Why: Close this task after verified merge, CI and runtime acceptance.
Evidence: Original PR results, actor/runner and exact-head CI readbacks
are preserved in the archived record.
Impact: Archive this task only; no source, configuration or other card.
Refs: Dev #483; RDM #288; Frontend #71
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=2c016931044bebdc4a114c1ca1127d1b40d4ab17.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Preserve real merge results, current-head CI and runtime acceptance.
Evidence: Gitea admission/merge readbacks and independent/live replay
receipts in this task only.
Impact: Metadata only; no unrelated task closure.
Refs: Dev #483; Frontend #71/#72; RDM #288
Why: Fixed identity contract and current main must share one candidate.
Evidence: Saved final sync, real SQLite/PG replays and live public
recovery receipts; exact current-head CI will decide admission.
Impact: Task metadata only.
Refs: Dev #483/#485; Frontend #71/#72
Why: The synchronization gate requires saved task evidence.
Evidence: Current product build and actual binary replay receipts are in
the canonical task record; subsequent sync uses an external receipt.
Impact: Evidence only.
Refs: Dev #483/#485
Why: Required lifecycle gates must follow the current identity contract.
Evidence: Real binary and temporary PostgreSQL replay, independent
review, and D1 synchronization records in the canonical task card.
Impact: Evidence only; application changes remain the approved recovery
and release collision protection with current main work preserved.
Refs: Dev #483/#485; Frontend #71/#72
Why: Main D1 now shares the same explicit fixture initialization contract.
Evidence: Both real SQLite and temporary PostgreSQL initialization paths
were independently replayed; capabilities JSON assertions are preserved.
Impact: Resolve duplicate PG setup through the tested helper; preserve
all main lifecycle changes and the rollback directory protection.
Refs: Dev #483/#485; D1 existing-store identity contract
Why: Current RDM identity ensure/verify intentionally refuse missing
databases and schema; the old fixture invoked them on empty stores.
Evidence: Actual RDM red failure, real SQLite and isolated PostgreSQL
green replays, and independent review receipts in the task card.
Impact: Test setup only; normal serve initializes temporary stores and
is reaped before the unchanged identity/lifecycle assertions.
Refs: Dev #483/#484; current RDM D1 existing-store contract
Why: deploys need a side-effect-free identity probe, an isolated lifecycle child, and the release transaction already on main.
Evidence: GATE run 2667 jobs 3845 test, 3846 test-pg, 3847 svc-realcombo all success on b4eb3a814c.
Impact: update and recover run in a clean child; serve keeps the exec-tool kill switch; Backend pin is 0f192a4.
Refs: #485
Why: identity ensure no longer creates the schema, so the probe has to follow a real serve that applies migrations.
Evidence: SELF python3 -m py_compile tests/test_svc_realcombo.py. GATE run 2663 job 3839 failed on the previous head with identity table missing.
Impact: the PostgreSQL check still passes the DSN only through the environment, after serve has migrated.
Refs: #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: env -i dropped RDM_DISABLE_EXEC_TOOLS, so the real RDM binary exited immediately on runners without bwrap, and the capability probe now prints the JSON document.
Evidence: SELF bash -n scripts/svc.sh; python3 -m py_compile tests/test_svc_realcombo.py. GATE run 2656 job 3831 failed on the previous head before this fix.
Impact: serve and the lifecycle child forward that one switch; identity capabilities is checked as protocol 1 JSON.
Refs: #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: main gained the real-combination CI gate after the previous sync, and this branch still has to carry that gate with the isolated identity calls.
Evidence: SELF python3 -m unittest recovery/identity/u2/deploy/pin/isolation — 100 tests OK (2 skipped); bash -n scripts/svc.sh.
Impact: identity ensure/verify still pass DSN only through the environment; stop waits for the port and can keep the desired state. CI keeps the lifecycle pin step and the svc-realcombo job.
Refs: #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Admit the recovery fix with the latest lifecycle guardrails.
Evidence: Independent replay on the synchronized combination and live
public recovery receipts; exact current-head CI is awaited next.
Impact: Evidence only; no further source changes.
Refs: Dev #483/#484; Frontend #71/#72
Why: env -i dropped SVC_STUB_*, so recovery tests saw an empty serve record even though the bound DSN was still passed.
Evidence: SELF python3 -m unittest tests.test_svc.SvcDbRecoveryTests tests.test_svc_lifecycle_isolation — 34 tests OK.
Impact: only SVC_STUB_* is added at launch; serve.env still omits them, and caller AGENT_SYSTEM_* stays out of the process.
Refs: #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=99048dda1f48bccb3d5d798050d7beeea2907177.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Final admission must include newly merged lifecycle validation.
Evidence: Full test/build and real local/public browser acceptance are
recorded; test and PostgreSQL CI passed on a8035bf.
Impact: Task record only; subsequent synchronization receives latest main.
Refs: Dev #483/#484; Frontend #71/#72
Why: main already has one release transaction, so this branch keeps that path and only isolates update and recover in a clean child.
Evidence: SELF bash -n scripts/svc.sh; python3 -m unittest identity/recover/deploy/u2/lifecycle pin 92 tests OK (2 skipped), then 66 tests OK after dropping the obsolete journal hook.
Impact: deploy uses releases/ and deploy.journal; the lifecycle child reconciles that journal before deploy or recover. Backend pin is 0f192a4.
Refs: #485
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-svc-u3-realcombo.md(PR#484) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: Completion must verify the served frontend and original conversation.
Evidence: Real authenticated local/public refresh and two-page preview;
HTTP2 event stream verified, credentials revoked, data identity unchanged.
Governance review and red/green outputs are in the canonical task card.
Impact: Evidence only; no application or storage change.
Refs: Dev #483; RDM #288/#289; Frontend #71/#72
Why: on slow runners the orphaned http child of a stopped stub lingers
a few hundred milliseconds past the parent's exit (ppid-watch suicide),
and the immediately following start - notably the U2 rollback restart -
classified the unparented listener as a foreign occupant and refused to
start (CI run 3774).
Evidence: test_svc_u2/identity/svc suites 82 OK locally with the wait
in both stop paths.
Impact: adds <=3s bounded wait in do_stop/do_stop_quiet after SIGTERM
cleanup; no behavior change when the port is already free.
Why: Second-resolution release IDs let staging delete a previous release
when a same-source deployment ran within the same clock tick.
Evidence: Fixed-clock rollback regression fails before and passes after;
250 governance checks pass. Independent review replays collision and
copy-failure protection; receipts are in the primary task card.
Impact: Add invocation identity and exclusive directory creation; keep
old artifacts intact. Also retain the latest compatible frontend pointer.
Refs: User-approved I2; Dev #483; Frontend #71/#72
Why: only the deploy invocation carried RDM_DISABLE_EXEC_TOOLS; the
trailing restart ran without it and the serve died on keyless runners
under the bwrap fail-closed policy (run 3765).
Evidence: local suite green; the restart now inherits the hard-disable.
Impact: tests only.
Why: the branches are ready for review but are not merged, so the card
must stay open and say what was verified on the live instances.
Evidence: local commits listed in the card. Companion pages titled RDM 工作台 returned HTTP 200. rdm.ping did not return a domain result. No data was moved.
Impact: documentation only. Login and the real lifecycle suite stay NOT_RUN.
Refs: recovery plan r3.1
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the CI-only serve-exit failure left no server-side evidence in the
assertion output; the tail pinpoints the refuse reason on the runner.
Evidence: local rerun green (diagnostic inert on success).
Impact: test diagnostics only.
Why: an update that stops the old process and overwrites the binary cannot
get the previous version back, and a migration the old binary cannot read
must be refused before that stop. CI also had no fixed RDM SHA to build from.
Evidence: python3 -m unittest tests.test_svc_identity tests.test_svc_recover tests.test_svc_deploy_txn tests.test_lifecycle_pin passed. make test-lifecycle exits 2 when AGENT_PG_TEST_DSN is unset.
Impact: installs land in releases/<rid> and current switches with mv -T.
Deploy keeps the desired state and rolls back a non-terminal journal.
Schema compatFloor above the installed target is refused unless
--migrate-schema --confirm is paired with a backup. test-lifecycle fails
closed without PostgreSQL and an RDM checkout. Login stays NOT_RUN.
Refs: recovery plan r3.1 D2 and D3; Backend feature/d1-identity-open
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: on keyless runners the RDM cache clone and pins materialization
inside svc.sh fetched nested pins over raw SSH URLs (run 2608: host key
verification failed); the suite now injects the same URL-scoped token
header and insteadOf rewrite via environment when SVC_CI_GIT_* is set.
Evidence: local rerun stays green (env unset locally); CI run applies it.
Impact: tests + ci.yaml only; token travels via environment only.
Why: CI runners lack bwrap, so the real RDM binary refuses to start
under the sandbox fail-closed policy (run 2607: serve exits right after
launch); the product provides RDM_DISABLE_EXEC_TOOLS as the top-level
fallback and lifecycle semantics under test are unchanged.
Evidence: local rerun with the env set stays green.
Impact: tests only.
Why: YAML env: values do not shell-expand, so $PWD-based binary paths
reached the suite as literal strings (run 2606: SVC_REAL_BIN not
executable).
Evidence: job log run 2606; paths now exported in the run script.
Impact: ci.yaml only.
Why: the realcombo steps unset the URL-scoped token env before
'submodule update', so nested pins fell back to raw SSH URLs and failed
host-key verification on the runner (first svc-realcombo run 2605).
Evidence: job log run 2605 shows ssh clone failures; reordered steps
keep insteadOf + token header active through the pins fetch.
Impact: ci.yaml ordering only.
Why: stub suites proved the script logic but not real artifact
behavior (the 2026-10-12 incidents passed all stub tests); the report's
U3 requires real-combination gates, and realcombo dry-runs exposed two
real gaps: fresh deploys closed identity governance one lifecycle late,
and pg-bound identity calls put the DSN on the command line.
Evidence: make test exit 0; local realcombo dry-run 16 OK (rows in the
task card); CI adds svc-realcombo (SQLite, both real binaries, full RDM
track) and a real-PG identity step on test-pg with env-delivered DSN.
Impact: tests/test_svc_realcombo.py (SVC_TEST_REAL gate, explicit
NOT_RUN otherwise); ci.yaml new job + test-pg step (RDM clone via
trusted-base URL-scoped token header, allowlist addition reviewed in
this PR); svc.sh delivers identity DSN via AGENT_SYSTEM_DSN and runs
manifest adoption in the same deploy that first registers svc.env;
modules/backend pinned to main (env fallback, backend #182).
Refs: .task/feature-svc-u3-realcombo.md; user goal directive 2026-10-12
(U3); backend #182; RDM #285.
Why: Bind the fixed frontend pin to the current integration baseline.
Evidence: Startup, task-sync, regression red/green, independent reviewer
replay and browser receipts in the canonical task card.
Impact: Evidence and phase authorization only.
Refs: Frontend #71; surface-black-screen-recovery
Why: Dev #452 selected a frontend pointer lacking the previously merged
SurfaceMeta hydration fix and blanked saved-page conversations.
Evidence: Independent review and regression red/green receipts are in
.task/feature-surface-black-screen-recovery.md; make test/build follow.
Impact: Pin the frontend that retains fast-slow and saved-page recovery;
no backend, UI token, storage or permission configuration change.
Refs: Frontend #68; Dev #454; Dev #452; surface-black-screen-recovery
Why: probing identity by running the subcommand still launched old RDM
builds, and ensure on a missing database created an empty one. A batch
update also inherited the caller's AGENT_SYSTEM_* variables.
Evidence: python3 -m unittest tests.test_svc_identity tests.test_svc_recover passed (41 tests, 1 skipped). tests.test_svc_lifecycle_isolation caller-env and restart cases passed.
Impact: capability probes use version --json only. Established instances
refuse a missing identity row until adopt --confirm. update and recover
run each service in a clean environment. serve reads a 0600 serve.env
and does not inherit the caller environment. Backend and documents pins
move to the D1 identity and recovery-plan commits.
Refs: recovery plan r3.1 D1; Backend feature/d1-identity-open; RDM feature/d1-version-json
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-svc-u3-realcombo.md; R0=4d362537d0e8755a03b1757b5bad92779a064b33.
Impact: task metadata only; the feature workspace starts at 4d362537d0.
Refs: .task/feature-svc-u3-realcombo.md
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-surface-black-screen-recovery.md; R0=4d362537d0e8755a03b1757b5bad92779a064b33.
Impact: task metadata only; the feature workspace starts at 4d362537d0.
Refs: .task/feature-surface-black-screen-recovery.md
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-svc-u2-release-recovery.md(PR#480) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
weichen
