Why: The project entry and task card must reflect current code evidence and the failed model gate.
Evidence: Native SELF receipts and independent review report cover the exact current component combination.
Impact: Save the report and status without merging or deploying the candidate.
Refs: U2/U3 plan r0.1
Why: Preserve authoritative main and both backend histories before draft review.
Evidence: Exact incoming cfb8308 merged without source conflicts; current combination and PG checks follow.
Impact: Keep session/account fixes and U2/U3 task authority in the same candidate; model gate remains failed.
Refs: Dev main aa6364f and U2/U3 task card
Why: Preserve the latest combination evidence and independent failure assessment before draft review.
Evidence: Native SELF receipts capture complete local test/build and current HTTP browser checks; model quality remains FAIL.
Impact: Pin the report and code review without merging or deploying the failed candidate.
Refs: feature-fast-slow-u2-u3-plan
Why: Preserve authoritative settings and session changes with the source-bound work candidate.
Evidence: Merged Backend, Core and live fixture guards passed local and independent checks; extra A01 remained a real FAIL.
Impact: Save a draft-reviewable composition without claiming CI, merge, deployment or model-quality approval.
Refs: U2/U3 task card and validation report
Why: The remaining open items (API-key SSE closure, cross-instance
redeem backoff, U7 atomic bootstrap/create, CLI credential delivery)
landed in Backend #192; Dev pins it and closes the contract leftovers.
Evidence: Backend #192 CI success at head bc1e0a3 (GATE); composite CI
on this PR re-runs the suite incl. test-pg (GATE).
Impact: backend pin cfb8308; contract leftover section now records all
items closed; task card H1-H6 requirement table.
Refs: Backend #192; docs/svc-deploy/2026-10-13-login-recovery-contract.md.
Why: Continue the existing delivery after explicit approval for one extra sample.
Evidence: Startup precheck READY and live output/run-limit fixture checks are recorded by evidence.
Impact: Fixed evaluation candidate, max two paid runs and no automatic retry; preserve all original failed samples.
Refs: User approval 2026-10-13
Why: check-pins failed on the follow-up CI: the newly pinned backend
(741da4a) carries deps/agent-system-core at 0f94e4b while Dev's
modules/core stayed at ba289e7 - the three-layer pin rule requires the
top-level core pin to match.
Evidence: 0f94e4b verified as an ancestor of Core origin/main; this
PR's composite CI re-runs check-pins (GATE).
Impact: modules/core gitlink to 0f94e4b; no source changes.
Refs: check-pins failure on job 4204.
Why: The follow-up CI exposed that backend #188 broke the Dev
multi-instance suite: serve --mock seeded runtime.mock at the user
scope, which system-managed settings now reject, so instances never
became healthy. Backend #190 seeds the startup flag into the system
scope; this PR repins and drops the now-invalid alice user-scope write.
Evidence: Backend #190 CI success at head 0af1ebc (GATE); this PR's
composite CI re-runs make test-multi-instance (GATE for the fix).
Impact: backend pin 741da4a; multi-instance test comments updated to
the system-managed regime.
Refs: Backend #188, #190.
Why: Preserve a clean reviewable candidate without treating code checks as a passed model gate.
Evidence: Native receipts retain final combination, PostgreSQL and actual HTTP/browser verification; independent code review is archived in Documents.
Impact: Save documentation and evidence, retain registered worktree and unmerged branches pending the requested extra test authorization.
Refs: U2/U3 plan r0.1 and validation report
Why: The completion audit flagged four gaps over the merged login
recovery implementation: real-browser acceptance, the login-key e2e
spec, SSE stream invalidation, and the Documents write-back.
Evidence: Browser acceptance receipts be7ae9a2/b3a9e691 (SELF, bound to
Dev HEAD 268ef29); Backend #189 CI success at head 8b73afe (GATE);
Documents #94 merged; this PR's composite CI is the GATE for frontend
pin 44b9646.
Impact: Pins backend=349a47d (SSE close) and frontend=44b9646 (e2e
spec); contract doc leftovers updated; task card carries the follow-up
record for closure.
Refs: docs/svc-deploy/2026-10-13-login-recovery-contract.md; Documents
proposal r3; Backend #189; Frontend #77.
Why: Keep the implementation, honest failed model evidence and approved planning progress reviewable as one candidate.
Evidence: Native SELF suite, PG and meaningful red-to-green receipts; independent reviewer reports and all original model artifacts are retained.
Impact: Pin source-record and terminal-state fixes; preserve U3 acceptance and extra-sample authorization as pending, with no deployment.
Refs: Approved U2/U3 plan and validation report
Why: Keep the accepted login recovery release and U2/U3 fixes in one current composition.
Evidence: Exact incoming Backend 467718a and Frontend 9fc7da2 were fetched and merged without source conflicts; task-sync receipts retain the gitlink conflict.
Impact: Preserve both component histories and refresh the authoritative base before final combination checks.
Refs: origin/main 268ef299; feature-fast-slow-u2-u3-plan
Why: Resolve the observed conclusion and qualification defects without rewriting failed evidence.
Evidence: Native SELF model failure and red-to-green conclusion receipts are retained in the task card.
Impact: Candidate recipe changes; an A01 rerun remains outside the original six-sample authorization.
Refs: Approved U2/U3 plan r0.1
Why: Complete the approved U2/U3 fix pass and prevent shared host fixture collisions.
Evidence: Native SELF receipts record complete Backend suite, Frontend 221 tests, meaningful startup regression failures and the bounded baseline model batch.
Impact: Pin the corrected Backend and Frontend and allocate owned recovery fixture ports; no existing service deployment.
Refs: modules/documents/docs/proposals/2026-10-13-fast-slow-u2-u3-plan.md
Why: The Dev composite must carry the exact backend (467718a) and
frontend (9fc7da2) commits implementing the login recovery contract.
Evidence: component branches pushed to their origins; make test runs in
this task worktree validate the composite (receipts in task card).
Impact: gitlink bump only; no other Dev tree changes.
Refs: docs/svc-deploy/2026-10-13-login-recovery-contract.md
Why: A fixed regression port collided with another task-owned preview and blocked full verification.
Evidence: SELF full-suite failure identified port 18795; the isolated fixture replays without stopping the unrelated process.
Impact: Changes one test fixture and records actual HTTP/browser acceptance; no service operations or production settings changed.
Refs: fast-slow-u2-u3 final verification
Why: Acceptance must cover both immediate and deferred material flows.
Evidence: SELF fixed composition and isolated PostgreSQL receipts are retained; direct browser replay follows this producer fix.
Impact: Pins the observed flow repair and controlled test suite.
Refs: fast-slow-u2-u3 Task 7
Why: Fixed composition checks must include the source preview version guard.
Evidence: SELF red-green and frontend build receipts are recorded in the task card.
Impact: Updates component pins and evidence only.
Refs: fast-slow-u2-u3 Task 7
Why: Final task verification must include the latest authoritative composition.
Evidence: Task-sync receipt records incoming main and component conflicts; each component preserves both branches.
Impact: Retains artifact typed-nil recovery, RDM role rejection state, lifecycle governance, and task checkpoint changes.
Refs: fast-slow-u2-u3 task-sync
Why: Runtime checks require fixed component inputs and task-owned process identity.
Evidence: SELF live compilation receipt in the task card; model calls have not started.
Impact: Pins the current evaluator without touching existing instances.
Refs: fast-slow-u2-u3 Task 7
Why: Fast feedback and slow-channel discoveries need a faithful progressive user interface.
Evidence: SELF startup, contract, component, atomicity, source, and recovery receipts are recorded in the task card; final composition and live acceptance are pending.
Impact: Pins the current Core, Backend, Frontend and UI implementation without deploying existing services.
Refs: Approved fast-slow-u2-u3 r0.1; feature-fast-slow-u2-u3-plan task card
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=6193db1b548b964ab3133557ddbb9d83a3643d31.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Dev has to follow the commits that landed on Backend and Documents main, which share trees with the drilled objects.
Evidence: Backend dc736e339d01 tree 498f61947564 equals 46073d30. Documents 05c13a42b14d tree equals 5335499. GATE run 2794 on 6d8b746 succeeded before this pin.
Impact: gitlinks move to the merge commits. Second-instance writes stay closed.
Refs: #186#92#497
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the restored drill passed artifact recovery, and the handbook, checklist, and collaboration plan have to say so without opening write traffic.
Evidence: backup-20261013-013354 on Dev a83588dd and backend 46073d30; K1-K7 true, RPO 65s, RTO 3s, five artifacts matched, cross-user access 404. SELF. Documents 5335499 is PR #92.
Impact: C5 is marked SELF-pass. Second-instance writes stay closed until REPLAY or CI and a second host exist.
Refs: docs/svc.md docs/release-multi-instance.md modules/documents
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: pick up Agent-System-Frontend dcd2699 (PR #75) so the Dev combined
CI validates the RDM roles panel rejected-state fix together with the
svc.sh rdm-admin recovery tooling in this task.
Evidence: gitlink 43d1933 -> dcd2699; merge-base --is-ancestor of the
reviewed head 0159f00 into frontend main OK (SELF).
Impact: gitlink bump only; combination validated by make test in this
worktree before PR.
Refs: task card feature-rdm-admin-lockout-recovery (R3/I2)
Why: an unset object store must keep artifact bytes available to the other process, which the store-level test does not execute.
Evidence: cross_artifact_roundtrip failed with EOF on backend c6fb130 and passed on 46073d30 (SELF, isolated u7drill-k4).
Impact: Dev now builds the fixed backend. Second-instance write traffic stays closed.
Refs: modules/backend tests/integration/multi-instance/multi_instance_test.go
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: retain a coherent combination before adding the atomic projection.
Evidence: Core suite and FE UI types; material tests and startup receipts recorded as SELF.
Impact: exact component gitlinks and task record.
Refs: U2/U3 Tasks1-2
Why: preserve current-source evidence and the reviewable next increment.
Evidence: READY receipt at5212fef, exact source and open-PR audit; plan r0.1 remains pending stage5 review.
Impact: task record, proposal link and exact Documents pin; no business code or runtime changes.
Refs: fast-slow r1.1, work-companion PR493
Why: Keep exact component and verification progress recoverable before final integration gates.
Evidence: Full SELF receipts remain in the task card; independent replay and platform gates are separately identified.
Impact: Documentation and Documents version only.
Refs: feature/work-companion-ui U5
Why: Bind the final candidate to actual review fixes and stronger interface acceptance.
Evidence: Full SELF red/green receipts and original independent report identities are retained; GATE and final review remain separate.
Impact: Pin UI0da2e3a and Frontend43d1933; no Backend/Core or running service change.
Refs: UI01-UI13, ce-code-review UI and Frontend findings, work-companion-ui
Why: Keep a recoverable record of the current validated combination and honest planning status.
Evidence: Full SELF make build and isolated two-case HTTP browser receipts are retained in the task card.
Impact: Documentation and Documents pin only; no running service change.
Refs: feature/work-companion-ui, U5
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=2c016931044bebdc4a114c1ca1127d1b40d4ab17.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
# Conflicts:
# modules/documents
Why: verify the exact UI and Frontend combination under the approved design.
Evidence: imported startup plus SELF unit, type, build, fixture browser and real HTTP/MockRunner smoke receipts in the task card.
Impact: three-pane presentation rules and fixed component revisions; existing services remain untouched.
Refs: work-companion-ui design r0.2, plan r1 and UI01-UI13.
Why: Main D1 now shares the same explicit fixture initialization contract.
Evidence: Both real SQLite and temporary PostgreSQL initialization paths
were independently replayed; capabilities JSON assertions are preserved.
Impact: Resolve duplicate PG setup through the tested helper; preserve
all main lifecycle changes and the rollback directory protection.
Refs: Dev #483/#485; D1 existing-store identity contract
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=99048dda1f48bccb3d5d798050d7beeea2907177.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: main already has one release transaction, so this branch keeps that path and only isolates update and recover in a clean child.
Evidence: SELF bash -n scripts/svc.sh; python3 -m unittest identity/recover/deploy/u2/lifecycle pin 92 tests OK (2 skipped), then 66 tests OK after dropping the obsolete journal hook.
Impact: deploy uses releases/ and deploy.journal; the lifecycle child reconciles that journal before deploy or recover. Backend pin is 0f192a4.
Refs: #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: isolate the approved interface work and fix its component baseline.
Evidence: imported startup precheck SELF receipt; source requirements and plan recorded in Documents.
Impact: task metadata, project links and authoritative UI/Frontend baselines; existing service state is untouched.
Refs: UI01-UI13 and work-companion-ui implementation plan r1.
Why: Second-resolution release IDs let staging delete a previous release
when a same-source deployment ran within the same clock tick.
Evidence: Fixed-clock rollback regression fails before and passes after;
250 governance checks pass. Independent review replays collision and
copy-failure protection; receipts are in the primary task card.
Impact: Add invocation identity and exclusive directory creation; keep
old artifacts intact. Also retain the latest compatible frontend pointer.
Refs: User-approved I2; Dev #483; Frontend #71/#72
Why: an update that stops the old process and overwrites the binary cannot
get the previous version back, and a migration the old binary cannot read
must be refused before that stop. CI also had no fixed RDM SHA to build from.
Evidence: python3 -m unittest tests.test_svc_identity tests.test_svc_recover tests.test_svc_deploy_txn tests.test_lifecycle_pin passed. make test-lifecycle exits 2 when AGENT_PG_TEST_DSN is unset.
Impact: installs land in releases/<rid> and current switches with mv -T.
Deploy keeps the desired state and rolls back a non-terminal journal.
Schema compatFloor above the installed target is refused unless
--migrate-schema --confirm is paired with a backup. test-lifecycle fails
closed without PostgreSQL and an RDM checkout. Login stays NOT_RUN.
Refs: recovery plan r3.1 D2 and D3; Backend feature/d1-identity-open
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: stub suites proved the script logic but not real artifact
behavior (the 2026-10-12 incidents passed all stub tests); the report's
U3 requires real-combination gates, and realcombo dry-runs exposed two
real gaps: fresh deploys closed identity governance one lifecycle late,
and pg-bound identity calls put the DSN on the command line.
Evidence: make test exit 0; local realcombo dry-run 16 OK (rows in the
task card); CI adds svc-realcombo (SQLite, both real binaries, full RDM
track) and a real-PG identity step on test-pg with env-delivered DSN.
Impact: tests/test_svc_realcombo.py (SVC_TEST_REAL gate, explicit
NOT_RUN otherwise); ci.yaml new job + test-pg step (RDM clone via
trusted-base URL-scoped token header, allowlist addition reviewed in
this PR); svc.sh delivers identity DSN via AGENT_SYSTEM_DSN and runs
manifest adoption in the same deploy that first registers svc.env;
modules/backend pinned to main (env fallback, backend #182).
Refs: .task/feature-svc-u3-realcombo.md; user goal directive 2026-10-12
(U3); backend #182; RDM #285.
Why: Dev #452 selected a frontend pointer lacking the previously merged
SurfaceMeta hydration fix and blanked saved-page conversations.
Evidence: Independent review and regression red/green receipts are in
.task/feature-surface-black-screen-recovery.md; make test/build follow.
Impact: Pin the frontend that retains fast-slow and saved-page recovery;
no backend, UI token, storage or permission configuration change.
Refs: Frontend #68; Dev #454; Dev #452; surface-black-screen-recovery
Why: probing identity by running the subcommand still launched old RDM
builds, and ensure on a missing database created an empty one. A batch
update also inherited the caller's AGENT_SYSTEM_* variables.
Evidence: python3 -m unittest tests.test_svc_identity tests.test_svc_recover passed (41 tests, 1 skipped). tests.test_svc_lifecycle_isolation caller-env and restart cases passed.
Impact: capability probes use version --json only. Established instances
refuse a missing identity row until adopt --confirm. update and recover
run each service in a clean environment. serve reads a 0600 serve.env
and does not inherit the caller environment. Backend and documents pins
move to the D1 identity and recovery-plan commits.
Refs: recovery plan r3.1 D1; Backend feature/d1-identity-open; RDM feature/d1-version-json
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen
