Why: retain the approved status changes and current documentation while adopting the already approved manual delivery window after real platform validation.
Evidence: original startup, conflict resolution, combination test and writer inventory receipts are preserved in the task card; independent Doc89 and platform replay reports are referenced. Final candidate CI and review remain required.
Impact: publish the delivered Documents merge, manual trial policy and truthful capability state; keep all workflow triggers/checks and original task baseline unchanged.
Refs: Dev PR #489; Documents PR #89; Issue #518; approved merge queue implementation plan r1; user continuation authorization on 2026-10-14
Why: The user requires all merges to follow agent-run synchronization, review, current-head CI and platform admission.
Evidence: Existing delivery stages and owner-only protection boundary reviewed; exact current Gitea Chinese labels verified from runtime resources.
Impact: Strengthen the merge executor rule only; retain human stage reviews, owner protection actions and actual CI requirements.
Refs: User instruction; merge-queue implementation plan U4/U5; Dev PR #519; Issue #518
Why: The approved document dependencies have been reviewed and merged. Their actual immutable merge commits must be fixed before final host validation, while operational activation remains a separate gate.
Evidence: Independent document replay and verified PR merges are recorded in the task card. The staged host combination passed make test with actual merged child pointers; final commit build/CI remains pending and will be recorded outside source.
Impact: Advance only the two reviewed merged child pins, expose the real plan path, and record partial stage-seven approval and pending activation. Preserve current main components and existing admission/owner boundaries.
Refs: Guidelines PR #5 (2f5b198); Documents PR #96 (129cc35); Dev PR #519; implementation plan U4-U6; Issue #518
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=20e086e48b9cec7f300feba5342db7a0661a4d4e.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Shared project identity resolution is one private module used by app and server.
Evidence: Boundary scan passes 85 edges and its injected illegal-edge negative check; previous full run stopped at this documented boundary.
Impact: Add only app/server to projectscope and projectscope to store, without allowing transport/composition dependencies in the resolver.
Refs: system-project-membership proposal r1; feature/project-member-access
Why: Main advanced after the first fixed candidate passed CI, changing four component pins and invalidating final admission against the new target. Stage progress must also be referenced outside fixed source to avoid status-driven commits.
Evidence: Source-external original receipts preserve the previous clean local test/build, three successful CI jobs on 80f5e9a, detection of target advance, the refused transient lock and successful serial synchronization to 10d54d5. New combination verification and exact-head CI are pending.
Impact: Preserve the merged authoritative component versions; record the expired candidate honestly and replace a temporary stage-status sentence with its authoritative record pointers. No platform protection change or queue activation.
Refs: PR #519; main PR #513; implementation plan U1/U3/U4; Issue #518
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=10d54d5ffb3d3fa4a4ea256537b2439cef4cc7f3.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Preserve the exact implementation object, independent review findings, remediation evidence and remaining stage gates for the owner review.
Evidence: External task-sync and test-governance receipts measured clean candidate cca59c88dd before and after execution. Governance ran 340 tests: 322 passed and 18 environment-dependent skips. Local receipts remain SELF.
Impact: Task record and removal of one trailing policy blank line only; tested code and check definitions unchanged. No queue activation, platform protection change or real CI/trial claim.
Refs: .task/feature-merge-queue-policy-draft.md; Documents plan ba4044d U1-U6; independent review R1/R2; Issue #518
Why: A LOCAL_READY receipt must permit normal target advancement without accepting a rewind or divergent target history after its observation.
Evidence: Two disposable real Git regressions reproduced erroneous successful recovery before the guard; all 18 task recovery tests pass afterward. Raw SELF receipts are in the task card.
Impact: Reject abnormal target ancestry before receipt import; preserve normal local recovery and strict delivery defaults. Correct stale implementation-stage documentation without activating the queue.
Refs: Documents implementation plan ba4044d U2; independent review R1 and R2; .task/feature-merge-queue-policy-draft.md
Why: the observed main protection does not require status checks, so platform admission must be verified before activating the delivery queue.
Evidence: SELF read-only configuration and actual PR context names recorded in the task card; protection changes and negative-case replay remain NOT_RUN.
Impact: owner instructions and six-field configuration proposal only; no remote protection, approval count or workflow is changed.
Refs: U5; policy/platform-admission.md; .task/feature-merge-queue-policy-draft.md
Why: agents need consistent entrypoints and recording defaults to avoid retrying synchronization and CI outside the final delivery window.
Evidence: SELF generated-task-card red-green regression and governance suite recorded through make evidence; pending shared record created as Issue #518.
Impact: rules, task template and capability matrix stay explicit about pending activation, default strict startup, manual coordination and unchanged CI triggers.
Refs: U4; policy/merge-queue.md; .task/feature-merge-queue-policy-draft.md
Why: recording checks in a frozen task card can change the candidate and invalidate current-head CI.
Evidence: SELF fixed-candidate capture regression and all 33 evidence tests passed; actual output and object digests are preserved by make evidence.
Impact: document preparation, external receipts and post-phase import using existing schema 1; no filesystem freeze or trust upgrade is introduced.
Refs: U3; policy/governance.md; .task/feature-merge-queue-policy-draft.md
Why: preserve the user's continuation from the delivered r1 specification into a concrete implementation and verification plan.
Evidence: precheck and plan source/link/example checks are preserved as SELF receipts in the task card; code, CI and platform trials remain NOT_RUN.
Impact: approval metadata, plan association and project entry only; the delivery mode remains unchanged and the plan awaits stage 5 review.
Refs: policy/merge-queue.md; .task/feature-merge-queue-policy-draft.md; Documents docs/proposals/2026-10-13-merge-queue-implementation-plan.md
Why: prepare a reviewable delivery window and migration contract that reduces repeated synchronization while preserving final CI and approval requirements.
Evidence: SELF precheck, document checks and read-only platform observations are preserved in .task/feature-merge-queue-policy-draft.md; runtime queue and platform trials remain NOT_RUN.
Impact: proposed policy, project entry and task record only; scripts, workflow, platform protection and guideline gitlink are not changed by this draft.
Refs: policy/merge-queue.md; .task/feature-merge-queue-policy-draft.md
Why: avoid general manual-stage wording overriding stages eight and nine.
Evidence: SELF document and link checks captured in the task card; existing governance checks cover unchanged script and test content.
Impact: clarify two policy sentences and record review-node synchronization; no mechanism or component change.
Refs: .task/feature-agent-pr-merge.md; policy/delivery.md
Why: make the agent responsible for merging reviewed PRs without another human merge step.
Evidence: SELF governance and generated-card checks are captured in .task/feature-agent-pr-merge.md; CI remains required on the final PR HEAD.
Impact: update project delivery policy, agent entry points, task metadata and closure guidance; preserve platform protection and scoped authorization.
Refs: .task/feature-agent-pr-merge.md; user instruction on 2026-10-12
Why: U5 injects the S3-compatible blobstore from the app composition root (env-driven, local fallback) - a legitimate dependency recorded in the baseline.
Evidence: lint-boundaries green after the update.
Impact: baseline bookkeeping only.
Refs: backend PR #157.
Why: backend PR #143 added surfacesvc with app/server/store edges already merged into component main; the Dev baseline must record them (lint failed after task-sync). runmgr->cmdbus no longer exists in code.
Evidence: lint-boundaries.sh green after the update; edges match the merged backend main exactly.
Impact: baseline bookkeeping only; no dependency change made by this task.
Refs: backend PR #143; Dev U4 task.
Why: Backend #114 (EXT-14, commands-as-tools) added the runmgr -> cmdbus
production import but its Dev-side ratchet update went missing, so make test
fails on any Dev head combining it (backend CI does not run the Dev
architecture check). Recorded here with the merge that surfaces it.
Evidence: SELF - lint-boundaries passes after the entry; the edge exists in
backend main (internal/runmgr/runmgr.go imports cmdbus).
Impact: Ratchet baseline only; unblocks the Dev combination for all in-flight
work.
Why: The 2026-10-09 diagnosis showed behavior-surface regressions (gate
deadlocks, silently broken lint, wrong artifact verdicts) passing every unit
test because no task-level check ran the real model. User ruling 6 approved
making before/after live-eval evidence a delivery requirement for prompt,
skill, tool-description, context-assembly and gate changes.
Evidence: SELF - clause drafted to reference modules/backend/eval/live and the
GATE/REPLAY/SELF sourcing already defined in AGENTS.md; task card for
feature/agent-quality-phase01 filled with the P0+P1 scope and requirements.
Impact: policy/delivery.md gains the 智能体行为面的真实验证 subsection;
NOT_RUN stays legal but must be explicit. Phase01 task card records scope,
requirements R1-R4 and the before/after eval protocol.
Refs: modules/documents proposal 2026-10-09-agent-quality-improvement-plan.md (ruling 6).
Why: Q3 WP1/WP2 moved workflow execution out of runtime (workflow_script.go
deleted, so runtime no longer imports internal/tools) into the new
internal/wfcompile package, which legitimately depends on internal/tools
(script host) and internal/workflow (render/validate/Launch data layer).
Evidence: make test-boundaries green after the baseline update (77 edges,
negative test ok); the lint itself flagged both the stale edge and the new
ones (SELF).
Impact: baseline -1 edge (backend/runtime backend/tools), +3 edges
(backend/runtime backend/wfcompile, backend/wfcompile backend/tools,
backend/wfcompile backend/workflow).
Refs: Q3 plan WP1/WP2; task card .task/feature-agent-stack-q3.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=eb0d4b5a499322a23155c8d89a024247f6e7830d.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Backend#89 merged the plugin/bundled skill validation; Native#28
and Squad#32 carried the validator; Dev pins, the plugins→skills edge,
and the increment record follow.
Evidence: check-pins pins ok; WP4 chain CI green on every merge head;
TestV2InvalidSkillRejected GATE on backend main b44f78b0.
Impact: skills now validated against the open Agent Skills spec.
Refs: Agent-Native#28, Agent-Squad#32, Agent-System-Backend#89
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=878e0e7ceba3bb6b78c36c5113eacc846a7f017b.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: backend #83 merged the slow-lane wiring (intentsem scorer/
generator, gate SetSemantic/SetGenerator, settings flags default off);
the Dev pins and boundary rules must move with it.
Evidence: backend CI green on 9d29371; check-pins consistent
(agent-intent 343b1e6 across Dev and the backend nested copy);
lint-boundaries registers intentsem as an agent-intent adapter and the
architecture baseline gains backend/app->backend/intentsem.
Impact: product behavior unchanged by default; the two
runtime.intent* flags opt into the slow lane.
Refs: Agent-System-Backend#83, I2 increment 3
Why: The dependency ratchet blocks new edges by default; the unique
router's four edges (route->intentgate, runmgr->intentgate,
runmgr->route, server->route) are the I1 router's intended shape.
Evidence: lint-architecture.sh ok (73 edges) and negative probe ok.
Impact: Policy baseline only.
Why: preserve project direction across tasks and require grounded next-task recommendations.
Evidence: the generated task-card regression fails before the template update and passes afterward; original SELF receipts are in the task card.
Impact: document the planning entrypoint and extend task records without granting new-task execution rights.
Refs: .task/feature-goal-continuity.md; policy/delivery.md
Why: completion claims require tool-written evidence (AGENTS.md).
Evidence: SELF receipt appended by make evidence; full suite green incl. ui 103 tests and agent-command.
Impact: task metadata only.
Refs: .task/feature-ext-5-host-parse.md
Why: independent review found shared submodule metadata risk, quoted header leakage, stale JSON receipt blindness and missing abandon coverage.
Evidence: SELF 92 governance regressions pass; the original review receipt and replay output are recorded in the task card.
Impact: preserves external component worktrees, handles both evidence formats and adds targeted failure-path coverage; no product behavior changes.
Refs: .task/feature-governance-reliability.md; .task/reviews/governance-reliability.json
Why: cleanup, component synchronization, receipt recording and credential handling could contradict the documented development boundaries.
Evidence: SELF 75 isolated governance tests and source checks are captured in .task/feature-governance-reliability.md; combination and CI verification follow.
Impact: hardens local task and CI tooling, aligns policy and component documentation, and adds continuous regression tests without changing product behavior.
Refs: .task/feature-governance-reliability.md; policy/governance.md; policy/platform-admission.md
Why: facts-verify failed closed on first run — the real token file stores keys
as markdown bullets ("- ACCESS_TOKEN=..."), so the ^-anchored sed match in the
registry never fired; the earlier manual probe had used grep (anywhere-in-line)
and passed, which is exactly the drift the registry re-verification exists to
surface.
Evidence: re-run recorded in the task card — [facts-verify] total=4 pass=4
fail=0 (sha256 919401b838d77909), after fixing the sed pattern to
"^[ -]*ACCESS_TOKEN=".
Impact: policy/facts.md F2 command now matches the actual file shape and the
fact text documents the file format; no behavior change elsewhere.
Refs: task card evidence table (failed run sha256 6c61e644395042fa, then pass).
Why: declarations were passing as capability; hand-transcribed outputs flowed
through cards and PR bodies as if they were execution evidence, and stale
external facts (e.g. the dead git-panel host) kept being trusted until burned.
Evidence: guidelines draft.10 (PR Development-Guidelines#4, merged af199ee)
pinned here; policy/facts.md F1-F4 each re-verified on 2026-10-05 before
registration (endpoint version, token HTTP 200 via header only, SSH ls-remote,
dead-host negative probe); scripts syntax-checked (bash -n); tool self-tests
and make test recorded in the task card via the new make evidence.
Impact: new AGENTS.md section (SELF/REPLAY/GATE, tool-written evidence,
replay-on-review, zero-trust facts, honest-empty); make evidence/facts-verify;
precheck gains [hooks]/[facts], task-sync gains stale-evidence-HEAD warning;
task-start cards now embed the evidence table; gitlink advances to draft.10.
Refs: task card .task/feature-evidence-driven-gates.md; guidelines CHANGELOG
0.1.0-draft.10.
Why: The listen guard reads auth and host policy from config before the database opens, so app depending on config is a real edge.
Evidence: make test stopped in lint-boundaries on backend/app backend/config. The edge is now in the baseline.
Impact: New imports still fail the ratchet. This one records the startup guard's dependency.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: New cross-layer imports and unused exports could land unnoticed, and confirm-waiting reused the success color.
Evidence: bash scripts/lint-boundaries.sh passed, including a probe that a new edge fails. Both design-guard tests passed. Knip counts stay at the baselines.
Impact: make test-boundaries now checks architecture edges. Frontend and ui test targets also run the knip ratchet.
Refs: feature/architecture-baseline
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Dev has to test the split modules and refuse a core import of a sibling library.
Evidence: bash scripts/lint-boundaries.sh printed boundaries ok. Full make test follows on this pin.
Impact: test-libs runs the intent, native, sqlite, and command modules. The sibling allowlist is empty.
Refs: D1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Dev could ship a combination whose nested gitlinks differed from the top-level pins, and make test never ran the three agent libraries.
Evidence: A go.work was measured and not adopted: workspace MVS selected newer golang.org/x crypto, exp, net, term, and text than backend with GOWORK=off. check-pins passes on the new pins and fails when backend's squad pin is 5cbac00.
Impact: make test adds pin checks and GOWORK=off vet/test for intent, native, and squad. make build still compiles inside backend; the pin check requires those gitlinks to match Dev.
Refs: R0
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: PR test evidence depended on the agent's word (single point); the
running binary could not answer what combination it was built from; and
irreversible operations lacked an explicit agent-stops-here boundary.
Evidence: Gitea runner online (home-runner, ubuntu-latest+docker); make
version prints describe+component SHAs; two-key line maps to baseline hard
boundary 1. CI first run observed on this PR before merge (see Actions tab).
Impact: .gitea/workflows/ci.yaml runs make test + make build on PR/push;
Makefile injects main.version (make version / agent-system version);
AGENTS.md and adoption register the two-key rule. No product code change.
Refs: policy/adoption.md; release-operations requirements
Why: the library now makes precedence, memory tiers, and lesson
mechanization explicit; the composition must pin the revision and register
how its layers map onto the new rules.
Evidence: guidelines PR#3 (ed2af3e) and documents PR#4 (2205138) merged;
make test on this branch per the gitlink rule.
Impact: gitlink advances; adoption registers the hierarchy/memory rows as
manual-with-existing-artifacts. No code change.
Refs: policy/adoption.md; docs/records/2026-09-30-history-migration-sha-map.md
Why: precheck missed uninitialized submodules (git submodule status '-'
prefix), and the branch protection configured today plus the second live
probe outcome must be recorded honestly in the matrices.
Evidence: platform negative: direct push to protected main rejected
(pre-receive hook declined, Logging-System probe); second write-guard probe
confirmed session-start config loading (no hook run in the pre-config
session log).
Impact: precheck sub_dirty now counts '-' prefixed entries; A3 registered
enforced at platform layer across 11 repos; zcode matrix pending-live
annotated with the loading-timing proof.
Refs: policy/tool-adaptation-matrix.md; policy/tool-adaptation-zcode.md
Why: zcode lacks a rules feature (AGENTS.md is the resident layer) but
supports PreToolUse hooks that can block Edit/Write before the write lands,
upgrading A1/A3 from commit-time to write-time enforcement; the two block
shapes (integration branch, detached submodule) mirror the real incidents.
Evidence: script-level suite 8/8 (N1-N3 blocks with exit 2 and remediation
hints, P1-P5 allows incl. fail-open degradation paths); config JSON valid;
client-side live-fire interception marked pending-live in the matrix.
Impact: .zcode/config.json enables the hook runner for this workspace;
.zcode/plans/ ignored (client state); no product code change.
Refs: Development-Guidelines 0.1.0-draft.8; policy/tool-adaptation-zcode.md
Why: the library now defines requirement-level conformance for tool rules
and hooks (draft.8); the composition's existing gate mechanisms should be
honestly graded against A1-A7 rather than implicitly assumed compliant.
Evidence: matrix rows cite the 19/19 scratch suite negatives, the live data/
dirty-tree interception, and PR records; commit-msg python3 dependency
verified fail-closed by reading the hook's test path.
Impact: docs-only; guidelines gitlink advances to c9ab623 (draft.8); no
workflow or code change.
Refs: Development-Guidelines PR#2 (c9ab623); policy/adoption.md
Why: the nine submodule entry docs and the documents migration record merged
via their own PRs; the parent must pin the new combination and register the
adoption with honest enforcement levels.
Evidence: per-repo PR merges (9x entry-docs PR#1, documents PR#2) verified
via API; make test on this branch follows before merge.
Impact: gitlinks advance to post-migration, gate-adopted mains; policy/
adoption.md registers enforced (local hooks) vs advisory vs manual honestly.
Refs: ef89fc8; Development-Guidelines 0.1.0-draft.7
weichen
