Why: 2026-10-13 the shared 8788 dev runtime locked its operator out of 系统管理→RDM 角色权限 — U7 acceptance had bootstrapped u7-admin into the singleton rdm_admins ledger, and KTD4 (correctly) does not grant base isAdmin the RDM domain-admin gate. Recovery required forensics; the roles table also spun on 加载中… forever after the 400.
What:
svc.sh rdm-admin [show|transfer --to x] — ledger inspection + trusted single-row transfer (BEGIN IMMEDIATE + read-back, provenance svc:rdm-admin:, typo guard against base users table, embedded-SQLite only, same binding contract as user CLI); status now lists the RDM domain admin and warns when it is not a base user (acceptance/leftover visibility).
Frontend pin → dcd2699 (Frontend PR #75): rolesListPlaceholder ends the fake loading row; describeRoleListError maps the domain-admin denial to a readable message naming rdm.perm.transfer.
Runtime data was already restored via the sanctioned channel (rdm.perm.transfer as u7-admin → weichen; temp API keys revoked); both admin tabs browser-verified on 8788.
Evidence: task card .task/feature-rdm-admin-lockout-recovery.md — precheck receipt, two combined make test rows (pre- and post-sync HEAD, exit=0, SELF), task-sync receipt; tests/test_svc_rdm_admin.py (25 tests) and frontend vitest (5 new, 215 total) included in make test; CI on this HEAD is the GATE for merge.
Impact: new ops surface only; no changes to rdm_admins semantics, KTD4 ruling, or existing commands; design-guard/contrast-guard untouched classes.
Why: 2026-10-13 the shared 8788 dev runtime locked its operator out of 系统管理→RDM 角色权限 — U7 acceptance had bootstrapped u7-admin into the singleton rdm_admins ledger, and KTD4 (correctly) does not grant base isAdmin the RDM domain-admin gate. Recovery required forensics; the roles table also spun on 加载中… forever after the 400.
What:
- svc.sh <env> rdm-admin [show|transfer --to x] — ledger inspection + trusted single-row transfer (BEGIN IMMEDIATE + read-back, provenance svc:rdm-admin:<old>, typo guard against base users table, embedded-SQLite only, same binding contract as user CLI); status now lists the RDM domain admin and warns when it is not a base user (acceptance/leftover visibility).
- Frontend pin → dcd2699 (Frontend PR #75): rolesListPlaceholder ends the fake loading row; describeRoleListError maps the domain-admin denial to a readable message naming rdm.perm.transfer.
- Runtime data was already restored via the sanctioned channel (rdm.perm.transfer as u7-admin → weichen; temp API keys revoked); both admin tabs browser-verified on 8788.
Evidence: task card .task/feature-rdm-admin-lockout-recovery.md — precheck receipt, two combined `make test` rows (pre- and post-sync HEAD, exit=0, SELF), task-sync receipt; tests/test_svc_rdm_admin.py (25 tests) and frontend vitest (5 new, 215 total) included in make test; CI on this HEAD is the GATE for merge.
Impact: new ops surface only; no changes to rdm_admins semantics, KTD4 ruling, or existing commands; design-guard/contrast-guard untouched classes.
Refs: task card sections R1–R4; Frontend PR #75.
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-rdm-admin-lockout-recovery.md; R0=5212fef01e59b7f9e12fa7fc42cd987c6792a786.
Impact: task metadata only; the feature workspace starts at 5212fef01e.
Refs: .task/feature-rdm-admin-lockout-recovery.md
Why: U7 acceptance bootstrapped u7-admin into the shared dev runtime's
singleton rdm_admins ledger, locking the operator out of RDM admin pages
(rdm.role.list 400); recovery required forensics. KTD4 keeps base isAdmin
to audit-view only, so an operator-side trusted channel is needed.
Evidence: python3 -m unittest tests.test_svc_rdm_admin -v (25 OK, SELF);
live smoke on runtime/dev: show/status/typo-guard outputs verified.
Impact: new svc.sh <env> rdm-admin [show|transfer --to x] command, help
topic, status ledger line with stale-owner warning; no behavior change
for existing commands.
Refs: task card .task/feature-rdm-admin-lockout-recovery.md R1/R2
Why: pick up Agent-System-Frontend dcd2699 (PR #75) so the Dev combined
CI validates the RDM roles panel rejected-state fix together with the
svc.sh rdm-admin recovery tooling in this task.
Evidence: gitlink 43d1933 -> dcd2699; merge-base --is-ancestor of the
reviewed head 0159f00 into frontend main OK (SELF).
Impact: gitlink bump only; combination validated by make test in this
worktree before PR.
Refs: task card feature-rdm-admin-lockout-recovery (R3/I2)
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=5aebedebeb963b5c01f39fd9122ec60dbe6d34d3.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why: 2026-10-13 the shared 8788 dev runtime locked its operator out of 系统管理→RDM 角色权限 — U7 acceptance had bootstrapped u7-admin into the singleton rdm_admins ledger, and KTD4 (correctly) does not grant base isAdmin the RDM domain-admin gate. Recovery required forensics; the roles table also spun on 加载中… forever after the 400.
What:
Evidence: task card .task/feature-rdm-admin-lockout-recovery.md — precheck receipt, two combined
make testrows (pre- and post-sync HEAD, exit=0, SELF), task-sync receipt; tests/test_svc_rdm_admin.py (25 tests) and frontend vitest (5 new, 215 total) included in make test; CI on this HEAD is the GATE for merge.Impact: new ops surface only; no changes to rdm_admins semantics, KTD4 ruling, or existing commands; design-guard/contrast-guard untouched classes.
Refs: task card sections R1–R4; Frontend PR #75.