Why: include the current integration baseline before verification.
Evidence: fetched origin/main=d40d1c2e5d29bb0ce429edf2221d9c4e4bcb0dcb.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: The remaining U7 release gates needed a durable spec before anyone replays them or wires CI.
Evidence: Run 2832 on head 72763c9 has test, test-pg, and svc-realcombo success on home-runner. Review found docs only and unchanged evidence grades.
Impact: Docs and the task card. Checklist grades stay SELF or not started. Second-instance writes stay closed.
Refs: .task/feature-u7-release-roadmap.md
Why: Main advanced with the login recovery merge while CI was running, so the branch had to take it in before merge. The new combination needed its own test evidence.
Evidence: make task-sync merged origin/main 268ef29 with no conflicts (SELF). make test exit 0 on the merged tree (SELF). CI on the new head is still required before merge.
Impact: Task card plus the merge of main. The release specs are unchanged. Second-instance writes stay closed.
Refs: .task/feature-u7-release-roadmap.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: depth 1 makes prev_sha and sha unrelated shallow roots, so update reports a fork instead of an upgrade.
Evidence: SELF the pin-fetch credential test; CI run 2829 showed the fork message.
Impact: test-pg fetches 200 commits from each pin, not the full history.
Refs: .task/feature-svc-d3-real-scenarios.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=268ef2999ca2ff3481c6bebd588cae51d6b90709.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: the CI fix needs a tool-written receipt on the commit that contains it.
Evidence: SELF make evidence, exit 0.
Impact: task metadata only.
Refs: .task/feature-svc-d3-real-scenarios.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Merge requires the current head CI result on the task card, with the run link, executor, and SHA.
Evidence: Run 2821 attempt 2 on head 3090dd9 has test, test-pg, and svc-realcombo success on home-runner (GATE). Attempt 1 failed in an unrelated timing-sensitive governance test and was rerun.
Impact: Task card only. Second-instance writes stay closed.
Refs: .task/feature-u7-release-roadmap.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The Dev composite must carry the exact backend (467718a) and
frontend (9fc7da2) commits implementing the login recovery contract.
Evidence: component branches pushed to their origins; make test runs in
this task worktree validate the composite (receipts in task card).
Impact: gitlink bump only; no other Dev tree changes.
Refs: docs/svc-deploy/2026-10-13-login-recovery-contract.md
Why: The 2026-10-13 login flow plan requires a frozen contract record
(three adjudications against the r2 proposal) and a traceable task card
before implementation merges.
Evidence: doc-only commit; acceptance matrix cites backend/frontend test
files added in companion commits (SELF).
Impact: docs/svc-deploy/2026-10-13-login-recovery-contract.md becomes
the authoritative login-recovery contract; task card records user
authorization and requirement table L1-L9.
Refs: modules/documents/docs/proposals/2026-10-12-svc-unified-deploy-and-login-key.md r2
Why: the card's main record must point at the review object before CI is accepted.
Evidence: PR 503 exists on the current branch.
Impact: task metadata only.
Refs: .task/feature-svc-d3-real-scenarios.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the sync checkpoint must be a tool-written receipt on the same card as the tests.
Evidence: SELF CMD make task-sync, exit 0, sync_base 3fb8210f64.
Impact: task metadata only.
Refs: .task/feature-svc-d3-real-scenarios.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: completion claims need tool-written receipts, including the SSH timeout and the passing rerun.
Evidence: SELF make evidence rows on this card.
Impact: task metadata only; login and rdm.ping stay NOT_RUN.
Refs: .task/feature-svc-d3-real-scenarios.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The merge step requires a fresh sync against origin/main recorded on the task card.
Evidence: make task-sync exit 0; sync_base 3fb8210f, tested_head d3f8677, already up to date (SELF).
Impact: Task card only.
Refs: .task/feature-u7-release-roadmap.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The merge gate needs a review record on the task card for the PR head.
Evidence: Review of base 3fb8210f against head dd77d27 found docs and the task card only, unchanged evidence grades, and no secrets. No blockers.
Impact: Task card only. Second-instance writes stay closed.
Refs: .task/feature-u7-release-roadmap.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Acceptance needs the task-sync and make test outputs on the task card before the PR. The first make test failed because an unrelated process held port 18795; the rerun passed.
Evidence: make task-sync exit 0 against origin/main 3fb8210f (SELF). make test exit 0 after the port was freed (SELF). CI on the PR head remains the authority.
Impact: Task card only. Evidence grades are unchanged and second-instance writes stay closed.
Refs: .task/feature-u7-release-roadmap.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-svc-login-recovery-flow.md; R0=3fb8210f6495a78e70a67af3661bdfe9c00fb9de.
Impact: task metadata only; the feature workspace starts at 3fb8210f64.
Refs: .task/feature-svc-login-recovery-flow.md
Why: The user authorized continuous delivery of the release-gate specs through merge and task-card closeout. The card still said no continuous authorization and left stages 1-6 unreviewed.
Evidence: Startup precheck READY, receipt imported into the task card (SELF). Spec claims rechecked locally: tree equality holds, policy/facts.md and the Documents repo are untouched, and checklist grades stay SELF or not started.
Impact: Task card text only. No replay, no workflow change, no second host, and second-instance writes stay closed.
Refs: .task/feature-u7-release-roadmap.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Second-instance writes stay closed until an independent replay or an admitted CI gate, plus a second host. Those remaining steps needed a durable spec.
Evidence: Task-card evidence rows read the merged PRs, tree equality, CI runs 2783/2810/2816, and Dev main branch protection. Source SELF. Drills were not run.
Impact: Docs and the task card only. Checklist grades stay SELF or not started. The collaboration proposal body stays r2.3.
Refs: docs/release-multi-instance.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=3fb8210f6495a78e70a67af3661bdfe9c00fb9de.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: the card still had the task-start placeholders, so review would not see the NOT_RUN boundary.
Evidence: documentation only; command evidence follows via make evidence.
Impact: login and rdm.ping stay NOT_RUN, and the card does not claim full coverage.
Refs: .task/feature-svc-d3-real-scenarios.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: test-pg only cloned the default branch, so prev_sha and legacy_sha were never built or attested.
Evidence: SELF python3 -m unittest tests.test_ci_credentials tests.test_lifecycle_pin (11 tests, exit 0).
Impact: the lifecycle suite prints the combination inventory and keeps login and rdm.ping as NOT_RUN.
Refs: .task/feature-svc-d3-real-scenarios.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-u7-release-roadmap.md; R0=3fb8210f6495a78e70a67af3661bdfe9c00fb9de.
Impact: task metadata only; the feature workspace starts at 3fb8210f64.
Refs: .task/feature-u7-release-roadmap.md
Why: A real process must not keep the caller DSN in its command line, environment, log, history, or svc.env. Domain events written by -bootstrap have to survive a later pin deploy.
Evidence: SELF unittest of the two new LifecycleRealTests methods exited 0.
Impact: The scan uses a sentinel that is not a live database password. Login and rdm.ping stay NOT_RUN.
Refs: tests/integration/lifecycle/test_lifecycle_real.py
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A static dev deploy deleted the worktree before copying dist, so a mixed batch could not update the workbench. Missing manifests and a second instance on the same Postgres database must fail closed the same way on real artifacts.
Evidence: SELF unittest of the mixed batch, the three-entry manifest-loss case, and the PG cross-instance case exited 0. The PG case used a temporary cluster.
Impact: static dev deploys copy dist before recycling the worktree. Login and rdm.ping stay NOT_RUN.
Refs: tests/integration/lifecycle/test_lifecycle_real.py
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the merged upload fix had left its task card open.
Evidence: GATE run on e25869a840 for test, test-pg, and svc-realcombo. Independent review approved. Only the K4 card is archived.
Impact: task metadata. Second-instance writes stay closed.
Refs: #500#497
Why: the result section still described Documents and Dev as unmerged after those pulls had landed.
Evidence: Documents #92 is 05c13a42b14d; Dev #497 is bb5343ca0d4c; GATE run 2810 on cfa8230d4c.
Impact: task card text only. Second-instance writes stay closed.
Refs: #500
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the archived card still said the Dev merge and cleanup had not happened.
Evidence: merge bb5343ca0d4c; GATE run 2810 on cfa8230d4cbb73f0a91a4816f8c884705866a4dd; task-finish observed_head cfa8230d.
Impact: task card text only. Second-instance writes stay closed.
Refs: #497
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the upload fix is on main, and its task card should not stay open.
Evidence: merge bb5343ca0d of PR #497. GATE run 2810 jobs 4080/4081/4082 success on cfa8230d4c. task-finish exit 0, observed_head cfa8230d.
Impact: one task card moves to .task/archive/. No code or submodule change. Other open cards stay open.
Refs: #497
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Stub journals do not prove that a real RDM binary rolls back after a switched fault, a failed build, or a candidate that exits on serve.
Evidence: SELF unittest of the three new LifecycleRealTests methods exited 0. Staging leaves the old pid and release in place; the next start clears that journal. Switched and an immediate serve exit both restore the previous real binary.
Impact: The crash candidate delegates version and identity to the real binary so the gate still sees a capable artifact. Login and rdm.ping stay NOT_RUN.
Refs: tests/integration/lifecycle/test_lifecycle_real.py
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: unset object storage panicked on upload, and the retested local fallback is ready to land.
Evidence: GATE run 2804 jobs 4070/4071/4072 success on 42ba9cdf7d, then main only archived a task card. GATE run on cfa8230d4c covers test, test-pg, and svc-realcombo. Backend dc736e339d01 and Documents 05c13a42b14d are pinned. Independent review approved with no blockers.
Impact: unconfigured blob stores use the local artifacts directory. Second-instance writes stay closed.
Refs: #497#186#92
Why: main archived the RDM recovery card after the previous CI, and the branch head has to contain that main.
Evidence: make task-sync exit 0; sync_base=e23cee5561; merge 62422afe5d. SELF. Card archive only.
Impact: task metadata.
Refs: .task/fix-u7-k4-artifact-upload.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=e23cee5561ecb90ba3d52980b239990c0f4def4f.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: The lifecycle gate only ran four realcombo cases. A legacy candidate and a missing or mismatched identity row must be refused before the old process stops, and the prev/sha pins must switch without changing the identity row.
Evidence: SELF unittest of the four LifecycleRealTests methods exited 0 against a private RDM clone. The pin moved to the identity merge and a later commit on the same backend pin, because the previous card-close SHAs build a binary with no ensure/verify.
Impact: make test still skips this class unless SVC_TEST_REAL, SVC_RDM_SRC_DIR and SVC_REAL_RDM_BIN are set. make test-lifecycle now runs the module. Login and rdm.ping stay NOT_RUN.
Refs: tests/integration/lifecycle/rdm.pin
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: main gained the RDM admin recovery after the previous CI, and this head has to contain it.
Evidence: make task-sync exit 0; sync_base=6193db1b54; merge e2e3d25418. SELF. No store-open change, so the K4 drill is not rerun.
Impact: task metadata plus the upstream frontend pin and svc admin tooling.
Refs: .task/fix-u7-k4-artifact-upload.md
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen
