Add CI, version stamping, and the high-consequence two-key rule #11

Merged
weichen merged 4 commits from feature/hardening-batch into main 2026-09-30 04:09:07 +00:00
4 Commits
Author SHA1 Message Date
weichen 4bd0803c51 Use a repo-scoped PAT secret for private submodule clones in CI
ci / test (pull_request) Successful in 1m17s
Why: the job token only authorizes the event repository; sibling private
submodules (Development-Guidelines et al.) returned 404 on the first run.
Evidence: run 194 log — clone of deps/development-guidelines failed with
repository not found despite the insteadOf rewrite.
Impact: ci.yaml reads secrets.SUBMODULE_TOKEN (stored via API, never in
tree or chat); no other change.
Refs: run 194; PR#11
2026-09-30 04:07:22 +00:00
weichen 51d9e92b88 Record the sync checkpoint
ci / test (pull_request) Failing after 6s
2026-09-30 04:06:02 +00:00
weichen 8252363c04 Add CI, version stamping, and the high-consequence two-key rule
Why: PR test evidence depended on the agent's word (single point); the
running binary could not answer what combination it was built from; and
irreversible operations lacked an explicit agent-stops-here boundary.
Evidence: Gitea runner online (home-runner, ubuntu-latest+docker); make
version prints describe+component SHAs; two-key line maps to baseline hard
boundary 1. CI first run observed on this PR before merge (see Actions tab).
Impact: .gitea/workflows/ci.yaml runs make test + make build on PR/push;
Makefile injects main.version (make version / agent-system version);
AGENTS.md and adoption register the two-key rule. No product code change.
Refs: policy/adoption.md; release-operations requirements
2026-09-30 04:05:42 +00:00
weichen f8dc724862 Record the task card for feature-hardening-batch 2026-09-30 04:04:26 +00:00