Why: account creation, password changes, and bootstrap currently commit in separate steps and do not write an audit row. The spec fixes the transaction, audit, and open-existing boundaries before code changes.
Evidence: SELF precheck receipt already imported at task-start. No runtime test in this commit.
Impact: task card and spec only. Backend behavior is unchanged.
Refs: docs/svc-deploy/u7-account-tx-audit.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-u7-account-tx-audit.md; R0=4d362537d0e8755a03b1757b5bad92779a064b33.
Impact: task metadata only; the feature workspace starts at 4d362537d0.
Refs: .task/feature-u7-account-tx-audit.md
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-svc-u2-release-recovery.md(PR#480) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=3b9cf82cd6fb53f973f26e2039275f7858b0c654.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: deploy overwrote live artifacts after stopping the old service, so
a failed start or workbench check left instances in a mixed
registration-vs-artifact state with no recovery path (2026-10-12
rdm1/rdmcand); the report's U2 requires restorable updates.
Evidence: make test-governance 250 OK; five svc suites 105 OK (rows in
the task card); new tests cover layout/pidcheck stability, rollback on
start failure with desired-state restore, build failure keeping the old
service running, interrupted-switch journal resolution, and schema-
advance blocking rollback without touching the database.
Impact: agent deploys stage immutable releases/<id>/ and switch the
current symlink atomically; deploy.journal persists the switch and is
resolved at start/restart/deploy/update/recover entries; legacy layouts
are adopted on first deploy and remain readable; release/rdm tracks
verify sha256 before staging.
Refs: .task/feature-svc-u2-release-recovery.md; user goal directive
2026-10-12; Dev #474 (U1 gate); Documents unified-deploy plan r2.
Why: keep original closure and synchronization evidence after moving the completed card.
Evidence: existing evidence.py read_receipt and append_card validated/imported original SELF receipts; initial scope refusal retained.
Impact: archived task record only; no policy or component change.
Refs: PR #476; PR #479
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=6ba91239e680ef240625dc1e86232c48c4221716.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-agent-pr-merge.md(PR#476) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: include the newly integrated backend identity CLI before testing the combination.
Evidence: SELF task-sync and ancestor verification receipts in the task card; final HEAD CI is required.
Impact: task metadata only; reviewed normative files are unchanged.
Refs: .task/feature-agent-pr-merge.md; PR #476
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-svc-u2-release-recovery.md; R0=9b5be3926eaa394a9e520fd72ffdf6d0a48d1aef.
Impact: task metadata only; the feature workspace starts at 9b5be3926e.
Refs: .task/feature-svc-u2-release-recovery.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=9b5be3926eaa394a9e520fd72ffdf6d0a48d1aef.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-pin-backend-identity-cli.md(PR#477) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: include the newly merged service identity baseline before final CI.
Evidence: SELF task-sync, ancestor check, generator replay and document-link receipts in the task card.
Impact: task metadata only; all reviewed policy and generator content is unchanged.
Refs: .task/feature-agent-pr-merge.md; PR #476
Why: Backend #180 moved the identity CLI to pkg/identity (shared with
Agent-System-RDM per PR 276); Dev main should consume it so composed
binaries carry the same identity semantics and capabilities output.
Evidence: make test exit 0 (combined suite on the bumped pin);
make test-pins ok; rows in the task card.
Impact: gitlink only (bbe9773 -> acabb85, spans #177/#179/#180).
Refs: .task/feature-pin-backend-identity-cli.md; user goal directive
2026-10-12 (implement remaining U1/U2/U3 items in order).
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=6a494d3977e6557e7bebe0e5bb1c4a12091296e0.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: preserve the actual main PR and independently reviewed object before final CI.
Evidence: completed review and authoritative synchronization receipts in the task card; CI must bind the new HEAD.
Impact: task metadata only; no normative or component change.
Refs: https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/476
Why: bind delivery to the completed review and the user authorized cleanup endpoint.
Evidence: independent review run 20261012-123744-f14f6caa and raw records are captured in the task card; final PR CI is still required.
Impact: task metadata only; all eight reviewed policy and generator files remain unchanged.
Refs: .task/feature-agent-pr-merge.md
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-pin-backend-identity-cli.md; R0=6a494d3977e6557e7bebe0e5bb1c4a12091296e0.
Impact: task metadata only; the feature workspace starts at 6a494d3977.
Refs: .task/feature-pin-backend-identity-cli.md
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-svc-identity-u1.md(PR#474) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=8ebf5021468a1301ccbe2fe0568508e16d8bb708.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: batch update leaked AGENT_SYSTEM_INSTANCE_ID/DBREF from one service
to the next, and RDM artifacts without the identity CLI were stopped and
overwritten before their startup identity refusal surfaced, leaving
rdm1/rdmcand in a mixed registration-vs-artifact state (2026-10-12).
Evidence: make test-governance 217 OK; tests.test_svc_identity and
tests.test_svc_precheck green; rows recorded in the task card.
Impact: env_config resets identity env per service; capability probe is
timeout-guarded and rejects serve-shaped output; identity ensure moves
to adoption/init (bare start is verify-only); deploy builds and gates
candidates before stopping the old service (refuses identityless
candidates, completes missing identity rows via the candidate); update
runs svc_manifest_migrate like every other lifecycle entry.
Refs: .task/feature-svc-identity-u1.md; user root-cause report 2026-10-12.
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=8ebf5021468a1301ccbe2fe0568508e16d8bb708.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: retain the synchronization against the advancing authoritative target.
Evidence: SELF task-sync receipt in .task/feature-agent-pr-merge.md; CI on the final synchronized candidate remains pending.
Impact: task metadata only.
Refs: .task/feature-agent-pr-merge.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=6a44736f03f08428e68861f923b18ca645043efe.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-pin-backend-read-consumption.md(PR#470) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: avoid general manual-stage wording overriding stages eight and nine.
Evidence: SELF document and link checks captured in the task card; existing governance checks cover unchanged script and test content.
Impact: clarify two policy sentences and record review-node synchronization; no mechanism or component change.
Refs: .task/feature-agent-pr-merge.md; policy/delivery.md
weichenandCursor