Merge pull request 'A1 multi-turn intent closure (sessions and cancel routing)' (#700) from feature/intent-multi-turn-a1 into main

Why: include the current integration baseline before merge.

Evidence: fetched origin/main=3d3474a7.

Impact: integrate upstream changes without rewriting task history.

Refs: task-sync

.task/archive/feature-audit-followups-pin-gate-m5.md

@@ -0,0 +1,162 @@
+# feature/audit-followups-pin-gate-m5 任务卡
+
+任务主记录：PR #695 https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/695；状态：已完成（合入前闭合）；owner：weichen
+
+## 基线与授权
+
+- 权威仓：ssh://git@192.168.3.2:2222/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= b7636742fc9ea937e6030123afc608fd294861bf
+- 工作区：/home/weichen/projects/Agent-System-Dev-wt-feature-audit-followups-pin-gate-m5（worktree）；分支：feature/audit-followups-pin-gate-m5
+- 分支类型：standalone；root_target：main；immediate_target：main；accepting_requirements：false
+- 需求分流：verdict=NEW；selected_initiative=无；requirement_sha256=d2608b7436d1c2d773c607a79568c57cfaa2c32cebf35d1a0cabda9562a543c1；triage_receipt=/tmp/triage-followups-1792647600.json；receipt_sha256=01837cb87f83d50c255ee460dfa8e28ade7ed600624bea7d0c083b7653c8a5dd
+
+- 授权与交付终点：<本次允许的动作与终点；未授权事项写明>
+- 交付模式：goal-first（目标、范围和交付终点一次确认；范围内连续推进）
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md）
+- 合入执行：agent（已授权交付范围内，Review 通过、冲突解决且当前 HEAD 的 CI 通过后合入）
+- 人工决策点：仅限目标/范围/验收变更、重大取舍、高后果操作或无法自动判定的业务验收
+- 当前阶段：需求拆解；当前增量：I1（待定义）
+- 流程依据：仓库根目录 policy/delivery.md（归档后仍按仓库根目录定位）
+
+## 目标与非目标
+
+<预期结果、受影响入口/模块/契约；明确不做什么。>
+
+## Agent 实施收据
+
+路由与 fail-stop 规则见根目录 AGENT-EXECUTION.md 与 policy/delivery.md；每次尝试一行，原始日志留在源码外收据路径。
+
+| 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|---|
+| 待定义 | — | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | — |
+
+## 关联方向与规划
+
+- 适用状态：待核对（无适用规划时说明原因）
+- 主记录路径/版本：待核对（路径按仓库根目录定位，归档后不变；只引用唯一正文）
+- 对应里程碑：待核对
+
+## 需求分析
+
+| ID | 描述 | 项目符合度及依据 | 优先级 | 验收条件 | 依赖 | 结论 |
+|---|---|---|---|---|---|---|
+| R1 | 待填写 | 待评估 | 待定 | 待定义 | 待确认 | 待评审 |
+
+## 方案与计划
+
+- 方案引用：待填写（含对象版本）
+- 实施计划引用：待填写（含增量与需求 ID）
+- 测试计划引用：待填写（含需求 ID 与验收条件）
+
+## 阶段记录
+
+| 阶段 | 对象版本 | 状态 | 决策/执行者 | 时间 | 依据 |
+|---|---|---|---|---|---|
+| 需求拆解 | 待定 | 待执行 | — | — | — |
+| 需求评估 | 待定 | 待执行 | — | — | — |
+| 需求表确认 | 待定 | 待执行 | — | — | — |
+| 方案设计 | 待定 | 待执行 | — | — | — |
+| 实施计划 | 待定 | 待执行 | — | — | — |
+| 实施与自检 | 待定 | 待执行 | — | — | — |
+| 正式测试与验收 | 待定 | 待执行 | — | — | — |
+| 代码 Review | 待定 | 待执行 | — | — | — |
+| 合入 | 待定 | 待执行 | — | — | — |
+| 合入核验与收口 | 待定 | 待执行 | — | — | — |
+
+## 探索试验与迭代
+
+| 增量/试验 | 假设 | 范围 | 判断和停止条件 | 授权/决策依据 | 结果 | 变更影响 | 需重审补测 |
+|---|---|---|---|---|---|---|---|
+| 待定义 | — | — | — | 待核对 | NOT_RUN | 待评估 | 待评估 |
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at |
+|---|---|---|---|
+| 启动 | b7636742fc9ea937e6030123afc608fd294861bf | b7636742fc9ea937e6030123afc608fd294861bf | 2026-10-22T05:41:15Z |
+
+## 证据（Evidence）
+
+<!-- CMD="<命令>" make evidence 写入；手抄/转写输出视为无效证据（AGENTS.md 证据与验证门禁）。 -->
+| 时间(UTC) | 命令 | 被测HEAD | exit | 来源 | sha256(16) |
+|---|---|---|---|---|---|
+
+## 交付调度
+
+- 调度状态：未入队；调度记录：无
+- entry_id：无；attempt_id：无；窗口执行者：无
+- 固定候选：无（base/head、组件与相关配置引用实际尝试）
+- 调度依据：policy/delivery.md#合入调度
+- 固定后证据：源码外 RECEIPT；实际结果后按授权原样导入和闭合
+
+## 结果与验证
+
+- 结果：
+- 验证：<结论摘要 PASS/FAIL/SKIP/NOT_RUN 逐项；逐条证据由 make evidence 写入上方证据表>
+- 影响与剩余项：
+
+## 规划进展与下一步
+
+- 本次推进/剩余：待核对（依据实际成果更新适用方案/规划）
+- 首选下一任务：待核对（无适用规划、已完成或受阻时如实说明，不虚构任务）
+- 推荐依据：待填写
+- 前置条件/待确认：待核对
+- 预期产物/验收条件：待定义
+- 重复任务核对：待核对（已有/在途任务、PR 与规划记录）
+- 启动授权：未授权（建议不自动启动新任务，仍须明确授权）
+
+## 合入与清理
+
+- CI 记录：首轮 CI Checkout 失败——backend 合并 tip a75783f 未推送远端；已补推，本提交重触发 CI。
+- CI 记录：88f03f50/67ffd7c9 两轮 CI——首轮 Checkout 失败（backend tip a75783f 未推送，已补推）；次轮 test-pg 的 TestMaterialAckAttachmentOnlyDoesNotCallParentModel 超时：产品代码从不设置 Workspace.Writable（M5 预检不可能触发），本地同提交复现 PASS（0.051s，真实 PG/Redis，verify-materialack.json），判定为并行功能新测试的 CI 环境超时 flake；后续提交重触发 CI。
+- Review 记录：独立 CLI 评审单元 audit-followups-independent-review（收据 /tmp/agent-stack-b2/reviewf-run.json）；结论 APPROVE；报告 .task/reviews/2026-10-22-audit-followups-independent-review.md；被审对象合并基线 vs main
+- 合并基线：分支已合并 origin/main（含并行 backend 角色策略/scrarch-session 工作与 frontend/ui pin 前进）；modules/backend 组合 pin = a75783f（含 7bcbbdb 与 M5 嵌套指针）。
+- 已知既有失败：make test-governance 中 test_svc.SvcDbRecoveryTests.test_addr_change_keeps_database_and_auth 在干净 main（b7636742）同样失败（环境依赖），与本分支无关；CI 环境为最终裁决。其余组合目标（boundaries/pins/libs/core/backend/frontend/ui/agentcmd）全部 PASS（verify-followups-rest.json exit=0）
+- 冲突记录：NOT_RUN（最新目标同步、冲突处置、组合兼容核验及复审/补测）
+- CI 记录：NOT_RUN（当前 HEAD 完整 SHA、全部必需检查、运行链接、执行身份及 GATE 结果）
+- 合入记录：NOT_RUN（交付授权范围、PR、被核验 HEAD、合入 SHA、目标分支及内容核验）
+- 清理记录：NOT_RUN（授权依据、写者退出确认、worktree/分支/任务卡处置）
+
+<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
+```json
+{
+  "summary_schema": 1,
+  "source": "SELF",
+  "timestamp": "2026-10-22T05:40:13.195742+00:00",
+  "command": "make precheck",
+  "exit_code": 0,
+  "cwd": "/home/weichen/projects/Agent-System-Dev",
+  "before_head": "b7636742fc9ea937e6030123afc608fd294861bf",
+  "after_head": "b7636742fc9ea937e6030123afc608fd294861bf",
+  "branch": "main",
+  "target_branch": "main",
+  "target_head": "b7636742fc9ea937e6030123afc608fd294861bf",
+  "root_target": "main",
+  "immediate_target": "main",
+  "before_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "after_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "output_tail": [
+    "make[1]: Entering directory '/home/weichen/projects/Agent-System-Dev'",
+    "[repo]   branch=main head=b7636742fc",
+    "[remote] origin/main=b7636742fc ahead=0 behind=0",
+    "[tree]   clean submodules_drift=0 uninit=0",
+    "[worktrees] linked=5",
+    "[initiatives] local cards (not authoritative): none",
+    "[hooks]   core.hooksPath=scripts/hooks（pre-commit/post-merge 实际接线）",
+    "[facts]   policy/facts.md 6 条事实均在有效期内",
+    "[required-reading] core/baseline.md, workflows/delivery.md §1, policy/delivery.md",
+    "[R0] b7636742fc（完整：b7636742fc9ea937e6030123afc608fd294861bf）",
+    "[worktree] before-sync: recursive component checks passed",
+    "[verdict] READY — 保留本次 precheck receipt 后建任务工作区：PRECHECK_RECEIPT=/tmp/task-precheck.json make task-start NAME=feature/your-branch",
+    "make[1]: Leaving directory '/home/weichen/projects/Agent-System-Dev'"
+  ],
+  "output_sha256": "750b4668efa152b0a18152e950ab40051a737f940cf5e108e6adc79324dea82a",
+  "receipt_sha256": "e2cd793c34846aafbd4c3dd5a77d8bc08fb51323ded1082b212c91e78074bad7",
+  "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/e2cd793c34846aafbd4c3dd5a77d8bc08fb51323ded1082b212c91e78074bad7.json"
+}
+```
+
+## 闭合记录（合入前折叠）
+
+- 本卡在 PR #695（https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/695）合入前闭合并归档，随该 PR 一同合入。
+- 该 PR 的合并提交即本任务的落地记录。
+- 合入后无需回填，也无需单独的闭合 PR。

.task/archive/feature-intent-multi-turn-a1.md

@@ -0,0 +1,168 @@
+# feature/intent-multi-turn-a1 任务卡
+
+任务主记录：PR #700 https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/700；状态：已完成（合入前闭合）；owner：weichen
+
+## 基线与授权
+
+- 权威仓：ssh://git@192.168.3.2:2222/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= 955a32de2bb49171348bad5f566cce935df19212
+- 工作区：/home/weichen/projects/Agent-System-Dev-wt-feature-intent-multi-turn-a1（worktree）；分支：feature/intent-multi-turn-a1
+- 分支类型：standalone；root_target：main；immediate_target：main；accepting_requirements：false
+- 需求分流：verdict=NEW；selected_initiative=无；requirement_sha256=5dd60900f5e7d69e382c367bfde373c087528dd9dcae7e16199c956ef4f3d9bf；triage_receipt=/tmp/triage-a1-1792658810.json；receipt_sha256=35b32668d143e39f386f069ae4c0004cae9761125d95241bb66e6aff1530d24b
+
+- 授权与交付终点：用户已批准启动 A1 多轮意图闭环（方案 Functional Follow-Ups 第一项）。范围内连续推进：设计、agent-per-unit 实施、验证、组合、Review、PR/CI/合入。未授权：A2-A4、A2A、部署/发布、其余业务动作族扩展。
+- 设计决定（2026-10-22，host）：
+  1. 第一类真实业务动作 = **运行取消**（"取消刚才的任务"）：cancel 命令已注册且为高后果动作，走既有 cmdbus 确认卡；后续动作族另行增量。
+  2. 会话状态存 Backend 既有 store（新表 intent_session，键 owner+project+conversation），保存挂起预期（action ref/revision/缺失槽位/已累积槽位）与过期时间（30 分钟 TTL）；revision 递增防过期回答污染新任务。
+  3. 库层不动 Stage 1 语义：Backend 实现 ExpectationProvider 数据源并在 intentgate/route 消费 set_slot/change_slot/cancel/expectation 命令（route.go 现按"宿主不消费"转 turn——本任务改变这一点）。
+  4. 高危动作仍必须经 cmdbus 确认；会话只是槽位与预期的载体，不授予执行权。
+- 交付模式：goal-first（目标、范围和交付终点一次确认；范围内连续推进）
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md）
+- 合入执行：agent（已授权交付范围内，Review 通过、冲突解决且当前 HEAD 的 CI 通过后合入）
+- 人工决策点：仅限目标/范围/验收变更、重大取舍、高后果操作或无法自动判定的业务验收
+- 当前阶段：需求拆解；当前增量：I1（待定义）
+- 流程依据：仓库根目录 policy/delivery.md（归档后仍按仓库根目录定位）
+
+## 目标与非目标
+
+**目标**：多轮对话中：缺槽动作 → 澄清 → 用户回答补槽 → 动作完成（第一类=运行取消）；"取消刚才的任务"作用于明确对象；歧义先澄清；过期回答（TTL 外）不影响新任务；双用户隔离；revision 防串轮。拆两个单元：U-A1b 会话状态与命令消费（intentgate/route/server + store 表）；U-A1c 取消意图路由到 cmdbus（确认卡 + 明确对象解析）。
+
+**非目标**：A2-A4；A2A；更多业务动作族；前端界面改动；部署。
+
+## Agent 实施收据
+
+路由与 fail-stop 规则见根目录 AGENT-EXECUTION.md 与 policy/delivery.md；每次尝试一行，原始日志留在源码外收据路径。
+
+| 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|---|
+| 待定义 | — | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | — |
+
+## 关联方向与规划
+
+- 适用状态：待核对（无适用规划时说明原因）
+- 主记录路径/版本：待核对（路径按仓库根目录定位，归档后不变；只引用唯一正文）
+- 对应里程碑：待核对
+
+## 需求分析
+
+| ID | 描述 | 项目符合度及依据 | 优先级 | 验收条件 | 依赖 | 结论 |
+|---|---|---|---|---|---|---|
+| R1 | 待填写 | 待评估 | 待定 | 待定义 | 待确认 | 待评审 |
+
+## 方案与计划
+
+- 方案引用：待填写（含对象版本）
+- 实施计划引用：待填写（含增量与需求 ID）
+- 测试计划引用：待填写（含需求 ID 与验收条件）
+
+## 阶段记录
+
+| 阶段 | 对象版本 | 状态 | 决策/执行者 | 时间 | 依据 |
+|---|---|---|---|---|---|
+| 需求拆解 | 待定 | 待执行 | — | — | — |
+| 需求评估 | 待定 | 待执行 | — | — | — |
+| 需求表确认 | 待定 | 待执行 | — | — | — |
+| 方案设计 | 待定 | 待执行 | — | — | — |
+| 实施计划 | 待定 | 待执行 | — | — | — |
+| 实施与自检 | 待定 | 待执行 | — | — | — |
+| 正式测试与验收 | 待定 | 待执行 | — | — | — |
+| 代码 Review | 待定 | 待执行 | — | — | — |
+| 合入 | 待定 | 待执行 | — | — | — |
+| 合入核验与收口 | 待定 | 待执行 | — | — | — |
+
+## 探索试验与迭代
+
+| 增量/试验 | 假设 | 范围 | 判断和停止条件 | 授权/决策依据 | 结果 | 变更影响 | 需重审补测 |
+|---|---|---|---|---|---|---|---|
+| 待定义 | — | — | — | 待核对 | NOT_RUN | 待评估 | 待评估 |
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at |
+|---|---|---|---|
+| 启动 | 955a32de2bb49171348bad5f566cce935df19212 | 955a32de2bb49171348bad5f566cce935df19212 | 2026-10-22T08:48:01Z |
+
+## 证据（Evidence）
+
+<!-- CMD="<命令>" make evidence 写入；手抄/转写输出视为无效证据（AGENTS.md 证据与验证门禁）。 -->
+| 时间(UTC) | 命令 | 被测HEAD | exit | 来源 | sha256(16) |
+|---|---|---|---|---|---|
+
+## 交付调度
+
+- 调度状态：未入队；调度记录：无
+- entry_id：无；attempt_id：无；窗口执行者：无
+- 固定候选：无（base/head、组件与相关配置引用实际尝试）
+- 调度依据：policy/delivery.md#合入调度
+- 固定后证据：源码外 RECEIPT；实际结果后按授权原样导入和闭合
+
+## 结果与验证
+
+- 结果：
+- 验证：<结论摘要 PASS/FAIL/SKIP/NOT_RUN 逐项；逐条证据由 make evidence 写入上方证据表>
+- 影响与剩余项：
+
+## 规划进展与下一步
+
+- 本次推进/剩余：待核对（依据实际成果更新适用方案/规划）
+- 首选下一任务：待核对（无适用规划、已完成或受阻时如实说明，不虚构任务）
+- 推荐依据：待填写
+- 前置条件/待确认：待核对
+- 预期产物/验收条件：待定义
+- 重复任务核对：待核对（已有/在途任务、PR 与规划记录）
+- 启动授权：未授权（建议不自动启动新任务，仍须明确授权）
+
+## 合入与清理
+
+- 实施收据：U-A1b（pi attempt1，intent-session 会话/命令消费，backend 0fb64c4，verify-a1b exit=0）；U-A1c（pi attempt1，cancel 经 cmdbus 路由，backend c2e3104→verify-a1c exit=0）；架构基线边登记（repair，a1arch4-run.json）与 storage-migrate manifest 补齐（repair，backend 9ee752c，verify-a1sr exit=0）。
+- 组合验证：test-governance 存在 svc 环境不稳定失败（两次运行分别挂在 test_addr_change / test_U2_health；addr_change 已在干净 main 复现，见批二后验证），其余全部目标 PASS（verify-a1-rest.json exit=0）；CI 环境为最终裁决（批二同代码 CI 全绿）。
+- Review 记录：待执行（独立 CLI 评审，随 PR 流程）
+- 冲突记录：NOT_RUN（最新目标同步、冲突处置、组合兼容核验及复审/补测）
+- CI 记录：NOT_RUN（当前 HEAD 完整 SHA、全部必需检查、运行链接、执行身份及 GATE 结果）
+- 合入记录：NOT_RUN（交付授权范围、PR、被核验 HEAD、合入 SHA、目标分支及内容核验）
+- 清理记录：NOT_RUN（授权依据、写者退出确认、worktree/分支/任务卡处置）
+
+<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
+```json
+{
+  "summary_schema": 1,
+  "source": "SELF",
+  "timestamp": "2026-10-22T08:46:59.325275+00:00",
+  "command": "make precheck",
+  "exit_code": 0,
+  "cwd": "/home/weichen/projects/Agent-System-Dev",
+  "before_head": "955a32de2bb49171348bad5f566cce935df19212",
+  "after_head": "955a32de2bb49171348bad5f566cce935df19212",
+  "branch": "main",
+  "target_branch": "main",
+  "target_head": "955a32de2bb49171348bad5f566cce935df19212",
+  "root_target": "main",
+  "immediate_target": "main",
+  "before_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "after_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "output_tail": [
+    "make[1]: Entering directory '/home/weichen/projects/Agent-System-Dev'",
+    "[repo]   branch=main head=955a32de2b",
+    "[remote] origin/main=955a32de2b ahead=0 behind=0",
+    "[tree]   clean submodules_drift=0 uninit=0",
+    "[worktrees] linked=4",
+    "[recycle] merged un-recycled branches: feature/container-storage-plan",
+    "[initiatives] local cards (not authoritative): none",
+    "[hooks]   core.hooksPath=scripts/hooks（pre-commit/post-merge 实际接线）",
+    "[facts]   policy/facts.md 6 条事实均在有效期内",
+    "[required-reading] core/baseline.md, workflows/delivery.md §1, policy/delivery.md",
+    "[R0] 955a32de2b（完整：955a32de2bb49171348bad5f566cce935df19212）",
+    "[worktree] before-sync: recursive component checks passed",
+    "[verdict] READY — 保留本次 precheck receipt 后建任务工作区：PRECHECK_RECEIPT=/tmp/task-precheck.json make task-start NAME=feature/your-branch",
+    "make[1]: Leaving directory '/home/weichen/projects/Agent-System-Dev'"
+  ],
+  "output_sha256": "f06e6cc8ddb0c414c2ac92e5100dc58b0b926a2bf7196273056b01be80253217",
+  "receipt_sha256": "32899ef2b4ebee5bf1725fb79e1bba0382177731155cebab04178821e6da3f1b",
+  "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/32899ef2b4ebee5bf1725fb79e1bba0382177731155cebab04178821e6da3f1b.json"
+}
+```
+
+## 闭合记录（合入前折叠）
+
+- 本卡在 PR #700（https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/700）合入前闭合并归档，随该 PR 一同合入。
+- 该 PR 的合并提交即本任务的落地记录。
+- 合入后无需回填，也无需单独的闭合 PR。

.task/archive/fix-svc-test-port-governance-final.md

@@ -0,0 +1,99 @@
+# fix/svc-test-port-governance-final 任务卡
+
+任务主记录：PR #698 https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/698；状态：已完成（合入前闭合）；owner：weichen
+
+- 权威仓：ssh://git@192.168.3.2:2222/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= 955a32de2bb49171348bad5f566cce935df19212
+- 工作区：/home/weichen/projects/Agent-System-Dev-wt-fix-svc-test-port-governance-final（worktree）；分支：fix/svc-test-port-governance-final
+- 分支类型：standalone；root_target：main；immediate_target：main；accepting_requirements：false
+- 需求分流：verdict=NEW；selected_initiative=无；requirement_sha256=04cbe9df900a03163aeadb42fd22e5a86ddeced179901b50ac0f4642ce7f6881；triage_receipt=/tmp/pg3-triage.json；receipt_sha256=aca390790027841efaefe2082123780b1ec8d775f9ca0be80262a80f7121bde9
+
+- 授权与交付终点：<本次允许的动作与终点；未授权事项写明>
+- 交付模式：goal-first（目标、范围和交付终点一次确认；范围内连续推进）
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md）
+- 合入执行：agent（已授权交付范围内，Review 通过、冲突解决且当前 HEAD 的 CI 通过后合入）
+- 流程依据：仓库根目录 policy/delivery.md（归档后仍按仓库根目录定位）
+
+## 目标与非目标
+
+<预期结果、受影响入口/模块/契约；明确不做什么。>
+
+## Agent 实施收据
+
+路由与 fail-stop 规则见根目录 AGENT-EXECUTION.md 与 policy/delivery.md；每次尝试一行，原始日志留在源码外收据路径。
+
+| 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|---|
+| 待定义 | — | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | — |
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at |
+|---|---|---|---|
+| 启动 | 955a32de2bb49171348bad5f566cce935df19212 | 955a32de2bb49171348bad5f566cce935df19212 | 2026-10-22T08:55:33Z |
+
+## 证据（Evidence）
+
+<!-- CMD="<命令>" make evidence 写入；手抄/转写输出视为无效证据（AGENTS.md 证据与验证门禁）。 -->
+| 时间(UTC) | 命令 | 被测HEAD | exit | 来源 | sha256(16) |
+|---|---|---|---|---|---|
+
+## 结果与验证
+
+- 结果：
+- 验证：<结论摘要 PASS/FAIL/SKIP/NOT_RUN 逐项；逐条证据由 make evidence 写入上方证据表>
+- 影响与剩余项：
+
+## 合入与清理
+
+- Review 记录：NOT_RUN（审阅智能体/平台身份、base/head、结论、问题闭合及重放依据）
+- 冲突记录：NOT_RUN（最新目标同步、冲突处置、组合兼容核验及复审/补测）
+- CI 记录：NOT_RUN（当前 HEAD 完整 SHA、全部必需检查、运行链接、执行身份及 GATE 结果）
+- 合入记录：NOT_RUN（交付授权范围、PR、被核验 HEAD、合入 SHA、目标分支及内容核验）
+- 清理记录：NOT_RUN（授权依据、写者退出确认、worktree/分支/任务卡处置）
+
+<!-- Local receipt: SELF. Digests detect corruption; they do not authenticate a reviewer or CI. -->
+```json
+{
+  "summary_schema": 1,
+  "source": "SELF",
+  "timestamp": "2026-10-22T08:54:47.013779+00:00",
+  "command": "make precheck",
+  "exit_code": 0,
+  "cwd": "/home/weichen/projects/Agent-System-Dev",
+  "before_head": "955a32de2bb49171348bad5f566cce935df19212",
+  "after_head": "955a32de2bb49171348bad5f566cce935df19212",
+  "branch": "main",
+  "target_branch": "main",
+  "target_head": "955a32de2bb49171348bad5f566cce935df19212",
+  "root_target": "main",
+  "immediate_target": "main",
+  "before_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "after_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+  "output_tail": [
+    "make[1]: Entering directory '/home/weichen/projects/Agent-System-Dev'",
+    "[repo]   branch=main head=955a32de2b",
+    "[remote] origin/main=955a32de2b ahead=0 behind=0",
+    "[tree]   clean submodules_drift=0 uninit=0",
+    "[worktrees] linked=5",
+    "[recycle] merged un-recycled branches: feature/container-storage-plan",
+    "[initiatives] local cards (not authoritative): none",
+    "[hooks]   core.hooksPath=scripts/hooks（pre-commit/post-merge 实际接线）",
+    "[facts]   policy/facts.md 6 条事实均在有效期内",
+    "[required-reading] core/baseline.md, workflows/delivery.md §1, policy/delivery.md",
+    "[R0] 955a32de2b（完整：955a32de2bb49171348bad5f566cce935df19212）",
+    "[worktree] before-sync: recursive component checks passed",
+    "[verdict] READY — 保留本次 precheck receipt 后建任务工作区：PRECHECK_RECEIPT=/tmp/task-precheck.json make task-start NAME=feature/your-branch",
+    "make[1]: Leaving directory '/home/weichen/projects/Agent-System-Dev'"
+  ],
+  "output_sha256": "b63c0d5c11be0292024cc972eee78fbcef7349381ee3bdecb432815b903373e6",
+  "receipt_sha256": "3ee914c56ff0e9cf2a4d11db1ec0a2e6c74cf745cceb7eff1cefd2f9d938ee89",
+  "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/3ee914c56ff0e9cf2a4d11db1ec0a2e6c74cf745cceb7eff1cefd2f9d938ee89.json"
+}
+```
+
+## 闭合记录（合入前折叠）
+
+- 本卡在 PR #698（https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/698）合入前闭合并归档，随该 PR 一同合入。
+- 该 PR 的合并提交即本任务的落地记录。
+- 合入后无需回填，也无需单独的闭合 PR。
+| 同步（记录前对象） | 98ee59c477785b2d5094fcbea3e67a4dc864c388 | a29562ef8315c6cbe71bf531720ce5ffa5ca2717 | 2026-10-22T09:35:11Z |

.task/archive/fix-svc-test-port-governance.md

@@ -1,6 +1,6 @@
 # fix/svc-test-port-governance 任务卡
 
-任务主记录：<PR 链接，交付前填写>；状态：进行中；owner：weichen
+任务主记录：PR #694 https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/694（merge 37e194871f）；状态：已完成（回填）；owner：weichen
 
 - 权威仓：ssh://git@192.168.3.2:2222/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= 33d6ef69212595c680a744549986c19bb6acd6c3
 - 工作区：/home/weichen/projects/Agent-System-Dev-wt-fix-svc-test-port-governance（worktree）；分支：fix/svc-test-port-governance
@@ -37,7 +37,7 @@
 | 时间(UTC) | 命令 | 被测HEAD | exit | 来源 | sha256(16) |
 |---|---|---|---|---|---|
 
-## 结果与验证（完成后填写）
+## 结果与验证
 
 - 结果：
 - 验证：<结论摘要 PASS/FAIL/SKIP/NOT_RUN 逐项；逐条证据由 make evidence 写入上方证据表>
@@ -91,4 +91,9 @@
 }
 ```
 | 同步（记录前对象） | d65195bd41317e480c5a0cfa5133b0ad98a48d4b | a1e0c85c0400ce300a847da276e70d520f842844 | 2026-10-22T07:17:59Z |
-| 同步（记录前对象） | 37e194871f4ce8f60c7678b64402bec3541fcbd1 | 37e194871f4ce8f60c7678b64402bec3541fcbd1 | 2026-10-22T07:36:17Z |
+
+## 闭合记录（card-autoclose 回填）
+
+- 依据：merge 37e194871f4ce8f60c7678b64402bec3541fcbd1（PR #694）已包含于 origin/main，分支成果已落盘；本段为合入后回填。
+- 合并主题：Merge pull request 'Use dynamic ports in the two remaining hardcoded test bindings' (#694) from fix/svc-test-port-governance into main
+- 归档：随闭合移入 .task/archive/；任务执行期的过程证据见原任务记录与 PR。

.task/reviews/2026-10-22-a1-intent-multi-turn-independent-review.md

@@ -0,0 +1,75 @@
+# 独立代码 Review：feature/intent-multi-turn-a1（A1 多轮意图闭环）
+
+- Reviewer：独立 CLI 会话（pi，未参与本分支实施）
+- 日期：2026-10-22（UTC）
+- 对象：`git diff 955a32de...9126b09b`（Dev 超级仓）；组件焦点 `modules/backend a75783fd..9ee752c3`
+- 任务卡：`.task/feature-intent-multi-turn-a1.md`（设计决定：run-cancel 为第一业务动作、30min TTL、revision、cmdbus 确认不变）
+- 性质：findings-only，未改任何代码；只新增本报告文件。
+
+## 1. 范围与方法
+
+- 超级仓 diff：`policy/architecture-baseline.json` +3 边、`modules/backend` gitlink a75783fd→9ee752c3、任务卡新增。
+- backend 组件 diff（3 commits，+3267/−21）：新包 `internal/intentsession`、`internal/store/intent_session.go`（表 v52）、`internal/route`（Cancel 裁决）、`internal/server`（`intent_session.go`、`intent_cancel.go`、`server.go` chat 接线）、`cmd/storage-migrate`（copyOrder 补 intent_session）。
+- 方法：全量逐文件静态精读 + 调用链追踪（chat postMessage → fuseIntentSession → route.Decide → admitIntentCommand → Bus.Dispatch / handleIntentCancel → dispatchCancel；runmgr HITL 转轨判定的 route 契约），测试断言逐条对照审查镜头。
+
+### 测试执行（诚实出口：NOT_RUN）
+
+- 本会话**未能复跑**聚焦测试（`go test ./internal/intentsession/... ./internal/route/... ./internal/server/...`）：当前工作区组件 checkout 只部分物化——`modules/backend/deps/agent-system-core、error-code-system、logging-system、agent-document-renderer` 为空目录，go.mod replace 闭包无法解析；无网络；本机模块缓存仅有 2026-10-13 伪版本（≠本次 pin 的提交），用它们编译出的结果不能作为本 PR 的证据，故弃用。
+- 尝试过程可复核：为诊断曾临时在 `modules/backend/deps/` 建指向超级仓 `deps/` 的符号链接并随即删除（超级仓 deps 亦缺上述四个组件，`go build` 报缺 go.mod 为证）；现场已恢复，`git status --porcelain` 干净（见 §5）。
+- 任务卡记录的 verify-a1b/a1c exit=0、批二 CI 全绿：本会话无法重放，按 `[未经证实]` 处理；下述结论全部来自静态审查。按任务单要求未跑 `make test`。
+
+## 2. 按镜头的结论（spec / security / regressions / tests）
+
+**spec（多轮闭环）**：缺槽动作 → 澄清（`suspendIntentSession`，intent_session.go:273-310）→ 回答折叠（`fuseIntentSession` → `ApplyAnswer`，slot 齐则合成与完整识别同形的 MatchResult 走同一准入/派发路径，server.go:1252-1258 + intent_session.go:110-155）→ 完成；TTL 30min、写时续期、读侧惰性删除（intentsession.go:12-13、344-357）；revision 单调、`ErrStale` 拒绝陈旧回答（intentsession.go:206-212、359-364）；双用户/项目/会话键隔离（store 全查询带 owner 过滤）。主链路成立，测试覆盖到每一环。**例外见 B1/M1**。
+
+**security**：会话不携带授权——补齐后仍走 `admitIntentCommand` + `Bus.Dispatch`，高危确认卡由 cmdbus 收口（TestIntentSessionStillRequiresHighRiskConfirmation 断言确认前处理器不执行）；取消经 `run.cancel` 注册命令走同款 Dispatch，卡确认前不记「已取消」（intent_cancel.go:150-186，TestIntentCancelSurfacesHighDangerConfirmCard 覆盖确认→执行全链）；跨用户运行 `GetRun(owner,…)` 不可见即澄清、不泄露存在性（intent_cancel.go:73-79，TestIntentCancelNeverResolvesAnotherOwnerRun）；候选只列本人本会话未终态运行（intent_cancel.go:97-112）。**例外见 M2**。
+
+**regressions**：无挂起预期时 fuse 段空转，`TestIntentSessionLegacyResponsesUnchanged` 做逐字节对照；route 契约——cancel 移出 unconsumedKinds 但 `StartFound` 刻意不置位（route.go:181-188），runmgr HITL 转轨判定（runmgr.go:2331-2334 只看 StartFound）行为与 main 一致；U6 准入——fused 结果同样过 `dispatchCommand`（res.Complete()）与 `admitIntentCommand`（声明 schema 映射、必填不满足即 Blocked）两道闸，非法/缺失槽位不可能执行。**例外见 M1（累计槽位跨任务泄漏）。**
+
+**tests**：覆盖面好——触发条件（有/无挂起、同意图/异意图、过期、隔离）、revision、高危确认、legacy 逐字节、显式/会话/歧义靶子、确认卡。缺口：无「同会话内换任务（异意图）再挂起」用例（正是 B1 场景）；无真实并发写测试（revision 逻辑覆盖属逻辑等价，可接受）；`answerFromRecognition` 显式落槽不看意图归属（intent_session.go:203）无专项用例。
+
+## 3. Findings
+
+### Blocker
+
+**B1（spec/正确性）换任务再挂起时，上一个动作的累计槽位被继承，可把陈旧值派发给新动作。**
+`Service.Suspend` 无条件合并旧行槽位：`slots = mergeSlots(cur.Slots, slots)`（internal/intentsession/intentsession.go:193-194）。宿主侧 `suspendIntentSession` 对「route 层槽位未就绪」的新动作一律走 Suspend（internal/server/intent_session.go:273-310），不区分新旧预期是否同一动作。可达序列（同会话、TTL 内）：
+1. T1 意图 A（如 `demo.run-cancel`）缺 reason → 挂起，累计 `{run_id: R-7}`；
+2. T2 用户改做意图 B（如 `demo.purge`，缺 scope）→ fuse 判「异意图、无落槽」不碰会话（intent_session.go:124-127）→ route 澄清 → `Suspend(B)` 继承 `{run_id: R-7}`；
+3. T3 用户补 scope → `ApplyAnswer` 合并全量槽位判齐（intentsession.go:227）→ `completedRecognition` 以累计槽位派发 B（intent_session.go:245-262）；
+4. `mapSchemaParams` 只丢弃**未声明**键，B 声明过的 `run_id` 会带陈旧值 R-7 进 params（internal/server/intent_admission.go:69-84）——若 run_id 是 B 的必填，准入反而被陈旧值满足。
+这与包自己的不变量直接冲突（「绝不允许旧槽位漏进新任务」intentsession.go:25；「别的任务的输入绝不混进当前动作」intent_session.go:53、188）——该保护只做在了 fuse 的回答投影上（answerFromRecognition 异意图不并入，intent_session.go:180-208），Suspend 覆写预期时漏了。建议：Suspend 时若 `cur.Expectation` 存在且 `IntentID/Action` 与新预期不同，则丢弃旧累计槽位（或显式要求宿主先 Drop）；并补「异意图换任务」回归用例。涉同一镜头的次生风险见 minor m4。
+
+### Major
+
+**M2（security/错误路径）`applyCancel` 吞掉存储错误后，可能把「放弃补槽」滑成「立即取消一个真实运行」。**
+同意图取消的设计语义是只清挂起预期、不派发（intent_session.go:20-24）。但 `applyCancel` 对非 ErrStale 的存储错误同样返回 nil 且错误被丢弃（internal/server/intent_session.go:165-170），`fuseIntentSession` 整体返回无会话语义 → postMessage 继续走 `route.KindCancel` 规划（server.go:1273-1279）。此时挂起行的 `run_id` 槽位经 `sessionRunTarget`→`Binding` 仍解出靶子（intent_session.go:313-327），`planIntentCancel` 对发起人可见即放行；若部署未注册 `run.cancel`，走 `dispatchCancel` 本地路径**立即 `CancelRun`、无任何确认**（intent_cancel.go:164-176）。即：一次瞬时存储故障把「算了不取消」变成「未确认取消 R-7」。建议：applyCancel 对 `err != nil`（非 ErrStale）向上传播错误（writeStoreErr），fail-closed。
+
+### Minor
+
+- **m1（文档失实）** `internal/store/intent_session.go:11-12` 声称该表「不进 storage-migrate 的 copyOrder（同 admission_leases）」，但 `cmd/storage-migrate/main.go:311-313` 已把 `intent_session` 加入 copyOrder（且是清单夹具测试 `main_test.go:218` 的强制要求，9ee752c 补得对）。代码正确、注释过期，需同步删改；旧源库缺表已有 `sqliteHasTable` 跳过（main.go:400-402），无行为问题。
+- **m2（回话如实性）** 总线路径派发被拒（StateRejected）时 `cancel.accepted=false` 但 `cancel.reason` 为空（internal/server/intent_cancel.go:142），与本地路径「失败带原因」不对称；receipt 虽随响应透出，建议把拒绝原因写入 `result.Reason`。
+- **m3（过期边界 fail-open）** `expires_at` 解析失败得零值时 `live()` 视为「永不过期」（intentsession.go:366-373 + store `parseTime` 容错返回零值）。当前写入方恒写 TTL，风险仅来自自身写坏的数据，但与全文件 fail-closed 纪律不一致：解析失败宜按已过期处理。
+- **m4（与 B1 联动）** 显式 `set_slot/change_slot` 命令「不看意图归属」直接写入当前挂起预期（intent_session.go:196-203，注释称有意）。B1 修复（换任务即弃旧槽位）落地后，此路径仍可把异动作的落槽命令并入当前预期；建议改为「命令名 ∈ 当前预期 Missing/声明键才采纳」，或补用例锁定现状语义。
+
+### Notes
+
+- **n1** 「放弃补槽」轮仍按 KindTurn 起普通回合（server.go:1273-1279 不改 routeKind；1340-1345 仅 KindCancel 拦截），响应同时带 `intent_session` note 与 run——与 main 上 cancel 落 turn 的旧行为一致，测试未固定该组合，建议在任务卡确认一次。
+- **n2** `completedRecognition` 不搬运 `Risk/RequiresConfirm`（intent_session.go:245-262）：全仓 grep 确认 `Decision.RequiresConfirm` 目前无消费者（route.go:114-116 仅透传），确认权在 cmdbus danger，今日无行为影响；将来若有人消费该字段，fused 路径会静默不同——建议留注释或补字段。
+- **n3** `PutIntentSession` upsert 后读回非原子（store/intent_session.go:74-93），并发双写可能都读到同一新 revision；当前会话请求路径单写者，无实害，建议加注释固化「每会话单写者」前提。
+- **n4** 未注册 `run.cancel` 的本地回落取消无确认卡——与既有 `POST /api/runs/{id}/cancel` 逐字同款、属设计决定（任务卡决定 1/4 与 intent_cancel.go:15-17 注释一致），非本 PR 引入；注册了命令的部署确认链有测试护栏。记录在案以回应「确认是否被绕过」镜头：**会话路径在命令注册时不绕过确认**。
+- **n5** 架构基线 3 条新边与实际 import 逐一核对相符（intentsession→intentgate/store；server→intentsession）；基线治理测试本会话未复跑（同 §1 NOT_RUN 原因）。
+- **n6** 任务卡记载的 svc governance 偶发失败为已知预存问题、按任务单不属本次范围，未复跑 `make test`。
+- **n7** 测试缺口清单：异意图换任务再挂起（B1 回归用例）、applyCancel 存储错误注入、显式落槽跨意图（m4）。
+
+## 4. 结论
+
+主链路（挂起→澄清→补齐→同路派发）、过期隔离、revision、双用户隔离、取消三态（显式/会话绑定/歧义→如实澄清）与 cmdbus 确认收口均实现且有测试护栏，route/runmgr 契约保持。但以下问题应先修再合：
+
+- Blocker B1：跨动作挂起继承旧累计槽位，陈旧值可进新动作派发参数（intentsession.go:193-194；admission 只滤未声明键）。
+- Major M2：applyCancel 吞存储错误 fail-open，可滑向无确认的本地取消（intent_session.go:165-170 → server.go:1273 → intent_cancel.go:164-176）。
+- Minor m1–m4 建议随修复一并处理（m1 文档、m2 回话、m3 过期 fail-closed、m4 落槽归属）。
+
+最终判定（理由如上三条）：
+
+REVIEW VERDICT: BLOCK

.task/reviews/2026-10-22-audit-followups-independent-review.md

@@ -0,0 +1,72 @@
+# Independent Code Review — feature/audit-followups-pin-gate-m5
+
+- Reviewer: independent CLI review session (audit-followups-independent-review unit; fresh session, not the implementer)
+- Date: 2026-10-22
+- Review object: this checkout @ `a2b4cf73` (branch tip `feature/audit-followups-pin-gate-m5`, detached HEAD) versus `origin/main`. No `origin/*` refs exist in this sandbox, so the diff was taken against the merged authoritative main tip `d65195bd` (PR #691 merge, second parent of `a874ee60` "Merge authoritative main into the task branch"); `merge-base(d65195bd, HEAD) = d65195bd`, so `git diff d65195bd...HEAD` ≡ `git diff origin/main...HEAD`.
+- Scope claims under review:
+  1. Dev: new `scripts/check_pin_regression.sh` wired into `scripts/check-pins.sh` and `scripts/task_pr_check.py`; tests `tests/test_check_pins.py` (+1 case) and `tests/test_check_pin_regression.py` (new, 13 cases). Motivating incident: PR #682 (stale branch silently resetting component pins over main).
+  2. `deps/agent-native` `cff69355` → `f2fb9ffa` (review-M5 fix: Writable preflight rejects subagent delegation).
+  3. Gitlink-only pin advances in `deps/agent-squad` `9edb6ba8` → `b6d87638` (nested native `f2fb9ffa`) and `modules/backend` `7bcbbdb3` → `a75783fd` (merged upstream `7bcbbdb` line + parallel work `443e7af`; nested native `f2fb9ffa`).
+- Method: read-only review of `git diff d65195bd...HEAD` (9 files, +479/−4) plus per-submodule commit/tree diffs; focused checks run where this worktree permits (see Verification runs). No code was changed; the only write is this report.
+
+## Findings
+
+### Blockers
+
+None.
+
+### Major
+
+- **MA1 — The CI leg of the pin-regression gate is a structural no-op; all enforcement rests on local full-clone runs.** All three CI checkout jobs fetch a raw object id shallowly and detach (`.gitea/workflows/ci.yaml:152,336,661` — `git fetch --depth=1 origin <sha>` then `checkout -q --detach FETCH_HEAD`), which writes only `FETCH_HEAD` and never creates `refs/remotes/origin/main` (empirically confirmed in a scratch repo: after a raw-SHA shallow fetch, `git rev-parse --verify origin/main^{commit}` fails). `check_pin_regression.sh:24-27` treats an unresolvable `origin/main` as "warn + exit 0" (documented shallow-checkout escape). Consequently `task_pr_check.py ci` (ci.yaml:162) and the CI `make test` → `test-pins` leg can never fail a PR on pin regression — the exact incident shape #682 (a stale branch merged through CI) would again pass CI today. Mitigation: the delivery policy mandates a local PR check before acceptance/merge, and in a full clone (`make task-pr-check local`) the gate does enforce (verified below). Not blocking — the change is a strict improvement and the local leg is the mandated enforcement point — but the gate's stated purpose ("gitlink 相对 origin/main 不得倒退" as a PR gate) is not achieved in CI. Recommendation: in the reviewed checkout step, additionally fetch the base ref (e.g. `git fetch --depth=1 origin "refs/heads/${GITHUB_BASE_REF}:refs/remotes/origin/main"`) so `pin_regression_problems()` verifies real ancestry at gate time; the submodule materialization already produces full child clones, so the per-component `merge-base --is-ancestor` checks would then work offline.
+
+### Minor
+
+- **MI1 — Gitlink removals relative to `origin/main` pass silently.** The gate iterates only HEAD's gitlinks (`check_pin_regression.sh:71-72,95`); a component dropped from the Dev tree (present on base, absent in HEAD) is never compared, and `check-pins.sh` likewise only checks the containers it iterates (a container dropping one of its `deps/*` links is equally invisible). Not the #682 shape (reset, not removal), and "new pin not on base" is an intentional pass (line 74-76), but silent composition shrinkage is adjacent to the incident class this gate exists for. Suggest a follow-up that diffs the base/HEAD gitlink path sets in both directions.
+- **MI2 — `pin_regression_problems()` runs the gate with no subprocess timeout** (`scripts/task_pr_check.py:222-224`). `ensure_commit`'s `git fetch` (`check_pin_regression.sh:48-54`) can hang on a black-holed connection and would stall the PR check until the runner/job timeout. Low practical likelihood (unchanged pins short-circuit at line 73 before any fetch; CI submodules are full clones), but a `timeout=` on the `subprocess.run` would bound it.
+- **MI3 — Unreachable-but-confusing fail mode if a CI submodule lacks the old pin.** If `ensure_commit` ever needed to fetch in CI, the component remotes persist only the public URL (credentials live solely inside the checkout step's per-command env), so the fetch fails and the gate fails closed ("missing locally and could not be fetched", lines 80-86) — correct direction, but the PR author sees an unfetchable-pin error whose real cause is credentials/absence. With full submodule clones this should never trigger; noting for diagnosis only.
+
+### Notes
+
+- **N1 — Preflight placement is consistent with the sibling F02 checks; "zero side effects" holds for the meaningful claims.** The new check (`deps/agent-native/adapters/native/backend.go:228-230`) sits inside the existing `len(writable) > 0 && profile == exec.ToolProfileWorkspace` block (line 216) before any registry/session/model work. Workdir preparation above it (`MkdirAll`, `INSTRUCTIONS.md`/`TASK.md` writes) predates rejection — identical to the pre-existing exec/MCP/host rejections, and `TestContractWritableRejectsSubagentInPreflight` asserts the substantive zero-side-effect properties: no stream call, no factory call, no deliverable file, no `.agentx` session state.
+- **N2 — `pin regression ok` (line 100) prints even when `PIN_REGRESSION_SKIP=1` downgraded failures to warns.** Exit status is the contract (0 with warns), and the warns are loud on stderr; cosmetic only.
+- **N3 — Pre-existing gofmt deviation in `adapters/native/backend.go`** (struct-literal alignment around `runtime.NewAgentSession`, ~line 447). The file at the base pin `cff69355` fails `gofmt -l` identically; the changed hunk (212-230) is clean. Out of scope for this fix.
+- **N4 — Pre-existing stderr noise `fatal: not a tree object` when a container directory exists but is uninitialized.** Reproduced as `git -C deps/agent-intent ls-tree <sha>` from an empty dir discovering the parent Dev repo (process substitution in `check-pins.sh:68`); pre-dates this branch and does not change its exit status. In this sandbox only `modules/backend`, `deps/agent-native`, `deps/agent-squad` are materialized.
+- **N5 — Go tests NOT_RUN in this workspace (environment, not code).** `deps/agent-native/go.mod:10,12` replace `error-code-system`/`logging-system` with nested checkouts that are not materialized here, and the pinned commit objects (`a3ee67bb`, `49b5d8be`) are absent from every local object store (Dev, native, squad, backend); network access is forbidden for this unit, so the modules cannot be completed. `GOWORK=off go test ./adapters/native/...` therefore fails at module setup, not in code. Fallbacks applied: both changed files parse (`gofmt -e`) and were line-reviewed; the author-recorded evidence (`verify-m5.json` / `verify-m5-host.json` exit=0, quoted in commit `f2fb9ffa`) is uncorroborated in this session and treated as author-claimed.
+- **N6 — Composition coherence verified (lens 3).** Nested pins agree at every level: native `f2fb9ffa` (Dev `deps/agent-native` = squad `deps/agent-native` = backend `deps/agent-native`), squad `b6d87638` (Dev = backend), intent `765a7e71` (Dev `deps/agent-intent` = native = squad = backend), core `0cf03446` (Dev `modules/core` = backend `deps/agent-system-core`), command `fe7987dc`, document-renderer `3f259990`, error-code-system `a3ee67bb`, logging-system `49b5d8be`; guidelines/manager deltas (`2688fd2`/`67784f43`/`bd3a7de5` vs Dev `a15db508`/`2c2e3725`) are warn-only by design (`check-pins.sh:57-62`). `bash scripts/check-pins.sh` exits 0 ("pins ok") in this worktree.
+
+## Spec lens (1) — gate catches the incident shape; M5 preflight is exact
+
+- Gate trigger: HEAD pin not a descendant of the base pin fails — stale reset (`test_pr682_stale_branch_carrying_old_pin_fails`) and diverged/rebased pins (`test_diverged_pin_fails`) both exit 1 with `moves BACKWARD` + `PR #682` guidance; forward move, same pin, base-pin-absent (`new, not on origin/main`), unresolvable `origin/main`, and `PIN_REGRESSION_SKIP=1` downgrade all exit 0. `task_pr_check.py ci` wiring hard-fails (`PR_CHECK_FAILED`) on regression and passes with the skip env (`test_task_pr_check_ci_hard_fails_on_regression`, `test_task_pr_check_ci_skip_env_passes`). All 19 Python tests pass in this workspace (Verification runs).
+- M5 preflight: the rejection condition is exactly non-empty Writable ∧ workspace profile ∧ delegation enabled (`backend.go:216,228-229`). Delegation exists iff `b.opts.Subagent != nil` (`runtime/subagent/subagent.go:62-71` no-ops on nil factory; `delegate_task` is registered only in the workspace branch, `backend.go:265`), and Writable reaches `Execute` only via `withWritable(ctx, req.Workspace.Writable)` (`adapters/native/contract.go:66`) — the reasoning profile has no registry at all. Empty-Writable delegation is covered by `TestContractSubagentWithoutWritableStillDelegates` (delegate_task declared, factory invoked with the request fields). Side-effect escape confirmed closed: `tools.ApplyWriteAllowlist` runs before `subagent.Register`, so `delegate_task` never inherited the write-set — rejecting the combination is the right call, and `run_tool_script` cannot reach it either (it only invokes registered tools and bans re-dispatch).
+
+## Regressions lens (2)
+
+- `check-pins.sh` behavior when `origin/main` is absent: unchanged — live run exits 0 with "pins ok", the gate only warns (`check_pin_regression.sh:24-27`). The appended call is `|| fail=1` (check-pins.sh:67), so any gate crash also fails closed.
+- `task_pr_check` callers: no signature/behavior changes to existing functions (`PIN_REGRESSION` const and `pin_regression_problems()` are additive; `cmd_local`/`cmd_ci` append/inject problems only). `scripts/test_affected.py:61-62` and `scripts/task.sh:699` import unaffected names. Remote-failure `Stop` paths still precede the gate (fail-closed elsewhere). `make task-pr-check` runs from the repo root, matching the gate's cwd→toplevel resolution.
+- Delegation flows without Writable: backend `a75783fd` and squad `b6d87638` contain zero `Writable`/`ContractRequest` usage in non-test Go code (grepped) — no live composition flow can trip the new rejection; the preflight only fires for contract requests that declare both.
+
+## Scope lens (3)
+
+Dev diff touches exactly the declared files plus the task card (`.task/**`, host domain): `scripts/check-pins.sh` (+2), `scripts/check_pin_regression.sh` (new, 100 lines), `scripts/task_pr_check.py` (+17/−1 docstring+gate), `tests/test_check_pins.py` (+17), `tests/test_check_pin_regression.py` (new, 187 lines). Submodule ranges are integration-only as declared: native = 1 commit (`f2fb9ff` "Reject subagent delegation under a Writable write-set", parent `cff6935`, no other content); squad = 1 gitlink-only commit (`b6d8763`, `diff-tree` = `deps/agent-native` only); backend = 3 commits (`3ab7cd7` and `92c2b4e` gitlink-only pins; `a75783f` = merge of `7bcbbdb` into the pin line; tree delta vs `7bcbbdb3` is exactly the two nested gitlinks; contains both `7bcbbdb` and `443e7af`). Nothing rides along outside the declared fixes.
+
+## Tests lens (4)
+
+New tests assert the trigger conditions, not just exit codes: exact rejection reason string, no stream/factory invocations, no deliverable/session files (native); `moves BACKWARD` / `PR #682` / `PIN_REGRESSION_SKIP=1` message substrings, `ok <path>` / `pin regression ok` / warn lines, and `[verdict] PR_CHECK_FAILED` / `PR_CHECK_OK` plumbing (Dev). `test_check_pins.py` additionally proves the gate is actually wired inside `check-pins.sh` (copies both scripts into the fixture). Offline discipline is good: temp-dir repos, hermetic env, `GIT_CONFIG_NOSYSTEM=1`, env vars scrubbed in setUp, local bare remotes for the fetch paths.
+
+## Verification runs (this session, foreground)
+
+| Check | Result |
+|---|---|
+| `git diff --stat d65195bd...HEAD` | 9 files, +479/−4 — matches declared scope |
+| `bash scripts/check-pins.sh` | exit 0, "pins ok"; gate warn-only (no origin/main); guidelines warns only |
+| `PYTHONDONTWRITEBYTECODE=1 python3 -m unittest tests.test_check_pin_regression tests.test_check_pins -v` | 19/19 OK (0.796s) |
+| `cd deps/agent-native && GOWORK=off go test -count=1 ./adapters/native/...` | NOT_RUN — module setup fails on unmaterialized replace targets (`go.mod:10,12`); objects absent everywhere; network forbidden (see N5) |
+| `gofmt -e` on both changed native files | parse OK; `gofmt -l` deviation pre-existing (N3) |
+| Raw-SHA shallow fetch → `origin/main` resolvability experiment | does NOT resolve (basis of MA1) |
+| `make test` | intentionally NOT run per unit packet (known pre-existing `test_svc.SvcDbRecoveryTests.test_addr_change_keeps_database_and_auth` governance failure on clean main `b7636742`, recorded on the task card; CI is the final arbiter) |
+
+## Verdict
+
+The pin-regression gate correctly detects the #682 backward-pin shape (and diverged pins) while passing forward/same/new-pin moves and degrading safely without `origin/main` or via the owner-reviewed skip; the M5 preflight rejects exactly the unenforceable Writable+delegation combination with zero behavioral fallout for empty-Writable or non-contract flows; composition pins advance cleanly with no source riding along; the new tests assert real trigger conditions. The one substantive weakness (MA1 — CI leg cannot enforce due to the shallow raw-SHA checkout) is an enforcement-depth gap on a strictly-improving change whose mandated local enforcement point works; MI1–MI3 are bounded follow-ups.
+
+REVIEW VERDICT: APPROVE

policy/architecture-baseline.json

@@ -36,6 +36,8 @@
 "backend/hostapi backend/store",
 "backend/ingest backend/vision",
 "backend/instanceguard backend/store",
+"backend/intentsession backend/intentgate",
+"backend/intentsession backend/store",
 "backend/pgbus backend/bus",
 "backend/pgbus backend/store",
 "backend/plugins backend/settings",
@@ -76,6 +78,7 @@
 "backend/server backend/execenv",
 "backend/server backend/ingest",
 "backend/server backend/intentgate",
+"backend/server backend/intentsession",
 "backend/server backend/plugins",
 "backend/server backend/profiles",
 "backend/server backend/projectscope",

scripts/check-pins.sh

@@ -64,6 +64,8 @@ for container in "${containers[@]}"; do
   done < <(git -C "$container" ls-tree "$commit" deps/)
 done
 
+bash "$root/scripts/check_pin_regression.sh" || fail=1
+
 if [ "$fail" -ne 0 ]; then
   exit 1
 fi

scripts/check_pin_regression.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# 组合指针不倒退：HEAD 中每个 gitlink（deps/*、modules/*）相对 origin/main
+# 只能前进——新 pin 必须以 origin/main 的旧 pin 为祖先。事故原型：PR #682
+# 合入了过期分支，其树把五个组件 pin 重置回批次前的值，静默丢掉了 main 上
+# batch-1 的组合。
+#
+# ┌─ 逃生口（须 owner Review）──────────────────────────────────────────────┐
+# │ PIN_REGRESSION_SKIP=1  声明这是一次有意的降级：失败改为醒目的 warn 并   │
+# │                        退出 0。只用于经组件 owner 审阅的刻意回退，PR   │
+# │                        描述须写明原因；不得用来绕过过期分支。         │
+# └─────────────────────────────────────────────────────────────────────────┘
+#
+# 其他开关：
+#   PIN_REGRESSION_NO_FETCH=1  旧 pin 在子仓本地缺失时不尝试 fetch（测试/离线用）。
+#
+# 在当前工作目录所属仓库的顶层运行。origin/main 本地不可解析（浅检出）时只告警、退出 0。
+set -euo pipefail
+root=$(git rev-parse --show-toplevel)
+cd "$root"
+
+base=origin/main
+skip=${PIN_REGRESSION_SKIP:-0}
+
+if ! git rev-parse --verify -q "$base^{commit}" >/dev/null; then
+  echo "warn: $base is not resolvable locally; pin regression check skipped" >&2
+  exit 0
+fi
+
+fail=0
+
+declare -A main_pins=()
+while read -r mode _typ sha path; do
+  [ "$mode" = "160000" ] || continue
+  main_pins["$path"]=$sha
+done < <(git ls-tree -r "$base")
+
+# 子仓须是独立检出的仓库；未初始化时 git -C 会落到 Dev 自身。
+own_repo() {
+  local path="$1" top
+  top=$(git -C "$path" rev-parse --show-toplevel 2>/dev/null) || return 1
+  [ "$top" = "$root/$path" ]
+}
+
+has_commit() {
+  git -C "$1" cat-file -e "$2^{commit}" 2>/dev/null
+}
+
+ensure_commit() {
+  local path="$1" sha="$2"
+  has_commit "$path" "$sha" && return 0
+  [ "${PIN_REGRESSION_NO_FETCH:-0}" = "1" ] && return 1
+  git -C "$path" fetch -q origin "$sha" >/dev/null 2>&1 || true
+  has_commit "$path" "$sha"
+}
+
+regress() {
+  if [ "$skip" = "1" ]; then
+    echo "warn: PIN_REGRESSION_SKIP=1 — $* (deliberate downgrade; requires owner review)" >&2
+  else
+    echo "pin: $*" >&2
+    fail=1
+  fi
+}
+
+while read -r mode _typ new path; do
+  [ "$mode" = "160000" ] || continue
+  old=${main_pins["$path"]:-}
+  if [ -z "$old" ]; then
+    echo "ok $path (new, not on $base)"
+    continue
+  fi
+  if [ "$old" = "$new" ]; then
+    echo "ok $path"
+    continue
+  fi
+  if ! own_repo "$path"; then
+    regress "$path is not checked out; cannot verify ${new:0:12} descends from $base ${old:0:12}"
+    continue
+  fi
+  if ! ensure_commit "$path" "$old"; then
+    regress "$path $base pin $old is missing locally and could not be fetched; cannot verify no regression"
+    continue
+  fi
+  if ! ensure_commit "$path" "$new"; then
+    regress "$path HEAD pin $new is missing locally and could not be fetched; cannot verify no regression"
+    continue
+  fi
+  if git -C "$path" merge-base --is-ancestor "$old" "$new"; then
+    echo "ok $path (forward ${old:0:12}..${new:0:12})"
+    continue
+  fi
+  regress "$path moves BACKWARD: $base is ${old:0:12}, HEAD is ${new:0:12} (not a descendant)." \
+"This is the PR #682 pattern (a stale branch resetting pins over main): merge $base and re-pin," \
+"or set PIN_REGRESSION_SKIP=1 for an owner-reviewed deliberate downgrade"
+done < <(git ls-tree -r HEAD)
+
+if [ "$fail" -ne 0 ]; then
+  exit 1
+fi
+echo "pin regression ok"

scripts/task_pr_check.py

@@ -13,6 +13,8 @@
       不联网、不需要 token；非 pull_request 事件跳过（退出 0）。
 
 期望目标：child → immediate_target；其余（initiative / standalone / 无卡）→ root_target（无卡即 main）。
+local 与 ci 均运行 check_pin_regression.sh（gitlink 相对 origin/main 不得倒退）；非零即拒绝，
+PIN_REGRESSION_SKIP=1 由该脚本降级为告警（有意降级须 owner Review）。
 
 退出码：0 通过；1 门禁拒绝（PR_CHECK_FAILED）；2 用法；6 远端无法核验（REMOTE_UNVERIFIED，fail closed）。
 仅使用标准库，复用 task_triage 的 Gitea 客户端与 token 读取。token 不打印、不写入任何产物。
@@ -33,6 +35,7 @@ EXIT_USAGE = 2
 PRE_MERGE_CLOSED = "已完成（合入前闭合）"
 CHILD_COLUMNS = ("子任务分支", "必需", "状态", "PR")
 DONE_STATES = ("已合入", "已延期")
+PIN_REGRESSION = Path(__file__).resolve().parent / "check_pin_regression.sh"
 
 
 def sh(*args):
@@ -216,6 +219,17 @@ def final_problems(api, slug, token, branch, meta, text):
     return problems
 
 
+def pin_regression_problems():
+    proc = subprocess.run(["bash", str(PIN_REGRESSION)], capture_output=True, text=True,
+                          encoding="utf-8", errors="replace")
+    for line in (proc.stdout + proc.stderr).splitlines():
+        print(f"[pin-regression] {line}")
+    if proc.returncode != 0:
+        return [f"pin regression gate failed (exit {proc.returncode}): a gitlink moves backward against "
+                "origin/main or cannot be verified; PIN_REGRESSION_SKIP=1 only for owner-reviewed downgrades"]
+    return []
+
+
 def verdict(problems, kind, base, head):
     if problems:
         for problem in problems:
@@ -264,6 +278,7 @@ def cmd_local(args):
         problems.append(f"parent initiative {expected} has no open PR into {meta['root_target']}")
     if args.final and kind == "initiative":
         problems.extend(final_problems(api, slug, token, branch, meta, text))
+    problems.extend(pin_regression_problems())
     return verdict(problems, kind, expected, head)
 
 
@@ -281,7 +296,7 @@ def cmd_ci(_args):
     if base != expected:
         raise Stop(EXIT_FAILED, f"PR base {base!r} differs from expected {expected!r} "
                                 f"for {meta['kind']} branch {head}")
-    return verdict([], meta["kind"], base, head)
+    return verdict(pin_regression_problems(), meta["kind"], base, head)
 
 
 def main(argv=None):

tests/test_check_pin_regression.py

@@ -0,0 +1,187 @@
+"""check_pin_regression.sh：gitlink 相对 origin/main 只能前进（PR #682 事故形态）。
+
+全部离线：临时目录内的普通 Git 仓库充当子仓，origin 只指向本地 bare 仓库。
+"""
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+SCRIPT = ROOT / "scripts" / "check_pin_regression.sh"
+PR_CHECK = ROOT / "scripts" / "task_pr_check.py"
+COMP = "deps/comp"
+
+
+class PinRegressionTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = Path(tempfile.mkdtemp())
+        self.addCleanup(shutil.rmtree, self.tmp, ignore_errors=True)
+        cfg = self.tmp / "gitconfig"
+        cfg.write_text("")
+        self.env = dict(
+            os.environ,
+            GIT_CONFIG_GLOBAL=str(cfg),
+            GIT_CONFIG_NOSYSTEM="1",
+            GIT_AUTHOR_NAME="t",
+            GIT_AUTHOR_EMAIL="t@example.invalid",
+            GIT_COMMITTER_NAME="t",
+            GIT_COMMITTER_EMAIL="t@example.invalid",
+        )
+        for key in ("PIN_REGRESSION_SKIP", "PIN_REGRESSION_NO_FETCH"):
+            self.env.pop(key, None)
+        self.dev = self.tmp / "dev"
+        self.dev.mkdir()
+        self.git(self.dev, "init", "-q")
+        # 子仓：A ← B，另有从 A 分叉的 C。
+        self.comp = self.dev / COMP
+        self.comp.mkdir(parents=True)
+        self.git(self.comp, "init", "-q")
+        self.a = self.commit(self.comp, "a")
+        self.b = self.commit(self.comp, "b")
+        self.git(self.comp, "checkout", "-q", "-b", "side", self.a)
+        self.c = self.commit(self.comp, "c")
+
+    def git(self, cwd, *args):
+        return subprocess.run(
+            ["git", *args], cwd=cwd, env=self.env, check=True, capture_output=True, text=True
+        ).stdout.strip()
+
+    def commit(self, repo, text):
+        (repo / "f").write_text(text)
+        self.git(repo, "add", "f")
+        self.git(repo, "commit", "-qm", text)
+        return self.git(repo, "rev-parse", "HEAD")
+
+    def pin(self, sha, path=COMP):
+        self.git(self.dev, "update-index", "--add", "--cacheinfo", f"160000,{sha},{path}")
+        self.git(self.dev, "commit", "-qm", f"pin {path} {sha[:7]}")
+        return self.git(self.dev, "rev-parse", "HEAD")
+
+    def compose(self, main_pin, head_pin):
+        """origin/main 钉 main_pin，HEAD（PR 分支）钉 head_pin。"""
+        main = self.pin(main_pin)
+        self.git(self.dev, "update-ref", "refs/remotes/origin/main", main)
+        if head_pin != main_pin:
+            self.pin(head_pin)
+
+    def run_check(self, **extra):
+        return subprocess.run(
+            ["bash", str(SCRIPT)], cwd=self.dev, env=self.env | extra, capture_output=True, text=True
+        )
+
+    def test_same_pin_passes(self):
+        self.compose(self.a, self.a)
+        res = self.run_check()
+        self.assertEqual(res.returncode, 0, res.stderr)
+        self.assertIn(f"ok {COMP}\n", res.stdout)
+        self.assertIn("pin regression ok", res.stdout)
+
+    def test_forward_pin_passes(self):
+        self.compose(self.a, self.b)
+        res = self.run_check()
+        self.assertEqual(res.returncode, 0, res.stderr)
+        self.assertIn(f"ok {COMP} (forward", res.stdout)
+
+    def test_pr682_stale_branch_carrying_old_pin_fails(self):
+        self.compose(self.b, self.a)
+        res = self.run_check()
+        self.assertEqual(res.returncode, 1, res.stdout)
+        self.assertIn(f"pin: {COMP} moves BACKWARD", res.stderr)
+        self.assertIn("PR #682", res.stderr)
+        self.assertIn("PIN_REGRESSION_SKIP=1", res.stderr)
+        self.assertNotIn("pin regression ok", res.stdout)
+
+    def test_diverged_pin_fails(self):
+        self.compose(self.b, self.c)
+        res = self.run_check()
+        self.assertEqual(res.returncode, 1, res.stdout)
+        self.assertIn(f"pin: {COMP} moves BACKWARD", res.stderr)
+
+    def test_skip_env_downgrades_to_warning(self):
+        self.compose(self.b, self.a)
+        res = self.run_check(PIN_REGRESSION_SKIP="1")
+        self.assertEqual(res.returncode, 0, res.stderr)
+        self.assertIn("warn: PIN_REGRESSION_SKIP=1", res.stderr)
+        self.assertIn("requires owner review", res.stderr)
+
+    def test_missing_origin_main_warns_and_passes(self):
+        self.pin(self.a)
+        res = self.run_check()
+        self.assertEqual(res.returncode, 0, res.stderr)
+        self.assertIn("warn: origin/main is not resolvable locally", res.stderr)
+
+    def test_new_component_not_on_main_passes(self):
+        self.compose(self.a, self.a)
+        other = self.dev / "deps" / "other"
+        other.mkdir()
+        self.git(other, "init", "-q")
+        self.pin(self.commit(other, "o"), "deps/other")
+        res = self.run_check()
+        self.assertEqual(res.returncode, 0, res.stderr)
+        self.assertIn("ok deps/other (new, not on origin/main)", res.stdout)
+
+    def test_missing_old_object_with_fetch_disabled_fails(self):
+        self.compose("1" * 40, self.a)
+        res = self.run_check(PIN_REGRESSION_NO_FETCH="1")
+        self.assertEqual(res.returncode, 1, res.stdout)
+        self.assertIn(f"pin: {COMP} origin/main pin {'1' * 40} is missing locally", res.stderr)
+
+    def test_missing_old_object_unfetchable_from_local_origin_fails(self):
+        bare = self.tmp / "comp-origin.git"
+        self.git(self.tmp, "init", "-q", "--bare", str(bare))
+        self.git(self.comp, "remote", "add", "origin", str(bare))
+        self.compose("2" * 40, self.a)
+        res = self.run_check()
+        self.assertEqual(res.returncode, 1, res.stdout)
+        self.assertIn("could not be fetched", res.stderr)
+
+    def test_missing_old_object_is_fetched_from_local_origin(self):
+        upstream = self.tmp / "upstream"
+        self.git(self.tmp, "clone", "-q", str(self.comp), str(upstream))
+        newer = self.commit(upstream, "z")
+        bare = self.tmp / "comp-origin.git"
+        self.git(self.tmp, "clone", "-q", "--bare", str(upstream), str(bare))
+        self.git(self.comp, "remote", "add", "origin", str(bare))
+        self.compose(newer, self.b)
+        res = self.run_check()
+        self.assertEqual(res.returncode, 1, res.stdout)
+        self.assertNotIn("could not be fetched", res.stderr)
+        self.assertIn(f"pin: {COMP} moves BACKWARD", res.stderr)
+        self.git(self.comp, "cat-file", "-e", f"{newer}^{{commit}}")
+
+    def test_uninitialized_component_cannot_be_verified(self):
+        self.compose(self.b, self.a)
+        shutil.rmtree(self.comp)
+        self.comp.mkdir()
+        res = self.run_check()
+        self.assertEqual(res.returncode, 1, res.stdout)
+        self.assertIn(f"pin: {COMP} is not checked out", res.stderr)
+
+    def run_pr_check_ci(self, **extra):
+        env = self.env | {"GITHUB_EVENT_NAME": "pull_request", "GITHUB_BASE_REF": "main",
+                          "GITHUB_HEAD_REF": "feature/stale", "TASK_TARGET_BRANCH": "main"} | extra
+        return subprocess.run([sys.executable, str(PR_CHECK), "ci"], cwd=self.dev, env=env,
+                              capture_output=True, text=True, timeout=60)
+
+    def test_task_pr_check_ci_hard_fails_on_regression(self):
+        self.compose(self.b, self.a)
+        res = self.run_pr_check_ci()
+        self.assertEqual(res.returncode, 1, res.stdout + res.stderr)
+        self.assertIn(f"[pin-regression] pin: {COMP} moves BACKWARD", res.stdout)
+        self.assertIn("[pr-check] FAIL pin regression gate failed", res.stdout)
+        self.assertIn("[verdict] PR_CHECK_FAILED", res.stdout)
+
+    def test_task_pr_check_ci_skip_env_passes(self):
+        self.compose(self.b, self.a)
+        res = self.run_pr_check_ci(PIN_REGRESSION_SKIP="1")
+        self.assertEqual(res.returncode, 0, res.stdout + res.stderr)
+        self.assertIn("[pin-regression] warn: PIN_REGRESSION_SKIP=1", res.stdout)
+        self.assertIn("[verdict] PR_CHECK_OK", res.stdout)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_check_pins.py

@@ -8,6 +8,7 @@ from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[1]
 SCRIPT = ROOT / "scripts" / "check-pins.sh"
+REGRESSION = ROOT / "scripts" / "check_pin_regression.sh"
 CONTAINERS = ("modules/backend", "deps/agent-native", "deps/agent-squad", "deps/agent-intent")
 
 
@@ -29,6 +30,7 @@ class CheckPinsTests(unittest.TestCase):
         self.dev = self.tmp / "dev"
         (self.dev / "scripts").mkdir(parents=True)
         shutil.copy(SCRIPT, self.dev / "scripts" / "check-pins.sh")
+        shutil.copy(REGRESSION, self.dev / "scripts" / "check_pin_regression.sh")
         self.git(self.dev, "init", "-q")
 
     def git(self, cwd, *args):
@@ -112,6 +114,21 @@ class CheckPinsTests(unittest.TestCase):
         self.assertEqual(res.returncode, 1)
         self.assertIn("has no Dev pin", res.stderr)
 
+    def test_pin_regression_against_origin_main_fails(self):
+        old, new = self.repo("deps/error-code-system", "e1", "e2")
+        self.build({"error-code-system": old}, {"deps/error-code-system": old})
+        self.git(self.dev, "commit", "-qm", "pr")
+        stale = self.git(self.dev, "rev-parse", "HEAD")
+        self.link(self.dev, "deps/error-code-system", new)
+        self.git(self.dev, "commit", "-qm", "main")
+        self.git(self.dev, "update-ref", "refs/remotes/origin/main", "HEAD")
+        self.git(self.dev, "reset", "-q", stale)
+        res = self.run_pins()
+        self.assertEqual(res.returncode, 1, res.stderr)
+        self.assertIn("ok modules/backend error-code-system", res.stdout)
+        self.assertIn("pin: deps/error-code-system moves BACKWARD", res.stderr)
+        self.assertNotIn("pins ok", res.stdout)
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_svc.py

@@ -296,12 +296,14 @@ class SvcDbRecoveryTests(unittest.TestCase):
     # ---- 1. 存量 exec= DSN：连续启动两次均恢复，进程参数无秘密 ----
 
     def test_legacy_exec_dsn_survives_consecutive_restarts(self):
-        self.register_pg("pg1", 18890, password="legacy-pw-1")
-        dsn = "postgresql://agent:legacy-pw-1@127.0.0.1:18890/agent"
+        pg_port = free_test_port()
+        self.register_pg("pg1", pg_port, password="legacy-pw-1")
+        dsn = "postgresql://agent:legacy-pw-1@127.0.0.1:%d/agent" % pg_port
         d = self.runtime("dev")
-        self.seed_agent("dev", 18791,
-                        "--addr 127.0.0.1:18791 --data %s --plugins %s --auth auto --dsn %s"
-                        % (d / "data", d / "plugins", dsn))
+        port = free_test_port()
+        self.seed_agent("dev", port,
+                        "--addr 127.0.0.1:%d --data %s --plugins %s --auth auto --dsn %s"
+                        % (port, d / "data", d / "plugins", dsn))
         for _ in range(2):
             self.clear_serve_record()
             self.svc("dev", "restart")
@@ -322,12 +324,14 @@ class SvcDbRecoveryTests(unittest.TestCase):
     # ---- 2. 仅 dbref：裸 restart 与重新部署均保留绑定 ----
 
     def test_dbref_binding_survives_bare_restart_and_redeploy(self):
-        self.register_pg("pg1", 18891, password="bind-pw-2")
-        dsn = "postgresql://agent:bind-pw-2@127.0.0.1:18891/agent"
+        pg_port = free_test_port()
+        self.register_pg("pg1", pg_port, password="bind-pw-2")
+        dsn = "postgresql://agent:bind-pw-2@127.0.0.1:%d/agent" % pg_port
         d = self.runtime("dev")
-        self.seed_agent("dev", 18792,
-                        "--addr 127.0.0.1:18792 --data %s --plugins %s --auth auto"
-                        % (d / "data", d / "plugins"),
+        port = free_test_port()
+        self.seed_agent("dev", port,
+                        "--addr 127.0.0.1:%d --data %s --plugins %s --auth auto"
+                        % (port, d / "data", d / "plugins"),
                         extra_rows=[("dbref", "pg1/agent"), ("db", "pg")])
         self.clear_serve_record()
         self.svc("dev", "restart")
@@ -413,9 +417,10 @@ class SvcDbRecoveryTests(unittest.TestCase):
 
     def test_refusals_keep_registration_without_sqlite_fallback(self):
         d = self.runtime("a1")
-        self.seed_agent("a1", 18796,
-                        "--addr 127.0.0.1:18796 --data %s --plugins %s --auth auto"
-                        % (d / "data", d / "plugins"),
+        port = free_test_port()
+        self.seed_agent("a1", port,
+                        "--addr 127.0.0.1:%d --data %s --plugins %s --auth auto"
+                        % (port, d / "data", d / "plugins"),
                         extra_rows=[("dbref", "pgmissing/agent"), ("db", "pg")])
         self.clear_serve_record()
         result = self.svc("a1", "restart", check=False)
@@ -425,33 +430,41 @@ class SvcDbRecoveryTests(unittest.TestCase):
         self.assertEqual(self.kv("a1", "dbref"), "pgmissing/agent")  # 可恢复配置保留
 
         # 实例登记不全（缺 password）→ 拒启。
-        self.register_pg("pginc", 18895, complete=False)
+        self.register_pg("pginc", free_test_port(), complete=False)
         d = self.runtime("a2")
-        self.seed_agent("a2", 18797,
-                        "--addr 127.0.0.1:18797 --data %s --plugins %s --auth auto"
-                        % (d / "data", d / "plugins"),
+        port = free_test_port()
+        self.seed_agent("a2", port,
+                        "--addr 127.0.0.1:%d --data %s --plugins %s --auth auto"
+                        % (port, d / "data", d / "plugins"),
                         extra_rows=[("dbref", "pginc/agent"), ("db", "pg")])
         result = self.svc("a2", "restart", check=False)
         self.assertNotEqual(result.returncode, 0)
         self.assertIn("拒绝", result.stdout)
 
         # dbref 与 dsn= 指向不同库 → 配置冲突拒启。
-        self.register_pg("pg1", 18896, password="clash-pw")
+        pg_port = free_test_port()
+        self.register_pg("pg1", pg_port, password="clash-pw")
+        other_pg_port = free_test_port()
+        while other_pg_port == pg_port:
+            other_pg_port = free_test_port()
         d = self.runtime("a3")
-        self.seed_agent("a3", 18798,
-                        "--addr 127.0.0.1:18798 --data %s --plugins %s --auth auto"
-                        % (d / "data", d / "plugins"),
+        port = free_test_port()
+        self.seed_agent("a3", port,
+                        "--addr 127.0.0.1:%d --data %s --plugins %s --auth auto"
+                        % (port, d / "data", d / "plugins"),
                         extra_rows=[("dbref", "pg1/agent"), ("db", "pg"),
-                                    ("dsn", "postgresql://u:p@127.0.0.1:18999/otherdb")])
+                                    ("dsn", "postgresql://u:p@127.0.0.1:%d/otherdb"
+                                     % other_pg_port)])
         result = self.svc("a3", "restart", check=False)
         self.assertNotEqual(result.returncode, 0)
         self.assertIn("拒绝", result.stdout)
 
         # db=pg 但无可恢复 DSN → 拒启。
         d = self.runtime("a4")
-        self.seed_agent("a4", 18799,
-                        "--addr 127.0.0.1:18799 --data %s --plugins %s --auth auto"
-                        % (d / "data", d / "plugins"),
+        port = free_test_port()
+        self.seed_agent("a4", port,
+                        "--addr 127.0.0.1:%d --data %s --plugins %s --auth auto"
+                        % (port, d / "data", d / "plugins"),
                         extra_rows=[("db", "pg")])
         result = self.svc("a4", "restart", check=False)
         self.assertNotEqual(result.returncode, 0)