Why: The task card is the pull request description, and it has to name the child merges and the checks that already passed.
Evidence: Documents 37, UI 34, Core 21, Frontend 43, Native 16, Squad 15, and Backend 63 are merged. Dev is still open.
Impact: The card stays in progress until the Dev pull request merges.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The task card has to name the commits and the gates that already passed before sync.
Evidence: make test and make build exited 0. config explain refuses 0.0.0.0:8788. serve on 0.0.0.0:18799 exited 1 and left no database directory.
Impact: The card still says the work is in progress until the pull requests merge.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The incremental build info commit has to be the gitlink Dev records.
Evidence: modules/frontend is eb6502f. make build produced bin/agent-system.
Impact: The parent branch names the same frontend commit the worktree built.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The shared types dropped a spare export so the knip ratchet stays at its baseline, and every container must name those commits.
Evidence: core 0b5c774, ui 6b2589c, frontend 13a1c63, backend c05832d. UI knip 55 and frontend knip 43.
Impact: Gitlinks move together. JSON field names are unchanged.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The listen guard reads auth and host policy from config before the database opens, so app depending on config is a real edge.
Evidence: make test stopped in lint-boundaries on backend/app backend/config. The edge is now in the baseline.
Impact: New imports still fail the ratchet. This one records the startup guard's dependency.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Dev's agent-native moved for message shaping, so squad and backend have to follow or check-pins fails.
Evidence: Squad 5a57636 and backend include that pin. make test previously stopped at test-pins on this mismatch.
Impact: The parent, backend, and squad all resolve agent-native 3a110a7.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Empty innerHTML clears were flagged because the space matcher could backtrack past the quotes. The child tests now keep that whitespace inside the lookahead.
Evidence: Frontend vitest 78 passed. UI html-sinks passed. Child commits are ui 5f8308a and frontend 02cebc0.
Impact: The parent pins match the ratchet that allows clearing a node before appending sanitized children.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The card still had placeholders for authorization, scope, and the compatibility note that reverse proxies need allowedHosts.
Evidence: The card names the new message and observation fields and the items that stay out of this task.
Impact: Reviewers can use the card as the PR description without reconstructing the scope.
Refs: docs/records/2026-10-04-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The research record, HTML cleaning, listen guard, secret store, and context controls land together, and the parent pointers have to name those commits.
Evidence: Child commits are core bd63223, agent-native 3a110a7, ui d76a8e6, frontend 36b92ed, documents f3f823e, backend 42cca8f. svc.sh forwards the listen switches and info prints them.
Impact: A reverse proxy or a LAN hostname needs allowedHosts or an unauthenticated host check returns 403. Startup moves raw API keys into the secret table after a settings snapshot.
Refs: .task/feature-sillytavern-review.md
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen
