Why: between the review round and the approval decision another session completed and merged svc-autorecover (PR #396/#400/#401/#402), so the (a)-decision tracking must reflect the landed slice and the remaining U2 delta.
Evidence: SELF - merged main history c622372 and archived card .task/archive/feature-svc-autorecover.md (10/10 tests, 146/146 governance, CI green on e0b49d1).
Impact: review record, INDEX; proposal r2 body unchanged.
Refs: PR #396#401
Why: the human gate resolved on 2026-10-12 - r2 approved (five stages at once) and option (a) adopted; the review record, proposal index and status navigation must reflect it.
Evidence: SELF - user decision relayed in conversation; stage-review details in the Dev task card; proposal r2 body unchanged (SHA256 9cfda252...).
Impact: review record, INDEX entry; no plan content change.
Refs: Dev task card .task/feature-service-restart-recovery-plan.md
Why: the reviewer record must reflect that all r2 gap claims hold at the post-sync backend pin 25fbea85, and that the svc-autorecover ownership decision now has 373 lines of unregistered, partially failing in-flight work to weigh.
Evidence: SELF - drift-check receipt in the Dev task card (exit 0, all cited gaps hold); svc-autorecover suite observed 5 of 10 tests failing on 2026-10-11.
Impact: review record addendum only; proposal r2 (SHA256 9cfda252...) unchanged.
Refs: Dev task card .task/feature-service-restart-recovery-plan.md
Why: absorb the external source-review round - pin the shutdown budget change, close the U1 acceptance gap for program/cwd changes, gate U4 public states on a mapping table, and make the svc-autorecover coordination an explicit human decision.
Evidence: SELF - external review round 2 in the review record; r2 SHA256 9cfda2520b913e6966c68fb3f66fb7bc8382a8f7a2b69cb364122216dcdb72cd; all reviewed claims re-verified against the pinned baselines.
Impact: documents only; four targeted amendments (U1/U3/U4/section 9) plus version bump and INDEX update; requirements and metrics unchanged.
Refs: Dev task card .task/feature-service-restart-recovery-plan.md
Why: U5 landed via RDM PR #213 (merge 1dce69d); all five implementation units now complete.
Evidence: RDM PR #213 merged=True.
Impact: plan status + U5 progress + INDEX.
Refs: RDM PR #213
Why: U4 landed via Dev PR #368 (merge 7aa8fd9).
Evidence: Dev PR #368 merged; CI green.
Impact: status line + U4 progress + INDEX only.
Refs: Dev PR #368
Why: The U6 precondition (benefit evidence from U4/U5) resolves to the
owner actually using the landed U1-U5 capability - the human usability
comparison marked NOT_RUN since U1 finds its execution path here; the
user ruled 2026-10-11 to evaluate first and decide U6 after.
Evidence: Ruling collected via the session question panel on
2026-10-11; U1-U5 all merged (Dev #329/#336/#345/#351/#367).
Impact: Documents-only (master record U6 gate note + index status).
Refs: r2 U6 clause; Dev task feature/generative-ui-u6-gate-record
EOF
)
Why: The user ruled on the three questions (categories and ranges
approved as proposed; C-class limited to plugin KV plus task ledger;
confirm UX reuses the inline card); the proposal becomes the approved
scope and unblocks the U5 implementation task.
Evidence: Ruling collected via the session question panel on
2026-10-11; implementation task feature/generative-ui-u5 starts under
policy/delivery.md.
Impact: Documents-only (proposal r2 + index status).
Refs: r2 master record U5; Dev task feature/generative-ui-u5
EOF
)
Why: The r2 U5 clause requires a human review of the action scope
before implementation; this draft grounds the decision in the current
command inventory and existing safety machinery.
Evidence: Source facts cited inline (builtin command list with risk
levels, DangerHigh inline-confirm flow with pendingStore, audit
envelope) verified against backend main on 2026-10-11.
Impact: Documents-only (new proposal + index entry); no code changes.
Refs: 2026-10-10-generative-ui-plugin.md (r2 U5); Dev task
feature/generative-ui-u5-scope
Why: U3 landed via RDM PR #201 (merge dbc41b6); the master record must reflect actual progress.
Evidence: SELF U3 closeout doc check exit 0 (receipt in Dev closeout task card).
Impact: proposal status line, U3 progress paragraph, INDEX row only.
Refs: RDM PR #201; Dev feature/rdm-u3-closeout
Why: Dev PR #340 pinned this Documents branch tip while it was never merged into Documents main (cross-repo pin discipline); this reconciliation unifies both planning lineages.
Evidence: merge-base 2a5f658; INDEX conflict resolved as union (U1+U2 progress row + two new plan entries).
Impact: docs only.
Refs: Dev #340
Why: U2 landed via RDM PR #197 (merge fe8a75b); delivery policy requires the master record to reflect actual progress at task completion.
Evidence: SELF U2 closeout doc check exit 0 (receipt in the Dev closeout task card); RDM PR #197 merged=True via API.
Impact: proposal status line, U2 progress paragraph, and INDEX row only.
Refs: RDM PR #197; Dev feature/rdm-u2-closeout
Why: retain the newly merged RDM U1 progress alongside the final-target plan.
Evidence: resolved the single index conflict by keeping the updated U1 entry and both new plan links; diff check passed.
Impact: documentation merge only; business validation NOT_RUN.
Refs: docs/proposals/INDEX.md
Why: reconcile the confirmed project, privacy and duty rules with all approved product requirements.
Evidence: current RDM d8d7e743 source review, recorded source receipt, and exact 34 UR/68 SR/10 F matrix checks; business validation NOT_RUN.
Impact: reviewed planning documents only, covering all 69 template types and the existing XLSX asset; no runtime changes.
Refs: docs/proposals/2026-10-11-rdm-final-target-completion.md
Why: U1 landed via RDM PR #195 (merge 05b7d1a); delivery policy requires the master record to reflect actual progress at task completion.
Evidence: SELF closeout doc check exit 0 (receipt in the Dev closeout task card); RDM PR #195 merged=True via API.
Impact: proposal status line, U1 progress paragraph, and INDEX row only; no scope or requirement change.
Refs: RDM PR #195; Dev feature/rdm-u1-closeout
Why: preserve the user decision from the previous planning turn before expanding scope.
Evidence: r1.1 records the explicit user response; prior documentation-check receipt is in the Dev task card.
Impact: planning metadata only; no business changes.
Refs: docs/proposals/2026-10-11-rdm-template-dialog-generation.md
Why: U4 ships the managed migration entry; the runbook is the operator-facing contract for inventory/backup/migrate, migration identity and resume rules, verification semantics, and the authorized-window switch sequence.
Evidence: backend branch feature/collab-storage-u4-migrator - integration tests green against real PostgreSQL (idempotent rerun, resume, foreign-data refusal, wrong-snapshot refusal, unknown-owner block).
Impact: docs only.
Refs: proposals/2026-10-11-collaboration-storage-and-distribution.md U4 and section 6.
Why: connect the existing RDM assets and two-trees model to a reviewable document workflow.
Evidence: source inventory at RDM 0081628a; document structure and local link checks recorded as SELF in the Dev task card; business validation NOT_RUN.
Impact: planning and inventory documents only; no implementation or deployment.
Refs: docs/proposals/2026-10-11-rdm-template-dialog-generation.md
Why: U3 slice 2 ships admission budgets (runtime.* keys, lease semantics, yield/reacquire) and the host-side action matrix; the runbook is the single source for operators and records the versioned public-contract plan KTD13 requires.
Evidence: backend branch feature/collab-storage-u3-budget-authz (admission.go, action matrix in server.go) with admission/matrix tests green.
Impact: docs only.
Refs: proposals/2026-10-11-collaboration-storage-and-distribution.md KTD13/R8, section 5 U3.
Why: branch protection requires the head to contain the current base before merge.
Evidence: fetched origin/main=336a90f0ade0ffe049879ca5159a61f0a3948708.
Impact: integrate upstream changes without rewriting task history.
Refs: Documents PR #63
Why: The U1 controlled trial (three arms on synthetic materials,
MiniMax M3 + M2.7-highspeed, CNY 3 spent of the 200 cap) finished on
2026-10-11; its evidence changes the plan and must live in the master
record: goal-driven structure divergence holds (6/6), generation must
go through tool arguments (text-channel JSON discipline is the floor),
highspeed is rejected as the generator, and the first release keeps the
in-house renderer.
Evidence: Full data and failure taxonomy in Dev task
feature/generative-ui-u1 (.task/genui-u1/report.md, SELF; CI gate on
the Dev PR). Tool-channel and response_format probes recorded there.
Impact: Proposal r1 -> r2 (new results section, catalog/model/channel
revisions); INDEX entry updated. No code or contract changes.
Refs: Dev task feature/generative-ui-u1; Documents PR #60 (r1)
Why: the user reviewed and approved the plan (2026-10-11, five stages bundled) and chose a two-tier admin model for KTD4 instead of strict ledger separation.
Evidence: SELF user session rulings recorded in the Dev task card; document-check receipt follows in the task card evidence section.
Impact: proposal r1 and INDEX now record approval and the two-tier admin ruling; no code or deployment change.
Refs: Dev feature/rdm-two-trees-audit-plan
Why: assess existing two-tree and trace-network capabilities and define project-scoped inspection.
Evidence: SELF source receipt and document checks; business and runtime verification were not run.
Impact: pending-review proposal and index only; no product implementation or deployment.
Refs: Dev feature/rdm-two-trees-audit-plan
Why: the approved collaboration plan U1 requires a fixed deployment manifest, tier config contract, migration mapping, capacity contract, isolation test scheme and KTD14 copy-protection contract as the single source of truth for team-tier operations.
Evidence: contract keys match backend config.go tier/pool fields (U2, backend branch feature/collab-storage-pg-tier); local verification used svc.sh collabtest on 127.0.0.1:8897 and Redis on 6399.
Impact: docs only (new guide + usage.md cross-links); no code change.
Refs: proposals/2026-10-11-collaboration-storage-and-distribution.md sections 5 (U1/U2), KTD1/KTD8/KTD12/KTD14.
Why: The user ruled on 2026-10-11 the three open product choices (first
pilot = full analysis page inside the conversation; enable/disable via a
trusted compiled plugin; U1 trial on MiniMax M3 + M2.7-highspeed with
sanitized materials and a CNY 200 cap), so the proposal now publishes as
the direction's master record instead of a local draft.
Evidence: Doc self-check receipts live in the Dev task card
feature/generative-ui-research; the rulings are recorded in the doc's
"用户裁定记录" section and mirrored in INDEX.md.
Impact: Documents-only change (new proposal + index entry). No runtime,
contract, or code changes; U1 trial start and deployment stay separately
reviewed.
Refs: Dev task feature/generative-ui-research
Why: freeze the direction for 10-100 user multi-project collaboration storage (PostgreSQL team tier, migration, staged multi-instance) before U1+U2 implementation starts.
Evidence: static review record and SELF audit receipt included; user approval recorded in Dev task card 2026-10-11 (instruction to start the transformation per the plan).
Impact: docs only - new proposal, index entry, review record, audit receipt; no code or runtime change.
Refs: Dev .task/feature-collaboration-storage-plan.md; plan section 5 names U1+U2 as the first increment.
Why: The E1 quick-fix increment landed (delegate full text, MiniMax
reasoning split, sandbox deps layer, parallel tool execution with kernel
ordering) and the proposal is the master record, so its stage table and
the index row must reflect the actual progress with links.
Evidence: Agent-Native #42/#43/#44, Backend #127, Dev task
feature/agent-e1-parallel-fixes (live verification receipts: F2 zero
think-leak, F3 sandbox IMPORTS-OK, F5 concurrent overlap; eval
toolFailures 19->11, unverifiedFacts 7->12 recorded honestly).
Impact: Documents-only progress backfill; E2-E5/S0 remain unauthorized.
Why: The user asked for a researched design covering subagent use,
tiered model routing (Claude via dmxapi for complex work, MiniMax for
the rest), a millisecond/sub-second task sandbox (record-only), and a
verdict on why the agent still feels weaker than codex/claude-code/kimi.
Why: Four research threads (external frontier survey, subagent/routing
evidence, harness-vs-model attribution, local code audit and probes)
converge on role/stage routing instead of whole-task routing, and on
three corrections to the sandbox assumptions (overlay is not a snapshot;
snapshots defer conflicts to merge time; destroy must follow sealing).
Evidence: Local measurements are SELF receipts in the Dev task card
(bwrap namespace ~7ms, overlay same, docker ~142ms; MiniMax reasoning
split; dmxapi /v1/messages cache_read; EXT-16 sandbox missing the
python-docx layer). External claims carry per-item source URLs in the
proposal's section 8.
Impact: Documents-only addition: new proposal 2026-10-10 (E1-E5/S0
increments, D/R workstreams, sandbox tiers L0-L2) plus INDEX rows for it
and the previously unlisted G1 package. No product code changes; all
implementation increments stay unauthorized until approved.
Refs: proposals/2026-10-09-agent-quality-improvement-plan.md (P4/P5,
model A/B), 2026-10-09-ext-g1-b1-b3-exec-backend.md (EXT-16),
Dev task feature/agent-exec-routing-sandbox-plan.
Why: RDM G1/G2 are blocked on four base capabilities - the member agent
cannot see published project knowledge inside a run, plugin commands are
unreachable as tools, members cannot see or open conversations in shared
projects, and the isolated exec tier needs a backend seam.
Evidence: SELF - code citations verified at Dev main (runmgr.go:726-736
owner-only Retrieve; hostcaps.go:64-66 owner-only search; server.go:438-441
owner-only listProjects; store/projects.go:124-130 owner-scoped conversation
creation); bwrap availability tested on this host (2026-10-09).
Impact: Docs only. New proposal docs/proposals/2026-10-09-ext-g1-b1-b3-exec-backend.md
registering EXT-13..EXT-16 per the compat-policy template; no code change.
Refs: RDM plan V1.1 sections 3.3/3.4/5.3; owner Q1-Q8 (Q4=option A, Q2)
Why: The 2026-10-09 diagnosis on real run transcripts identified the direct
conversation path's failure chain and a phased plan was approved with six
explicit user rulings (open up tools, kernel-transcript-authoritative context,
markdown-source deliverables with all file types retained, gate demotions,
uncapped stronger-model evals, real-model eval required for behavior changes).
The plan needs a durable main record per the long-term-direction policy, and
the 2026-09-30 preview proposal's "fs tools hidden by default" ruling is
superseded by ruling 1, which must be discoverable from the index.
Evidence: SELF - the record cites the diagnosis session, the transcript
sources (pg1 + legacy SQLite, 62 assistant turns) and the before-baseline
report location on the task card; no code or pointers changed in this repo.
Impact: New proposal 2026-10-09-agent-quality-improvement-plan.md plus one
index row. Subsequent phase tasks reference this record instead of restating
the plan.
Refs: Dev task feature/agent-quality-phase01; supersedes the fs-tool default
in 2026-09-30-file-preview-and-reserved-capabilities.md §2.3.
Why: v0.2.0 is the hard prerequisite for RDM shared work, and the release
checklist referenced a stale SurfaceVersion and tag message.
Evidence: SELF - scope lines are tied to merged Backend PRs (#66-#110);
Backend #110 CI success; UI composite run 1369 shows 14 files/103 tests.
Impact: Adds docs/records/2026-10-09-base-v0.2.0-release.md and points the
compat policy and the EXT-1 proposal at the actual 2.5.0-experimental line.
Tag creation and push stay with the owner (dual-key rule).
Refs: Dev feature/base-v020-release; Backend #110
Why: U0 (merged in RDM) rules that domain logic stays downstream and the base needs seven minimal generic capabilities; the formal four-element applications are the only legal path to base changes.
Evidence: All current-state citations re-verified at Dev 34a2bbe (backend fe7c245); RDM requirement source pinned at RDM main ca72cfc.
Impact: New proposal doc + one INDEX row; no code, no surface change in this PR.
Refs: RDM U0 proposal section 5 / ruling D1; extension-compat-policy; phase-plan section 3.3.
Why: The RDM plan's 2026-10-07 snapshot (downstream at zero, N1 in
flight, O1/O3/O7 blocked) was contradicted by the RDM repo's 103 merged
PRs; the planning index registered this as an open reconciliation item
and named it the preferred follow-up to the stage-record task.
Evidence: isolated clone replay at RDM 4feb2f0 (pins=v0.1.0) - make
test exit 0, -ms1 PASS (same-source gold caveat recorded), ms0
acceptance PASS=9/SKIP=0 on a disposable postgres container, five
upload probes, and entrance probes (chat 400 vs commands 200); card/
PR snapshot JSON; all receipts SELF (RDM has no CI), stored under
docs/records/2026-10-08-rdm-status-*.json. The private minutes probe
receipt stays local by decision; only hashes and metrics are recorded.
Impact: adds plan SS2.3 (row-by-row re-verdict, MS1 seven-clause audit,
six registered gaps), marks SS2 as a historical snapshot, updates the
index milestone table and closes the RDM-snapshot open item, registers
the dual-main-record ruling and the missing-CI gap.
Refs: Dev task feature/rdm-status-review; Documents index next-step
(2026-10-08).
Why: The planning index listed the stage-record reconciliation as the
preferred next task: N1 WP6b/6c transfers, the Q1 platform-task vs
squad-run boundary, I1 reserved command consumption, and the I2 card's
dangling reference all feed N2/Q3 and RDM dependency judgments.
Evidence: Dev merges #230/#231/#234/#235/#237/#240/#242 verified in
main via git log --merges on 2026-10-08; stage claims are SELF-level
card statements, explicitly not replayed; intent command.go:18-25/78-84
checked for the Cancel/Handoff ruling.
Impact: Adds a status-backfill section (SS7) to the N1/Q1/I1 plan with
per-item done/transferred/todo ownership, an I2 status note in the
stack completion plan (the sole I2 main record), and INDEX navigation
updates; registers the truncated Q2/Q3 archive lines as a new open
item.
Refs: Dev task feature/agent-stack-stage-records; planning index
"next-step" recommendation (2026-10-08).
Why: documents main gained two plans after the index snapshot, and Dev has since merged N2, N3, Q2, and Q3.
Evidence: 21 markdown proposals are present at HEAD; merge SHAs were read from Dev origin/main git log --merges.
Impact: navigation only; proposal bodies and acceptance claims are unchanged.
Refs: Documents #43#44; Dev #244#247#248#249#250#251#253
Why: the index branch was cut before N3 and Q2/Q3 plans landed on main.
Evidence: merge-tree reported no content conflicts against origin/main 16795ed598.
Impact: bring those two proposal files into the index branch without rewriting history.
Refs: documents main
Why: N1-N3/Q1/I1-I2 are closed; per the completion doc dependency
order Q2 then Q3 are next. Both need plans grounded in current code:
squad has no topology abstraction (two modes, dormant Cond
combinators, dead FactItem.Verified), RespondDecision has no actor
attribution (the mailbox acceptance attack surface), WorkflowDef
execution compresses steps into SpawnSubagent, and adapters/a2a does
not exist.
Evidence: three-area survey with file:line citations at the pinned
baselines (agent-squad c462bc4, backend 6e02a1f); the review
equivalence baseline is quoted from backend runReview with its test
anchors; the P4 ruling is quoted verbatim from agent-harness.md.
Impact: documentation only; Q2 implementation starts after merge,
Q3 after Q2 closes.
Refs: 2026-10-02-agent-stack-completion.md Q2/Q3 sections
Why: N2 is closed; per the completion doc's dependency order N3 is
next and needs a plan grounded in current code (the crash window
between persist and intent commit is unprotected, the product
conversation path has zero durability, span names/attributes do not
follow the GenAI convention, the memory port does not exist).
Evidence: five-area survey with file:line citations at the pinned
baselines (agent-native 74aa60b, backend 7980a8a, core 0b5c774);
audit N1/N21 verified fixed, N6/N20 verified still open.
Impact: documentation only; work starts after this plan merges.
Refs: 2026-10-02-agent-stack-completion.md N3 section
Why: expose existing milestone records and distinguish source observations from combination tests.
Evidence: linked records exist at the fixed source version; proposal blobs and the observation receipt remain unchanged.
Impact: index wording and navigation only; no plan or acceptance decision changes.
Refs: docs/proposals/INDEX.md
Why: author and task-account names do not establish ownership of a plan.
Evidence: independent review found four missing owner fields in the adopted set and N2 also has none; fourteen source headers explicitly name weichen.
Impact: correct the index attribution and clarify the local N2 document adoption boundary; source proposals remain unchanged.
Refs: planning-index review P2; docs/proposals/INDEX.md
weichen
weichen