspace
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=5efbeebbdc09f8c2484613230a29c882c54652f0.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=5efbeebbdc09f8c2484613230a29c882c54652f0.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Record user acceptance and use the actual merged permission contract in the integration composition.
Evidence: Documents PR 98 merged as 3cf263962bd106529ee0531c8415cb16eecedfe3; independent document review and full SELF receipts retained in the task record.
Impact: Advance only Documents and delivery evidence; full IAM later increments and deployment remain outside scope.
Refs: Documents PR 98; IAM I1 U1-U2; policy/delivery.md stages 8-9.
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-rdm-increment-settings-duties.md(PR#529) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-d1-closeout-evidence.md(PR#517) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=5aae47ebca20ad1f3add3b080212cca7e1c6edf9.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Prepare ordinary component workspaces and real module downloads without changing global Git configuration or other feature branches.
Evidence: SELF clean-cache module consumption and real temporary-Git transport tests are recorded by make evidence in the task card, including expected RED and passing GREEN runs.
Impact: Add component identities/source locks and non-secret transport configuration. Existing submodule layout remains supported during migration.
Refs: Versioned dependencies U1/U2; R15; feature/dependency-workspace
Why: Preserve the user-approved stage-7 conclusion before the final merge candidate is frozen.
Evidence: Import original precheck, sync, build, CI and independent replay receipts; validate current fixed components, document links and the incoming acceptance script syntax through make evidence.
Impact: Update this task card only; preserve implementation and activation boundaries. New HEAD CI remains required before merge.
Refs: Dev PR #519; Guidelines PR #5; Documents PR #96; queue Issue #518
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=5aae47ebca20ad1f3add3b080212cca7e1c6edf9.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
weichen