From 7a289378a159a03b33886289474adaef78a02946 Mon Sep 17 00:00:00 2001 From: agent-exec-transport Date: Thu, 22 Oct 2026 12:31:10 +0000 Subject: [PATCH 1/4] agent-exec transport a9d557e025200bb64622b5690985f868/d036131967f9 --- policy/facts.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/policy/facts.md b/policy/facts.md index 3fcf83fa..2efc4b6c 100644 --- a/policy/facts.md +++ b/policy/facts.md @@ -15,9 +15,9 @@ | ID | 事实 | 验证命令 | last_verified | TTL(天) | |---|---|---|---|---| -| F1 | Gitea Web/API 可达：https://git-home.u1680832.nyat.app:30319（1.27.3） | `curl -fsS -m 10 https://git-home.u1680832.nyat.app:30319/api/v1/version` | 2026-10-14 | 30 | -| F2 | API token 存在且可用（值在 ~/.secrets/gitea，HOME/IMC 两段各一组 `- ACCESS_TOKEN=…`，本条取 HOME 段；不入仓不回显，不进子进程 argv） | `bash scripts/facts-verify.sh api-token https://git-home.u1680832.nyat.app:30319/api/v1/user` | 2026-10-14 | 30 | -| F3 | Git over SSH 可达：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/<Repo>.git（key ~/.ssh/home_gitea） | `GIT_SSH_COMMAND="ssh -i ~/.ssh/home_gitea -o BatchMode=yes" git ls-remote ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Development-Guidelines.git HEAD` | 2026-10-14 | 30 | +| F1 | Gitea Web/API 可达（2026-10-22 迁移后新权威）：https://gitea.naitangbaobao.cn（443，1.27.3）；旧地址 git-home…:30319 过渡期仍可达，随时退役 | `curl -fsS -m 10 https://gitea.naitangbaobao.cn/api/v1/version` | 2026-10-22 | 30 | +| F2 | API token 存在且可用（值在 ~/.secrets/gitea，HOME/IMC 两段各一组 `- ACCESS_TOKEN=…`，本条取 HOME 段；不入仓不回显，不进子进程 argv）；在新权威 URL 实测 200 | `bash scripts/facts-verify.sh api-token https://gitea.naitangbaobao.cn/api/v1/user` | 2026-10-22 | 30 | +| F3 | Git over SSH 可达（新地址，端口 52222）：ssh://git@gitea.naitangbaobao.cn:52222/weichen/<Repo>.git（key ~/.ssh/home_gitea）；旧地址 git-ssh…:31411 迁移期 push 间歇失败，不再作为权威 | `GIT_SSH_COMMAND="ssh -i ~/.ssh/home_gitea -p 52222 -o BatchMode=yes" git ls-remote ssh://git@gitea.naitangbaobao.cn:52222/weichen/Development-Guidelines.git HEAD` | 2026-10-22 | 30 | | F4 | 旧端点 git-panel.u1680832.nyat.app:30319 TCP 可连通但 TLS 握手失败（仅 TLS 层握手错误判 PASS） | `bash scripts/facts-verify.sh tls-handshake-fails git-panel.u1680832.nyat.app 30319` | 2026-10-14 | 180 | | F5 | 基座 users 表存有姓名（name 列，CreateAccount/ListUsersAdmin 读写；EXT-19 目录自 P3 起向授权管理读面下发） | `cd modules/backend && go test ./internal/app/ -run TestInprocHostSearchAccounts -count=1` | 2026-10-14 | 180 | | F6 | 基座账号无停用位（users 表无 disabled；EXT-19 Valid 恒为存在性）——停用机制未实现，不得当已具备 | `cd modules/backend && ! grep -rn -e disabled -e Disabled internal/store/auth.go pkg/extension/extension.go` | 2026-10-14 | 180 | -- 2.54.0 From c1bc29f8a65570bac170796560f38e4f8f0dd8ba Mon Sep 17 00:00:00 2001 From: agent-exec-transport Date: Fri, 23 Oct 2026 00:50:12 +0000 Subject: [PATCH 2/4] agent-exec transport 67b53b6782741e58be8fa2cb2735dcf0/ac828178cff7 --- .gitea/workflows/ci.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 51c880a2..1673d8e9 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -178,6 +178,12 @@ jobs: tar -C /usr/local --strip-components=1 -xJf "$RUNNER_TEMP/node.tar.xz" - name: Install house-style Python packages run: python3 -m pip install --break-system-packages -i https://pypi.tuna.tsinghua.edu.cn/simple python-docx python-pptx openpyxl + - name: Provision the Gitea token file for facts verification + run: | + set -euo pipefail + mkdir -p "$HOME/.secrets" + printf 'HOME:\n- ACCESS_TOKEN=%s\n' "${{ secrets.GITHUB_TOKEN }}" > "$HOME/.secrets/gitea" + chmod 600 "$HOME/.secrets/gitea" - name: make test (boundaries, pins, libs, core, backend, frontend, ui, agent-command) run: make test - name: Build the single binary -- 2.54.0 From 7434a7f2a9662ffb575a0e16bca06f752a40ce11 Mon Sep 17 00:00:00 2001 From: agent-exec-transport Date: Fri, 23 Oct 2026 01:13:52 +0000 Subject: [PATCH 3/4] agent-exec transport f7b4ea6b0bf5f1569d470f8601683913/2b73b405ae50 --- .gitea/workflows/ci.yaml | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 1673d8e9..1dde0d55 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -179,11 +179,30 @@ jobs: - name: Install house-style Python packages run: python3 -m pip install --break-system-packages -i https://pypi.tuna.tsinghua.edu.cn/simple python-docx python-pptx openpyxl - name: Provision the Gitea token file for facts verification + env: + T1: ${{ secrets.GITEA_TOKEN }} + T2: ${{ secrets.GITHUB_TOKEN }} run: | set -euo pipefail + echo "provision: GITEA_TOKEN length=${#T1}, GITHUB_TOKEN length=${#T2}" + if [ -n "$T1" ]; then + token="$T1"; source_name=GITEA_TOKEN + elif [ -n "$T2" ]; then + token="$T2"; source_name=GITHUB_TOKEN + else + echo "provision: GITEA_TOKEN/GITHUB_TOKEN both empty" + exit 1 + fi + echo "provision: using ${source_name}" mkdir -p "$HOME/.secrets" - printf 'HOME:\n- ACCESS_TOKEN=%s\n' "${{ secrets.GITHUB_TOKEN }}" > "$HOME/.secrets/gitea" + printf 'HOME:\n- ACCESS_TOKEN=%s\n' "$token" > "$HOME/.secrets/gitea" chmod 600 "$HOME/.secrets/gitea" + code="$(curl -fsS -m 10 -H "Authorization: token ${token}" https://gitea.naitangbaobao.cn/api/v1/user -o /dev/null -w '%{http_code}')" || true + if [ "$code" != "200" ]; then + echo "provision: /api/v1/user self-check failed with http code ${code:-none} (source ${source_name})" + exit 1 + fi + echo "provision: /api/v1/user self-check ok (http 200)" - name: make test (boundaries, pins, libs, core, backend, frontend, ui, agent-command) run: make test - name: Build the single binary -- 2.54.0 From 2068d0a630686e9b2eeeace792a3f02fc61d7eeb Mon Sep 17 00:00:00 2001 From: agent-exec-transport Date: Fri, 23 Oct 2026 01:29:43 +0000 Subject: [PATCH 4/4] agent-exec transport 71865509d360ea4e44027c7530f107e0/119993e4d4f8 --- scripts/facts-verify.sh | 4 ++-- tests/test_facts_verify.py | 31 ++++++++++++++++--------------- 2 files changed, 18 insertions(+), 17 deletions(-) diff --git a/scripts/facts-verify.sh b/scripts/facts-verify.sh index 61d4200c..5a8d24f4 100755 --- a/scripts/facts-verify.sh +++ b/scripts/facts-verify.sh @@ -4,7 +4,7 @@ # 用法：make facts-verify [ARGS=--update] （--update：把 PASS 项 last_verified 刷为当天并写回） # 表内验证命令约定不含竖线；含 "\|" 转义时按字面还原后执行。 # 登记表引用的探针子命令（单独运行时在 stderr 说明判定，不输出凭据）： -# api-token URL URL 须逐字等于登记端点 https://git-home.u1680832.nyat.app:30319/api/v1/user， +# api-token URL URL 须逐字等于登记端点 https://gitea.naitangbaobao.cn/api/v1/user， # 校验通过后才进程内读 ~/.secrets/gitea HOME 段 ACCESS_TOKEN 并 GET（不跟随重定向）； # 0=接受 3=缺失 4=格式不符 5=请求失败/被拒/重定向 6=非登记端点 # tls-handshake-fails HOST PORT 仅当 TCP 已连通且 TLS 层握手报错时 0； @@ -20,7 +20,7 @@ import sys, urllib.request sys.path.insert(0, sys.argv[1]) import task_triage -ENDPOINT = "https://git-home.u1680832.nyat.app:30319/api/v1/user" +ENDPOINT = "https://gitea.naitangbaobao.cn/api/v1/user" if sys.argv[2] != ENDPOINT: print("api-token: URL 不是 policy/facts.md F2 登记端点，拒绝发送凭据", file=sys.stderr) sys.exit(6) diff --git a/tests/test_facts_verify.py b/tests/test_facts_verify.py index 5b3d9d2a..6d46e1aa 100644 --- a/tests/test_facts_verify.py +++ b/tests/test_facts_verify.py @@ -256,7 +256,7 @@ class FactsVerifyTests(unittest.TestCase): self.assert_status(result.stdout, "F2", "PASS") requests = self.stub_events("http") self.assertEqual(len(requests), 1, requests) - self.assertEqual(requests[0]["url"], "https://git-home.u1680832.nyat.app:30319/api/v1/user") + self.assertEqual(requests[0]["url"], "https://gitea.naitangbaobao.cn/api/v1/user") self.assertEqual(requests[0]["authorization"], "token " + HOME_TOKEN) self.assertEqual(self.dates(), {"F2": self.today, "F8": self.today, "F9": OLD_DATE}) self.assertTrue(receipt.exists(), result.stderr) @@ -285,7 +285,7 @@ class FactsVerifyTests(unittest.TestCase): self.assert_status(result.stdout, "F2", "FAIL") self.assertEqual(self.stub_events("http"), [], "no request without a valid HOME token") self.assertEqual(self.dates()["F2"], OLD_DATE) - direct = self.run_script("api-token", "https://git-home.u1680832.nyat.app:30319/api/v1/user") + direct = self.run_script("api-token", "https://gitea.naitangbaobao.cn/api/v1/user") self.assertNotEqual(direct.returncode, 0) self.assertIn("ACCESS_TOKEN", direct.stderr) self.assert_no_secrets(result.stdout, result.stderr, direct.stdout, direct.stderr, @@ -299,7 +299,7 @@ class FactsVerifyTests(unittest.TestCase): result = self.run_script("--update", http=http) self.assert_status(result.stdout, "F2", "FAIL") self.assertEqual(self.dates(), {"F2": OLD_DATE, "F8": self.today, "F9": OLD_DATE}) - direct = self.run_script("api-token", "https://git-home.u1680832.nyat.app:30319/api/v1/user", + direct = self.run_script("api-token", "https://gitea.naitangbaobao.cn/api/v1/user", http=http) self.assertNotEqual(direct.returncode, 0) self.assertNotIn("Authorization", direct.stderr) @@ -307,17 +307,18 @@ class FactsVerifyTests(unittest.TestCase): def test_f2_rejects_unregistered_destination_before_reading_credentials(self): bad_urls = [ - "http://git-home.u1680832.nyat.app:30319/api/v1/user", + "http://gitea.naitangbaobao.cn/api/v1/user", "https://evil.invalid/api/v1/user", - "https://git-home.u1680832.nyat.app:30320/api/v1/user", - "https://git-home.u1680832.nyat.app/api/v1/user", - "https://user:pw@git-home.u1680832.nyat.app:30319/api/v1/user", - "https://git-home.u1680832.nyat.app:30319@evil.invalid/api/v1/user", - "https://git-home.u1680832.nyat.app:30319/api/v1/user#frag", - "https://git-home.u1680832.nyat.app:30319/api/v1/user?next=https://evil.invalid", - "https://git-home.u1680832.nyat.app:30319/api/v1/users", - "https://git-home.u1680832.nyat.app:30319/api/v1/user/../admin", - "https://git-home.u1680832.nyat.app:30319/api/v1/user ", + "https://git-home.u1680832.nyat.app:30319/api/v1/user", + "https://gitea.naitangbaobao.cn:30320/api/v1/user", + "https://gitea.naitangbaobao.cn:443/api/v1/user", + "https://user:pw@gitea.naitangbaobao.cn/api/v1/user", + "https://gitea.naitangbaobao.cn@evil.invalid/api/v1/user", + "https://gitea.naitangbaobao.cn/api/v1/user#frag", + "https://gitea.naitangbaobao.cn/api/v1/user?next=https://evil.invalid", + "https://gitea.naitangbaobao.cn/api/v1/users", + "https://gitea.naitangbaobao.cn/api/v1/user/../admin", + "https://gitea.naitangbaobao.cn/api/v1/user ", ] for secrets_present in (True, False): if not secrets_present: @@ -337,12 +338,12 @@ class FactsVerifyTests(unittest.TestCase): for code in ("301", "302", "303", "307", "308"): with self.subTest(code): self.stub_log.unlink(missing_ok=True) - direct = self.run_script("api-token", "https://git-home.u1680832.nyat.app:30319/api/v1/user", + direct = self.run_script("api-token", "https://gitea.naitangbaobao.cn/api/v1/user", http=code) self.assertEqual(direct.returncode, 5, direct.stderr) requests = self.stub_events("http") self.assertEqual([r["url"] for r in requests], - ["https://git-home.u1680832.nyat.app:30319/api/v1/user"], "no follow-up request") + ["https://gitea.naitangbaobao.cn/api/v1/user"], "no follow-up request") self.assertNotIn("redirect-target", direct.stdout + direct.stderr) self.assert_no_secrets(direct.stdout, direct.stderr) -- 2.54.0