Why: The approved contract requires exactly three safe attempts for Cursor, agy, and PI, then one Codex emergency attempt, never host implementation authority.
Evidence: Routing/config tests were RED for never, max attempts, forbidden adapters, and legacy host fallback; 133 related tests now pass with one opt-in probe skipped.
Impact: Normal emergency-mode roles reject all non-Cursor/agy/PI adapters, project fallback is never, and Codex remains available through emergency/review paths.
Refs: independent Codex review of feature/agent-cli-enforcement
Why: Agents must use configured CLIs for implementation and testing, while remaining free to inspect, plan, test, and iterate within bounded scope.
Evidence: Task-card contract tests and the full 430-test governance discovery pass with 19 existing skips; diff-check passes.
Impact: Defines three safe attempts per normal CLI, one emergency Codex attempt, fail-stop terminals, and mandatory apply/admit integration.
Refs: feature/agent-cli-enforcement
Why: app, server, and tools now call the layered Python environment. The dependency ratchet rejects those edges until they are recorded.
Evidence: CI job 5179 failed test-boundaries on exactly these three edges. scripts/lint-architecture.sh passes locally after the update.
Impact: The allowlist grows by three edges. No other package may import execenv until it is added the same way.
Refs: Agent-System-Dev pull 570
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=919f75cf7b39ca357e212a08a0ba5ba3d9a79b51.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=692735e91d6a9ab07ddd3686feb60a56b270728a.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Synchronize the approved policy candidate with the active simplified merge-window rules now on origin/main.
Evidence: Resolved the two semantic conflicts by preserving upstream queue simplification and this task's goal-first/cursor-per-unit contract; focused task-card regression and cached diff checks passed.
Impact: Retains the active single-window delivery process while replacing mechanical stage approvals with necessary decisions and preserving Cursor-per-unit execution.
Refs: .task/feature-goal-first-delivery.md
Why: Context assembly, ingest and runtime now depend on the vision package, and the dependency ratchet rejects edges that are not recorded.
Evidence: scripts/lint-boundaries.sh reports architecture ok with 88 edges.
Impact: The three new edges are the allowed image path. No other package gains a dependency.
Refs: .task/feature-four-model-vision.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Ensure implementation authorship is delegated per unit while the primary model remains responsible for planning and delivery management.
Evidence: The focused task-card generation regression went red then green, and git diff --check passed.
Impact: Every repository-writing implementation unit gets a fresh Cursor CLI run; unavailable or failed Cursor work is recorded as a blocker instead of being silently implemented by the primary model.
Refs: .task/feature-goal-first-delivery.md
Why: Keep authorized work focused on its stated outcome, prevent private scope expansion, and remove mechanical human stage gates.
Evidence: make test-governance passed 344 tests with 18 environment-dependent skips; receipt is recorded in the task card.
Impact: New tasks use goal-first execution while retaining real decision points, independent review, evidence, platform admission, and high-consequence dual keys.
Refs: .task/feature-goal-first-delivery.md
Why: Keep final sync and conflict handling with the merge agent and avoid treating pre-freeze SELF checks as final evidence.
Evidence: Review found one stale anchor, one ownership ambiguity, and one evidence-scope overclaim; all three are corrected.
Impact: Documentation only; no runtime or platform behavior changes.
Refs: Agent-System-Dev #518
Why: Keep branches developing independently and serialize only final sync, validation, and agent merge without expanding into audits or new platform mechanisms.
Evidence: scope and link checks, git diff --check, and recursive worktree verification passed as SELF evidence in the task card.
Impact: Documentation only; existing task-sync, CI, branch protection, and agent merge behavior remain unchanged.
Refs: Agent-System-Dev #518
Why: F2 token extraction predates the two-section (HOME/IMC) layout of
~/.secrets/gitea so it concatenated both tokens and always failed; F6
registered a grep BRE alternation that facts-verify unescapes into a
literal pipe, failing re-verification and misaligning precheck's naive
pipe split into a spurious F6 date-format expiry warning, while both
underlying facts still hold.
Evidence: make facts-verify now 6/6 PASS with last_verified refreshed
to 2026-10-14; new regression test for escaped pipes in facts rows;
full governance suite 342 tests OK (18 skipped); precheck [facts] line
reports all facts fresh on the fixed parser.
Impact: policy/facts.md F2 (HOME-section awk extraction) and F6
(negated pipe-free grep); scripts/task.sh precheck neutralizes escaped
pipes the same way facts-verify does; tests/test_task.py covers it.
Refs: precheck WARN 过期事实 F6(日期格式); AGENTS.md 证据与验证门禁.
Why: retain the approved status changes and current documentation while adopting the already approved manual delivery window after real platform validation.
Evidence: original startup, conflict resolution, combination test and writer inventory receipts are preserved in the task card; independent Doc89 and platform replay reports are referenced. Final candidate CI and review remain required.
Impact: publish the delivered Documents merge, manual trial policy and truthful capability state; keep all workflow triggers/checks and original task baseline unchanged.
Refs: Dev PR #489; Documents PR #89; Issue #518; approved merge queue implementation plan r1; user continuation authorization on 2026-10-14
Why: The user requires all merges to follow agent-run synchronization, review, current-head CI and platform admission.
Evidence: Existing delivery stages and owner-only protection boundary reviewed; exact current Gitea Chinese labels verified from runtime resources.
Impact: Strengthen the merge executor rule only; retain human stage reviews, owner protection actions and actual CI requirements.
Refs: User instruction; merge-queue implementation plan U4/U5; Dev PR #519; Issue #518
Why: The approved document dependencies have been reviewed and merged. Their actual immutable merge commits must be fixed before final host validation, while operational activation remains a separate gate.
Evidence: Independent document replay and verified PR merges are recorded in the task card. The staged host combination passed make test with actual merged child pointers; final commit build/CI remains pending and will be recorded outside source.
Impact: Advance only the two reviewed merged child pins, expose the real plan path, and record partial stage-seven approval and pending activation. Preserve current main components and existing admission/owner boundaries.
Refs: Guidelines PR #5 (2f5b198); Documents PR #96 (129cc35); Dev PR #519; implementation plan U4-U6; Issue #518
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=20e086e48b9cec7f300feba5342db7a0661a4d4e.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Shared project identity resolution is one private module used by app and server.
Evidence: Boundary scan passes 85 edges and its injected illegal-edge negative check; previous full run stopped at this documented boundary.
Impact: Add only app/server to projectscope and projectscope to store, without allowing transport/composition dependencies in the resolver.
Refs: system-project-membership proposal r1; feature/project-member-access
Why: Main advanced after the first fixed candidate passed CI, changing four component pins and invalidating final admission against the new target. Stage progress must also be referenced outside fixed source to avoid status-driven commits.
Evidence: Source-external original receipts preserve the previous clean local test/build, three successful CI jobs on 80f5e9a, detection of target advance, the refused transient lock and successful serial synchronization to 10d54d5. New combination verification and exact-head CI are pending.
Impact: Preserve the merged authoritative component versions; record the expired candidate honestly and replace a temporary stage-status sentence with its authoritative record pointers. No platform protection change or queue activation.
Refs: PR #519; main PR #513; implementation plan U1/U3/U4; Issue #518
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=10d54d5ffb3d3fa4a4ea256537b2439cef4cc7f3.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Preserve the exact implementation object, independent review findings, remediation evidence and remaining stage gates for the owner review.
Evidence: External task-sync and test-governance receipts measured clean candidate cca59c88dd before and after execution. Governance ran 340 tests: 322 passed and 18 environment-dependent skips. Local receipts remain SELF.
Impact: Task record and removal of one trailing policy blank line only; tested code and check definitions unchanged. No queue activation, platform protection change or real CI/trial claim.
Refs: .task/feature-merge-queue-policy-draft.md; Documents plan ba4044d U1-U6; independent review R1/R2; Issue #518
Why: A LOCAL_READY receipt must permit normal target advancement without accepting a rewind or divergent target history after its observation.
Evidence: Two disposable real Git regressions reproduced erroneous successful recovery before the guard; all 18 task recovery tests pass afterward. Raw SELF receipts are in the task card.
Impact: Reject abnormal target ancestry before receipt import; preserve normal local recovery and strict delivery defaults. Correct stale implementation-stage documentation without activating the queue.
Refs: Documents implementation plan ba4044d U2; independent review R1 and R2; .task/feature-merge-queue-policy-draft.md
Why: the observed main protection does not require status checks, so platform admission must be verified before activating the delivery queue.
Evidence: SELF read-only configuration and actual PR context names recorded in the task card; protection changes and negative-case replay remain NOT_RUN.
Impact: owner instructions and six-field configuration proposal only; no remote protection, approval count or workflow is changed.
Refs: U5; policy/platform-admission.md; .task/feature-merge-queue-policy-draft.md
Why: agents need consistent entrypoints and recording defaults to avoid retrying synchronization and CI outside the final delivery window.
Evidence: SELF generated-task-card red-green regression and governance suite recorded through make evidence; pending shared record created as Issue #518.
Impact: rules, task template and capability matrix stay explicit about pending activation, default strict startup, manual coordination and unchanged CI triggers.
Refs: U4; policy/merge-queue.md; .task/feature-merge-queue-policy-draft.md
Why: recording checks in a frozen task card can change the candidate and invalidate current-head CI.
Evidence: SELF fixed-candidate capture regression and all 33 evidence tests passed; actual output and object digests are preserved by make evidence.
Impact: document preparation, external receipts and post-phase import using existing schema 1; no filesystem freeze or trust upgrade is introduced.
Refs: U3; policy/governance.md; .task/feature-merge-queue-policy-draft.md
Why: preserve the user's continuation from the delivered r1 specification into a concrete implementation and verification plan.
Evidence: precheck and plan source/link/example checks are preserved as SELF receipts in the task card; code, CI and platform trials remain NOT_RUN.
Impact: approval metadata, plan association and project entry only; the delivery mode remains unchanged and the plan awaits stage 5 review.
Refs: policy/merge-queue.md; .task/feature-merge-queue-policy-draft.md; Documents docs/proposals/2026-10-13-merge-queue-implementation-plan.md
Why: prepare a reviewable delivery window and migration contract that reduces repeated synchronization while preserving final CI and approval requirements.
Evidence: SELF precheck, document checks and read-only platform observations are preserved in .task/feature-merge-queue-policy-draft.md; runtime queue and platform trials remain NOT_RUN.
Impact: proposed policy, project entry and task record only; scripts, workflow, platform protection and guideline gitlink are not changed by this draft.
Refs: policy/merge-queue.md; .task/feature-merge-queue-policy-draft.md
Why: avoid general manual-stage wording overriding stages eight and nine.
Evidence: SELF document and link checks captured in the task card; existing governance checks cover unchanged script and test content.
Impact: clarify two policy sentences and record review-node synchronization; no mechanism or component change.
Refs: .task/feature-agent-pr-merge.md; policy/delivery.md
Why: make the agent responsible for merging reviewed PRs without another human merge step.
Evidence: SELF governance and generated-card checks are captured in .task/feature-agent-pr-merge.md; CI remains required on the final PR HEAD.
Impact: update project delivery policy, agent entry points, task metadata and closure guidance; preserve platform protection and scoped authorization.
Refs: .task/feature-agent-pr-merge.md; user instruction on 2026-10-12
Why: U5 injects the S3-compatible blobstore from the app composition root (env-driven, local fallback) - a legitimate dependency recorded in the baseline.
Evidence: lint-boundaries green after the update.
Impact: baseline bookkeeping only.
Refs: backend PR #157.
Why: backend PR #143 added surfacesvc with app/server/store edges already merged into component main; the Dev baseline must record them (lint failed after task-sync). runmgr->cmdbus no longer exists in code.
Evidence: lint-boundaries.sh green after the update; edges match the merged backend main exactly.
Impact: baseline bookkeeping only; no dependency change made by this task.
Refs: backend PR #143; Dev U4 task.
Why: Backend #114 (EXT-14, commands-as-tools) added the runmgr -> cmdbus
production import but its Dev-side ratchet update went missing, so make test
fails on any Dev head combining it (backend CI does not run the Dev
architecture check). Recorded here with the merge that surfaces it.
Evidence: SELF - lint-boundaries passes after the entry; the edge exists in
backend main (internal/runmgr/runmgr.go imports cmdbus).
Impact: Ratchet baseline only; unblocks the Dev combination for all in-flight
work.
Why: The 2026-10-09 diagnosis showed behavior-surface regressions (gate
deadlocks, silently broken lint, wrong artifact verdicts) passing every unit
test because no task-level check ran the real model. User ruling 6 approved
making before/after live-eval evidence a delivery requirement for prompt,
skill, tool-description, context-assembly and gate changes.
Evidence: SELF - clause drafted to reference modules/backend/eval/live and the
GATE/REPLAY/SELF sourcing already defined in AGENTS.md; task card for
feature/agent-quality-phase01 filled with the P0+P1 scope and requirements.
Impact: policy/delivery.md gains the 智能体行为面的真实验证 subsection;
NOT_RUN stays legal but must be explicit. Phase01 task card records scope,
requirements R1-R4 and the before/after eval protocol.
Refs: modules/documents proposal 2026-10-09-agent-quality-improvement-plan.md (ruling 6).
Why: Q3 WP1/WP2 moved workflow execution out of runtime (workflow_script.go
deleted, so runtime no longer imports internal/tools) into the new
internal/wfcompile package, which legitimately depends on internal/tools
(script host) and internal/workflow (render/validate/Launch data layer).
Evidence: make test-boundaries green after the baseline update (77 edges,
negative test ok); the lint itself flagged both the stale edge and the new
ones (SELF).
Impact: baseline -1 edge (backend/runtime backend/tools), +3 edges
(backend/runtime backend/wfcompile, backend/wfcompile backend/tools,
backend/wfcompile backend/workflow).
Refs: Q3 plan WP1/WP2; task card .task/feature-agent-stack-q3.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=eb0d4b5a499322a23155c8d89a024247f6e7830d.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Backend#89 merged the plugin/bundled skill validation; Native#28
and Squad#32 carried the validator; Dev pins, the plugins→skills edge,
and the increment record follow.
Evidence: check-pins pins ok; WP4 chain CI green on every merge head;
TestV2InvalidSkillRejected GATE on backend main b44f78b0.
Impact: skills now validated against the open Agent Skills spec.
Refs: Agent-Native#28, Agent-Squad#32, Agent-System-Backend#89
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=878e0e7ceba3bb6b78c36c5113eacc846a7f017b.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: backend #83 merged the slow-lane wiring (intentsem scorer/
generator, gate SetSemantic/SetGenerator, settings flags default off);
the Dev pins and boundary rules must move with it.
Evidence: backend CI green on 9d29371; check-pins consistent
(agent-intent 343b1e6 across Dev and the backend nested copy);
lint-boundaries registers intentsem as an agent-intent adapter and the
architecture baseline gains backend/app->backend/intentsem.
Impact: product behavior unchanged by default; the two
runtime.intent* flags opt into the slow lane.
Refs: Agent-System-Backend#83, I2 increment 3
Why: The dependency ratchet blocks new edges by default; the unique
router's four edges (route->intentgate, runmgr->intentgate,
runmgr->route, server->route) are the I1 router's intended shape.
Evidence: lint-architecture.sh ok (73 edges) and negative probe ok.
Impact: Policy baseline only.
Why: preserve project direction across tasks and require grounded next-task recommendations.
Evidence: the generated task-card regression fails before the template update and passes afterward; original SELF receipts are in the task card.
Impact: document the planning entrypoint and extend task records without granting new-task execution rights.
Refs: .task/feature-goal-continuity.md; policy/delivery.md
agent-exec-transport
weichen