weichen/Agent-System-Dev
1
0
Fork 0
Code Issues 1 Pull Requests 2 Actions 2 Packages Projects Releases Wiki Activity

Harden task.sh and pin backend/core gitlinks past module-level advisories #92

Merged
weichen merged 5 commits from fix/followup-hardening into main 2026-09-30 17:18:07 +00:00
Conversation 0 Commits 5 Files Changed 4
+49 -3
5 Commits
Author SHA1 Message Date
weichen 7e657c4b47 Record the sync checkpoint
ci / test (pull_request) Failing after 1m31s
Details
2026-09-30 17:17:46 +00:00
weichen dcb5bc0f72 Merge remote-tracking branch 'origin/main' into fix/followup-hardening 2026-09-30 17:17:46 +00:00
weichen 1381b826ec Pin backend and core gitlinks and record follow-up hardening 
Why: two strands land together — (1) the remaining 20 module-level govulncheck advisories against x/crypto v0.37.0 clear to the upstream floor via Backend#25 (19 fixed, GO-2026-5932 unfixed upstream); (2) backend main (daddac8) and core main (cafd9a5) from the parallel cardflow merge were not yet pinned, and backend main no longer built against the Dev-pinned core — pinning the coherent pair keeps main verifiable.
Evidence: combined make test exit 0 at backend daddac8 + core cafd9a5 (backend packages ok, frontend 33/33, ui 37/37, agentcmd ok); backend go test green and govulncheck 0 affected / 0 import-level / 1 module-level; task.sh hardening smoke-verified (drift measurement, identity probe, abandon cleanup all PASS).
Impact: two gitlink pins + task card; no Dev-repo source change; remote branch hygiene (55 merged branches deleted) and global git identity were environment fixes outside the repo.
Refs: .task/fix-followup-hardening.md, Backend PR #25
 2026-09-30 17:16:28 +00:00
weichen aeb9a6a8ea Harden task.sh materialization check and close push retry 
Why: two recurring papercuts from 2026-09-30 sessions — (1) task-start treated a zero-exit submodule update as complete, but a worktree could still carry 12 drifted/uninitialized nested submodules that only surfaced at build time; (2) close ran a single git push, so a tunnel hiccup left the card-close branch unpushed and the auto-PR never created (hand-patched twice that day).
Evidence: bash -n clean; smoke start of a throwaway task measured nested drift count explicitly and abandon-path finish recycled worktree and branch cleanly (both PASS); fresh-clone commit identity probe also PASS after setting the global identity outside this repo.
Impact: scripts/task.sh cmd_start (+3-line status check) and cmd_close (one retry on push); no interface change.
Refs: .task/fix-followup-hardening.md
 2026-09-30 17:11:40 +00:00
weichen 9269986bfe Record the task card for fix-followup-hardening 2026-09-30 16:58:24 +00:00