Implement U1 instance identity: manifest authority, startup verification and init #415

Merged
weichen merged 10 commits from feature/recovery-u1-instance-identity into main 2026-10-12 03:23:20 +00:00
10 Commits
Author SHA1 Message Date
weichen 6d453ee87e Record the full local make test pass ahead of the CI retry
ci / test-pg (pull_request) Successful in 1m8s
ci / test (pull_request) Successful in 3m6s
Why: CI ci/test failed on cf4bbb4 while the identical suite passes locally (exit 0, receipt in card); the sibling head failed the other job instead - runner-side flakiness under five concurrent PRs, so retry via a fresh head.

Evidence: SELF - make test exit 0 via make evidence (full suite, 99 ok lines, no FAIL); prior CI status details fetched via API (cf4bbb4 test-pg=success test=failure; 568afbc test=success test-pg=failure).

Impact: task card evidence row only.

Refs: PR #415
2026-10-12 03:17:34 +00:00
weichen cf4bbb423d Fix a path typo in the task card master-record line
ci / test-pg (pull_request) Successful in 1m19s
ci / test (pull_request) Failing after 2m51s
Why: correct artifact path for the data-ownership inventory.

Evidence: SELF.

Impact: task card typo only.

Refs: PR #415
2026-10-12 03:01:38 +00:00
weichen 568afbc5ee Record the delivery PR link in the task card
ci / test-pg (pull_request) Failing after 1m18s
ci / test (pull_request) Successful in 3m27s
Why: the card is the single master record and must carry PR #415.

Evidence: SELF - PR #415 created via API on head ecbaa84.

Impact: task card only.

Refs: PR #415
2026-10-12 03:01:29 +00:00
weichen ecbaa84261 Record the push grant and correct the acceptance-gate wording
ci / test-pg (pull_request) Failing after 1m17s
ci / test (pull_request) Failing after 2m58s
Why: user green-lit delivery on 2026-10-12; the gate for formal acceptance is the PR CI itself, so the earlier 'no push before acceptance' cell was self-contradictory.

Evidence: SELF - user grant; three-segment receipts (precheck/task-sync/tests) already in card.

Impact: task card only.

Refs: AGENTS.md 完成声明三段输出
2026-10-12 03:00:55 +00:00
weichen b62a040062 Record the U1 acceptance-ready state after sync and suite re-runs
Why: post-sync evidence must be refreshed at the final head before requesting review; stage table now separates local SELF green from the pending PR CI gate and the real-PG NOT_RUN boundary.

Evidence: SELF - identity suite 21/21 and governance 169/169 re-run at the synced head via make evidence (receipts in card).

Impact: task card only.

Refs: docs/recovery/u1-identity-manifest.md section 7
2026-10-12 02:58:14 +00:00
weichen ce78d597d1 Record the sync checkpoint
Why: bind the task validation checkpoint to the latest integration baseline.

Evidence: SELF recursive component checks; sync_base=501b785e17843fdf0b19184e28952e426c1a198f; candidate=a4a68ca74f15e9f80fb9ef5ee7d3cc7e7a1d68fd.

Impact: task metadata only.

Refs: .task/feature-recovery-u1-instance-identity.md
2026-10-12 02:55:51 +00:00
weichen a4a68ca74f Merge authoritative main into the task branch
Why: include the current integration baseline before verification.

Evidence: fetched origin/main=501b785e17843fdf0b19184e28952e426c1a198f.

Impact: integrate upstream changes without rewriting task history.

Refs: task-sync
2026-10-12 02:55:23 +00:00
weichen c170939bb7 Implement the U1 identity manifest layer with startup verification and tests
Why: approved design (2026-10-12) - persistent manifest becomes the startup authority, closing the param-rebuild drift, non-atomic per-key writes, and missing-config-creates-empty-system recovery gaps (plan r2 U1 / KTD1-KTD2).

Evidence: SELF - python3 tests/test_svc_identity.py 21 tests OK (1 skip = real-PG identity NOT_RUN by design); make test-governance 169 OK incl. existing svc db-binding and autorecover suites; receipts appended via make evidence.

Impact: scripts/svc.sh gains manifest-aware set/del/record_state/autostart plus lock-held migrate, pre-launch identity verify and an init action; new scripts/svc_manifest.py (atomic temp-fsync-rename, identity anchors, derived svc.env); unmigrated instances keep the exact legacy path (regressions green).

Refs: docs/recovery/u1-identity-manifest.md; plan r2 section 7 U1
2026-10-12 02:50:32 +00:00
weichen c43ccd7481 Draft the U1 identity manifest contract, data ownership inventory and card
Why: U1 starts per the approved recovery plan r2 - a reviewed design contract must exist before touching scripts/svc.sh, and R3 needs an enumerable data-ownership baseline.

Evidence: SELF - doc-check receipt via make evidence. First run FAILED (exit 1: proposal r2 not present in this worktree because it sits unmerged on feature/service-restart-recovery-plan); references reworded to cite the path with a pending-merge note and the check re-run PASS (exit 0). Both receipts are in the card; grounding facts verified at baseline 89174a0.

Impact: docs/recovery/ additions and task card only; no behavior change; implementation gated on design review.

Refs: modules/documents/docs/proposals/2026-10-12-service-restart-data-recovery.md r2 U1
2026-10-12 01:39:20 +00:00
weichen 39f7c08af6 Record the task card for feature-recovery-u1-instance-identity
Why: establish the authorized task workspace and its initial baseline.

Evidence: preserved precheck receipt in .task/feature-recovery-u1-instance-identity.md; R0=89174a0f5c28ff7f49c794f37ea7e9528f9b526e.

Impact: task metadata only; the feature workspace starts at 89174a0f5c.

Refs: .task/feature-recovery-u1-instance-identity.md
2026-10-12 01:33:51 +00:00