Why: user approved the four design documents and authorized implementation
(/goal); the plan's section-7 tradeoffs gate the I1 public DTO and had to be
frozen before any implementation unit starts. A read-only audit of the RDM
backend (Agent-System-RDM main 5df66106) supplied the source facts.
Evidence: audit findings recorded in rollout section 7 (tree is doc->section
only, no confidence field, no persisted conflict entity, per-project event seq
complete); review fixes folded into the read-model contract (statReasons,
structuralGap, AssertionSummary); precheck receipt READY imported via
task-resume.
Impact: unlocks I1 implementation in the RDM repo; design deliverable ready
for PR/CI/merge; no business code, pins, database or deployment touched.
Refs: .task/feature-document-visualization-plan.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=dc86a023605d00fccca1b9679b4cdad96373bdee.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Settings plaintext loses to secret_keys, so replacing the env key did not change the key a conversation actually sent.
Evidence: python3 -m unittest tests.test_svc.SvcDbRecoveryTests.test_seed_replaces_old_system_secret tests.test_svc.SvcDbRecoveryTests.test_seed_warns_when_old_secret_stays_active tests.test_svc.SvcDbRecoveryTests.test_seed_puts_without_credentials_when_auth_off (SELF).
Impact: Embedded databases now compare the active system secret fingerprint after seeding, and the backend gitlink carries the adoption fix.
Refs: fix/model-key-secret-overlay
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=919f75cf7b39ca357e212a08a0ba5ba3d9a79b51.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=692735e91d6a9ab07ddd3686feb60a56b270728a.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The dev service is an rdm build, so startup skipped model seeding and kept the old MiniMax chat model. Later starts need the saved env file applied even without an admin key command.
Evidence: seed and rdm launcher tests passed. The live dev database now uses the four-model chat route and keeps the original MiniMax endpoint as reserve.
Impact: Restart of a service with envfile set rewrites system model settings. HTTP seeding is unchanged for builds that can mint an admin key. MiniMax is stored separately because fallbacks cannot switch gateways.
Refs: .task/feature-four-model-vision.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Turn the approved multi-CLI routing design into independently testable Cursor implementation units without another manual plan gate.
Evidence: The plan self-review found R1-R10 coverage, stable interfaces, five review-focus tests, and no placeholders or whitespace errors.
Impact: Authorizes U1-U5 execution through fresh Cursor Agent runs while the host retains scope, verification, integration, and delivery control.
Refs: docs/superpowers/specs/2026-10-15-project-agent-execution-design.md
Why: Let each project route expensive implementation work across available Agent CLIs while the host model retains planning and delivery control.
Evidence: The specification passed placeholder, consistency, scope, path, and whitespace self-checks; implementation and runtime validation remain NOT_RUN.
Impact: Defines a review-only R1-R10 design for Markdown configuration, adapters, run-everything execution, receipts, recovery, and host fallback without enabling the new route.
Refs: .task/feature-goal-first-delivery.md
Why: Chat, lightweight, fallback and vision settings need a seed path, and the backend now sends current-turn images only to models declared capable of seeing them.
Evidence: The backend change is cfde38d. The seed test covers fallback and vision settings. A local image conversation on each builtin profile returned the pictured content from the expected model, and removing the chat model from the capable list switched that turn to the vision model.
Impact: New runs can use the four builtin profiles and image input. Secrets stay in the ignored env file. The live 8788 process is unchanged.
Refs: .task/feature-four-model-vision.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: deploy needs to choose registered plugins and ship them inside one agent-system, then refuse the release when they are not active.
Evidence: python3 -m unittest tests.test_svc_plugins tests.test_svc_user_help tests.test_svc tests.test_svc_u2 (SELF, 63 passed, 1 skipped). Real compose build and make test-lifecycle are NOT_RUN.
Impact: --with is mutually exclusive with --from rdm and --from release. Existing non-interactive deploys stay without plugins unless plugins= is already recorded. Changing the plugin id set on a live service requires --allow-source-switch.
Refs: .task/feature-svc-plugin-compose.md modules/documents/docs/proposals/2026-10-14-svc-plugin-compose-deploy.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The account task needs the actual synchronized combination and raw local checks before freezing its final Dev candidate; two spec lines overstated identity and test behavior.
Evidence: SELF make test, isolated PostgreSQL and Redis backend tests, make build, and task-sync receipts are imported; Backend #185 has independent REPLAY and exact-head GATE.
Impact: Keep current component pins, clarify read-only identity verification and test coverage, and prepare the Dev PR for final exact-head admission.
Refs: Dev #486; Backend #185; merge queue #518
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=d852c159b6b3387a2f418a42ab6d3696ac873d01.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: The login recovery contract reserved the owner browser login step
for the user (passwords never pass through the agent); the user
confirmed the test passed on 2026-10-13, closing the final acceptance
loop.
Evidence: User session confirmation 2026-10-13; deploy and prior
verifiable acceptance under receipt 5396054b.
Impact: Doc-only status update in the leftover section.
Refs: docs/svc-deploy/2026-10-13-login-recovery-contract.md.
Why: The remaining open items (API-key SSE closure, cross-instance
redeem backoff, U7 atomic bootstrap/create, CLI credential delivery)
landed in Backend #192; Dev pins it and closes the contract leftovers.
Evidence: Backend #192 CI success at head bc1e0a3 (GATE); composite CI
on this PR re-runs the suite incl. test-pg (GATE).
Impact: backend pin cfb8308; contract leftover section now records all
items closed; task card H1-H6 requirement table.
Refs: Backend #192; docs/svc-deploy/2026-10-13-login-recovery-contract.md.
Why: The completion audit flagged four gaps over the merged login
recovery implementation: real-browser acceptance, the login-key e2e
spec, SSE stream invalidation, and the Documents write-back.
Evidence: Browser acceptance receipts be7ae9a2/b3a9e691 (SELF, bound to
Dev HEAD 268ef29); Backend #189 CI success at head 8b73afe (GATE);
Documents #94 merged; this PR's composite CI is the GATE for frontend
pin 44b9646.
Impact: Pins backend=349a47d (SSE close) and frontend=44b9646 (e2e
spec); contract doc leftovers updated; task card carries the follow-up
record for closure.
Refs: docs/svc-deploy/2026-10-13-login-recovery-contract.md; Documents
proposal r3; Backend #189; Frontend #77.
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=268ef2999ca2ff3481c6bebd588cae51d6b90709.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: The 2026-10-13 login flow plan requires a frozen contract record
(three adjudications against the r2 proposal) and a traceable task card
before implementation merges.
Evidence: doc-only commit; acceptance matrix cites backend/frontend test
files added in companion commits (SELF).
Impact: docs/svc-deploy/2026-10-13-login-recovery-contract.md becomes
the authoritative login-recovery contract; task card records user
authorization and requirement table L1-L9.
Refs: modules/documents/docs/proposals/2026-10-12-svc-unified-deploy-and-login-key.md r2
Why: Second-instance writes stay closed until an independent replay or an admitted CI gate, plus a second host. Those remaining steps needed a durable spec.
Evidence: Task-card evidence rows read the merged PRs, tree equality, CI runs 2783/2810/2816, and Dev main branch protection. Source SELF. Drills were not run.
Impact: Docs and the task card only. Checklist grades stay SELF or not started. The collaboration proposal body stays r2.3.
Refs: docs/release-multi-instance.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Dev has to follow the commits that landed on Backend and Documents main, which share trees with the drilled objects.
Evidence: Backend dc736e339d01 tree 498f61947564 equals 46073d30. Documents 05c13a42b14d tree equals 5335499. GATE run 2794 on 6d8b746 succeeded before this pin.
Impact: gitlinks move to the merge commits. Second-instance writes stay closed.
Refs: #186#92#497
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the restored drill passed artifact recovery, and the handbook, checklist, and collaboration plan have to say so without opening write traffic.
Evidence: backup-20261013-013354 on Dev a83588dd and backend 46073d30; K1-K7 true, RPO 65s, RTO 3s, five artifacts matched, cross-user access 404. SELF. Documents 5335499 is PR #92.
Impact: C5 is marked SELF-pass. Second-instance writes stay closed until REPLAY or CI and a second host exist.
Refs: docs/svc.md docs/release-multi-instance.md modules/documents
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The measured backup, PITR, and disconnect steps were only in the drill scripts, and the checklist still said those rows were not run.
Evidence: Results pgbench-20261012-131948, fault-20261012-142734, and backup-20261012-153441 (SELF). K4 stays failed.
Impact: Second-instance write traffic stays closed. The handbook records the upload panic and the short socket path.
Refs: feature/u7-ops-drills
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the integration tree has to carry the single-transaction account changes, and operators need to see that --dsn and --password still work while warning.
Evidence: Backend 545a75b. SELF store tests named in that branch. PostgreSQL, cross-process, and SIGKILL password checks are NOT_RUN locally.
Impact: Dev gitlink moves to 545a75b. scripts/svc.sh is unchanged and can keep passing --dsn and --password.
Refs: docs/svc-deploy/u7-account-tx-audit.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: account creation, password changes, and bootstrap currently commit in separate steps and do not write an audit row. The spec fixes the transaction, audit, and open-existing boundaries before code changes.
Evidence: SELF precheck receipt already imported at task-start. No runtime test in this commit.
Impact: task card and spec only. Backend behavior is unchanged.
Refs: docs/svc-deploy/u7-account-tx-audit.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=b4b042630a352eca2a399a7a64931c74978bca7f.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: make the six instance-bound user commands discoverable (T5-1) and pin Documents r2/r3.
Evidence: python3 -m unittest tests.test_svc_user_help; existing test_svc_user_binding still green.
Impact: scripts/svc.sh help accounts|user; docs/svc.md topic list; documents gitlink to plan branch tip.
Refs: Documents #87; feature/svc-account-durability-plan
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=b4b042630a352eca2a399a7a64931c74978bca7f.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: preserve current source and service snapshots before final verification.
Evidence: SELF task-sync and read-only runtime receipts in the task card.
Impact: planning metadata only; no runtime or account changes.
Refs: account r2; recovery r3
Why: preserve evidence, current contracts and the next review scope without changing the running system.
Evidence: SELF startup, sync and document validation receipts in the task card; runtime and fault acceptance NOT_RUN.
Impact: task metadata, planning index and account specifications only; component pins and business code unchanged.
Refs: feature/svc-account-durability-plan; Documents account r2 and recovery r3
Why: RDM agent deploy left workbench htdocs unserved (prompt-only), so
environments like dev silently offered API-only 404 pages after a source
switch; static first-start also misclassified http.server as dead when
pidcheck was unset.
Evidence: CMD="make test-governance" make evidence (200 ok, 1 skipped; SELF).
Impact: rdm deploy auto-starts <name>web and asserts UI 200; cross-kind
redeploy needs --allow-source-switch; list/info flag missing workbench.
Refs: .task/feature-svc-rdm-ui-gate.md; docs/svc.md §5.4
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: After capability gate hid 追溯审计 on plain base, the shared dev
entry needs a pinned RDM combo and a candidate-then-cutover runbook.
Evidence: RDM #250 (310c3fe) pins to Dev main; candidate+cutover R1–R5
SELF receipts imported; FE preview showed audit entry on :8788.
Impact: docs/svc.md §5.4.1; local runtime/dev is rdm@310c3fe (ops, not
in git). Owner password was reset via recover key during verification.
Refs: feature/rdm-audit-combo-integration; RDM pulls/250
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=673e687c5c85b9af3ce13ca30845d5e68de5dfa0.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=673e687c5c85b9af3ce13ca30845d5e68de5dfa0.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: #428 landed the same svc-deploy specs; U1 branch still had parallel copies causing add/add conflicts.
Evidence: U1 docs kept branch「已启动」; U4 docs took main (#428) versions
Impact: PR #429 should become mergeable.
Refs: Dev pulls/429; merged #428
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Backend #170 rebased; design doc still said v26.
Evidence: local unittest identity+backup OK after task-sync.
Impact: docs/recovery/u1-identity-manifest.md §5.2 version note.
Refs: Backend PR #170; Dev PR #426
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=b431777c9fa9c74f096d7f14fce40d1beba53fe2.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Dev #429 conflicted on scripts/svc.sh (U1 user vs main backup) and Backend gitlink.
Evidence: conflict hunks resolved; actions include init|user|backup|backups
Impact: PR #429 should become mergeable after push; both U1 binding and agent backup entrypoints preserved.
Refs: Dev pulls/429; main backup #417; Backend #171
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=b431777c9fa9c74f096d7f14fce40d1beba53fe2.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: task-sync hit a submodule conflict; pin must track Backend #170
HEAD after rebase onto main (copyOrder fix).
Evidence: backend 0c79618; origin/main merge completed in worktree.
Impact: modules/backend gitlink; sync with main.
Refs: Backend #170; Dev #426
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=ae465d24441ab349c961a55e9b04f8c4ccaf6de8.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=ae465d24441ab349c961a55e9b04f8c4ccaf6de8.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Backend #171 HEAD advanced with must_change e2e fix; keep Dev gitlink in sync and mark U4 specs started.
Evidence: Backend go test store/server/app green at 47463a9
Impact: Dev U4 branch tracks Backend PR #171 tip.
Refs: docs/svc-deploy/u4-one-time-login-key.md; Backend pulls/171
Co-authored-by: Cursor <cursoragent@cursor.com>
agent-exec-transport
weichen