Why: include the current integration baseline before verification.
Evidence: fetched origin/main=99048dda1f48bccb3d5d798050d7beeea2907177.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: Final admission must include newly merged lifecycle validation.
Evidence: Full test/build and real local/public browser acceptance are
recorded; test and PostgreSQL CI passed on a8035bf.
Impact: Task record only; subsequent synchronization receives latest main.
Refs: Dev #483/#484; Frontend #71/#72
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-svc-u3-realcombo.md(PR#484) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: Completion must verify the served frontend and original conversation.
Evidence: Real authenticated local/public refresh and two-page preview;
HTTP2 event stream verified, credentials revoked, data identity unchanged.
Governance review and red/green outputs are in the canonical task card.
Impact: Evidence only; no application or storage change.
Refs: Dev #483; RDM #288/#289; Frontend #71/#72
Why: on slow runners the orphaned http child of a stopped stub lingers
a few hundred milliseconds past the parent's exit (ppid-watch suicide),
and the immediately following start - notably the U2 rollback restart -
classified the unparented listener as a foreign occupant and refused to
start (CI run 3774).
Evidence: test_svc_u2/identity/svc suites 82 OK locally with the wait
in both stop paths.
Impact: adds <=3s bounded wait in do_stop/do_stop_quiet after SIGTERM
cleanup; no behavior change when the port is already free.
Why: Second-resolution release IDs let staging delete a previous release
when a same-source deployment ran within the same clock tick.
Evidence: Fixed-clock rollback regression fails before and passes after;
250 governance checks pass. Independent review replays collision and
copy-failure protection; receipts are in the primary task card.
Impact: Add invocation identity and exclusive directory creation; keep
old artifacts intact. Also retain the latest compatible frontend pointer.
Refs: User-approved I2; Dev #483; Frontend #71/#72
Why: only the deploy invocation carried RDM_DISABLE_EXEC_TOOLS; the
trailing restart ran without it and the serve died on keyless runners
under the bwrap fail-closed policy (run 3765).
Evidence: local suite green; the restart now inherits the hard-disable.
Impact: tests only.
Why: the CI-only serve-exit failure left no server-side evidence in the
assertion output; the tail pinpoints the refuse reason on the runner.
Evidence: local rerun green (diagnostic inert on success).
Impact: test diagnostics only.
Why: on keyless runners the RDM cache clone and pins materialization
inside svc.sh fetched nested pins over raw SSH URLs (run 2608: host key
verification failed); the suite now injects the same URL-scoped token
header and insteadOf rewrite via environment when SVC_CI_GIT_* is set.
Evidence: local rerun stays green (env unset locally); CI run applies it.
Impact: tests + ci.yaml only; token travels via environment only.
Why: CI runners lack bwrap, so the real RDM binary refuses to start
under the sandbox fail-closed policy (run 2607: serve exits right after
launch); the product provides RDM_DISABLE_EXEC_TOOLS as the top-level
fallback and lifecycle semantics under test are unchanged.
Evidence: local rerun with the env set stays green.
Impact: tests only.
Why: YAML env: values do not shell-expand, so $PWD-based binary paths
reached the suite as literal strings (run 2606: SVC_REAL_BIN not
executable).
Evidence: job log run 2606; paths now exported in the run script.
Impact: ci.yaml only.
Why: the realcombo steps unset the URL-scoped token env before
'submodule update', so nested pins fell back to raw SSH URLs and failed
host-key verification on the runner (first svc-realcombo run 2605).
Evidence: job log run 2605 shows ssh clone failures; reordered steps
keep insteadOf + token header active through the pins fetch.
Impact: ci.yaml ordering only.
Why: stub suites proved the script logic but not real artifact
behavior (the 2026-10-12 incidents passed all stub tests); the report's
U3 requires real-combination gates, and realcombo dry-runs exposed two
real gaps: fresh deploys closed identity governance one lifecycle late,
and pg-bound identity calls put the DSN on the command line.
Evidence: make test exit 0; local realcombo dry-run 16 OK (rows in the
task card); CI adds svc-realcombo (SQLite, both real binaries, full RDM
track) and a real-PG identity step on test-pg with env-delivered DSN.
Impact: tests/test_svc_realcombo.py (SVC_TEST_REAL gate, explicit
NOT_RUN otherwise); ci.yaml new job + test-pg step (RDM clone via
trusted-base URL-scoped token header, allowlist addition reviewed in
this PR); svc.sh delivers identity DSN via AGENT_SYSTEM_DSN and runs
manifest adoption in the same deploy that first registers svc.env;
modules/backend pinned to main (env fallback, backend #182).
Refs: .task/feature-svc-u3-realcombo.md; user goal directive 2026-10-12
(U3); backend #182; RDM #285.
Why: Bind the fixed frontend pin to the current integration baseline.
Evidence: Startup, task-sync, regression red/green, independent reviewer
replay and browser receipts in the canonical task card.
Impact: Evidence and phase authorization only.
Refs: Frontend #71; surface-black-screen-recovery
Why: Dev #452 selected a frontend pointer lacking the previously merged
SurfaceMeta hydration fix and blanked saved-page conversations.
Evidence: Independent review and regression red/green receipts are in
.task/feature-surface-black-screen-recovery.md; make test/build follow.
Impact: Pin the frontend that retains fast-slow and saved-page recovery;
no backend, UI token, storage or permission configuration change.
Refs: Frontend #68; Dev #454; Dev #452; surface-black-screen-recovery
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-svc-u3-realcombo.md; R0=4d362537d0e8755a03b1757b5bad92779a064b33.
Impact: task metadata only; the feature workspace starts at 4d362537d0.
Refs: .task/feature-svc-u3-realcombo.md
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-surface-black-screen-recovery.md; R0=4d362537d0e8755a03b1757b5bad92779a064b33.
Impact: task metadata only; the feature workspace starts at 4d362537d0.
Refs: .task/feature-surface-black-screen-recovery.md
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-svc-u2-release-recovery.md(PR#480) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=3b9cf82cd6fb53f973f26e2039275f7858b0c654.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: deploy overwrote live artifacts after stopping the old service, so
a failed start or workbench check left instances in a mixed
registration-vs-artifact state with no recovery path (2026-10-12
rdm1/rdmcand); the report's U2 requires restorable updates.
Evidence: make test-governance 250 OK; five svc suites 105 OK (rows in
the task card); new tests cover layout/pidcheck stability, rollback on
start failure with desired-state restore, build failure keeping the old
service running, interrupted-switch journal resolution, and schema-
advance blocking rollback without touching the database.
Impact: agent deploys stage immutable releases/<id>/ and switch the
current symlink atomically; deploy.journal persists the switch and is
resolved at start/restart/deploy/update/recover entries; legacy layouts
are adopted on first deploy and remain readable; release/rdm tracks
verify sha256 before staging.
Refs: .task/feature-svc-u2-release-recovery.md; user goal directive
2026-10-12; Dev #474 (U1 gate); Documents unified-deploy plan r2.
Why: keep original closure and synchronization evidence after moving the completed card.
Evidence: existing evidence.py read_receipt and append_card validated/imported original SELF receipts; initial scope refusal retained.
Impact: archived task record only; no policy or component change.
Refs: PR #476; PR #479
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=6ba91239e680ef240625dc1e86232c48c4221716.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-agent-pr-merge.md(PR#476) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: include the newly integrated backend identity CLI before testing the combination.
Evidence: SELF task-sync and ancestor verification receipts in the task card; final HEAD CI is required.
Impact: task metadata only; reviewed normative files are unchanged.
Refs: .task/feature-agent-pr-merge.md; PR #476
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-svc-u2-release-recovery.md; R0=9b5be3926eaa394a9e520fd72ffdf6d0a48d1aef.
Impact: task metadata only; the feature workspace starts at 9b5be3926e.
Refs: .task/feature-svc-u2-release-recovery.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=9b5be3926eaa394a9e520fd72ffdf6d0a48d1aef.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-pin-backend-identity-cli.md(PR#477) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: include the newly merged service identity baseline before final CI.
Evidence: SELF task-sync, ancestor check, generator replay and document-link receipts in the task card.
Impact: task metadata only; all reviewed policy and generator content is unchanged.
Refs: .task/feature-agent-pr-merge.md; PR #476
Why: Backend #180 moved the identity CLI to pkg/identity (shared with
Agent-System-RDM per PR 276); Dev main should consume it so composed
binaries carry the same identity semantics and capabilities output.
Evidence: make test exit 0 (combined suite on the bumped pin);
make test-pins ok; rows in the task card.
Impact: gitlink only (bbe9773 -> acabb85, spans #177/#179/#180).
Refs: .task/feature-pin-backend-identity-cli.md; user goal directive
2026-10-12 (implement remaining U1/U2/U3 items in order).
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=6a494d3977e6557e7bebe0e5bb1c4a12091296e0.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
weichen