Why:
Later authenticated source acquisition must never follow a frontend build or provider test.
Evidence:
SELF host replay passed all 23 real composition fixtures; both acquisition-order regressions failed before the repair.
Impact:
Prepare fixed sources and Go/npm caches before execution; retain committed tooling checks and RDM-selected Backend versions.
Refs:
R7, R8, R11, R14; dependency-workspace U5
Why:
An interrupted multi-component transition must retain original staged, ignored and external-worktree data after some independent copies have completed.
Evidence:
SELF scratch fixture interrupts a real nested copy after App is saved and Logging is partially copied; originals and external Git metadata remain identical, recorded partial data persists and retry refuses to discard it.
Impact:
Add failure-path coverage and clarify reachability checks before component branch cleanup; no transition implementation change.
Refs:
Dependency-workspace R9/R15 and independent reliability coverage followup.
Why:
The lifecycle pin verification step executes candidate Python and shell code even when its YAML run value is inline.
Evidence:
SELF regression observes three credential-order failures on the prior candidate, then passes after moving pin verification behind all privileged acquisition and recognizing inline run entries.
Impact:
Retain the pin verification gate while ending credential use before every candidate entry point.
Refs:
Dependency-workspace independent security and standards validation; R8 and CI phase boundary.
Why:
A dirty composer could change artifacts under a committed Dev identity, and two CI jobs reacquired credentials after executing candidate build code.
Evidence:
SELF regressions reproduce both issues before the fixes; all22 real composition cases and21 dependency/CI cases pass after. CI syntax checked; full exact committed replay follows this checkpoint.
Impact:
Verify executing composer/transport bytes before import and publication, record explicit tooling provenance, order all privileged acquisition first, and model CGO correctly in the nested component race fixture. Existing product and required CI gates remain.
Refs:
Dependency-workspace early code review; correctness/standards/security P1 findings and R7-R8/R14.
Why:
Formal root tests cannot read ignored migration clones, so provider CI regressions failed despite the product and source gates passing.
Evidence:
SELF receipts record 18 missing-source errors, then all 29 credential cases passing from a real source archive without .migration and with exact host Git-source validation.
Impact:
Use committed test-only workflow snapshots with full source commits and SHA256 provenance. Real acquisition still executes trusted inline workflows and never reads these fixtures.
Refs:
Dependency-workspace U5/U7; archive receipt66f01970885b34bbb0f9a2dfb244e4a58618b725e600f85fe765099cf2f3bd36.
Why:
Preserve work merged by concurrent tasks while adopting versioned dependency workspaces.
Evidence:
SELF task receipts record conflict detection, all 96 task/recovery/cutover cases, all 33 evidence cases and 5 component identity cases. Documents links and requirements were replayed after preserving both planning entries.
Impact:
Keep upstream idempotent sync, local resume and source-external receipt rules; adapt fixed-guidelines readiness and ignored component identity validation. Remove only obsolete index links and retain their physical Git metadata.
Refs:
Authoritative main57bcb17ea212a531186b6e21617a7f3bea65a791; Documents4a26798000c39cc59ba0c2cc6328f5c8f10dcb32; dependency-workspace R15.
Why:
An attempted shared digest import introduced a workspace package requirement in standalone fixed-root product fixtures.
Evidence:
SELF task receipts record the actual ModuleNotFoundError followed by all 20 real Git/Go/npm composition cases passing after restoring the local helper.
Impact:
Preserve standalone operation and retain the behavior-preserving unused parameter/import cleanup.
Refs:
Agent-System-Dev dependency-workspace U5; SELF composition receipt 5b7c224d67ab248b685da436ebee56638c1945a1dca3666f40e763621c1b8003.
Why:
Replace repeated submodule source pointers with consumer-owned language versions and fixed application sources, keeping independent repository edits and existing branches intact.
Evidence:
SELF task receipts contain startup/sync evidence, real Go and npm consumption, Native overlay/unlink, safe transition/ref preservation, credential boundary and historical build regressions. Exact committed full composition and RDM checks follow this checkpoint; formal acceptance and GATE CI remain pending.
Impact:
Add isolated build/test composition, source provenance and safe owner refresh, adapt governance and service build callers, remove replaced index links while retaining original Git metadata, and adopt reusable dependency standards.
Refs:
Documents approved dependency-workspace r1/R1-R15 and U1-U7 implementation plan; feature/dependency-workspace task card.
Why: Close the delivered I1 task without modifying unrelated task records or shared workspaces.
Evidence: Dev PR 534 merged after all three exact-head CI jobs passed; RDM 360/362 and Documents 98/99 actual results and independent reviews are retained.
Impact: Archive this task card and preserve original receipts only; leave all worktrees, branches, production services and later IAM increments unchanged.
Refs: Dev PR 534; policy/delivery.md task closure authorization; IAM I1.
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=e793e9804a1f5ecf49b29a40b4baac90ceb04e55.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Preserve independent final review and current-source equivalence before platform admission.
Evidence: Final document and integration metadata review has zero findings; full composition test and source equivalence receipts are retained with precise SELF object boundaries.
Impact: Delivery evidence only; no production, provider, guideline or document changes from the reviewed candidate.
Refs: IAM I1 integration task; Documents 98/99; RDM 360/362.
Why: Preserve actual component merge results and current delivery authorization before integration CI.
Evidence: RDM PR 360 merged at exact successful CI head; new Dev make test passed and independent metadata checks preserved approved digests and pins.
Impact: Clarify historical task records and current approved repair scope; preserve documentation and delivery evidence only.
Refs: Documents PRs 98 and 99; RDM PRs 360 and 362; IAM I1 task record.
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=1e5c6b9c10ba77ed34663fd670138621a17342bd.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Carry the actual merged contract and approved permission implementation boundary into the integration composition.
Evidence: Documents PR 99 merged as a7ff466d9ae91fc67a53d2bf4991f47fc63a2a4c after independent review and verified source digest; RDM PR 360 preserves actual-actor projection semantics.
Impact: Update documentation pin, navigation and delivery records only; new composition tests and final-head CI remain required.
Refs: IAM I1 permission contract section 8; Documents PRs 98 and 99; RDM PR 360.
Why: the user confirmed acceptance in conversation on 2026-10-13; the archived
card should carry the verdict with an honest source label.
Evidence: user confirmation (conversation reply); automated ten-scenario replay
25/25 PASS rows on this card and PR #529.
Impact: archived task card note only.
Refs: task feature/rdm-increment-settings-duties (archived via #532).
Why: Preserve a single Dev entry and independent repository ownership while allowing active feature branches to migrate without losing source or Git state.
Evidence: SELF 29 real Git/Go workspace tests and ordinary component evidence/lock tests passed; detailed RED/GREEN runs are recorded by make evidence in the task card.
Impact: Add fixed cloning, selected-version baselines, development overlays, npm source resolution, and independently preserved legacy snapshots. No other active worktree is modified.
Refs: Versioned dependencies U2/U5; R15; feature/dependency-workspace
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=5efbeebbdc09f8c2484613230a29c882c54652f0.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=5efbeebbdc09f8c2484613230a29c882c54652f0.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Record user acceptance and use the actual merged permission contract in the integration composition.
Evidence: Documents PR 98 merged as 3cf263962bd106529ee0531c8415cb16eecedfe3; independent document review and full SELF receipts retained in the task record.
Impact: Advance only Documents and delivery evidence; full IAM later increments and deployment remain outside scope.
Refs: Documents PR 98; IAM I1 U1-U2; policy/delivery.md stages 8-9.
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-rdm-increment-settings-duties.md(PR#529) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-d1-closeout-evidence.md(PR#517) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=5aae47ebca20ad1f3add3b080212cca7e1c6edf9.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Prepare ordinary component workspaces and real module downloads without changing global Git configuration or other feature branches.
Evidence: SELF clean-cache module consumption and real temporary-Git transport tests are recorded by make evidence in the task card, including expected RED and passing GREEN runs.
Impact: Add component identities/source locks and non-secret transport configuration. Existing submodule layout remains supported during migration.
Refs: Versioned dependencies U1/U2; R15; feature/dependency-workspace
Why: Preserve the user-approved stage-7 conclusion before the final merge candidate is frozen.
Evidence: Import original precheck, sync, build, CI and independent replay receipts; validate current fixed components, document links and the incoming acceptance script syntax through make evidence.
Impact: Update this task card only; preserve implementation and activation boundaries. New HEAD CI remains required before merge.
Refs: Dev PR #519; Guidelines PR #5; Documents PR #96; queue Issue #518
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=5aae47ebca20ad1f3add3b080212cca7e1c6edf9.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=69c5c84d8a2f1a7966ebfb809cbb26d54e8e8abb.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=69c5c84d8a2f1a7966ebfb809cbb26d54e8e8abb.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Final fixed Documents composition and current modules passed their checks and now require the user acceptance decision.
Evidence: Complete SELF make test and document checks passed at4af5956; receipt5e81c91e and the independent RDM replay subjects are retained.
Impact: Record-only checkpoint after user stage 6 approval; do not claim stage 7 approval or shipping.
Refs: I1 bounded acceptance; policy/delivery.md
Why: Keep complete archive verification after the active card is moved.
Evidence: Original SELF synchronization and scoped diff receipts confirm no product or unrelated card changes.
Impact: Task records only.
Refs: Dev #526; RDM #354
Why: The approved base and downstream project membership delivery has reached its merge endpoint.
Evidence: Dev #526 and RDM #354 actual merge records, exact-head gates and independent reviews are preserved with original source labels.
Impact: Archive this task and record the separately authorized deployment follow-up; no product change, worktree cleanup or 8788 write.
Refs: Dev #526; RDM #354
Why: Keep the user-approved implementation and pending acceptance separate in the fixed integration records.
Evidence: Current Dev make test passed at10789653 and RDM combined checks passed at70e27b08; final text-only combination is verified next.
Impact: Documents and card records only; no permission source, pins in RDM, existing services or production data changes.
Refs: I1 stage 7 acceptance candidate
Why: task-sync flagged the earlier rows as recorded with uncommitted script
changes; the gate requires key checks re-run at a committed head.
Evidence: SELF row via make evidence - 25/25 PASS on a fresh rdm@84ca64f
disposable instance.
Impact: task card only.
Refs: task feature/rdm-increment-settings-duties.
weichen