Harden svc.sh identity isolation and deploy candidate gate (U1 slice) #474

2026-10-12T13:01:46Z

weichen commented

2026-10-12 13:01:46 +00:00

任务卡（同一份文档）：.task/feature-svc-identity-u1.md @ 1874af8

Why: 2026-10-12 rdm1/rdmcand 批量更新各 3 次失败的根因组合——① env_config 未重置 AGENT_SYSTEM_INSTANCE_ID/DBREF，dev 的身份串给后续服务；② svc_bin_has_identity 无 timeout、且 grep ensure 被 RDM 产物身份门禁报文（恰含 "identity ensure" 字样）误报为有能力；③ cmd_update 绕过 svc_manifest_migrate；④ deploy 先停服再覆盖制品，身份拒绝发生在覆盖之后，留下登记 0aab6c3 ≠ 磁盘 894df2b 的混合状态。

改动（scripts/svc.sh）：

env_config 按实例 unset 身份环境（棘轮锁定）；
能力探测 timeout 5s + serve 痕迹否决（无副作用、有界）；
ensure 收敛到领养（svc_manifest_migrate 内，先 resolve_db_config）与显式 init；普通启动 verify-only，缺行即事件；
agent_do_deploy 构建前置 + svc_deploy_identity_gate：无 identity 候选在停旧服务之前拒绝（旧进程/制品/登记逐项不变）；有能力候选停服前幂等补齐缺失身份行；
cmd_update 批内接入 svc_manifest_migrate（与单实例生命周期同入口）。

Evidence（详见任务卡证据表，SELF 源）：make test-governance 217 OK（同步后 HEAD 重录）；tests.test_svc_identity / tests.test_svc_precheck / tests.test_svc 显式复跑全绿；新增回归：候选拒绝保现场（进程/制品/登记逐项断言）、候选补行后完整更新（serve 只含本服务身份）、缺行裸 start 拒绝且 init 恢复、探测三态（可用/误报否决/挂死有界）。

Impact: 仅 svc.sh 与测试；未治理实例（无 manifest.py）行为不变（rdm 部署端到端三测零回归）；治理实例从本 PR 起无法再被无 identity 产物停服覆盖。跨仓后续（非本 PR）：Backend identity CLI 公共化 + RDM main.go 接线（U1 完成条件）、U2 失败恢复、U3 真实组合门禁。

Refs: 用户根因诊断 2026-10-12（U1/U2/U3 增量）；#457（先行修复）；Documents r2/r3 统一部署与恢复方案。

任务卡（同一份文档）：.task/feature-svc-identity-u1.md @ 1874af8 **Why**: 2026-10-12 rdm1/rdmcand 批量更新各 3 次失败的根因组合——① env_config 未重置 AGENT_SYSTEM_INSTANCE_ID/DBREF，dev 的身份串给后续服务；② svc_bin_has_identity 无 timeout、且 grep ensure 被 RDM 产物身份门禁报文（恰含 "identity ensure" 字样）误报为有能力；③ cmd_update 绕过 svc_manifest_migrate；④ deploy 先停服再覆盖制品，身份拒绝发生在覆盖之后，留下登记 0aab6c3 ≠ 磁盘 894df2b 的混合状态。 **改动（scripts/svc.sh）**： 1. env_config 按实例 unset 身份环境（棘轮锁定）； 2. 能力探测 timeout 5s + serve 痕迹否决（无副作用、有界）； 3. ensure 收敛到领养（svc_manifest_migrate 内，先 resolve_db_config）与显式 init；普通启动 verify-only，缺行即事件； 4. agent_do_deploy 构建前置 + svc_deploy_identity_gate：无 identity 候选在停旧服务之前拒绝（旧进程/制品/登记逐项不变）；有能力候选停服前幂等补齐缺失身份行； 5. cmd_update 批内接入 svc_manifest_migrate（与单实例生命周期同入口）。 **Evidence（详见任务卡证据表，SELF 源）**：make test-governance 217 OK（同步后 HEAD 重录）；tests.test_svc_identity / tests.test_svc_precheck / tests.test_svc 显式复跑全绿；新增回归：候选拒绝保现场（进程/制品/登记逐项断言）、候选补行后完整更新（serve 只含本服务身份）、缺行裸 start 拒绝且 init 恢复、探测三态（可用/误报否决/挂死有界）。 **Impact**: 仅 svc.sh 与测试；未治理实例（无 manifest.py）行为不变（rdm 部署端到端三测零回归）；治理实例从本 PR 起无法再被无 identity 产物停服覆盖。跨仓后续（非本 PR）：Backend identity CLI 公共化 + RDM main.go 接线（U1 完成条件）、U2 失败恢复、U3 真实组合门禁。 **Refs**: 用户根因诊断 2026-10-12（U1/U2/U3 增量）；#457（先行修复）；Documents r2/r3 统一部署与恢复方案。

weichen added 7 commits 2026-10-12 13:01:46 +00:00

Record the task card for feature-svc-identity-u1 05c3d050b4

Why: establish the authorized task workspace and its initial baseline.

Evidence: preserved precheck receipt in .task/feature-svc-identity-u1.md; R0=d8a269ab2fd20e4783ba0cde6a4794a702ad7571.

Impact: task metadata only; the feature workspace starts at d8a269ab2f.

Refs: .task/feature-svc-identity-u1.md

Harden svc.sh identity isolation and deploy candidate gate 55ed5899fb

Why: batch update leaked AGENT_SYSTEM_INSTANCE_ID/DBREF from one service
to the next, and RDM artifacts without the identity CLI were stopped and
overwritten before their startup identity refusal surfaced, leaving
rdm1/rdmcand in a mixed registration-vs-artifact state (2026-10-12).
Evidence: make test-governance 217 OK; tests.test_svc_identity and
tests.test_svc_precheck green; rows recorded in the task card.
Impact: env_config resets identity env per service; capability probe is
timeout-guarded and rejects serve-shaped output; identity ensure moves
to adoption/init (bare start is verify-only); deploy builds and gates
candidates before stopping the old service (refuses identityless
candidates, completes missing identity rows via the candidate); update
runs svc_manifest_migrate like every other lifecycle entry.
Refs: .task/feature-svc-identity-u1.md; user root-cause report 2026-10-12.

Record governance suite evidence for the identity gate slice 3ad0da12ce

Merge authoritative main into the task branch c3aaaa2954

Why: include the current integration baseline before verification.

Evidence: fetched origin/main=8ebf5021468a1301ccbe2fe0568508e16d8bb708.

Impact: integrate upstream changes without rewriting task history.

Refs: task-sync

Record the sync checkpoint 9404eeed71

Why: bind the task validation checkpoint to the latest integration baseline.

Evidence: SELF recursive component checks; sync_base=8ebf5021468a1301ccbe2fe0568508e16d8bb708; candidate=c3aaaa2954333e2d3a55c2f950fc5051cca5fe88.

Impact: task metadata only.

Refs: .task/feature-svc-identity-u1.md

Record task-sync evidence and merged main into the slice 96be78c044

Re-record governance suite evidence on the synced head

ci / test-pg (pull_request) Successful in 1m29s

Details

ci / test (pull_request) Successful in 3m25s

Details

1874af880d

weichen added 1 commit 2026-10-12 13:02:24 +00:00

Fill PR link and outcome sections in the task card

ci / test-pg (pull_request) Successful in 2m16s

Details

ci / test (pull_request) Successful in 3m24s