Close the two audit follow-ups approved after batches 1-2: a pin-regression gate and the review-M5 subagent write-set gap.
Why: PR #682 demonstrated that a stale branch merging into main can silently reset component pins (it reverted the batch-1 composition); and review minor M5 showed delegate_task can spawn sub-agents outside a parent's Writable enforcement - the same unenforceability preflight already rejects for exec/MCP/host tools.
Evidence: pin gate wired into check-pins and task-pr-check with regression/forward/skip/missing-object tests and a documented PIN_REGRESSION_SKIP escape; M5 preflight rejection with delegation-still-works and legacy cases. Combination: test-pins green (gate exercised on real forward moves), all other targets pass except one pre-existing environment-dependent svc test that reproduces identically on clean main (documented in the task card; CI environment arbitrates). Independent review lands in the task card before merge.
Impact: native pin advanced to f2fb9ff (M5); squad/backend containers re-pinned with matching nested bumps (b6d8763, 92c2b4e); gate scripts + tests in Dev. No deploy, no migration, no release.
Close the two audit follow-ups approved after batches 1-2: a pin-regression gate and the review-M5 subagent write-set gap.
Why: PR #682 demonstrated that a stale branch merging into main can silently reset component pins (it reverted the batch-1 composition); and review minor M5 showed delegate_task can spawn sub-agents outside a parent's Writable enforcement - the same unenforceability preflight already rejects for exec/MCP/host tools.
Evidence: pin gate wired into check-pins and task-pr-check with regression/forward/skip/missing-object tests and a documented PIN_REGRESSION_SKIP escape; M5 preflight rejection with delegation-still-works and legacy cases. Combination: test-pins green (gate exercised on real forward moves), all other targets pass except one pre-existing environment-dependent svc test that reproduces identically on clean main (documented in the task card; CI environment arbitrates). Independent review lands in the task card before merge.
Impact: native pin advanced to f2fb9ff (M5); squad/backend containers re-pinned with matching nested bumps (b6d8763, 92c2b4e); gate scripts + tests in Dev. No deploy, no migration, no release.
Refs: docs/superpowers/plans/2026-10-21-agent-stack-audit-remediation-plan.md; .task/reviews/2026-10-21-agent-stack-b1-independent-review.md (M5)
Why: carry authorization and unit plan for the audit follow-ups:
pin-regression gate and native subagent Writable preflight (M5).
Evidence: card only; no code change.
Impact: task metadata only.
Refs: feature/audit-followups-pin-gate-m5
Why: land the review-M5 preflight fix (delegate_task under a Writable
write-set is now rejected like exec/MCP/host tools).
Evidence: transport success (gitlinkm5c-run.json); native unit tests
green (verify-m5.json); gate/pins checks re-run with the pin bump.
Impact: one component gitlink.
Refs: feature/audit-followups-pin-gate-m5
Why: PR #682 merged a stale branch that reset five component pins to
pre-batch values, silently dropping the batch-1 composition on main.
Evidence: materialized byte-exact from the reviewed transport
(gatemat-run.json); regression/forward/same/skip/missing-object cases
(verify-pingate.json); make test-governance and test-pins re-run below.
Impact: new check script wired into check-pins and task-pr-check;
PIN_REGRESSION_SKIP=1 documents deliberate downgrades.
Refs: feature/audit-followups-pin-gate-m5
Why: native carries the M5 subagent preflight fix; backend adopts its
branch tip that merges upstream main (scratch sessions) on top of the
batch-2 line.
Evidence: integration transport success (gitlinkf5-run.json); nested
native pins follow in the next commit; pins checks re-run below.
Impact: two component gitlinks.
Refs: feature/audit-followups-pin-gate-m5
Why: the backend branch advanced past its nested agent-native bump so
the composed chain carries the M5 preflight end to end.
Evidence: integration transport success (gitlinkb2h-run.json); pins
checks and full make test re-run below.
Impact: one component gitlink.
Refs: feature/audit-followups-pin-gate-m5
Why: the squad container carries its nested agent-native M5 bump; the
backend container is already at its repaired tip in this history.
Evidence: integration transport (gitlinks3-run.json); pins checks and
full make test re-run below.
Impact: one component gitlink.
Refs: feature/audit-followups-pin-gate-m5
Why: backend's nested agent-squad advances with its nested agent-native
M5 bump, keeping every container consistent with the Dev-level pins.
Evidence: integration transport (gitlinkb3b-run.json); pins checks and
full make test re-run below.
Impact: one component gitlink.
Refs: feature/audit-followups-pin-gate-m5
Why: pins checks green with the new gate; all other combination targets
pass; the single governance failure reproduces on clean main.
Evidence: verify-followups-{pins5,rest}.json exit=0; main reproduction
captured in-session.
Impact: task metadata only.
Refs: feature/audit-followups-pin-gate-m5
Why: backend adopts upstream main (role-policy/HITL fixes) and the
parallel scratch-session work while keeping the M5 nested pin, so the
followups composition stays current with main.
Evidence: integration transport (gitlinkb7-run.json); pins checks and
combination targets re-run below.
Impact: one component gitlink.
Refs: feature/audit-followups-pin-gate-m5
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=d65195bd.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: the branch now carries authoritative main (backend role-policy and
scratch-session work, frontend/ui pin advances); the only combination
failure is the environment-dependent svc test that reproduces on clean
main.
Evidence: verify-f-pins9.json exit=0; verify-f-rest.json exit=0;
verify-f-combo.json shows the single pre-existing failure.
Impact: task metadata only.
Refs: feature/audit-followups-pin-gate-m5
Why: the first CI run failed at checkout because the backend merge tip
a75783f existed only locally; it is now pushed.
Evidence: remote ref updated on Agent-System-Backend.
Impact: task metadata only.
Refs: PR #695
Why: close the task card inside its own PR so landing it needs no post-merge backfill or separate close PR.
Evidence: .task/feature-audit-followups-pin-gate-m5.md -> .task/archive/feature-audit-followups-pin-gate-m5.md; status 已完成（合入前闭合）; PR #695https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/695.
Impact: task metadata only; the card is archived within PR #695 and lands with its merge commit.
Refs: task.sh close --self
Why: the CI test-pg timeout on TestMaterialAckAttachmentOnlyDoesNot-
CallParentModel is environmental (the product never sets a Writable
write-set, so the M5 preflight cannot trigger there; the same commit
and test pass locally in 0.05s against real PG/Redis).
Evidence: verify-materialack.json exit=0.
Impact: task metadata only.
Refs: PR #695
Why: include the current integration baseline before merge.
Evidence: fetched origin/main=9a80897c.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
weichen
merged commit 955a32de2b into main2026-10-22 08:43:16 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Close the two audit follow-ups approved after batches 1-2: a pin-regression gate and the review-M5 subagent write-set gap.
Why: PR #682 demonstrated that a stale branch merging into main can silently reset component pins (it reverted the batch-1 composition); and review minor M5 showed delegate_task can spawn sub-agents outside a parent's Writable enforcement - the same unenforceability preflight already rejects for exec/MCP/host tools.
Evidence: pin gate wired into check-pins and task-pr-check with regression/forward/skip/missing-object tests and a documented PIN_REGRESSION_SKIP escape; M5 preflight rejection with delegation-still-works and legacy cases. Combination: test-pins green (gate exercised on real forward moves), all other targets pass except one pre-existing environment-dependent svc test that reproduces identically on clean main (documented in the task card; CI environment arbitrates). Independent review lands in the task card before merge.
Impact: native pin advanced to f2fb9ff (M5); squad/backend containers re-pinned with matching nested bumps (b6d8763, 92c2b4e); gate scripts + tests in Dev. No deploy, no migration, no release.
Refs: docs/superpowers/plans/2026-10-21-agent-stack-audit-remediation-plan.md; .task/reviews/2026-10-21-agent-stack-b1-independent-review.md (M5)
Why: pins checks green with the new gate; all other combination targets pass; the single governance failure reproduces on clean main. Evidence: verify-followups-{pins5,rest}.json exit=0; main reproduction captured in-session. Impact: task metadata only. Refs: feature/audit-followups-pin-gate-m5