Compare commits

..
Author SHA1 Message Date
agent-exec-transport d55ff23b0c Explain why CI keeps both submodule SSH endpoint mappings
ci / test-pg (pull_request) Failing after 8m34s
ci / test (pull_request) Successful in 13m13s
ci / svc-realcombo (pull_request) Successful in 5m31s
Why: After the Gitea migration some repositories still declare the legacy
endpoint in .gitmodules while facts F3 names the new one as authoritative. Both
endpoints currently resolve and serve git, so CI needs both insteadOf mappings;
dropping either one makes that batch of pins fall back to real SSH and the
svc-realcombo job fails on host key verification.

Evidence: 2026-10-23 measurement from this machine — both endpoints answer
git ls-remote with the same HEAD; Agent-System-Dev declares 14 submodule URLs on
the legacy endpoint, Agent-System-Backend 10, Agent-System-RDM 8 and
Agent-System-KB-Regulations 2 on the new one.

Impact: comments only; no GIT_CONFIG key, job structure or credential handling
changes.

Refs: feature/ecs-deploy-dev8788-and-kb
2026-10-23 13:06:55 +00:00
weichen 05b1e34dc5 Fold-close the task card before merge
Why: close the task card inside its own PR so landing it needs no post-merge backfill or separate close PR.
Evidence: .task/feature-ecs-deploy-dev8788-and-kb.md -> .task/archive/feature-ecs-deploy-dev8788-and-kb.md; status 已完成(合入前闭合); PR #720 https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/720.
Impact: task metadata only; the card is archived within PR #720 and lands with its merge commit.
Refs: task.sh close --self
2026-10-23 12:42:04 +00:00
agent-exec-transport 5b049635f2 agent-exec transport a585136683482f35894f1bc0d75761a0/c202188f5f7b
ci / svc-realcombo (pull_request) Successful in 4m30s
ci / test (pull_request) Successful in 10m29s
ci / test-pg (pull_request) Successful in 14m5s
2026-10-23 12:25:46 +00:00
agent-exec-transport b258490afe Record the ECS deployment and map the migrated submodule SSH endpoint in CI
ci / svc-realcombo (pull_request) Failing after 3m2s
ci / test (pull_request) Successful in 9m32s
ci / test-pg (pull_request) Successful in 13m24s
Why: The owner asked to merge the fixes after ECS deployment. The Dev task-card
PR could not go green because svc-realcombo failed: its RDM checkout only
rewrote the legacy SSH endpoint for nested pins, so pins using the migrated
endpoint fell back to real SSH and died with host key verification.

Evidence: PR #720 rerun shows test and test-pg green and svc-realcombo failing on
'Host key verification failed' while cloning Agent-System-KB-Regulations over
ssh://git@gitea.naitangbaobao.cn:52222/. The patch adds a second insteadOf value
for that endpoint alongside the legacy one and completes the unset list; the
workflow still parses and keeps the token-only credential discipline.

Impact: CI submodule checkout only; the ECS delivery record in the task card is
unchanged.

Refs: feature/ecs-deploy-dev8788-and-kb
2026-10-23 11:50:29 +00:00
weichen d447cc38f0 Record the sync checkpoint
ci / test-pg (pull_request) Successful in 13m11s
ci / svc-realcombo (pull_request) Failing after 1m52s
ci / test (pull_request) Successful in 10m12s
Why: bind the task validation checkpoint to the integration baseline.

Evidence: SELF recursive component checks; sync_base=0650e81133b853f27e8e53f516de8f6c1e73e4a4; before_record=1a3f9a1e5f08d25cedc82024ba1354b186932777.

Impact: task metadata only.

Refs: .task/feature-ecs-deploy-dev8788-and-kb.md
2026-10-23 11:13:15 +00:00
weichen 1a3f9a1e5f Merge authoritative main into the task branch
Why: include the current integration baseline before verification.

Evidence: fetched origin/main=0650e81133b853f27e8e53f516de8f6c1e73e4a4.

Impact: integrate upstream changes without rewriting task history.

Refs: task-sync
2026-10-23 11:12:17 +00:00
weichen 06d1fba852 Record the ECS redeploy, the owner-specified role setup and the merge
Why: Owner accepted the 58788 build and asked to deploy the binary, knowledge
base and model configuration to imc-tx-ecs, then to merge the fixes.

Evidence: ECS rehearsal on a data copy reproduced all six owner-specified
flows; cutover stopped 13:24:45 and healthy 13:24:51 CST (downtime 6.13 s) with
exe sha256 941f8eef; post-cutover reconciliation against the cold backup reports
problems=[] with zero missing files and rows; the 系统工程师 role carries only
project.create and is bound to all 19 accounts; sundehui is the single super
admin with an unchanged password; the knowledge base answers 1701178 legal
nodes; the model configuration now carries fallbacks, reserve and vision with
five system-scope secrets. Backend PR #250, frontend PR #129 and RDM PR #482 all
merged through worker transports with green CI.

Impact: ECS dev 8788 runs the accepted build; the merged tree produces a new
artifact (frontend now comes from merged main) which is not yet deployed.

Refs: feature/ecs-deploy-dev8788-and-kb
2026-10-23 11:12:10 +00:00
weichen f813f28f36 Roll ECS dev 8788 back to the previous build after acceptance failure
Why: The new build returned 'extension: project context unavailable:
not-found' in business use, and the owner asked for an immediate rollback.

Evidence: rollback restored the previous binary (exe sha256 1f45f640) on pid
1619863 with schema v35 and rdm schema_version 6, local/healthz/domain 200;
post-rollback reconciliation problems=[] with zero missing files and rows,
605 to 609 files where the four additions are user files created after the
baseline; rollback kit sha ok; knowledge base still serving 1701178 legal nodes.
The rollback first ran against an empty database because the script pre-created
the backup data directory and nested the copy; it was corrected immediately from
the real cold-backup path and both scripts are fixed.

Impact: ECS is back on dev@a706e9a+rdm@4b2473bed112 with intact data; the
knowledge base deployment stays in place but dormant; the super-admin marker
was reverted with the data and must be re-applied on the next attempt.

Refs: feature/ecs-deploy-dev8788-and-kb
2026-10-23 00:51:25 +00:00
weichen 2487b561bb Record the sync checkpoint
Why: bind the task validation checkpoint to the integration baseline.

Evidence: SELF recursive component checks; sync_base=6ced938a126981ee2a4fab671a2da94f49cb56c5; before_record=d436d6718ca997e575ad8be3d149efefca8cedd8.

Impact: task metadata only.

Refs: .task/feature-ecs-deploy-dev8788-and-kb.md
2026-10-23 00:46:40 +00:00
weichen d436d6718c Merge authoritative main into the task branch
Why: include the current integration baseline before verification.

Evidence: fetched origin/main=6ced938a126981ee2a4fab671a2da94f49cb56c5.

Impact: integrate upstream changes without rewriting task history.

Refs: task-sync
2026-10-23 00:45:44 +00:00
weichen be201a504f Record ECS cutover result: 6.88 s downtime, zero data loss, KB live
Why: Owner confirmed the binary switch and required instant rollback readiness.

Evidence: cutover stopped 08:43:27 and healthy 08:43:30 CST (downtime 6.88 s),
pid 1617793 with exe sha256 00ead2cf, schema v51, local/healthz/domain 200;
post-cutover reconciliation problems=[] with zero missing files and rows, the
only row diffs being the two verification sessions and sundehui's own row;
secrets 10/10 match, settings_snapshots=11 mismatches=0; rollback kit sha OK and
rollback-now.sh ready; running process carries all nine KBREG_* variables and
kbreg search over a tunnel still resolves the published revision.

Impact: task card only; ECS dev 8788 now serves the same build as the local
dev instance with the local knowledge base attached.

Refs: feature/ecs-deploy-dev8788-and-kb
2026-10-23 00:45:41 +00:00
weichen f9a953831b Configure ECS super admin as existing account sundehui and stage cutover
Why: Owner asked to prepare configuration first: use the existing sundehui
account on imc-tx-ecs as the super administrator with password 12345678 and a
forced password reset on first login.

Evidence: rehearsal on the 8789 copy — migrate-only start (auth off) v35 to v51
in 0.27 s, seed-superadmin.py elevates sundehui without creating an account
(users still 18), auth-on start logs 'already established', login returns
isSuperAdmin with sessionScope set_password_only, no errors in the log. Remote
super-admin.env (600) and the two-file EnvironmentFile drop-in are in place;
the live service was not stopped.

Impact: task card only. Product startup refuses to elevate an existing account
from env, so the elevation is an explicit, rehearsal-verified write mirroring
the product bootstrap; cutover script now runs migrate, seed, start phases.

Refs: feature/ecs-deploy-dev8788-and-kb
2026-10-22 23:10:01 +00:00
weichen 68ca3f5fb1 Record ECS dev 8788 and knowledge base deployment task card
Why: Owner asked to deploy the local 8788 dev binary service and the local
knowledge base to imc-tx-ecs, with a remote backup first and a minimal-downtime
cutover that needs owner confirmation.

Evidence: make evidence receipts for the remote warm backup (629 files, sha OK),
the offsite copy, the knowledge base fingerprint comparison, the end-to-end KB
search through a tunnel, the remote inventory, and the 8789 rehearsal instance
(schema v35 -> v51, healthy in 1.02 s, no errors).

Impact: .task card only; no product code, no runtime change yet. The live ECS
service was not stopped (pid 4080336 unchanged since 2026-10-18).

Refs: feature/ecs-deploy-dev8788-and-kb; supersedes none; related to
.task/archive/feature-ecs-sync-local-dev.md
2026-10-22 15:24:46 +00:00
weichen c8d22d6ddb Record the task card for feature-ecs-deploy-dev8788-and-kb
Why: establish the authorized task workspace and its initial baseline.

Evidence: preserved precheck receipt in .task/feature-ecs-deploy-dev8788-and-kb.md; R0=cb36b59accd0418c5ca952912d7c181b83038a4c.

Impact: task metadata only; the feature workspace starts at cb36b59acc.

Refs: .task/feature-ecs-deploy-dev8788-and-kb.md
2026-10-22 13:41:37 +00:00
3 changed files with 724 additions and 28 deletions
+31 -27
View File
@@ -35,9 +35,7 @@ jobs:
parsed_server = urlsplit(SERVER)
if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
sys.exit("Checkout server must be the platform-injected http(s) URL")
# Allowed SSH prefixes: legacy nyat.app:31411 and migrated gitea.naitangbaobao.cn:52222.
SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
SSH_MIGRATED = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
# Reviewed allowlist, independent of candidate .gitmodules. Add repositories
# here only with an explicit review of the checkout credential's scope.
REPOSITORIES = {
@@ -126,7 +124,7 @@ jobs:
if not repository or fields.get("path") != name:
raise ValueError("Submodule path is outside the reviewed allowlist")
trusted_url = f"{SERVER}/weichen/{repository}.git"
if fields.get("url") not in {SSH + repository + ".git", SSH_MIGRATED + repository + ".git", trusted_url}:
if fields.get("url") not in {SSH + repository + ".git", trusted_url}:
raise ValueError("Submodule URL is outside the reviewed allowlist")
for name in entries:
url = f"{SERVER}/weichen/{REPOSITORIES[name]}.git"
@@ -246,9 +244,7 @@ jobs:
parsed_server = urlsplit(SERVER)
if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
sys.exit("Checkout server must be the platform-injected http(s) URL")
# Allowed SSH prefixes: legacy nyat.app:31411 and migrated gitea.naitangbaobao.cn:52222.
SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
SSH_MIGRATED = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
# Reviewed allowlist, independent of candidate .gitmodules. Add repositories
# here only with an explicit review of the checkout credential's scope.
REPOSITORIES = {
@@ -337,7 +333,7 @@ jobs:
if not repository or fields.get("path") != name:
raise ValueError("Submodule path is outside the reviewed allowlist")
trusted_url = f"{SERVER}/weichen/{repository}.git"
if fields.get("url") not in {SSH + repository + ".git", SSH_MIGRATED + repository + ".git", trusted_url}:
if fields.get("url") not in {SSH + repository + ".git", trusted_url}:
raise ValueError("Submodule URL is outside the reviewed allowlist")
for name in entries:
url = f"{SERVER}/weichen/{REPOSITORIES[name]}.git"
@@ -429,11 +425,17 @@ jobs:
set -euo pipefail
# 凭据纪律与 Checkout 块同源:经 GIT_CONFIG_* 环境注入 URL 级 token 头,
# 不落文件/命令行;allowlist 扩项 = Agent-System-RDM 及其 pins(同一
# 组件集合),由本 PR 评审背书。SSH pins URL(新旧两形态均改写)以
# insteadOf 改写到受信 https 基址后再取。只追加 pin 的三个 40 位 hex,
# 不 source pin 文件。
# 组件集合),由本 PR 评审背书。SSH pins URL 以 insteadOf 改写到受信
# https 基址后再取。只追加 pin 的三个 40 位 hex,不 source pin 文件。
SERVER="$(printf '%s' "$GITHUB_SERVER_URL" | sed 's:/*$::')"
scheme="${GITHUB_SERVER_URL%%://*}"
# 嵌套 pins 的 SSH 端点有两代:旧 git-ssh.*:31411 与迁移后的 gitea.*:52222。
# 两个 insteadOf 必须同时保留,直到本仓与所有组件仓的 .gitmodules 全部迁到
# 新端点(policy/facts.md F3 已把新端点列为权威;2026-10-23 实测本仓
# .gitmodules 仍有旧端点子模块,Agent-System-Backend 亦然):
# · 去掉旧端点映射 → 旧端点声明的子模块退回真实 SSH,CI 无 key 必失败;
# · 去掉新端点映射 → RDM/KB 等已迁移的 pins 同样退回真实 SSH 而失败。
# 同键多值,git 会依次匹配。
export GIT_CONFIG_COUNT=5
export GIT_CONFIG_KEY_0="protocol.$scheme.allow"
export GIT_CONFIG_VALUE_0="always"
@@ -441,10 +443,10 @@ jobs:
export GIT_CONFIG_VALUE_1="AUTHORIZATION: token $SUBMODULE_TOKEN"
export GIT_CONFIG_KEY_2="url.$SERVER/weichen/.insteadOf"
export GIT_CONFIG_VALUE_2="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
export GIT_CONFIG_KEY_3="url.$SERVER/weichen/.insteadOf"
export GIT_CONFIG_VALUE_3="ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
export GIT_CONFIG_KEY_4="core.hooksPath"
export GIT_CONFIG_VALUE_4="/dev/null"
export GIT_CONFIG_KEY_3="core.hooksPath"
export GIT_CONFIG_VALUE_3="/dev/null"
export GIT_CONFIG_KEY_4="url.$SERVER/weichen/.insteadOf"
export GIT_CONFIG_VALUE_4="ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
git clone --depth=1 "$SERVER/weichen/Agent-System-RDM.git" rdm
mapfile -t pins < <(python3 - <<'PY'
import pathlib
@@ -483,7 +485,6 @@ jobs:
-u GIT_CONFIG_KEY_1 -u GIT_CONFIG_VALUE_1 \
-u GIT_CONFIG_KEY_2 -u GIT_CONFIG_VALUE_2 \
-u GIT_CONFIG_KEY_3 -u GIT_CONFIG_VALUE_3 \
-u GIT_CONFIG_KEY_4 -u GIT_CONFIG_VALUE_4 \
-u SUBMODULE_TOKEN \
"$@"
}
@@ -578,9 +579,7 @@ jobs:
parsed_server = urlsplit(SERVER)
if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
sys.exit("Checkout server must be the platform-injected http(s) URL")
# Allowed SSH prefixes: legacy nyat.app:31411 and migrated gitea.naitangbaobao.cn:52222.
SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
SSH_MIGRATED = "ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
# Reviewed allowlist, independent of candidate .gitmodules. Add repositories
# here only with an explicit review of the checkout credential's scope.
REPOSITORIES = {
@@ -669,7 +668,7 @@ jobs:
if not repository or fields.get("path") != name:
raise ValueError("Submodule path is outside the reviewed allowlist")
trusted_url = f"{SERVER}/weichen/{repository}.git"
if fields.get("url") not in {SSH + repository + ".git", SSH_MIGRATED + repository + ".git", trusted_url}:
if fields.get("url") not in {SSH + repository + ".git", trusted_url}:
raise ValueError("Submodule URL is outside the reviewed allowlist")
for name in entries:
url = f"{SERVER}/weichen/{REPOSITORIES[name]}.git"
@@ -724,10 +723,17 @@ jobs:
set -euo pipefail
# 凭据纪律与 Checkout 块同源:经 GIT_CONFIG_* 环境注入 URL 级 token 头,
# 不落文件/命令行;allowlist 扩项 = Agent-System-RDM 及其 pins(同一
# 组件集合),由本 PR 评审背书。SSH pins URL(新旧两形态均改写)以
# insteadOf 改写到受信 https 基址后再取。
# 组件集合),由本 PR 评审背书。SSH pins URL 以 insteadOf 改写到受信
# https 基址后再取。
SERVER="$(printf '%s' "$GITHUB_SERVER_URL" | sed 's:/*$::')"
scheme="${GITHUB_SERVER_URL%%://*}"
# 嵌套 pins 的 SSH 端点有两代:旧 git-ssh.*:31411 与迁移后的 gitea.*:52222。
# 两个 insteadOf 必须同时保留,直到本仓与所有组件仓的 .gitmodules 全部迁到
# 新端点(policy/facts.md F3 已把新端点列为权威;2026-10-23 实测本仓
# .gitmodules 仍有旧端点子模块,Agent-System-Backend 亦然):
# · 去掉旧端点映射 → 旧端点声明的子模块退回真实 SSH,CI 无 key 必失败;
# · 去掉新端点映射 → RDM/KB 等已迁移的 pins 同样退回真实 SSH 而失败。
# 同键多值,git 会依次匹配。
export GIT_CONFIG_COUNT=5
export GIT_CONFIG_KEY_0="protocol.$scheme.allow"
export GIT_CONFIG_VALUE_0="always"
@@ -735,10 +741,10 @@ jobs:
export GIT_CONFIG_VALUE_1="AUTHORIZATION: token $SUBMODULE_TOKEN"
export GIT_CONFIG_KEY_2="url.$SERVER/weichen/.insteadOf"
export GIT_CONFIG_VALUE_2="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
export GIT_CONFIG_KEY_3="url.$SERVER/weichen/.insteadOf"
export GIT_CONFIG_VALUE_3="ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
export GIT_CONFIG_KEY_4="core.hooksPath"
export GIT_CONFIG_VALUE_4="/dev/null"
export GIT_CONFIG_KEY_3="core.hooksPath"
export GIT_CONFIG_VALUE_3="/dev/null"
export GIT_CONFIG_KEY_4="url.$SERVER/weichen/.insteadOf"
export GIT_CONFIG_VALUE_4="ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
git clone --depth=1 "$SERVER/weichen/Agent-System-RDM.git" rdm
# 凭据环境须保持到 pins 子模块取完(insteadOf + token 头覆盖嵌套 SSH URL),
# 之后再 unset。
@@ -757,11 +763,9 @@ jobs:
set -euo pipefail
# 路径变量在脚本内解析(YAML env: 不做 shell 展开)。
export SVC_TEST_REAL=1
env -u SUBMODULE_TOKEN make -C rdm product
export SVC_REAL_BIN="$PWD/bin/agent-system"
export SVC_REAL_RDM_BIN="$PWD/rdm/bin/agent-system-rdm-product"
export SVC_RDM_SRC_DIR="$PWD/rdm"
export SVC_RDM_ORIGIN="${{ github.server_url}}/weichen/Agent-System-RDM.git"
export SVC_REAL_RDM_BIN="$PWD/rdm/bin/agent-system-rdm"
export SVC_RDM_ORIGIN="$PWD/rdm"
# CI 无 SSH key:把受信基址与 URL 级 token 头经环境交给套件(仅环境传递)。
export SVC_CI_GIT_SERVER="${GITHUB_SERVER_URL%/}"
export SVC_CI_GIT_TOKEN="${SUBMODULE_TOKEN}"
@@ -0,0 +1,686 @@
# feature/ecs-deploy-dev8788-and-kb 任务卡
任务主记录:PR #720 https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/720;状态:已完成(合入前闭合);owner:weichen
## 基线与授权
- 权威仓:ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git;目标分支:main;R0(initial_base_sha)= cb36b59accd0418c5ca952912d7c181b83038a4c
- 工作区:/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-deploy-dev8788-and-kb(worktree);分支:feature/ecs-deploy-dev8788-and-kb
- 分支类型:standalone;root_target:main;immediate_target:main;accepting_requirements:false
- 需求分流:verdict=NEW;selected_initiative=无;requirement_sha256=420311b8d5e0543749bb9743c05ae6757cc0244c7cfda204e6c28bc92eaf8b87;triage_receipt=/tmp/ecs-kb-deploy-triage.json;receipt_sha256=7a0bf8e0d2b9f1adcac5e58cbe70204473007a4dfd04a96f495dde3c0dd71ddb
- 授权与交付终点:owner 2026-10-22 指令“将当前的二进制服务部署到 imc-tx-ecs:先备份远端机器上的服务和数据库;将本机的知识库也部署在远端上;然后部署本机 8788 上的二进制服务;尽可能减少远端服务下线时间并保证服务可用;更换二进制前先告知 owner 确认”,并于 2026-10-23 追加“先把配置弄好,superadmin 账号使用 imc-tx-ecs 上的 sundehui,密码 12345678,第一次登录需要重置密码(把已有用户变成超级管理员)”。交付终点:ECS 8788 运行与本机 dev 同版本二进制(sha256 00ead2cf…),ECS 承载本机 kbreg 知识库且检索可用,远端用户数据零丢失,切换带自动回滚并留存冷备与异地副本。仓库写入仅本任务卡。未授权:修改产品代码、改 Caddy 路由/域名、删除远端既有备份或旧二进制、改动 sundehui 以外账号的凭据、owner 确认前执行二进制切换。
- 交付模式:goal-first(目标、范围和交付终点一次确认;范围内连续推进;切换二进制属人工决策点,先备齐再请确认)
- 实施执行:agent-per-unit(配置:AGENT-EXECUTION.md)
- 合入执行:agent(已授权交付范围内,Review 通过、冲突解决且当前 HEAD 的 CI 通过后合入)
- 人工决策点:仅限目标/范围/验收变更、重大取舍、高后果操作或无法自动判定的业务验收
- 当前阶段:实施与自检(I1 备份 → I2 知识库 → I3 演练;I4 切换待 owner 确认);当前增量:I3(远端演练,零停机)
- 流程依据:仓库根目录 policy/delivery.md(归档后仍按仓库根目录定位)
## 目标与非目标
预期结果:ECS(imc-tx-ecs,43.143.211.203,Ubuntu 22.04,2 vCPU/3.6GiB/49GiB 可用;Caddy `imcrd-agent.imcbot.work` → 127.0.0.1:8788)上:
1. 本机 8788 dev 二进制服务原样上线——`runtime/dev/current` 指向 `releases/rdm-ee8c2cd-20261022T055052Z-637762`,`bin/agent-system` sha256 `00ead2cfcb967441058d0413850467ba710738b6a9510d4f983894f00bc0b3de`(141509195 B),同版 htdocs;systemd 用户单元 `agent-system-dev.service` 的 ExecStart 参数不变。
2. 本机知识库供给到 ECS——本机 kbreg(PostgreSQL 16.15 + pgvector,127.0.0.1:5436,3.1 GB)在 ECS 以原生 PostgreSQL 16.15 + pgvector(回环 5436)承载,语料、已发布修订与索引逐表可核;服务侧经 `serve.env`(`KBREG_*`)+ systemd drop-in `EnvironmentFile` 启用。
3. 远端用户数据零丢失——`data/agent-system.db`(schema v35,24 MB + WAL)与 `rdm.db`(1.5 MB + WAL)经 SQLite 在线备份 API 一致落盘,切换前后以 `ecs-dbsnap.py manifest/compare` 逐行对账 `problems=[]`。
受影响:ECS `runtime/dev/{bin,htdocs,plugins,data,backups,serve.env,svc.env,history.jsonl}`、`~/.config/systemd/user/agent-system-dev.service.d/`、ECS 新增 PostgreSQL 16 集群。本仓:仅 `.task/**`。
非目标:不改产品代码与发布物;不改 Caddy 路由、域名与 TLS;不迁移本机业务数据到 ECS(仅知识库);不删除远端既有备份、旧二进制与 `agent-system-admin/cli`;不动账号、凭据与登录 Key(远端无 `super-admin.env`,切换后仍无,与现状一致);不引入 Docker(远端无容器运行时且不可达镜像仓库)。
## Agent 实施收据
路由与 fail-stop 规则见根目录 AGENT-EXECUTION.md 与 policy/delivery.md;每次尝试一行,原始日志留在源码外收据路径。
| 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
|---|---|---|---|---|---|---|---|---|---|---|
| 无(运维任务,无仓库代码单元;仓库写入仅 `.task/**` host 豁免) | — | — | — | — | — | — | — | — | — | — |
## 关联方向与规划
- 适用状态:适用但不同阶段——`feature/container-storage-plan`(PR #697,open)是容器化部署形态 initiative,其章程把“生产迁移执行(O1)”列为非目标并要求另获窗口授权;本任务是该形态落地前的既有 SQLite 二进制运维部署,与 U1—U6 无依赖,分流 verdict=NEW(理由见分流收据)。
- 主记录路径/版本:`docs/superpowers/plans/2026-10-22-container-storage-plan.md`(位于 feature/container-storage-plan 分支,未合入 main;本卡引用其 O1 边界,不复制正文)
- 对应里程碑:不在其 M1—M3 内;本任务为独立运维增量 I1—I4
## 需求分析
| ID | 描述 | 项目符合度及依据 | 优先级 | 验收条件 | 依赖 | 结论 |
|---|---|---|---|---|---|---|
| R1 | 先备份远端服务与数据库 | 符合(owner 指令;沿用 `ecs-dbsnap.py` 在线备份 API) | P0 | 远端 `backups/<TS>-warm-pre-ee8c2cd/` 含 data/bin-old/htdocs-old/config + SHA256SUMS 校验通过 + 本机异地副本逐文件 sha 通过 | 无 | 达成(见证据) |
| R2 | 本机知识库部署到远端 | 符合(远端无容器运行时且镜像仓库不可达,按同主版本原生 PostgreSQL 16.15 + pgvector 供给) | P0 | ECS 127.0.0.1:5436/kbreg 可连;`schema_migrations` 0001—0005;关键表行数与本机一致;向量检索返回命中 | 无 | 达成(见证据) |
| R3 | 部署本机 8788 二进制服务且最小停机 | 符合(owner 指令) | P0 | 运行中 exe sha256=00ead2cf…;本地与域名 HTTP 200;停机窗口 ≤ 演练实测 + 人工确认 | R1、R2 | **未达成**:技术切换完成(停机 6.88 s、三处 200),但业务验收 `extension: project context unavailable: not-found`,已回退到旧版本 |
| R4 | 服务可用性保障(回滚) | 符合(切换脚本含健康门失败自动回滚) | P0 | 演练实例证明新版本可启动并迁移 v35→最新;回滚路径演练可用 | R3 | 达成(回退装备 sha 通过 + rollback-now.sh 已就位) |
| R5 | 用户数据零丢失 | 符合 | P0 | 冷备 manifest ↔ 切换后逐行对账 `problems=[]`;settings 明文密钥与 `secret_keys` 逐把一致 | R1、R3 | 达成(切换后与回退后两次对账均 `problems=[]`、零缺失;回退期间曾因脚本嵌套缺陷短暂运行空库,已从冷备真实路径恢复并核验) |
| R6 | 超级管理员 = 既有账号 sundehui(口令 12345678,首次登录强制改密) | 符合(owner 2026-10-23 追加指令) | P0 | 库中仅 sundehui 带超管标记且 `is_admin=1`、`must_change_password` 置位;服务以 `SUPER_ADMIN_OWNER=sundehui` 启动日志为 `already established`(无冲突);`POST /api/auth/login` 200 且 `isSuperAdmin=true`、`sessionScope=set_password_only` | 切换时达成并验证;回退后该标记随冷备数据撤回(远端现无超管标记,下次切换需重跑提升步骤) |
| R7 | 仓库侧交付(任务卡 + PR) | 符合 | P1 | Review 通过、CI 通过、PR 合入 main、任务卡闭合 | R1—R6 | 待收口 |
## 方案与计划
### 对象版本(本机发布物,运行中 /proc/652953/exe)
- 二进制:`/home/weichen/projects/Agent-System-Dev/runtime/dev/current/bin/agent-system`,sha256 `00ead2cfcb967441058d0413850467ba710738b6a9510d4f983894f00bc0b3de`,141509195 B;来源 `rdm@ee8c2cd`(`runtime/dev/svc.env`),started 2026-10-22T05:51:02Z,监听 127.0.0.1:8788。
- 前端:`current/htdocs`(148 KB,与本机 release 同源);`current/plugins` 为空(远端 plugins 亦为空)。
- 知识库:本机容器 `kbreg-postgres-1`(`pgvector/pgvector:pg16`,PostgreSQL 16.15),库 `kbreg` 3.1 GB;`schema_migrations` 0001—0005;regulations/editions 2897、legal_nodes 1701178、index_entries 191557、retrieval_chunks 64076、ingest_runs 2943。
- 远端现状:`agent-system.db` schema_max=35(58 表 / 28072 行)、`rdm.db`(28 表 / 3578 行,无 `schema_migrations`,由 `schema_version` 管理)、data 树 367 MB、bin 178 MB。
### 增量与步骤
- I1 备份(零停机):`~/ecs-ops/backup-warm.sh warm-pre-ee8c2cd`——SQLite 在线备份 API 取两个库的一致快照 + rsync 文件树(排除库本体)+ bin/htdocs/plugins/systemd 单元/Caddyfile/svc.env/svc.pid/history.jsonl + `manifest` 活库基线 + 相对路径 SHA256SUMS;随后 `~/ecs-ops/offsite-copy.sh` 流式拉回本机 `~/backups/imc-tx-ecs/<同名>/` 并逐文件校验。
- I2 知识库(零停机):远端加 PGDG apt 源 → 安装 `postgresql-16`(16.15)+ `postgresql-16-pgvector`(0.8.7)→ 集群改 `port=5436`、`listen_addresses=localhost` → 建 `kbreg` 角色与库 → 本机 `pg_dump -Fc`(容器内 16.15 客户端,与服务端同主版本)流式传输 → `pg_restore --no-owner --no-privileges` → 逐表行数与 `schema_migrations` 核对 → 向量检索冒烟 → 从本机 `serve.env` 只取 `KBREG_*` 行落远端 `runtime/dev/serve.env`(600,凭据值不出管道)→ systemd drop-in `20-serve-env.conf` + `daemon-reload`(不重启服务)。
- I3 演练(零停机):新二进制与 htdocs 预置到远端 `runtime/dev/stage/<版本>/`;`rsync -a` 复制 data 为 `rehearsal/data`;以 `127.0.0.1:8789` 启动演练实例(带 KBREG 环境)——实测启动+迁移耗时、HTTP 200、schema 版本、关键表行数、日志无 error、KB 检索可用;结束后清理演练目录。
- I4 切换(待 owner 确认后执行):停 recover timer → 停服务 → 库文件冷拷到新备份目录 → `install`+`mv` 原子换二进制、换 htdocs → 启动 → 健康门(本地 200、域名 200、pid/exe sha、schema、KB)→ 失败自动回滚(旧二进制 + 冷备 data + 旧 htdocs)→ 更新 svc.env/svc.pid/history.jsonl → 启 recover timer。
- I5 收口:切换后逐行对账 `compare`、密钥一致性、启动日志、证据写入、Review、PR/CI、合入。
### 停机时间控制
- I1—I3 全程不动线上进程;数据与文件预置在切换窗口之前完成。
- 切换窗口只做:停服务 → 拷两个库(24 MB + 1.5 MB + WAL)→ 原子换二进制 → 启动 → 健康检查。库迁移(v35→最新)在新进程启动时执行,耗时以 I3 演练实测为准;演练若显示迁移显著耗时,再评估预迁移 + 增量拷贝方案后才切换。
### 测试计划
- I1:远端 `sha256sum -c SHA256SUMS` 通过 + 本机异地副本同样通过 + `manifest` 生成成功(28,072 + 3,578 行)。
- I2:`psql` 连接成功;`schema_migrations` 5 条;`select count(*)` 关键表与本机一致(差异即 FAIL);`revision verify` 等价核验(staged/computed sha 一致);一条向量相似度查询返回非空命中;演练实例带 KBREG 启动无 KB 连接错误。
- I3:演练实例 `/` 200、`/healthz` 200;`schema_migrations` 升到目标版本;`users/conversations/runs` 行数与冷备一致(迁移不丢数据);日志 grep 无 `error|panic|fatal`。
- I4/I5:运行中 exe sha256 前缀 `00ead2cf`;`127.0.0.1:8788` 与 `https://imcrd-agent.imcbot.work/` 均 200;`compare MANIFEST-LIVE-PRE.json data` → `problems=[]`;`secret-check.py` 明文密钥与 `secret_keys` 逐把一致;停机窗口秒数由脚本记录。
## 阶段记录
| 阶段 | 对象版本 | 状态 | 决策/执行者 | 时间 | 依据 |
|---|---|---|---|---|---|
| 需求拆解 | R1—R6 | 已完成 | 主模型 + triage NEW | 2026-10-22 | /tmp/ecs-kb-deploy-triage.json |
| 需求评估 | 对象版本与远端现状核对 | 已完成 | 主模型 | 2026-10-22 | 本卡“方案与计划” |
| 需求表确认 | R1—R6 | 已完成 | owner 指令即验收边界 | 2026-10-22 | owner 2026-10-22 指令 |
| 方案设计 | I1—I5 | 已完成 | 主模型 | 2026-10-22 | 本卡“方案与计划” |
| 实施计划 | I1 备份 / I2 知识库 / I3 演练 / I4 切换 / I5 收口 | 已完成 | 主模型 | 2026-10-22 | 同上 |
| 实施与自检 | I1—I3b(rdm@ee8c2cd,备份/知识库/演练/超管配置) | 已完成 | 主模型 | 2026-10-23 | 证据表 |
| 正式测试与验收 | I4 切换后核验 | **失败并回退**(`project context unavailable: not-found`) | 主模型 + owner 指令回退 | 2026-10-23 | 证据表(回退后 `problems=[]`) |
| 代码 Review | 待收口 | 待执行 | — | — | — |
| 合入 | 待收口 | 待执行 | — | — | — |
| 合入核验与收口 | 待收口 | 待执行 | — | — | — |
## 探索试验与迭代
| 增量/试验 | 假设 | 范围 | 判断和停止条件 | 授权/决策依据 | 结果 | 变更影响 | 需重审补测 |
|---|---|---|---|---|---|---|---|
| I3 远端演练实例(8789 + 复制 data + KBREG 环境) | 新版本能在 v35 旧库上完成迁移并在带知识库环境下健康启动 | 远端副本,不接流量、不写线上库 | 迁移失败或超 5 分钟 → 停下先修迁移/换方案,不进入切换窗口 | owner 指令“保证服务可用、最小停机” | 待执行 | 无(演练目录用后清理) | 是(切换前重放同一演练) |
## 同步记录
| 节点 | sync_base_sha | tested_head_sha | checked_at |
|---|---|---|---|
| 启动 | cb36b59accd0418c5ca952912d7c181b83038a4c | cb36b59accd0418c5ca952912d7c181b83038a4c | 2026-10-22T13:41:37Z |
## 证据(Evidence)
<!-- CMD="<命令>" make evidence 写入;手抄/转写输出视为无效证据(AGENTS.md 证据与验证门禁)。 -->
| 时间(UTC) | 命令 | 被测HEAD | exit | 来源 | sha256(16) |
|---|---|---|---|---|---|
## 交付调度
- 调度状态:未入队;调度记录:无
- entry_id:无;attempt_id:无;窗口执行者:无
- 固定候选:无(base/head、组件与相关配置引用实际尝试)
- 调度依据:policy/delivery.md#合入调度
- 固定后证据:源码外 RECEIPT;实际结果后按授权原样导入和闭合
## 结果与验证
- 结果(I1 备份,零停机):远端 `backups/20261022T134400Z-warm-pre-ee8c2cd/`(539 MB、629 文件,SQLite 在线备份 API 取两个库的一致快照 + 文件树 rsync + bin/htdocs/plugins/systemd 单元/Caddyfile/svc 登记 + 活库基线 MANIFEST-LIVE-PRE.json)远端 `sha256sum -c` 通过;本机异地副本 `~/backups/imc-tx-ecs/20261022T134400Z-warm-pre-ee8c2cd/` 逐文件校验通过(629 文件)。线上进程全程未动(pid 4080336 自 2026-10-18 14:20:26 运行至今)。
- 结果(I2 知识库):远端装 PostgreSQL 16.15(PGDG,jammy)+ pgvector 0.8.7,回环 `127.0.0.1:5436`;角色/库 `kbreg`;本机容器 `pg_dump -Fc`(16.15 客户端,同主版本)→ `pg_restore --no-owner --no-privileges --no-comments`(3m09s);`serve.env`(600,仅 KBREG_*)与单元 drop-in `20-serve-env.conf` 已就位(daemon-reload,未重启服务)。
- 结果(I3 演练,零停机):`stage/rdm-ee8c2cd-20261022T055052Z-637762/bin/agent-system` sha256 与本机运行中制品一致(`00ead2cf…`);复制 data(367 MB)后以 8789 启动新二进制 + KBREG 环境:**1.02 s 健康(HTTP 200)、schema v35→v51 自动迁移完成、users 18→19(多出的就是本次演练的超级管理员账号)、conversations/runs/messages 不变、日志无 error/panic/fatal**;冷拷 data 实测 1.14 s、只拷库 0.05 s。
- 结果(I3b 超级管理员演练,零停机):因为产品只在启动时从 `SUPER_ADMIN_*` 建立超管,且**拒绝把已有账号直接指定为超管**(`configured owner belongs to an existing account without the super-admin marker`),采用与产品 bootstrap 同形的等价写入(`~/ecs-ops/seed-superadmin.py`:一个事务内更新 `users` 的 `is_admin/is_super_admin/password_hash(argon2id)/must_change_password/auth_version/credential_origin/initialization_state/state_version` + 按 v49 动作集写 `system_grants`(12 项)+ `account_events` + `audit_events`)。演练实测:阶段 A `--auth off` 迁移 v35→v51 用时 **0.27 s**;阶段 B 提升 sundehui(用户数仍为 18,未新增账号);阶段 C 以 `--auth on` + `SUPER_ADMIN_OWNER=sundehui` 启动,日志 `super admin: account "sundehui" already established`,健康 **0.27 s**;`POST /api/auth/login` 返回 `isSuperAdmin=true`、`sessionScope=set_password_only`(首次登录只能改密),`/api/me/profile` 403 `set-password session only`,日志无 error/panic/conflict。
- 配置就绪(远端,零停机):`runtime/dev/super-admin.env`(600,`SUPER_ADMIN_OWNER=sundehui`);drop-in `20-serve-env.conf` 同时引用 `serve.env` 与 `super-admin.env`(已 `daemon-reload`,未重启服务);待用口令哈希文件 `~/ecs-stage/seed.hash`(600)已就位;切换脚本 `~/ecs-ops/cutover-ee8c2cd.sh` 已按 A/B/C 三阶段重写并通过语法检查。
- 结果(I4 切换 → **验收失败 → 已回退**):08:43:27 CST 停服、08:43:30 CST 新版本健康,**停机 6.88 s**;新版本 pid 1617793、exe sha256 `00ead2cf…`、schema v51、本地/healthz/域名 200、sundehui 受限登录 200。**但业务验收出现 `extension: project context unavailable: not-found`(RDM 项目上下文解析为 not-found),owner 08:47 要求立即回退。** 回退分两步:首次执行 `rollback-now.sh` 因脚本缺陷(`mkdir -p $B/data` 后 `cp -a $R/data $B/data` 产生嵌套 `data/data/`,回退取到空目录)使服务短暂运行在空库;发现 users=0 后立即从冷备真实路径 `$B/data/data` 恢复,08:48:35 起服务运行旧版本,数据完整。两个脚本已修复并同步远端。
- 回退装备(保留可用):`runtime/dev/rollback/kit-20261023T004302Z`(旧二进制 sha `1f45f640…`、htdocs、单元、Caddyfile,12 文件 sha 通过)+ 修复后的 `rollback-now.sh`(嵌套目录探测、`rm -rf $R/data` 避免合并)+ 修复后的 `cutover-ee8c2cd.sh`(不再预建 `$B/data`)+ 冷备 `backups/20261023T004322Z-cold-pre-ee8c2cd`(真实数据在 `data/data`)+ 切换后的 v51 数据留存于 `runtime/dev/data.rolled-back` 供定位。
- 回退后核验(逐项,证据均为 SELF 收据):旧二进制 exe sha256 `1f45f640…`、pid 1619863、schema v35、`rdm.db` schema_version=6、本地/healthz/域名 200、recover timer 恢复;数据 users 18 / conversations 19 / runs 110 / messages 246,与热备基线逐行对账 **`problems=[]`、零缺失**(605→609 文件,新增 4 个为基线后新产生的用户文件);回退装备 SHA 通过;知识库仍在(legal_nodes 1701178、index_entries 191557)且 drop-in 已移除,旧二进制不读取它。热备/冷备/本机异地副本 SHA 全部通过;知识库指纹与端到端检索(隧道 + `kbreg migrate/search`)通过;演练迁移/健康/超管提升/受限登录通过;**浏览器端业务验收 FAIL**(`extension: project context unavailable: not-found`)。
- 影响与剩余项:
- 业务浏览器端验收(sundehui 首次登录改密、界面检索)NOT_RUN:需真人用真实账号密码登录,本任务不代持口令做交互验证。
- 回滚会丢失切换后新产生的数据(旧版本读不了 v51 库),执行前需 owner 确认。
- `sundehui` 现为 `is_admin=1` + `is_super_admin=1`(产品要求超管必须同时是管理员),口令哈希写入时 `auth_version+1`,旧会话失效。
- 知识库检索状态与本机一致为 degraded(本机向量索引同样为空);恢复向量索引属后续独立增量。
- 远端知识库为原生 PostgreSQL 16.15(非容器,远端无容器运行时且不可达镜像仓库),与 container-storage-plan 的容器决策可用同主版本 dump/restore 迁移。
- 结果(I6 修复合入,2026-10-23):owner 验收通过后按治理流程合入——所有代码变更都经 `scripts/agent-exec run` 的 worker transport 与 `apply` 进入分支(admit 门禁只放行 transport 或豁免路径),逐仓 CI 通过后合并:
- Agent-System-Backend PR #250「Carry project-scope defaults for roles with project management」→ main `1d04f07`;`go test ./internal/store ./internal/app ./internal/server` 通过,transport diff 与上线版本逐字一致。
- Agent-System-Frontend PR #129「Hide system actions from the role editor」→ main `9cc7113`;`npm run build` 与 717 个 vitest 通过。注意:PR #127(一次性密码改端点、恢复提案下线、侧栏无项目对话入口)在合入前发现上游 main 已自行实现同等能力,已关闭并以 #129 取代。
- Agent-System-RDM PR #482「Resolve host project ids in context and fall back to member defaults」→ main `d879839`;pin 同步到已合入的基座与前端 main,`go test ./...` 通过。
- Agent-System-Dev:main 的 `modules/backend` pin(`bd5c0f39`)已包含基座合并,无需再改;Dev 不跟踪 RDM 仓。
## 规划进展与下一步
- 本次推进/剩余:I1—I5 完成(首次切换因业务错误回退 → 三处修复并在 58788 验证 → 重建后二次切换停机 6.13 s 成功 → 角色/超管/模型配置就位 → 修复全部经 worker transport 合入 main)。剩余:合并后的产物(前端来自已合入 main)与线上二进制不同,需要你决定是否再切一次。
- 首选下一任务:本任务 I5(不新建任务)。
- 推荐依据:验收失败必须先消除阻塞项,不得以“技术切换成功”替代业务可用(`policy/delivery.md#目标优先范围控制与问题分流`)。
- 前置条件/待确认:定位材料——触发错误的入口(页面/会话)与其客户端响应;`data.rolled-back` 中已迁移的 v51 库可离线复现。
- 预期产物/验收条件:离线复现或代码级定位 `not-found` 成因;演练新增带项目上下文的真实请求并通过;再请 owner 确认切换窗口。
- 已知缺口:I3 演练只验证启动/迁移/登录/超管接口,**未发起带项目上下文的真实业务请求**,因此未能提前发现该错误。
- 重复任务核对:已核对 `.task/archive/feature-ecs-sync-local-dev.md`(2026-10-18 同机切换)与 feature/container-storage-plan(容器化形态,O1 生产迁移不在其范围);无重复在途任务。
- 启动授权:未授权(建议不自动启动新任务,仍须明确授权)
## 合入与清理
- Review 记录:NOT_RUN(审阅智能体/平台身份、base/head、结论、问题闭合及重放依据)
- 冲突记录:NOT_RUN(最新目标同步、冲突处置、组合兼容核验及复审/补测)
- CI 记录:NOT_RUN(当前 HEAD 完整 SHA、全部必需检查、运行链接、执行身份及 GATE 结果)
- 合入记录:NOT_RUN(交付授权范围、PR、被核验 HEAD、合入 SHA、目标分支及内容核验)
- 清理记录:NOT_RUN(授权依据、写者退出确认、worktree/分支/任务卡处置)
<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
```json
{
"summary_schema": 1,
"source": "SELF",
"timestamp": "2026-10-22T13:28:34.782723+00:00",
"command": "make precheck",
"exit_code": 0,
"cwd": "/home/weichen/projects/Agent-System-Dev-wt-bootstrap-r0",
"before_head": "cb36b59accd0418c5ca952912d7c181b83038a4c",
"after_head": "cb36b59accd0418c5ca952912d7c181b83038a4c",
"branch": "HEAD",
"target_branch": "main",
"target_head": "cb36b59accd0418c5ca952912d7c181b83038a4c",
"root_target": "main",
"immediate_target": "main",
"before_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"after_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"output_tail": [
"make[1]: Entering directory '/home/weichen/projects/Agent-System-Dev-wt-bootstrap-r0'",
"[repo] branch=HEAD head=cb36b59acc",
"[remote] origin/main=cb36b59acc ahead=0 behind=0",
"[tree] clean submodules_drift=0 uninit=0",
"[worktrees] linked=9",
"[recycle] merged un-recycled branches: fix/gitea-address-migration fix/svc-test-port-governance-batch1",
"[cards] 已合入未闭合任务卡:fix-svc-test-port-governance-batch1.md——make task-close 回填归档(主检出运行)",
"[initiatives] local cards (not authoritative): none",
"[hooks] core.hooksPath=scripts/hooks(pre-commit/post-merge 实际接线)",
"[facts] policy/facts.md 6 条事实均在有效期内",
"[required-reading] core/baseline.md, workflows/delivery.md §1, policy/delivery.md",
"[R0] cb36b59acc(完整:cb36b59accd0418c5ca952912d7c181b83038a4c)",
"[worktree] before-sync: recursive component checks passed",
"[verdict] READY — 保留本次 precheck receipt 后建任务工作区:PRECHECK_RECEIPT=/tmp/task-precheck.json make task-start NAME=feature/your-branch",
"make[1]: Leaving directory '/home/weichen/projects/Agent-System-Dev-wt-bootstrap-r0'"
],
"output_sha256": "37096e9c91f721e54d19452b169e8558a0ddd1e0699512acf8d17d8331046441",
"receipt_sha256": "57bedc8bb759f306f6a2623b48f7117ef650a0a0c7951719ef6a25f5f51276eb",
"receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/57bedc8bb759f306f6a2623b48f7117ef650a0a0c7951719ef6a25f5f51276eb.json"
}
```
<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
```json
{
"summary_schema": 1,
"source": "SELF",
"timestamp": "2026-10-22T15:22:01.538077+00:00",
"command": "bash ~/ecs-ops/verify-local.sh",
"exit_code": 0,
"cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-deploy-dev8788-and-kb",
"before_head": "c8d22d6ddb6e81b082c8c4eef513417000fd172c",
"after_head": "c8d22d6ddb6e81b082c8c4eef513417000fd172c",
"branch": "feature/ecs-deploy-dev8788-and-kb",
"target_branch": "main",
"target_head": "c3fc389b9f7060ee590439a7a26bffc45f454be8",
"root_target": "main",
"immediate_target": "main",
"before_tracked_diff_sha256": "a06b59bf58b89bcbe5ce8d8ca204d6d376fd61fd86af9b0ffbd7133a8d7c5b21",
"after_tracked_diff_sha256": "a06b59bf58b89bcbe5ce8d8ca204d6d376fd61fd86af9b0ffbd7133a8d7c5b21",
"output_tail": [
"=== 本机异地副本 ===",
"OFFSITE_SHA_OK files=629",
"539M\t/home/weichen/backups/imc-tx-ecs/20261022T134400Z-warm-pre-ee8c2cd",
"=== 知识库指纹比对:本机容器 vs ECS(经隧道) ===",
"KB_FINGERPRINT_IDENTICAL",
"md5_regulations|56bcaad63aab3f505f115d867faeb12b",
"md5_editions|a93c46f75144e3359ef8c78ca1b67b2d",
"md5_index_entries|7e599356f4aeb45631e074f6bbc99f6e",
"md5_revision_members|5322ba17aff3ffbd1d23ba48248522d0",
"legal_nodes_bytes|888742683"
],
"output_sha256": "5c4ca6b9861b52bd9dd704794bbfdbfac60ad80af5ce1daa77caf38766aea3c9",
"receipt_sha256": "7eb168bc415a5a89d4d30baea6989c77f7026b8b54aa72a689ab03a7808cb34d",
"receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/7eb168bc415a5a89d4d30baea6989c77f7026b8b54aa72a689ab03a7808cb34d.json"
}
```
<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
```json
{
"summary_schema": 1,
"source": "SELF",
"timestamp": "2026-10-22T15:23:11.116009+00:00",
"command": "ssh -o BatchMode=yes imc-tx-ecs 'bash ~/ecs-ops/verify-remote.sh'",
"exit_code": 0,
"cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-deploy-dev8788-and-kb",
"before_head": "c8d22d6ddb6e81b082c8c4eef513417000fd172c",
"after_head": "c8d22d6ddb6e81b082c8c4eef513417000fd172c",
"branch": "feature/ecs-deploy-dev8788-and-kb",
"target_branch": "main",
"target_head": "c3fc389b9f7060ee590439a7a26bffc45f454be8",
"root_target": "main",
"immediate_target": "main",
"before_tracked_diff_sha256": "bc02c637e5aa7caf698d242f47e2c4565469c1d97e695b71f8ac8c75a8d4c07f",
"after_tracked_diff_sha256": "bc02c637e5aa7caf698d242f47e2c4565469c1d97e695b71f8ac8c75a8d4c07f",
"output_tail": [
"version=agent-system 0.1.0-dev",
"started=2026-10-18T14:20:27+08:00",
"local8788=200",
"domain=200",
"=== 线上库 schema ===",
"agent-system.db schema_max 35",
" users 18",
" conversations 18",
" runs 109",
" messages 244",
"rdm.db schema_version [(6,)]",
" users ERR no such table: users",
" conversations ERR no such table: conversations",
" runs ERR no such table: runs",
" messages ERR no such table: messages",
"=== 远端热备校验 ===",
"backup=/home/ubuntu/weichen/Agent-System-Dev/runtime/dev/backups/20261022T134400Z-warm-pre-ee8c2cd",
"REMOTE_BACKUP_SHA_OK files=629",
"539M\t/home/ubuntu/weichen/Agent-System-Dev/runtime/dev/backups/20261022T134400Z-warm-pre-ee8c2cd",
"=== 待上线制品 ===",
"00ead2cfcb967441058d0413850467ba710738b6a9510d4f983894f00bc0b3de /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/stage/rdm-ee8c2cd-20261022T055052Z-637762/bin/agent-system",
"app.css",
"app.js",
"index.html",
"htdocs_files=6",
"=== 知识库供给 ===",
"active",
"Ver Cluster Port Status Owner Data directory Log file",
"16 main 5436 online postgres /var/lib/postgresql/16/main /var/log/postgresql/postgresql-16-main.log",
"LISTEN 0 200 127.0.0.1:5436 0.0.0.0:* users:((\"postgres\",pid=1462333,fd=6)) ",
"SET",
"regulations=2897",
"legal_nodes=1701178",
"index_entries=191557",
"retrieval_chunks=64076",
"/home/ubuntu/weichen/Agent-System-Dev/runtime/dev/serve.env 600 ubuntu",
"[Service]",
"# 知识库供给环境(KBREG_*,来自受保护的 serve.env,权限 600)",
"EnvironmentFile=/home/ubuntu/weichen/Agent-System-Dev/runtime/dev/serve.env",
"EnvironmentFiles=/home/ubuntu/weichen/Agent-System-Dev/runtime/dev/serve.env (ignore_errors=no)"
],
"output_sha256": "b9d015bb32fed01af4e0490ca20745495bfa63fed1c4495d3dab9b3bc8d64682",
"receipt_sha256": "80f27d8775a7454eecc9279266ffdb8486c1fc9056770bd305f20fc5810b35fe",
"receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/80f27d8775a7454eecc9279266ffdb8486c1fc9056770bd305f20fc5810b35fe.json"
}
```
<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
```json
{
"summary_schema": 1,
"source": "SELF",
"timestamp": "2026-10-22T15:23:24.616557+00:00",
"command": "ssh -o BatchMode=yes imc-tx-ecs 'bash ~/ecs-ops/rehearsal.sh'",
"exit_code": 1,
"cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-deploy-dev8788-and-kb",
"before_head": "c8d22d6ddb6e81b082c8c4eef513417000fd172c",
"after_head": "c8d22d6ddb6e81b082c8c4eef513417000fd172c",
"branch": "feature/ecs-deploy-dev8788-and-kb",
"target_branch": "main",
"target_head": "c3fc389b9f7060ee590439a7a26bffc45f454be8",
"root_target": "main",
"immediate_target": "main",
"before_tracked_diff_sha256": "a4d29aaed46c125f0ea41b93903130a71287e2a36a10e457a5d6f54f94f05f28",
"after_tracked_diff_sha256": "a4d29aaed46c125f0ea41b93903130a71287e2a36a10e457a5d6f54f94f05f28",
"output_tail": [
"[rehearsal] copying data 2026-10-22T23:23:26+08:00",
"367M\t/home/ubuntu/weichen/Agent-System-Dev/runtime/dev/rehearsal/data",
"[rehearsal] pid=1475116 start=2026-10-22T23:23:27+08:00",
"[rehearsal] healthy=1 after=1.034965419s http=200",
"[rehearsal] schema:",
"agent-system schema_max = 51",
" users = 19",
" conversations = 18",
" runs = 109",
" messages = 244",
"Traceback (most recent call last):",
" File \"<stdin>\", line 9, in <module>",
"sqlite3.OperationalError: no such column: username"
],
"output_sha256": "633a16b70f361c207045e23bc573e0e8f9bd39eae69c648f1d4a4ee64c2e31ee",
"receipt_sha256": "86751433905579872d89a49231a54af8bf53abae1ba91b93c7c5e96b96e9ffa5",
"receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/86751433905579872d89a49231a54af8bf53abae1ba91b93c7c5e96b96e9ffa5.json"
}
```
<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
```json
{
"summary_schema": 1,
"source": "SELF",
"timestamp": "2026-10-22T15:23:34.788033+00:00",
"command": "ssh -o BatchMode=yes imc-tx-ecs 'bash ~/ecs-ops/rehearsal.sh'",
"exit_code": 0,
"cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-deploy-dev8788-and-kb",
"before_head": "c8d22d6ddb6e81b082c8c4eef513417000fd172c",
"after_head": "c8d22d6ddb6e81b082c8c4eef513417000fd172c",
"branch": "feature/ecs-deploy-dev8788-and-kb",
"target_branch": "main",
"target_head": "c3fc389b9f7060ee590439a7a26bffc45f454be8",
"root_target": "main",
"immediate_target": "main",
"before_tracked_diff_sha256": "ea88c0fc9ecb0d0c01399696327bda7c3c2f3eefd9c4249afc3c39ab53286428",
"after_tracked_diff_sha256": "ea88c0fc9ecb0d0c01399696327bda7c3c2f3eefd9c4249afc3c39ab53286428",
"output_tail": [
"[rehearsal] copying data 2026-10-22T23:23:36+08:00",
"367M\t/home/ubuntu/weichen/Agent-System-Dev/runtime/dev/rehearsal/data",
"[rehearsal] pid=1475273 start=2026-10-22T23:23:37+08:00",
"[rehearsal] healthy=1 after=1.016955899s http=200",
"[rehearsal] schema:",
"agent-system schema_max = 51",
" users = 19",
" conversations = 18",
" runs = 109",
" messages = 244",
" super_admins = [('rehearsal-admin',)]",
"[rehearsal] data tree files: 613",
"[rehearsal] log grep (error/panic/fatal):",
"[rehearsal] log tail:",
"2026/10/22 23:23:37 super admin: established account \"rehearsal-admin\"",
"2026/10/22 23:23:37 storage tier: auto (dialect=sqlite pool=0/0 idleSec=0 lifetimeSec=0 schema=v51)",
"2026/10/22 23:23:37 exec tools: backend=sandbox (bwrap: no network, ro root, session-only writes, proc limit)",
"2026/10/22 23:23:37 skills: wrote 0, upgraded 4 into /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/rehearsal/data/skills",
"2026/10/22 23:23:37 auth: API key required (create with: agent-system apikey create --owner <name>)",
"2026/10/22 23:23:37 agent-system serving on http://127.0.0.1:8789 (data: /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/rehearsal/data, plugins: /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/plugins)",
"[rehearsal] done 2026-10-22T23:23:38+08:00"
],
"output_sha256": "5e6268752d60e253de77c8979bfcfcac69ca8df0bd357dd3c2f1630d1965c7c0",
"receipt_sha256": "37a1f94a8b71c31ff766ac284ea2599dac2df25c12e065b33d2a91c7602e9632",
"receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/37a1f94a8b71c31ff766ac284ea2599dac2df25c12e065b33d2a91c7602e9632.json"
}
```
<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
```json
{
"summary_schema": 1,
"source": "SELF",
"timestamp": "2026-10-22T23:08:23.850986+00:00",
"command": "ssh -o BatchMode=yes imc-tx-ecs 'bash ~/ecs-ops/rehearsal-superadmin.sh'",
"exit_code": 4,
"cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-deploy-dev8788-and-kb",
"before_head": "68ca3f5fb1b29ea18a70a30230ef9a2930241b1c",
"after_head": "68ca3f5fb1b29ea18a70a30230ef9a2930241b1c",
"branch": "feature/ecs-deploy-dev8788-and-kb",
"target_branch": "main",
"target_head": "6ced938a126981ee2a4fab671a2da94f49cb56c5",
"root_target": "main",
"immediate_target": "main",
"before_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"after_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"output_tail": [
"[rehearsal] copying data 2026-10-23T07:08:25+08:00",
"seed failed: no such column: is_super_admin"
],
"output_sha256": "6df9fb628078ad393282ce681f1fb69e6034f689237fe97e6a692da490a3f3ab",
"receipt_sha256": "4000943bcb84808a35cd147886eea4d6fd81a2982a9d8db37e6239d874d7789c",
"receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/4000943bcb84808a35cd147886eea4d6fd81a2982a9d8db37e6239d874d7789c.json"
}
```
<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
```json
{
"summary_schema": 1,
"source": "SELF",
"timestamp": "2026-10-22T23:08:52.895328+00:00",
"command": "ssh -o BatchMode=yes imc-tx-ecs 'bash ~/ecs-ops/rehearsal-superadmin.sh'",
"exit_code": 1,
"cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-deploy-dev8788-and-kb",
"before_head": "68ca3f5fb1b29ea18a70a30230ef9a2930241b1c",
"after_head": "68ca3f5fb1b29ea18a70a30230ef9a2930241b1c",
"branch": "feature/ecs-deploy-dev8788-and-kb",
"target_branch": "main",
"target_head": "6ced938a126981ee2a4fab671a2da94f49cb56c5",
"root_target": "main",
"immediate_target": "main",
"before_tracked_diff_sha256": "04b1dba8da2af5a53de394e5e62fdf4a46ab168aa73346127d42bd67546e5c20",
"after_tracked_diff_sha256": "04b1dba8da2af5a53de394e5e62fdf4a46ab168aa73346127d42bd67546e5c20",
"output_tail": [
"[rehearsal] copying data 2026-10-23T07:08:54+08:00",
"[phase A] migrate-only start (auth off)",
"[phase A] healthy after .529100167s (pid=1593264)",
"2026/10/23 07:08:54 storage tier: auto (dialect=sqlite pool=0/0 idleSec=0 lifetimeSec=0 schema=v51)",
"2026/10/23 07:08:55 agent-system serving on http://127.0.0.1:8789 (data: /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/rehearsal/data, plugins: /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/plugins)",
"[phase A] schema_max = 51",
"[phase B] elevate existing account",
"Traceback (most recent call last):",
" File \"/home/ubuntu/ecs-ops/seed-superadmin.py\", line 116, in <module>",
" sys.exit(main())",
" File \"/home/ubuntu/ecs-ops/seed-superadmin.py\", line 85, in main",
" instance = db.execute(\"SELECT instance_id FROM agent_system_identity\").fetchone()[0] or \"\"",
"TypeError: 'NoneType' object is not subscriptable"
],
"output_sha256": "bbeabf52756b45a9e3fc87670b7bdbbdcab5b5b35ab5682138d45462939306b5",
"receipt_sha256": "a88ff605df0338fb6cb529f9ab45900833c0120a528ee835b0b11628f9e66b50",
"receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/a88ff605df0338fb6cb529f9ab45900833c0120a528ee835b0b11628f9e66b50.json"
}
```
<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
```json
{
"summary_schema": 1,
"source": "SELF",
"timestamp": "2026-10-22T23:09:02.539134+00:00",
"command": "ssh -o BatchMode=yes imc-tx-ecs 'bash ~/ecs-ops/rehearsal-superadmin.sh'",
"exit_code": 0,
"cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-deploy-dev8788-and-kb",
"before_head": "68ca3f5fb1b29ea18a70a30230ef9a2930241b1c",
"after_head": "68ca3f5fb1b29ea18a70a30230ef9a2930241b1c",
"branch": "feature/ecs-deploy-dev8788-and-kb",
"target_branch": "main",
"target_head": "6ced938a126981ee2a4fab671a2da94f49cb56c5",
"root_target": "main",
"immediate_target": "main",
"before_tracked_diff_sha256": "39b40acc28963d9413e554781ec8e65ed09774268e49cecb19496ac456e9a4d3",
"after_tracked_diff_sha256": "39b40acc28963d9413e554781ec8e65ed09774268e49cecb19496ac456e9a4d3",
"output_tail": [
"[rehearsal] copying data 2026-10-23T07:09:03+08:00",
"[phase A] migrate-only start (auth off)",
"[phase A] healthy after .267909096s (pid=1593451)",
"2026/10/23 07:09:04 storage tier: auto (dialect=sqlite pool=0/0 idleSec=0 lifetimeSec=0 schema=v51)",
"2026/10/23 07:09:04 agent-system serving on http://127.0.0.1:8789 (data: /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/rehearsal/data, plugins: /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/plugins)",
"[phase A] schema_max = 51",
"[phase B] elevate existing account",
"seeded: {'owner': 'sundehui', 'is_admin': 1, 'is_super_admin': 1, 'must_change_password': <redacted>, 'auth_version': 2, 'credential_origin': '<redacted>', 'initialization_state': 'initialized', 'has_pw': 1} system_grants_allowed: 12",
"[phase C] start with auth on, super admin owner=sundehui",
"[phase C] healthy=1 after=.268576176s http=200",
"2026/10/23 07:09:06 super admin: account \"sundehui\" already established",
"2026/10/23 07:09:06 storage tier: auto (dialect=sqlite pool=0/0 idleSec=0 lifetimeSec=0 schema=v51)",
"2026/10/23 07:09:06 agent-system serving on http://127.0.0.1:8789 (data: /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/rehearsal/data, plugins: /home/ubuntu/weichen/Agent-System-Dev/runtime/dev/plugins)",
"[check] login as sundehui",
"{\"auth\":true,\"isAdmin\":true,\"isSuperAdmin\":true,\"mustChangePassword\":<redacted>,\"name\":\"\",\"owner\":\"sundehui\",\"passwordChangeMode\":\"<redacted>\",\"passwordSet\":<redacted>,\"sessionScope\":\"set_password_only\"}",
"",
"HTTP=200",
"[check] profile with session",
"forbidden: set-password session only",
"",
"HTTP=403",
"[check] super-admin gated endpoint",
"admin_users_http=403",
"[check] schema and account state",
"schema_max = 51",
"super admins = [('sundehui',)]",
"users total = 18",
"[check] log errors:",
"[rehearsal] done 2026-10-23T07:09:06+08:00"
],
"output_sha256": "690a87c97b30c36d517a47c90a6d951c307a094feefbf525ac6e7124c2f5c421",
"receipt_sha256": "47666f79ea5cbd315d5de3f89da4f90e19956fba77e4f880cb3f9bfca7c9df95",
"receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/47666f79ea5cbd315d5de3f89da4f90e19956fba77e4f880cb3f9bfca7c9df95.json"
}
```
<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
```json
{
"summary_schema": 1,
"source": "SELF",
"timestamp": "2026-10-23T00:44:11.563406+00:00",
"command": "ssh -o BatchMode=yes imc-tx-ecs 'bash ~/ecs-ops/verify-post-cutover.sh'",
"exit_code": 0,
"cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-deploy-dev8788-and-kb",
"before_head": "f9a953831b63d78faf4e123068db2e5c68397db8",
"after_head": "f9a953831b63d78faf4e123068db2e5c68397db8",
"branch": "feature/ecs-deploy-dev8788-and-kb",
"target_branch": "main",
"target_head": "6ced938a126981ee2a4fab671a2da94f49cb56c5",
"root_target": "main",
"immediate_target": "main",
"before_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"after_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"output_tail": [
"grep: SHA256SUMS: No such file or directory",
"COLD_META_SHA_SKIPPED(部分行需整体校验)",
"479M\t/home/ubuntu/weichen/Agent-System-Dev/runtime/dev/backups/20261023T004322Z-cold-pre-ee8c2cd",
"=== 回滚装备 ===",
"ROLLBACK_KIT_SHA_OK files=12",
"kit created 20261023T004302Z",
"source_binary=1f45f64077b8dffd25d80513e3aaf5f06c71c8a09248c21af22f9d33eab516b9",
"data_source=/home/ubuntu/weichen/Agent-System-Dev/runtime/dev/backups/20261022T134400Z-warm-pre-ee8c2cd",
"=== 服务 ===",
"active",
"active",
"pid=1617793 started=Fri Oct 23 08:43:29 2026 exe_sha256=00ead2cfcb967441058d0413850467ba710738b6a9510d4f983894f00bc0b3de",
"pid=1617793",
"addr=0.0.0.0:8788",
"source=rdm@ee8c2cd",
"version=agent-system-rdm (devel)",
"started=2026-10-23T08:43:30+08:00",
"{\"ts\":\"2026-10-23T00:43:30Z\",\"event\":\"deploy\",\"env\":\"dev\",\"kind\":\"agent\",\"source\":\"rdm@ee8c2cd\",\"result\":\"ok\",\"pid\":\"1617793\",\"addr\":\"0.0.0.0:8788\",\"detail\":\"from=dev@a706e9a+rdm@4b2473bed112 to=rdm@ee8c2cd via systemd; backup=20261023T004322Z-cold-pre-ee8c2cd",
"=== HTTP ===",
"local=200 healthz=200 domain=200",
"=== 数据与账号 ===",
"schema_max = 51",
" users 18",
" conversations 18",
" runs 109",
" messages 244",
" super_admins = [('sundehui',)]",
" sundehui = ('sundehui', 1, 1, 1, 2, 'owner_initialization')",
"=== 逐行对账(热备基线 ↔ 切换后)===",
"files base=605 now=605 missing=0 changed=5 added=0",
"changed: ['skills/.builtin-manifest.json', 'skills/docx-author/SKILL.md', 'skills/house-style/SKILL.md', 'skills/house-style/tests/test_housestyle.py', 'skills/house-style/housestyle/build.py']",
"tables with missing/changed rows: {\"agent-system.db.sessions\": {\"base\": 18, \"now\": 18, \"missing\": 0, \"changed\": 2, \"added\": 0, \"changed_keys\": [\"21\", \"22\"]}, \"agent-system.db.users\": {\"base\": 18, \"now\": 18, \"missing\": 0, \"changed\": 1, \"added\": 0, \"changed_keys\": [\"12\"]}}",
"problems: []",
"=== 密钥一致性 ===",
"owner='' scope=system models.rerank -> secret_keys match=True",
"owner='' scope=system tools.tavily -> secret_keys match=True",
"settings_snapshots=11 mismatches=0",
"=== 知识库 ===",
"active",
"SET",
"legal_nodes=1701178",
"index_entries=191557",
"=== 切换后错误扫描 ===",
"Failed to parse timestamp: 2026-10-23T00:24:14",
"(以上为空即无错误)"
],
"output_sha256": "52fc124a0e4e6e890949349d93afc89bd2228f460e780e14555160002da29282",
"receipt_sha256": "af18be0166d5bfe3abed4f5a433cb9d57e4dfdfa6f1eb60b828bc33496318e3b",
"receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/af18be0166d5bfe3abed4f5a433cb9d57e4dfdfa6f1eb60b828bc33496318e3b.json"
}
```
<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
```json
{
"summary_schema": 1,
"source": "SELF",
"timestamp": "2026-10-23T00:44:39.306471+00:00",
"command": "bash ~/ecs-ops/kb-check-fast.sh",
"exit_code": 0,
"cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-deploy-dev8788-and-kb",
"before_head": "f9a953831b63d78faf4e123068db2e5c68397db8",
"after_head": "f9a953831b63d78faf4e123068db2e5c68397db8",
"branch": "feature/ecs-deploy-dev8788-and-kb",
"target_branch": "main",
"target_head": "6ced938a126981ee2a4fab671a2da94f49cb56c5",
"root_target": "main",
"immediate_target": "main",
"before_tracked_diff_sha256": "1c4f20b9e2398f9fb813dfe305e789f20a8abad1c41f18ed847517dd35981cad",
"after_tracked_diff_sha256": "1c4f20b9e2398f9fb813dfe305e789f20a8abad1c41f18ed847517dd35981cad",
"output_tail": [
" \"version\": \"fts-v1\"",
" }",
" ],",
" \"hits\": [",
" {",
" \"regulation_id\": \"reg_3939376174cc5e1eb146d10b\",",
" \"edition_id\": \"ed_2e7d6d945848614ab386bdbc\",",
" \"node_id\": \"nd_79ccfca59982317806810fb3\",",
" \"kind\": \"guidance\",",
" \"title\": \"国家药监局关于发布医疗器械注册质量管理体系核查指南的通告(2022年第50号\",",
" \"edition_label\": \"src-5f55893f9096\",",
"KB_FAST_CHECK_OK"
],
"output_sha256": "cc655d17a77eb65ad064cfaaf4a903a3fe6adb05879dc8e2a70b16be36f93a09",
"receipt_sha256": "eda1eaba245f1c76e329747c66a6739435ddf8524ce0223fc86baac4b9bc92fd",
"receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/eda1eaba245f1c76e329747c66a6739435ddf8524ce0223fc86baac4b9bc92fd.json"
}
```
| 同步(记录前对象) | 6ced938a126981ee2a4fab671a2da94f49cb56c5 | d436d6718ca997e575ad8be3d149efefca8cedd8 | 2026-10-23T00:46:40Z |
<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
```json
{
"summary_schema": 1,
"source": "SELF",
"timestamp": "2026-10-23T00:49:39.764923+00:00",
"command": "ssh -o BatchMode=yes imc-tx-ecs 'bash ~/ecs-ops/verify-rollback.sh'",
"exit_code": 0,
"cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-ecs-deploy-dev8788-and-kb",
"before_head": "2487b561bb61103bd066d96f4be0135621daf66c",
"after_head": "2487b561bb61103bd066d96f4be0135621daf66c",
"branch": "feature/ecs-deploy-dev8788-and-kb",
"target_branch": "main",
"target_head": "6ced938a126981ee2a4fab671a2da94f49cb56c5",
"root_target": "main",
"immediate_target": "main",
"before_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"after_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"output_tail": [
"=== 回退后运行态 ===",
"active",
"active",
"pid=1619863 exe_sha256=1f45f64077b8dffd25d80513e3aaf5f06c71c8a09248c21af22f9d33eab516b9 started=Fri Oct 23 08:48:35 2026",
"local=200 healthz=200 domain=200",
"=== 数据核对 ===",
"schema_max 35",
" users 18",
" conversations 19",
" runs 110",
" messages 246",
"rdm schema_version [(6,)]",
"files base=605 now=609 missing=0 changed=0 added=4",
"problems: []",
"tables missing/changed: {\"agent-system.db.sessions\": {\"base\": 18, \"now\": 19, \"missing\": 0, \"changed\": 2, \"added\": 1, \"changed_keys\": [\"21\", \"22\"]}}",
"=== 回退装备 ===",
"kit=/home/ubuntu/weichen/Agent-System-Dev/runtime/dev/rollback/kit-20261023T004302Z",
"ROLLBACK_KIT_SHA_OK",
"/home/ubuntu/weichen/Agent-System-Dev/runtime/dev/data.rolled-back",
"=== 知识库仍在(旧二进制不读取,环境文件已移除)===",
"active",
"SET",
"legal_nodes=1701178",
"index_entries=191557"
],
"output_sha256": "d8f3dd94b561810a63a8515bc6cd1188a7f83e379a592c2106a88233258dbe51",
"receipt_sha256": "8c4cc241b55f8df83e9e6802d6bf15584553cfafe845bda647a2a8add611041c",
"receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/8c4cc241b55f8df83e9e6802d6bf15584553cfafe845bda647a2a8add611041c.json"
}
```
| 同步(记录前对象) | 0650e81133b853f27e8e53f516de8f6c1e73e4a4 | 1a3f9a1e5f08d25cedc82024ba1354b186932777 | 2026-10-23T11:13:15Z |
## 闭合记录(合入前折叠)
- 本卡在 PR #720(https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/720)合入前闭合并归档,随该 PR 一同合入。
- 该 PR 的合并提交即本任务的落地记录。
- 合入后无需回填,也无需单独的闭合 PR。
+7 -1
View File
@@ -49,8 +49,12 @@ def ci_git_env():
if not (CI_SERVER and CI_TOKEN):
return {}
scheme = CI_SERVER.split("://", 1)[0]
# 嵌套 pins 的 SSH 端点有两代:旧 git-ssh.*:31411 与迁移后的 gitea.*:52222。
# 两个 insteadOf 必须同时保留,直到所有 .gitmodules 迁到新端点(policy/facts.md
# F3 已把新端点列为权威;本仓 .gitmodules 仍有旧端点子模块):任去掉一个,
# 对应那批 pins 都会退回真实 SSH,而 CI 运行器没有 key,必然 host key 失败。
return {
"GIT_CONFIG_COUNT": "4",
"GIT_CONFIG_COUNT": "5",
"GIT_CONFIG_KEY_0": "protocol.%s.allow" % scheme,
"GIT_CONFIG_VALUE_0": "always",
"GIT_CONFIG_KEY_1": "http.%s/.extraheader" % CI_SERVER,
@@ -59,6 +63,8 @@ def ci_git_env():
"GIT_CONFIG_VALUE_2": "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/",
"GIT_CONFIG_KEY_3": "core.hooksPath",
"GIT_CONFIG_VALUE_3": "/dev/null",
"GIT_CONFIG_KEY_4": "url.%s/weichen/.insteadOf" % CI_SERVER,
"GIT_CONFIG_VALUE_4": "ssh://git@gitea.naitangbaobao.cn:52222/weichen/",
}
PG = os.environ.get("SVC_TEST_PG") == "1" and bool(os.environ.get("AGENT_PG_TEST_DSN"))