weichen
0d9f44a7e2
Why: A dirty composer could change artifacts under a committed Dev identity, and two CI jobs reacquired credentials after executing candidate build code. Evidence: SELF regressions reproduce both issues before the fixes; all22 real composition cases and21 dependency/CI cases pass after. CI syntax checked; full exact committed replay follows this checkpoint. Impact: Verify executing composer/transport bytes before import and publication, record explicit tooling provenance, order all privileged acquisition first, and model CGO correctly in the nested component race fixture. Existing product and required CI gates remain. Refs: Dependency-workspace early code review; correctness/standards/security P1 findings and R7-R8/R14.
Agent-System-Dev
Agent-System 的开发集成入口，组织独立功能仓、固定依赖和跨仓构建。只需手动 clone 本仓；应用与资料由源码清单准备，Go/npm 库由消费方下载。发布物仍在 Agent-System-Releases，默认采用原生单二进制。
开始开发
make setup
RECEIPT=/tmp/my-task-precheck.json CMD="make precheck" make evidence
make task-start NAME=feature/my-task PRECHECK_RECEIPT=/tmp/my-task-precheck.json
# 在返回的任务 worktree 中执行
make workspace-prepare
make component-edit NAME=Agent-Native BRANCH=feature/my-native-change
make workspace-status
make component-unlink NAME=Agent-Native
按需源码是 .workspace 下的普通独立 Git 仓。功能修改提交到所属仓；消费方通过依赖 PR 采用新版本，不需要为了保存源码提交而同步推进全部仓库。
make test 与 make build 使用已提交的固定组合，在隔离目录关闭开发覆盖，生成 bin/agent-system、storage-migrate 与 resolved-manifest.json。源码身份见 components.json；应用/规范/资料提交见 components.lock.json；库的实际版本见消费方 go.mod/go.sum、package-lock.json。
规范与过渡
旧提交继续采用自己的 submodule 模式；旧任务同步新主干前由 owner 保存现场并显式过渡。迁移工具默认只报告，不改动其他活动工作区。规范来自固定 Development-Guidelines，过程文档来自固定 Agent-System-Documents；新项目通过独立采纳采用通用规则。
本机服务管理见 docs/svc.md。依赖改造不授权共享服务部署、数据库操作或发布。