Harden task.sh and pin backend/core gitlinks past module-level advisories #92

2026-09-30T17:18:06Z

weichen commented

2026-09-30 17:18:06 +00:00

fix/followup-hardening 任务卡

任务主记录：<PR 链接，task-finish 时填写>；状态：进行中；owner：weichen

基线与授权

权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= 48c3da846f
工作区：/home/weichen/projects/Agent-System-Dev-wt-fix-followup-hardening（worktree）；分支：fix/followup-hardening
授权与交付终点：修复过程遗留小坑（全局 git 身份、远端已合入分支残留、task-start 物化静默失败、close push 无重试）并将 backend 剩余 20 条 module 级依赖通告清至地板；终点为 backend PR 与 Dev PR 合入后回收 worktree。

目标与非目标

目标：①设全局 git 身份（修新克隆提交失败）；②清理远端已合入分支；③task.sh start 物化后按 submodule status 实测核对（不只信退出码）+ close push 失败重试一次；④backend x/crypto→v0.56.0 清 19 条 module 级通告；⑤Dev 钉 backend daddac8 + core cafd9a5（并行会话已合入未钉的配套对，随本卡一并收敛）。
非目标：不动 GO-2026-5932（上游无修复版，地板）；不处理 frontend/ui（audit 已清零）；不重写 precheck 判脏口径。
<本次允许的动作与终点；未授权事项写明>

目标与非目标

<预期结果、受影响入口/模块/契约；明确不做什么。>

同步记录

节点	sync_base_sha	tested_head_sha	checked_at
启动	`48c3da846f`	`48c3da846f`	2026-09-30T16:58:24Z

结果与验证（完成后填写）

结果：
验证：
影响与剩余项：

结果与验证

结果：全局身份已设（weichen weichen@home.local）；远端 55 条已合入分支全删（剩 main + 活跃 cardflow-r1）；task.sh 两处小修提交 aeb9a6a；backend PR #25（5a01b0e）合入，backend main=daddac8；Dev 双 gitlink 钉入。
验证：冒烟——throwaway 任务 start（嵌套物化漂移实测计数）+ 新克隆空提交探测（身份生效）+ FORCE_ABANDON finish 干净回收，全部 PASS；backend go build/go test 绿且 govulncheck 报 0 affected / 0 import / 1 module（GO-2026-5932 上游无修复）；Dev make test exit 0（backend 全包 ok、frontend 33/33、ui 37/37、agentcmd ok）。
影响与剩余项：无阻断项；GO-2026-5932 待上游发修复版后随 routine bump 消化；close push 重试的真实链路验证随本卡收尾的卡片自动闭合完成。

# fix/followup-hardening 任务卡任务主记录：<PR 链接，task-finish 时填写>；状态：进行中；owner：weichen ## 基线与授权 - 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= 48c3da846f801c53164b93a9c79affb98689f791 - 工作区：/home/weichen/projects/Agent-System-Dev-wt-fix-followup-hardening（worktree）；分支：fix/followup-hardening - 授权与交付终点：修复过程遗留小坑（全局 git 身份、远端已合入分支残留、task-start 物化静默失败、close push 无重试）并将 backend 剩余 20 条 module 级依赖通告清至地板；终点为 backend PR 与 Dev PR 合入后回收 worktree。 ## 目标与非目标 - 目标：①设全局 git 身份（修新克隆提交失败）；②清理远端已合入分支；③task.sh start 物化后按 submodule status 实测核对（不只信退出码）+ close push 失败重试一次；④backend x/crypto→v0.56.0 清 19 条 module 级通告；⑤Dev 钉 backend daddac8 + core cafd9a5（并行会话已合入未钉的配套对，随本卡一并收敛）。 - 非目标：不动 GO-2026-5932（上游无修复版，地板）；不处理 frontend/ui（audit 已清零）；不重写 precheck 判脏口径。 - <本次允许的动作与终点；未授权事项写明> ## 目标与非目标 <预期结果、受影响入口/模块/契约；明确不做什么。> ## 同步记录 | 节点 | sync_base_sha | tested_head_sha | checked_at | |---|---|---|---| | 启动 | 48c3da846f801c53164b93a9c79affb98689f791 | 48c3da846f801c53164b93a9c79affb98689f791 | 2026-09-30T16:58:24Z | ## 结果与验证（完成后填写） - 结果： - 验证： - 影响与剩余项： ## 结果与验证 - 结果：全局身份已设（weichen <weichen@home.local>）；远端 55 条已合入分支全删（剩 main + 活跃 cardflow-r1）；task.sh 两处小修提交 aeb9a6a；backend PR #25（5a01b0e）合入，backend main=daddac8；Dev 双 gitlink 钉入。 - 验证：冒烟——throwaway 任务 start（嵌套物化漂移实测计数）+ 新克隆空提交探测（身份生效）+ FORCE_ABANDON finish 干净回收，全部 PASS；backend go build/go test 绿且 govulncheck 报 0 affected / 0 import / 1 module（GO-2026-5932 上游无修复）；Dev make test exit 0（backend 全包 ok、frontend 33/33、ui 37/37、agentcmd ok）。 - 影响与剩余项：无阻断项；GO-2026-5932 待上游发修复版后随 routine bump 消化；close push 重试的真实链路验证随本卡收尾的卡片自动闭合完成。

weichen added 5 commits 2026-09-30 17:18:06 +00:00

Record the task card for fix-followup-hardening 9269986bfe

Harden task.sh materialization check and close push retry aeb9a6a8ea

Why: two recurring papercuts from 2026-09-30 sessions — (1) task-start treated a zero-exit submodule update as complete, but a worktree could still carry 12 drifted/uninitialized nested submodules that only surfaced at build time; (2) close ran a single git push, so a tunnel hiccup left the card-close branch unpushed and the auto-PR never created (hand-patched twice that day).
Evidence: bash -n clean; smoke start of a throwaway task measured nested drift count explicitly and abandon-path finish recycled worktree and branch cleanly (both PASS); fresh-clone commit identity probe also PASS after setting the global identity outside this repo.
Impact: scripts/task.sh cmd_start (+3-line status check) and cmd_close (one retry on push); no interface change.
Refs: .task/fix-followup-hardening.md

Pin backend and core gitlinks and record follow-up hardening 1381b826ec

Why: two strands land together — (1) the remaining 20 module-level govulncheck advisories against x/crypto v0.37.0 clear to the upstream floor via Backend#25 (19 fixed, GO-2026-5932 unfixed upstream); (2) backend main (daddac8) and core main (cafd9a5) from the parallel cardflow merge were not yet pinned, and backend main no longer built against the Dev-pinned core — pinning the coherent pair keeps main verifiable.
Evidence: combined make test exit 0 at backend daddac8 + core cafd9a5 (backend packages ok, frontend 33/33, ui 37/37, agentcmd ok); backend go test green and govulncheck 0 affected / 0 import-level / 1 module-level; task.sh hardening smoke-verified (drift measurement, identity probe, abandon cleanup all PASS).
Impact: two gitlink pins + task card; no Dev-repo source change; remote branch hygiene (55 merged branches deleted) and global git identity were environment fixes outside the repo.
Refs: .task/fix-followup-hardening.md, Backend PR #25

Merge remote-tracking branch 'origin/main' into fix/followup-hardening dcb5bc0f72

Record the sync checkpoint

ci / test (pull_request) Failing after 1m31s

Details

7e657c4b47

weichen merged commit 5005ce6dad into main

2026-09-30 17:18:07 +00:00

weichen referenced this issue from a commit

2026-10-13 01:46:55 +00:00

Record the K4 retest and pin the plan revision

weichen referenced this pull request

2026-10-13 01:47:05 +00:00