Why: Frontend PR #49 merged; the pin must point at component main so the
merged content is actually contained (branch-head pins drop unmerged diff).
Evidence: vitest 85/85 and browser replay recorded earlier cover the branch
head; make test rerun on this pin before the Dev PR.
Impact: modules/frontend gitlink 84b73ab -> 339a9eb.
Refs: Frontend PR #49; task card feature/empty-state-preview-fix.
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=bf2a8f073079eb6b49910142151345e87da03ae1.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: the frontend fix branch carries the preview key unification, orphan-tab
adoption, conversation restore, and missing-artifact toast; the Dev gitlink
records the tested head ahead of the Frontend PR merge.
Evidence: vitest 85/85; fresh-profile browser replay in the task card.
Impact: modules/frontend gitlink 84b73ab -> 475fd3a only.
Refs: Frontend PR #49; task card feature/empty-state-preview-fix.
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-empty-state-preview-fix.md; R0=d53efd5f14bb339dfe908c5d8850ed0eedec024e.
Impact: task metadata only; the feature workspace starts at d53efd5f14.
Refs: .task/feature-empty-state-preview-fix.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=d53efd5f14bb339dfe908c5d8850ed0eedec024e.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: The proposal 2026-10-10-agent-delegation-routing-sandbox.md merged
into Documents main (#53) and needs a Dev-side pin plus its task card so
the research, the F1-F5 defect findings, and the E1-E5/S0 increment plan
have a tracked record with evidence receipts.
Evidence: Task card feature-agent-exec-routing-sandbox-plan carries five
SELF receipts (sandbox latency benchmarks, model-endpoint probes) and the
make-test/task-sync runs are appended before the PR; Documents #53 merged
at 0f6d697.
Impact: Gitlink-only bump for modules/documents (3e43193 -> 0f6d697) plus
the task card; no product code changes.
Refs: Documents PR #53; proposals/2026-10-10-agent-delegation-routing-sandbox.md.
Why: Backend #125 (background subagent inbox card lifecycle, delegate/base-method
dual-speed guidance, #background mock demo) merged into component main; the Dev
gitlink must move to the merged head for the combo to build with it.
Evidence: Backend PR #125 CI green (ci/vet-and-test on 43087a7); Dev-level make
test to be rerun on the committed pin (previous run failed only the drift check
that expects exactly this commit).
Impact: modules/backend gitlink 421fee8 -> d2bb936; no other component moves.
Refs: Backend PR #125; task card feature/dual-speed-tasks.
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-agent-exec-routing-sandbox-plan.md; R0=890b9b2bf2e9b356351d373a21f358ea04ca958b.
Impact: task metadata only; the feature workspace starts at 890b9b2bf2.
Refs: .task/feature-agent-exec-routing-sandbox-plan.md
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-dual-speed-tasks.md; R0=890b9b2bf2e9b356351d373a21f358ea04ca958b.
Impact: task metadata only; the feature workspace starts at 890b9b2bf2.
Refs: .task/feature-dual-speed-tasks.md
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-v030-backend-pin.md(PR#299) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: the Dev pin sat at e03d3ac while backend main moved to 421fee8
(#124: pluginRegistry now fills the shared EXT-8 authz slot instead of
rejecting in-proc registrations — the fix that restored rdm.* command
availability in the served RDM process). The umbrella must carry it
before v0.3.0 is tagged so the release combination includes the fix.
Evidence: Backend #124 head 72b2098 CI success, merged as 421fee8;
RDM consumed it as pins 421fee8 in RDM #173 with the full MS1
re-acceptance green. Umbrella make test follows via evidence.
Impact: umbrella gitlink only.
Refs: Backend #124; RDM #173; plan G1-8.
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-v030-backend-pin.md; R0=0d84792d678f7aeafefb52cf47b834be3e4e9011.
Impact: task metadata only; the feature workspace starts at 0d84792d67.
Refs: .task/feature-v030-backend-pin.md
Why: The model A/B branch merged into main via #296 (the final item of the
quality improvement plan); its task card must be backfilled and archived to
prevent bookkeeping debt.
Evidence: SELF - merge 63a2485 verified via git log --merges against
origin/main; card backfilled with the PR link.
Impact: .task/feature-agent-model-ab.md moved to .task/archive/ with status
backfilled; no code or submodule change.
Refs: task.sh close semantics (replicated from a temp worktree because the
main checkout is occupied by a parallel writer's branch).
Why: the plan section 3.4 observed the local dev service carrying the
credential-bearing DSN as a serve --dsn argument, visible to any
process on the host (ps / /proc/<pid>/cmdline) — including scripts
generated by agents. The base config layer already supports
AGENT_SYSTEM_DSN, so the launcher can move the secret out of the
argument vector without touching the binary.
Evidence: bash -n clean; make test-governance 104/104 green; an
end-to-end probe with a stub binary and a legacy exec= carrying
--dsn ...secret... shows the migration stripping the flag
(MIGRATED:yes), the process args free of the secret
(NO-LEAK-IN-CMDLINE), and AGENT_SYSTEM_DSN present in the process
environment (DSN_IN_ENV:yes). New/rebuilt launches never put the DSN
in argv; legacy persisted configs are migrated on first reuse.
Impact: scripts/svc.sh only — rebuild path sets DSN_ENV instead of
--dsn, reuse path strips --dsn from stored exec= once and logs the
migration, launch injects AGENT_SYSTEM_DSN alongside the existing
guard vars. CLI --dsn still wins inside the binary (config
precedence), so manual invocations are unchanged.
Refs: plan G1-7 (line 356) and section 3.4 (2026-10-09 ps
observation); backend config AGENT_SYSTEM_DSN.
Why: Ruling 5's final item. With the user-provided lmuai endpoint
(claude-opus-5-5) and the P5 build unchanged, the same golden task set ran
both sides to completion (6/6 turns each).
Evidence: SELF - B report .task/model-ab/ab-opus.json (2793s) vs A baseline
.task/phase05-eval/after-p5.json; smoke through the live instance confirmed
the provider switch (after fixing the active-secret shadowing: overlayKey
prefers the secret table, so provider changes need /api/secrets rotation).
Impact: Selection report in the card - opus-5-5 eliminates invented numbers
(7 -> 0, the program's core metric), restores independent verification via
lightweight=deepseek-v4-flash; MiniMax stays as the fast/fallback tier.
Recommended default documented for the owner.
Why: A small max_tokens probe passed (small pre-deduction), suggesting the
account might have been topped up; redeploying with chat=claude-sonnet-4-6
and lightweight=deepseek-v4-flash showed full-turn pre-deduction (CNY 0.62)
still exceeds the CNY 0.48 balance - 6/6 turns quota-failed again.
Evidence: SELF - .task/model-ab/ab-sonnet-quota-blocked-r2.json + evidence
row; settings confirmed chat=claude-sonnet-4-6, lightweight=deepseek-v4-flash
on the instance before the run.
Impact: Still blocked on user-only payment input. Estimated CNY 50-100 covers
multiple full comparison runs on dmxapi; alternatively any OpenAI-compatible
provider key via ~/.secrets/abmodel or .env.dev SVC_MODEL_*.
Why: Ruling 5 authorized the strong-model comparison with uncapped budget.
The A/B infrastructure is proven end to end (qa7 on remote main, seeded
claude-sonnet-4-6 via the user's existing dmxapi aggregator key, eval/live
ran the full golden set), but the account holds CNY 0.49 against a CNY 0.62
per-request pre-deduction - all six turns failed with insufficient quota,
captured honestly in the report.
Evidence: SELF - .task/model-ab/ab-sonnet-quota-blocked.json + evidence row;
smoke test of the dmxapi streaming endpoint succeeded before the run.
Impact: Task blocked on user input only (top up dmxapi or provide another
provider key). No code changes; worktree retained for immediate resumption.
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-agent-model-ab.md; R0=43f8e27b74e5e2213e2099ba04e5a69fe398586f.
Impact: task metadata only; the feature workspace starts at 43f8e27b74.
Refs: .task/feature-agent-model-ab.md
weichen