Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-rdm-audit-export-entry.md; R0=99048dda1f48bccb3d5d798050d7beeea2907177.
Impact: task metadata only; the feature workspace starts at 99048dda1f.
Refs: .task/feature-rdm-audit-export-entry.md
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-svc-u3-realcombo.md(PR#484) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: on slow runners the orphaned http child of a stopped stub lingers
a few hundred milliseconds past the parent's exit (ppid-watch suicide),
and the immediately following start - notably the U2 rollback restart -
classified the unparented listener as a foreign occupant and refused to
start (CI run 3774).
Evidence: test_svc_u2/identity/svc suites 82 OK locally with the wait
in both stop paths.
Impact: adds <=3s bounded wait in do_stop/do_stop_quiet after SIGTERM
cleanup; no behavior change when the port is already free.
Why: only the deploy invocation carried RDM_DISABLE_EXEC_TOOLS; the
trailing restart ran without it and the serve died on keyless runners
under the bwrap fail-closed policy (run 3765).
Evidence: local suite green; the restart now inherits the hard-disable.
Impact: tests only.
Why: the CI-only serve-exit failure left no server-side evidence in the
assertion output; the tail pinpoints the refuse reason on the runner.
Evidence: local rerun green (diagnostic inert on success).
Impact: test diagnostics only.
Why: on keyless runners the RDM cache clone and pins materialization
inside svc.sh fetched nested pins over raw SSH URLs (run 2608: host key
verification failed); the suite now injects the same URL-scoped token
header and insteadOf rewrite via environment when SVC_CI_GIT_* is set.
Evidence: local rerun stays green (env unset locally); CI run applies it.
Impact: tests + ci.yaml only; token travels via environment only.
Why: CI runners lack bwrap, so the real RDM binary refuses to start
under the sandbox fail-closed policy (run 2607: serve exits right after
launch); the product provides RDM_DISABLE_EXEC_TOOLS as the top-level
fallback and lifecycle semantics under test are unchanged.
Evidence: local rerun with the env set stays green.
Impact: tests only.
Why: YAML env: values do not shell-expand, so $PWD-based binary paths
reached the suite as literal strings (run 2606: SVC_REAL_BIN not
executable).
Evidence: job log run 2606; paths now exported in the run script.
Impact: ci.yaml only.
Why: the realcombo steps unset the URL-scoped token env before
'submodule update', so nested pins fell back to raw SSH URLs and failed
host-key verification on the runner (first svc-realcombo run 2605).
Evidence: job log run 2605 shows ssh clone failures; reordered steps
keep insteadOf + token header active through the pins fetch.
Impact: ci.yaml ordering only.
Why: stub suites proved the script logic but not real artifact
behavior (the 2026-10-12 incidents passed all stub tests); the report's
U3 requires real-combination gates, and realcombo dry-runs exposed two
real gaps: fresh deploys closed identity governance one lifecycle late,
and pg-bound identity calls put the DSN on the command line.
Evidence: make test exit 0; local realcombo dry-run 16 OK (rows in the
task card); CI adds svc-realcombo (SQLite, both real binaries, full RDM
track) and a real-PG identity step on test-pg with env-delivered DSN.
Impact: tests/test_svc_realcombo.py (SVC_TEST_REAL gate, explicit
NOT_RUN otherwise); ci.yaml new job + test-pg step (RDM clone via
trusted-base URL-scoped token header, allowlist addition reviewed in
this PR); svc.sh delivers identity DSN via AGENT_SYSTEM_DSN and runs
manifest adoption in the same deploy that first registers svc.env;
modules/backend pinned to main (env fallback, backend #182).
Refs: .task/feature-svc-u3-realcombo.md; user goal directive 2026-10-12
(U3); backend #182; RDM #285.
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-svc-u3-realcombo.md; R0=4d362537d0e8755a03b1757b5bad92779a064b33.
Impact: task metadata only; the feature workspace starts at 4d362537d0.
Refs: .task/feature-svc-u3-realcombo.md
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-svc-u2-release-recovery.md(PR#480) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=3b9cf82cd6fb53f973f26e2039275f7858b0c654.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: deploy overwrote live artifacts after stopping the old service, so
a failed start or workbench check left instances in a mixed
registration-vs-artifact state with no recovery path (2026-10-12
rdm1/rdmcand); the report's U2 requires restorable updates.
Evidence: make test-governance 250 OK; five svc suites 105 OK (rows in
the task card); new tests cover layout/pidcheck stability, rollback on
start failure with desired-state restore, build failure keeping the old
service running, interrupted-switch journal resolution, and schema-
advance blocking rollback without touching the database.
Impact: agent deploys stage immutable releases/<id>/ and switch the
current symlink atomically; deploy.journal persists the switch and is
resolved at start/restart/deploy/update/recover entries; legacy layouts
are adopted on first deploy and remain readable; release/rdm tracks
verify sha256 before staging.
Refs: .task/feature-svc-u2-release-recovery.md; user goal directive
2026-10-12; Dev #474 (U1 gate); Documents unified-deploy plan r2.
Why: keep original closure and synchronization evidence after moving the completed card.
Evidence: existing evidence.py read_receipt and append_card validated/imported original SELF receipts; initial scope refusal retained.
Impact: archived task record only; no policy or component change.
Refs: PR #476; PR #479
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=6ba91239e680ef240625dc1e86232c48c4221716.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-agent-pr-merge.md(PR#476) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: include the newly integrated backend identity CLI before testing the combination.
Evidence: SELF task-sync and ancestor verification receipts in the task card; final HEAD CI is required.
Impact: task metadata only; reviewed normative files are unchanged.
Refs: .task/feature-agent-pr-merge.md; PR #476
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-svc-u2-release-recovery.md; R0=9b5be3926eaa394a9e520fd72ffdf6d0a48d1aef.
Impact: task metadata only; the feature workspace starts at 9b5be3926e.
Refs: .task/feature-svc-u2-release-recovery.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=9b5be3926eaa394a9e520fd72ffdf6d0a48d1aef.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-pin-backend-identity-cli.md(PR#477) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: include the newly merged service identity baseline before final CI.
Evidence: SELF task-sync, ancestor check, generator replay and document-link receipts in the task card.
Impact: task metadata only; all reviewed policy and generator content is unchanged.
Refs: .task/feature-agent-pr-merge.md; PR #476
Why: Backend #180 moved the identity CLI to pkg/identity (shared with
Agent-System-RDM per PR 276); Dev main should consume it so composed
binaries carry the same identity semantics and capabilities output.
Evidence: make test exit 0 (combined suite on the bumped pin);
make test-pins ok; rows in the task card.
Impact: gitlink only (bbe9773 -> acabb85, spans #177/#179/#180).
Refs: .task/feature-pin-backend-identity-cli.md; user goal directive
2026-10-12 (implement remaining U1/U2/U3 items in order).
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=6a494d3977e6557e7bebe0e5bb1c4a12091296e0.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: preserve the actual main PR and independently reviewed object before final CI.
Evidence: completed review and authoritative synchronization receipts in the task card; CI must bind the new HEAD.
Impact: task metadata only; no normative or component change.
Refs: https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/476
Why: bind delivery to the completed review and the user authorized cleanup endpoint.
Evidence: independent review run 20261012-123744-f14f6caa and raw records are captured in the task card; final PR CI is still required.
Impact: task metadata only; all eight reviewed policy and generator files remain unchanged.
Refs: .task/feature-agent-pr-merge.md
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-pin-backend-identity-cli.md; R0=6a494d3977e6557e7bebe0e5bb1c4a12091296e0.
Impact: task metadata only; the feature workspace starts at 6a494d3977.
Refs: .task/feature-pin-backend-identity-cli.md
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-svc-identity-u1.md(PR#474) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
weichen