Bind svc user CLI to instance manifest and reject flock bypass #429

Merged

weichen merged 11 commits from feature/svc-deploy-u1-account-binding into main

2026-10-12 05:19:39 +00:00

Author	SHA1	Message	Date
weichenandCursor	d0e29b7a22	Merge origin/main after #428 ; resolve docs/svc-deploy add/add ci / test-pg (pull_request) Failing after 1m6s Details ci / test (pull_request) Failing after 1m30s Details Why: #428 landed the same svc-deploy specs; U1 branch still had parallel copies causing add/add conflicts. Evidence: U1 docs kept branch「已启动」; U4 docs took main (#428) versions Impact: PR #429 should become mergeable. Refs: Dev pulls/429; merged #428 Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-12 05:16:59 +00:00
weichenandCursor	926e2ed539	Record post-sync U1 evidence after resolving main conflict ci / test-pg (pull_request) Failing after 1m6s Details ci / test (pull_request) Failing after 2m36s Details Why: task-sync merged origin/main; svc.sh keeps user + backup; refresh SELF evidence for #429. Evidence: unittest user_binding + identity + backup exit 0 Impact: PR #429 should become mergeable. Refs: Dev pulls/429; Backend #171 (merged) Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-12 05:07:21 +00:00
weichen	82b857b7d6	Record the sync checkpoint Why: bind the task validation checkpoint to the latest integration baseline. Evidence: SELF recursive component checks; sync_base=b431777c9fa9c74f096d7f14fce40d1beba53fe2; candidate=4713d5953c0169a6d7e8475aee980edd75863de5. Impact: task metadata only. Refs: .task/feature-svc-deploy-u1-account-binding.md	2026-10-12 05:06:39 +00:00
weichenandCursor	4713d5953c	Merge origin/main into U1 account-binding; keep user+backup actions Why: Dev #429 conflicted on scripts/svc.sh (U1 user vs main backup) and Backend gitlink. Evidence: conflict hunks resolved; actions include init\|user\|backup\|backups Impact: PR #429 should become mergeable after push; both U1 binding and agent backup entrypoints preserved. Refs: Dev pulls/429; main backup #417; Backend #171 Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-12 05:06:09 +00:00
weichenandCursor	37ccedef99	Pin Backend to main tip that includes merged U4 OpenExisting Why: U1 svc user depends on --open-existing; Dev #429 conflicted on modules/backend against main. Evidence: Backend #171 merged as 1d9e8f4 on origin/main Impact: Unblocks task-sync; svc.sh content conflicts remain to resolve against main backup work. Refs: Dev pulls/429; Backend #171 Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-12 05:05:23 +00:00
weichenandCursor	4d510e2d0b	Link U1 task card to Dev #429 ci / test-pg (pull_request) Failing after 1m44s Details ci / test (pull_request) Failing after 3m23s Details Why: PR URL is the task主记录 after push; keep the card discoverable for review. Evidence: Gitea API created pulls/429 Impact: Card header points at open PR; no merge. Refs: pulls/429; Backend pulls/171 Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-12 03:59:48 +00:00
weichenandCursor	c7ff9d5afd	Record U1 svc user-binding test evidence after task-sync ci / test-pg (pull_request) Failing after 1m55s Details ci / test (pull_request) Failing after 3m22s Details Why: Completion gate requires evidence-tool receipts for T1–T5 and identity regression. Evidence: SELF unittest test_svc_user_binding + test_svc_identity (exit 0) Impact: Task card ready for PR review; merge still owner-only. Refs: docs/svc-deploy/u1-instance-account-binding.md; Backend pulls/171 Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-12 03:59:27 +00:00
weichen	15294d6bfa	Record the sync checkpoint Why: bind the task validation checkpoint to the latest integration baseline. Evidence: SELF recursive component checks; sync_base=ae465d24441ab349c961a55e9b04f8c4ccaf6de8; candidate=79f50493ddac51b45f0b044b152110138331aedb. Impact: task metadata only. Refs: .task/feature-svc-deploy-u1-account-binding.md	2026-10-12 03:57:05 +00:00
weichen	79f50493dd	Merge authoritative main into the task branch Why: include the current integration baseline before verification. Evidence: fetched origin/main=ae465d24441ab349c961a55e9b04f8c4ccaf6de8. Impact: integrate upstream changes without rewriting task history. Refs: task-sync	2026-10-12 03:56:41 +00:00
weichenandCursor	2a03dd58f9	Bind svc user CLI to instance storage and reject lock bypass Why: U1 requires account ops to hit manifest data_root/DSN with OpenExisting and refuse missing flock or default ./data. Evidence: python3 -m unittest tests.test_svc_user_binding (T1–T5) + test_svc_identity Impact: svc <env> user … calls ENV_BIN with --open-existing; deploy/user fail closed without flock. Refs: docs/svc-deploy/u1-instance-account-binding.md; Backend OpenExisting (PR #171) Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-12 03:55:24 +00:00
weichen	d978de4715	Record the task card for feature-svc-deploy-u1-account-binding Why: establish the authorized task workspace and its initial baseline. Evidence: preserved precheck receipt in .task/feature-svc-deploy-u1-account-binding.md; R0=9a9665b458916179df6d94066dfb9aa657a13d60. Impact: task metadata only; the feature workspace starts at `9a9665b458`. Refs: .task/feature-svc-deploy-u1-account-binding.md	2026-10-12 03:38:18 +00:00