Why: the job runs the full backend suite against real services; internal/runtime lint tests require python-docx (job 2290: ModuleNotFoundError 'docx') which the plain test job already installs.
Evidence: job 2290 log; all PG/Redis-dependent packages green in the same run (store 2.6s, pgbus, runmgr, ratelimit, server).
Impact: test-pg job setup only.
Refs: Dev PR #325.
Why: the runner-container guard had a doubled '[[' from a string replacement (exit '[: too many arguments'), and pgvector's extension is named 'vector' (control file vector.control) - CREATE EXTENSION pgvector failed with 'extension not available' (jobs 2285/2286 logs).
Evidence: job 2286 log 'ERROR: extension pgvector is not available ... pgvector.control: No such file'; package postgresql-16-pgvector 0.6.0 installed fine.
Impact: test-pg job only; repins backend to the #138 merge (30s SQLite busy timeout for serialized migrators).
Refs: backend PR #138; Dev PR #325.
Why: the runner container executes as root without sudo; the previous $SUDO -u postgres expanded to a bare '-u' and failed with exit 127 on the first test-pg run (job 2280 log).
Evidence: job 2280 log lines '/var/run/act/workflow/3: line 6: -u: command not found', exitcode 127; postgresql service itself started fine as root.
Impact: test-pg job setup steps only; also prints pinned pgvector/pg_trgm extension versions for acceptance records.
Refs: PR #325; docs/guides/team-storage.md section 5.
Why: the approved collaboration plan U2 requires CI to run the backend suite against real PostgreSQL+pgvector and Redis and fail when the services are missing, instead of silently skipping the tier.
Evidence: local gate green twice against PostgreSQL 18.6+pgvector and Redis 8.10.2 (isolated svc.sh instance); the target fails fast when AGENT_PG_TEST_DSN/AGENT_REDIS_TEST_ADDR are unset.
Impact: new make target test-backend-pg (env-guarded) and a required test-pg job (apt postgresql-16-pgvector + redis-server, ephemeral per-run services); existing test job unchanged.
Refs: proposals/2026-10-11-collaboration-storage-and-distribution.md U2; docs/guides/team-storage.md section 5.
Why: cleanup, component synchronization, receipt recording and credential handling could contradict the documented development boundaries.
Evidence: SELF 75 isolated governance tests and source checks are captured in .task/feature-governance-reliability.md; combination and CI verification follow.
Impact: hardens local task and CI tooling, aligns policy and component documentation, and adds continuous regression tests without changing product behavior.
Refs: .task/feature-governance-reliability.md; policy/governance.md; policy/platform-admission.md
Why: lint.py imports python-pptx and openpyxl at import time, so installing only python-docx still skipped the layout finding.
Evidence: actions run 680 failed TestLintErrorContinues with lint reason missing after python-docx was present.
Impact: CI installs python-docx, python-pptx, and openpyxl from the Tsinghua index.
Refs: feature/agent-stack-r0-r1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The runner image has Python but not python-docx, so TestLintErrorContinues failed after checkout succeeded.
Evidence: Agent-System-Dev actions job 1012 reported ModuleNotFoundError: No module named docx.
Impact: The package comes from the Tsinghua PyPI mirror. Library CI still stops until SUBMODULE_TOKEN is set.
Refs: feature/agent-stack-r0-r1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The runner cannot reach github.com, so actions/checkout and setup-node would time out before make test.
Evidence: Go 1.27.1 comes from mirrors.aliyun.com and Node 22.23.3 from npmmirror. Checkout uses the job token and GITHUB_SHA.
Impact: Submodule checkout still requires SUBMODULE_TOKEN. A missing secret fails the job with that message.
Refs: feature/agent-stack-r0-r1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: make test downloads Go modules, and the runner cannot reach proxy.golang.org.
Evidence: The test job sets GOPROXY=https://goproxy.cn,direct. The step name lists boundaries, pins, libs, core, backend, frontend, ui, and agent-command.
Impact: npm still uses the default registry; add the npmmirror only if npm ci times out.
Refs: feature/agent-stack-r0-r1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the job token only authorizes the event repository; sibling private
submodules (Development-Guidelines et al.) returned 404 on the first run.
Evidence: run 194 log — clone of deps/development-guidelines failed with
repository not found despite the insteadOf rewrite.
Impact: ci.yaml reads secrets.SUBMODULE_TOKEN (stored via API, never in
tree or chat); no other change.
Refs: run 194; PR#11
Why: PR test evidence depended on the agent's word (single point); the
running binary could not answer what combination it was built from; and
irreversible operations lacked an explicit agent-stops-here boundary.
Evidence: Gitea runner online (home-runner, ubuntu-latest+docker); make
version prints describe+component SHAs; two-key line maps to baseline hard
boundary 1. CI first run observed on this PR before merge (see Actions tab).
Impact: .gitea/workflows/ci.yaml runs make test + make build on PR/push;
Makefile injects main.version (make version / agent-system version);
AGENTS.md and adoption register the two-key rule. No product code change.
Refs: policy/adoption.md; release-operations requirements
weichen
