Why: seed_settings PUTs /api/settings/user without credentials, so under the PG tier always-on auth the seed always 401s and model config never lands; dev had to be seeded by hand on 2026-10-11.
Evidence: task card .task/feature-svc-seed-auth.md carries tool-written precheck / task-sync / make test receipts (post-sync make test exit=0, receipt cf79fb62); CI on this PR head is the authoritative gate; 3 new stub-based tests in tests/test_svc.py cover auth-on Bearer seeding with create/revoke, --seed-owner override, and the unchanged auth-off path.
Impact: svc.sh deployments passing SVC_MODEL_*/SVC_TAVILY_KEYS seed reliably in both auth modes; a temporary apikey (name=svc-seed) is minted for the first admin (or --seed-owner/SVC_SEED_OWNER) and revoked immediately after; the plaintext key never reaches logs.
Refs: scripts/svc.sh seed_settings + --seed-owner flag.
Why: seed_settings PUTs /api/settings/user without credentials, so under the PG tier always-on auth the seed always 401s and model config never lands; dev had to be seeded by hand on 2026-10-11.
Evidence: task card .task/feature-svc-seed-auth.md carries tool-written precheck / task-sync / make test receipts (post-sync make test exit=0, receipt cf79fb62); CI on this PR head is the authoritative gate; 3 new stub-based tests in tests/test_svc.py cover auth-on Bearer seeding with create/revoke, --seed-owner override, and the unchanged auth-off path.
Impact: svc.sh deployments passing SVC_MODEL_*/SVC_TAVILY_KEYS seed reliably in both auth modes; a temporary apikey (name=svc-seed) is minted for the first admin (or --seed-owner/SVC_SEED_OWNER) and revoked immediately after; the plaintext key never reaches logs.
Refs: scripts/svc.sh seed_settings + --seed-owner flag.
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-svc-seed-auth.md; R0=f382544ec7829abec379b9d1bba04c4ddaac52b7.
Impact: task metadata only; the feature workspace starts at f382544ec7.
Refs: .task/feature-svc-seed-auth.md
Why: seed_settings PUTs /api/settings/user without credentials, so under the PG tier's always-on auth the seed always 401s and model config silently never lands (reproduced on the dev instance 2026-10-11; settings had to be written by hand).
Evidence: make test-governance && make test exit=0 (receipt 8ffc3a89); tests/test_svc.py adds three stub-based cases - auth-on seeds with a Bearer header and create/revoke around the PUT, --seed-owner skips account lookup, auth-off stays credential-free; 14/14 svc tests green.
Impact: deployments that pass SVC_MODEL_*/SVC_TAVILY_KEYS now seed reliably regardless of auth mode; a temporary apikey (name=svc-seed) is minted for the first admin (or --seed-owner/SVC_SEED_OWNER) and revoked right after; auth-off path unchanged.
Refs: task card feature-svc-seed-auth.
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=fefb3e060ec05cdadc6ee8bc55abff730fe79e21.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: task-sync merged newer main (fefb3e06) after the last receipt; the gate requires evidence on the exact head proposed for merge.
Evidence: fresh make test receipt exit=0 appended by make evidence.
Impact: card only.
Refs: feature-svc-seed-auth
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=97002721485662c1e2abfa793f63d46f12cb14ce.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: main advanced after the first review cycle; branch protection requires the head to contain latest main with fresh gate evidence.
Evidence: fresh make test receipt exit=0 on the synced head.
Impact: card only.
Refs: feature/svc-seed-auth
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=0b53094b0d5a6699cccdbc7ca45e649f6bef477b.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: main advanced again during the CI cycle; branch protection requires latest main in head.
Evidence: fresh make test receipt exit=0 on the resynced head (3a1b16f7 sync base 0b53094).
Impact: card only.
Refs: feature/svc-seed-auth
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=5cbb38e788ab3050b8d9f23c21d98d2fd1587a31.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: main gained the U5 ownership feature during the previous CI window; branch protection requires latest main in head.
Evidence: fresh make test receipt exit=0 on the resynced head.
Impact: card only.
Refs: feature/svc-seed-auth
weichen
merged commit 422beb93ac into main2026-10-11 15:37:29 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why: seed_settings PUTs /api/settings/user without credentials, so under the PG tier always-on auth the seed always 401s and model config never lands; dev had to be seeded by hand on 2026-10-11.
Evidence: task card .task/feature-svc-seed-auth.md carries tool-written precheck / task-sync / make test receipts (post-sync make test exit=0, receipt cf79fb62); CI on this PR head is the authoritative gate; 3 new stub-based tests in tests/test_svc.py cover auth-on Bearer seeding with create/revoke, --seed-owner override, and the unchanged auth-off path.
Impact: svc.sh deployments passing SVC_MODEL_*/SVC_TAVILY_KEYS seed reliably in both auth modes; a temporary apikey (name=svc-seed) is minted for the first admin (or --seed-owner/SVC_SEED_OWNER) and revoked immediately after; the plaintext key never reaches logs.
Refs: scripts/svc.sh seed_settings + --seed-owner flag.