docs(herdr): record v1.2 validation and cleanup ownership

2026-09-21 15:20:12 +00:00
parent 8c5e347758
commit 70f3c73d84
6 changed files with 119 additions and 6 deletions
@@ -1,12 +1,17 @@
 ---
 task_id: herdr-orchestration-v12
-status: in_progress
+status: done
 owner: Codex
 branch: feature/herdr-orchestration-v12
 base_dev_sha: d919e06a73f7a4e18ed9d0cc26728f9cb32f8d97
 policy_revision: agent-governance-2026-09-21-r1
 deployment: not_required
 remote_sync: not_requested
+integration_state: merged
+review_state: passed
+cleanup: pending
+cleanup_owner: independent-maintainer-after-owner-exit
+effective_commit: 8c5e3477585fe27a485343dac97a670d95cf8905
 ---
 # Herdr v1.2 分工与自动审批

@@ -16,7 +21,7 @@ remote_sync: not_requested

 范围：AGENTS/PROJECT 条件入口、roster、两个启动/派发脚本及共享模块/测试。写入通过任务 path 租约；共享 CURRENT 用 CAS。保留其他任务与已存在 cleanup_pending。

-结论与验收将补入本文。交付后的原 task_id 继续用于 Kimi 总次数；不得以拆子任务重置预算。
+结论与验收见下文。交付后的原 task_id 继续用于 Kimi 总次数；不得以拆子任务重置预算。

 ## 研究与验证结果

@@ -26,6 +31,16 @@ remote_sync: not_requested

 - 11 项专用行为测试 PASS（4.664s），包含九个 profile 的自动审批 flags、Herdr 外/错工作区拒绝、目标 pane 检查、报告路由、显式实施备援、不确定发送不重投、唯一重试标记、同角色歧义、Kimi 关停/跨入口计数/未知结果不退款；八进程竞争只有一次真实模拟发送。
 - [测试输出](../../test-reports/assets/2026-09-21-herdr-v12/focused-tests.txt)；[九种启动命令](../../test-reports/assets/2026-09-21-herdr-v12/launch-commands.json)。Git/SQLite 是真实临时仓库，Herdr transport 为 fake，绝不将其声明为实际 pane 启动/模型 E2E。
- PI 安装版本 0.85.1 的本机 README 明确内置工具无权限弹窗，`--approve` 是项目文件信任；扩展仍可自建交互。Cursor force 保留显式 deny，Kimi 使用 auto 而非 yolo。其他本机帮助与[官方出处](../2026-09-13-herdr-agent-roster.md#5-自动通过请求与实际启动)相互核对。
+- PI 安装版本 0.85.1 的本机 README 明确内置工具无权限弹窗，`--approve` 是项目文件信任；扩展仍可自建交互。Cursor force 保留显式 deny，Kimi 使用 auto 而非 yolo。其他本机帮助与[官方出处](../../ops/2026-09-13-herdr-agent-roster.md#5-自动通过请求与实际启动)相互核对。
 - 本地复核：路由/参数集中于一个 Python 模块，两个 shell 薄入口不复制策略；保留 task 与主仓 `.locks` 身份校验；Kimi 占用在投递前事务提交。没有后台队列/全账户计费控制，MiniMax/GPT 预算轮次由任务记录管理。
 - 代码不涉及产品 Go/前端/数据库业务；无需产品重建。提交后的候选将按工程测试全集验证，再受控合入 dev；真实 Herdr 会话核验留给下一次在 Herdr 内的实际任务，不在外部强行接入。
+
+## 收口
+
+实现提交 `8bc7940e`；生效 dev 候选 `8c5e3477585fe27a485343dac97a670d95cf8905`，其第一父节点 `d919e06a`，主目录持锁快进接收同一已验证节点。[候选完整输出](../../test-reports/assets/2026-09-21-herdr-v12/candidate-tests.txt)：87 tests PASS，36.216s，含原门禁与本轮 11 项测试。语法、diff 与本轮链接检查均通过。收口附加提交仅文档，按文档契约另验。
+
+运行边界：未启动真实 Herdr/pane/模型请求，未改全局配置、产品服务或数据库；deployment=not_required，无远端 push。不会把模拟 transport 的通过当作实际账户、余额或审批 UI 已消失的证明。
+
+清理：[进程可见性预检](../../test-reports/assets/2026-09-21-herdr-v12/cleanup-preflight.json)拒绝，部分同 UID cwd 不可读。保留 `.worktrees/herdr-orchestration-v12` 与 `.worktrees/integrate-herdr-orchestration-v12`；独立维护者在 owner 退出和进程可见性核实后重跑普通 remove/-d 的全部门禁，不强删，不接管其他任务。
+
+影响：Herdr roster、条件入口、规范登记、启动/派发脚本一致；不改变 FEATURE-MATRIX 的产品状态或治理完整自动化 partial，也不改变 gap-matrix。下一次实际 Herdr 任务先核验模型/自动审批启动状态，再按既有任务范围调度；Kimi 仅有必要时调用一次。
@@ -1,6 +1,6 @@
 # Herdr 多 Agent 编排 v1.2

-更新：2026-09-21；owner：Herdr 任务协调者；本轮规范修订 `herdr-v1.2`。本文件是 Herdr 角色、额度、审批与备援的唯一来源，取代原 2026-09-13 路由。实现/核验见[任务记录](./short-term/2026-09-21-herdr-orchestration-v12.md)。
+更新：2026-09-21；owner：Herdr 任务协调者；本轮规范修订 `herdr-v1.2`。本文件是 Herdr 角色、额度、审批与备援的唯一来源，取代原 2026-09-13 路由。实现/核验见[任务记录](../archive/ops/2026-09-21-herdr-orchestration-v12.md)。

 ## 1. 生效范围与前提

@@ -26,4 +26,4 @@ CURRENT 是带时间的活跃协调快照；Git/机器状态用于核验实际

 ## Herdr v1.2 局部修订

-用户已授权采纳经研究修正的资源分工与自动审批。Herdr roster 的角色/额度/客户端参数由 `herdr-v1.2` 取代旧路由，仅在明确使用 Herdr 时激活，不扩展通用会话工作流。具体来源、验证与生效集成见[本轮任务](./short-term/2026-09-21-herdr-orchestration-v12.md)。以包含本修订的已验证 dev 合并提交生效；profile/dry-run、入口保护和 Kimi 原子计数有隔离验收，真实 Herdr pane 启动未在本轮执行，不将其记为已实测。
+用户已授权采纳经研究修正的资源分工与自动审批。Herdr roster 的角色/额度/客户端参数由 `herdr-v1.2` 取代旧路由，仅在明确使用 Herdr 时激活，不扩展通用会话工作流。具体来源、验证与生效集成见[本轮任务](../archive/ops/2026-09-21-herdr-orchestration-v12.md)。已通过 dev 合并提交 `8c5e3477585fe27a485343dac97a670d95cf8905` 生效；profile/dry-run、入口保护和 Kimi 原子计数有隔离验收，真实 Herdr pane 启动未在本轮执行，不将其记为已实测。
@@ -12,7 +12,7 @@

 | owner | task | branch | worktree | mutex | status |
 |---|---|---|---|---|---|
-| Codex | herdr-orchestration-v12 | feature/herdr-orchestration-v12 | .worktrees/herdr-orchestration-v12 | herdr-policy+scripts | in_progress |
+| Codex | herdr-orchestration-v12 | feature/herdr-orchestration-v12 | .worktrees/herdr-orchestration-v12 | herdr-policy+scripts | done |
 | Codex | 2026-09-21-agent-governance-implementation | feature/agent-governance-implementation | .worktrees/agent-governance-implementation | agent-governance | done |
 | Cursor | 2026-09-21-force-material-chunk-index | feature/force-material-chunk-index-2026-09-21 | .worktrees/force-material-chunk-index-2026-09-21 | bizdev+materialindex | done |
 | Cursor | 2026-09-21-workflow-scope-weighting | feature/workflow-scope-weighting-2026-09-21 | .worktrees/workflow-scope-weighting-2026-09-21 | intent+web+docgov | done |
@@ -35,6 +35,7 @@

 | 路径/事项 | 分类与保留原因 | cleanup_owner | 复查触发 |
 |---|---|---|---|
+| `.worktrees/herdr-orchestration-v12`、`.worktrees/integrate-herdr-orchestration-v12` | [Herdr v1.2 已交付](../archive/ops/2026-09-21-herdr-orchestration-v12.md)；同 UID cwd 不可读，cleanup=pending | 独立维护者 | owner 退出并核实进程可见性后，重跑全部门禁 |
 | `.worktrees/force-material-chunk-index-2026-09-21` | Cursor 已交付，保留原任务验收与工作区 | Cursor owner / 独立维护者 | owner 退出后核对祖先、文件、证据与进程 |
 | `.worktrees/agent-governance-implementation`、`.worktrees/integrate-agent-governance-implementation` | 已交付；同 UID 进程 cwd 不可读，cleanup=pending | Codex 之外的集成/维护执行者 | 验收、集成、证据归档完成且 owner 退出 |
 | `.worktrees/feature-agent-workflow-governance-plan` | 原 adoption 仍 in_progress；不得替 owner 改 done | 原 Codex owner / 维护者接管 | 核对原任务交付与进程后更新真实状态 |
@@ -0,0 +1,93 @@
+test_unknown_same_uid_inaccessible_cwd_is_not_skipped (test_agent_worktree.ProcessVisibilityTest.test_unknown_same_uid_inaccessible_cwd_is_not_skipped) ... ok
+test_branch_delete_refusal_preserves_branch_without_force_with_visibility_fixture (test_agent_worktree.WorktreeTest.test_branch_delete_refusal_preserves_branch_without_force_with_visibility_fixture) ... ok
+test_cleanup_actual_branch_mapping_with_visibility_fixture (test_agent_worktree.WorktreeTest.test_cleanup_actual_branch_mapping_with_visibility_fixture) ... ok
+test_cleanup_legacy_mapping_and_nonforced_branch_delete_with_visibility_fixture (test_agent_worktree.WorktreeTest.test_cleanup_legacy_mapping_and_nonforced_branch_delete_with_visibility_fixture) ... ok
+test_cleanup_lifecycle_lock_prevents_a_new_run (test_agent_worktree.WorktreeTest.test_cleanup_lifecycle_lock_prevents_a_new_run) ... ok
+test_cleanup_refuses_active_registry_operation_even_with_other_cwd (test_agent_worktree.WorktreeTest.test_cleanup_refuses_active_registry_operation_even_with_other_cwd) ... ok
+test_cleanup_refuses_live_process_cwd (test_agent_worktree.WorktreeTest.test_cleanup_refuses_live_process_cwd) ... ok
+test_cleanup_refuses_tracked_untracked_and_ignored_evidence (test_agent_worktree.WorktreeTest.test_cleanup_refuses_tracked_untracked_and_ignored_evidence) ... ok
+test_cleanup_refuses_unfinished_git_operation (test_agent_worktree.WorktreeTest.test_cleanup_refuses_unfinished_git_operation) ... ok
+test_cleanup_refuses_unmerged_commit (test_agent_worktree.WorktreeTest.test_cleanup_refuses_unmerged_commit) ... ok
+test_create_from_feature_uses_current_dev_and_canonical_main (test_agent_worktree.WorktreeTest.test_create_from_feature_uses_current_dev_and_canonical_main) ... ok
+test_create_with_main_on_unrelated_branch_uses_dev (test_agent_worktree.WorktreeTest.test_create_with_main_on_unrelated_branch_uses_dev) ... ok
+test_forged_inherited_lease_is_refused (test_agent_worktree.WorktreeTest.test_forged_inherited_lease_is_refused) ... ok
+test_inherited_worktree_lease_does_not_double_lock (test_agent_worktree.WorktreeTest.test_inherited_worktree_lease_does_not_double_lock) ... ok
+test_list_is_read_only_without_init (test_agent_worktree.WorktreeTest.test_list_is_read_only_without_init) ... ok
+test_rejects_traversal_nested_and_protected_branches (test_agent_worktree.WorktreeTest.test_rejects_traversal_nested_and_protected_branches) ... ok
+test_same_task_id_and_existing_branch_do_not_collide (test_agent_worktree.WorktreeTest.test_same_task_id_and_existing_branch_do_not_collide) ... ok
+test_stable_lock_refuses_concurrent_writer (test_agent_worktree.WorktreeTest.test_stable_lock_refuses_concurrent_writer) ... ok
+test_symlink_parent_or_target_is_refused (test_agent_worktree.WorktreeTest.test_symlink_parent_or_target_is_refused) ... ok
+test_write_requires_explicit_init (test_agent_worktree.WorktreeTest.test_write_requires_explicit_init) ... ok
+test_admin_document_cannot_bypass_done_with_compact_cells (test_agentctl.AgentctlTests.test_admin_document_cannot_bypass_done_with_compact_cells) ... ok
+test_admin_document_cas_preserves_slot_and_needs_capability (test_agentctl.AgentctlTests.test_admin_document_cas_preserves_slot_and_needs_capability) ... ok
+test_admin_full_document_requires_explicit_admin_capability (test_agentctl.AgentctlTests.test_admin_full_document_requires_explicit_admin_capability) ... ok
+test_commit_lease_must_cover_staged_files_not_only_task_scope (test_agentctl.AgentctlTests.test_commit_lease_must_cover_staged_files_not_only_task_scope) ... ok
+test_descendant_resource_guard_accepts_only_held_resource (test_agentctl.AgentctlTests.test_descendant_resource_guard_accepts_only_held_resource) ... ok
+test_docs_cannot_launder_unmanaged_other_task_changes (test_agentctl.AgentctlTests.test_docs_cannot_launder_unmanaged_other_task_changes) ... ok
+test_docs_foreign_current_row_is_rejected (test_agentctl.AgentctlTests.test_docs_foreign_current_row_is_rejected) ... ok
+test_docs_multi_file_preflight_failure_has_no_partial_writes (test_agentctl.AgentctlTests.test_docs_multi_file_preflight_failure_has_no_partial_writes) ... ok
+test_docs_row_cas_preserves_unrelated_rows_and_is_idempotent (test_agentctl.AgentctlTests.test_docs_row_cas_preserves_unrelated_rows_and_is_idempotent) ... ok
+test_env_guard_accepts_clean_main_and_requires_all_target_leases (test_agentctl.AgentctlTests.test_env_guard_accepts_clean_main_and_requires_all_target_leases) ... ok
+test_env_guard_refuses_linked_worktree_even_with_capability (test_agentctl.AgentctlTests.test_env_guard_refuses_linked_worktree_even_with_capability) ... ok
+test_failed_child_releases_lease_and_preserves_failure (test_agentctl.AgentctlTests.test_failed_child_releases_lease_and_preserves_failure) ... ok
+test_failed_revalidation_revokes_old_success_receipt (test_agentctl.AgentctlTests.test_failed_revalidation_revokes_old_success_receipt) ... ok
+test_guard_build_requires_exact_clean_commit (test_agentctl.AgentctlTests.test_guard_build_requires_exact_clean_commit) ... ok
+test_hook_checks_reject_out_of_scope_and_secret_paths (test_agentctl.AgentctlTests.test_hook_checks_reject_out_of_scope_and_secret_paths) ... ok
+test_hook_rejects_shared_document_without_publish_receipt (test_agentctl.AgentctlTests.test_hook_rejects_shared_document_without_publish_receipt) ... ok
+test_hooks_allow_published_shared_document_receipt (test_agentctl.AgentctlTests.test_hooks_allow_published_shared_document_receipt) ... ok
+test_hooks_allow_scoped_task_commit_under_live_lease (test_agentctl.AgentctlTests.test_hooks_allow_scoped_task_commit_under_live_lease) ... ok
+test_hooks_refuse_overwriting_foreign_hook (test_agentctl.AgentctlTests.test_hooks_refuse_overwriting_foreign_hook) ... ok
+test_init_cannot_steal_live_legacy_lock (test_agentctl.AgentctlTests.test_init_cannot_steal_live_legacy_lock) ... ok
+test_init_preserves_existing_legacy_lock_inode (test_agentctl.AgentctlTests.test_init_preserves_existing_legacy_lock_inode) ... ok
+test_installed_hooks_reject_direct_dev_commit (test_agentctl.AgentctlTests.test_installed_hooks_reject_direct_dev_commit) ... ok
+test_interrupted_validation_stops_child_before_releasing_scope (test_agentctl.AgentctlTests.test_interrupted_validation_stops_child_before_releasing_scope) ... ok
+test_invalid_document_request_shape_has_no_write_side_effects (test_agentctl.AgentctlTests.test_invalid_document_request_shape_has_no_write_side_effects) ... ok
+test_linked_worktree_uses_only_main_coordination_root (test_agentctl.AgentctlTests.test_linked_worktree_uses_only_main_coordination_root) ... ok
+test_live_and_stale_credentials_cannot_be_spoofed (test_agentctl.AgentctlTests.test_live_and_stale_credentials_cannot_be_spoofed) ... ok
+test_live_run_cannot_be_recovered_or_task_closed (test_agentctl.AgentctlTests.test_live_run_cannot_be_recovered_or_task_closed) ... ok
+test_multi_resource_acquisition_is_atomic (test_agentctl.AgentctlTests.test_multi_resource_acquisition_is_atomic) ... ok
+test_parent_child_path_conflict_and_disjoint_coexistence (test_agentctl.AgentctlTests.test_parent_child_path_conflict_and_disjoint_coexistence) ... ok
+test_path_scope_and_capability_are_enforced (test_agentctl.AgentctlTests.test_path_scope_and_capability_are_enforced) ... ok
+test_recovery_refuses_dead_supervisor_with_live_child (test_agentctl.AgentctlTests.test_recovery_refuses_dead_supervisor_with_live_child) ... ok
+test_registered_active_task_must_close_before_cleanup (test_agentctl.AgentctlTests.test_registered_active_task_must_close_before_cleanup) ... ok
+test_replaced_compatibility_inode_is_not_a_new_free_lock (test_agentctl.AgentctlTests.test_replaced_compatibility_inode_is_not_a_new_free_lock) ... ok
+test_shared_lease_does_not_satisfy_write_guard (test_agentctl.AgentctlTests.test_shared_lease_does_not_satisfy_write_guard) ... ok
+test_task_index_lease_serializes_index_but_not_disjoint_work (test_agentctl.AgentctlTests.test_task_index_lease_serializes_index_but_not_disjoint_work) ... ok
+test_task_registration_rejects_protected_branch_and_invalid_scopes (test_agentctl.AgentctlTests.test_task_registration_rejects_protected_branch_and_invalid_scopes) ... ok
+test_uninitialized_status_and_doctor_do_not_create_state (test_agentctl.AgentctlTests.test_uninitialized_status_and_doctor_do_not_create_state) ... ok
+test_validated_linear_commit_cannot_bypass_candidate_entrypoint (test_agentctl.AgentctlTests.test_validated_linear_commit_cannot_bypass_candidate_entrypoint) ... ok
+test_validated_merge_candidate_is_exactly_promoted_to_dev (test_agentctl.AgentctlTests.test_validated_merge_candidate_is_exactly_promoted_to_dev) ... ok
+test_both_expected_tests_pass (test_go_test_evidence.TestEvidence.test_both_expected_tests_pass) ... ok
+test_missing_partial_skip_failure_and_duplicate_are_not_pass (test_go_test_evidence.TestEvidence.test_missing_partial_skip_failure_and_duplicate_are_not_pass) ... ok
+test_subtests_and_case_mismatches_do_not_prove_parent_execution (test_go_test_evidence.TestEvidence.test_subtests_and_case_mismatches_do_not_prove_parent_execution) ... ok
+test_all_profiles_have_noninteractive_flags_and_explicit_pi_routes (test_herdr_agents.HerdrTests.test_all_profiles_have_noninteractive_flags_and_explicit_pi_routes) ... ok
+test_explicit_prewrite_retry_reaches_flash (test_herdr_agents.HerdrTests.test_explicit_prewrite_retry_reaches_flash) ... ok
+test_implementation_fallback_is_explicit (test_herdr_agents.HerdrTests.test_implementation_fallback_is_explicit) ... ok
+test_kimi_atomic_limit_across_eight_processes (test_herdr_agents.HerdrTests.test_kimi_atomic_limit_across_eight_processes) ... ok
+test_kimi_reason_disabled_marker_and_cross_lane_budget (test_herdr_agents.HerdrTests.test_kimi_reason_disabled_marker_and_cross_lane_budget) ... ok
+test_kimi_uncertain_send_consumes_budget (test_herdr_agents.HerdrTests.test_kimi_uncertain_send_consumes_budget) ... ok
+test_main_or_wrong_target_pane_cannot_start (test_herdr_agents.HerdrTests.test_main_or_wrong_target_pane_cannot_start) ... ok
+test_outside_herdr_and_wrong_task_cwd_never_contact_transport (test_herdr_agents.HerdrTests.test_outside_herdr_and_wrong_task_cwd_never_contact_transport) ... ok
+test_report_routes_to_max_not_kimi_or_minimax (test_herdr_agents.HerdrTests.test_report_routes_to_max_not_kimi_or_minimax) ... ok
+test_same_role_ambiguity_and_foreign_cwd_do_not_dispatch (test_herdr_agents.HerdrTests.test_same_role_ambiguity_and_foreign_cwd_do_not_dispatch) ... ok
+test_uncertain_transport_error_and_blocked_do_not_fallback (test_herdr_agents.HerdrTests.test_uncertain_transport_error_and_blocked_do_not_fallback) ... ok
+test_authorized_pinned_rebuild_preserves_no_build (test_ops_guards.OpsGuardsTest.test_authorized_pinned_rebuild_preserves_no_build) ... ok
+test_build_accepts_nightly_evidence_excluded_from_build_context (test_ops_guards.OpsGuardsTest.test_build_accepts_nightly_evidence_excluded_from_build_context) ... ok
+test_build_context_is_frozen_when_managed_source_changes (test_ops_guards.OpsGuardsTest.test_build_context_is_frozen_when_managed_source_changes) ... ok
+test_build_dirty_source_refuses_before_docker_or_receipts (test_ops_guards.OpsGuardsTest.test_build_dirty_source_refuses_before_docker_or_receipts) ... ok
+test_build_mismatched_commit_refuses_before_docker_or_receipts (test_ops_guards.OpsGuardsTest.test_build_mismatched_commit_refuses_before_docker_or_receipts) ... ok
+test_build_untracked_source_refuses_before_docker_or_receipts (test_ops_guards.OpsGuardsTest.test_build_untracked_source_refuses_before_docker_or_receipts) ... ok
+test_clean_build_records_exact_source_commit (test_ops_guards.OpsGuardsTest.test_clean_build_records_exact_source_commit) ... ok
+test_environment_lease_cannot_deploy_dirty_main_source (test_ops_guards.OpsGuardsTest.test_environment_lease_cannot_deploy_dirty_main_source) ... ok
+test_invalid_action_does_not_initialize_environment (test_ops_guards.OpsGuardsTest.test_invalid_action_does_not_initialize_environment) ... ok
+test_linked_worktree_writes_refuse_and_queries_remain_read_only (test_ops_guards.OpsGuardsTest.test_linked_worktree_writes_refuse_and_queries_remain_read_only) ... ok
+test_one_environment_lease_does_not_authorize_all (test_ops_guards.OpsGuardsTest.test_one_environment_lease_does_not_authorize_all) ... ok
+test_queries_never_initialize_environment (test_ops_guards.OpsGuardsTest.test_queries_never_initialize_environment) ... ok
+test_service_writes_without_lease_refuse_before_any_side_effect (test_ops_guards.OpsGuardsTest.test_service_writes_without_lease_refuse_before_any_side_effect) ... ok
+test_valid_lease_cannot_hide_linked_caller_or_linked_script (test_ops_guards.OpsGuardsTest.test_valid_lease_cannot_hide_linked_caller_or_linked_script) ... ok
+
+----------------------------------------------------------------------
+Ran 87 tests in 36.216s
+
+OK
+{"run_id": "c40ab72e-e47f-45a5-80ab-c8e9f64363cc", "sha": "8c5e3477585fe27a485343dac97a670d95cf8905", "status": "validated", "task": "integrate-herdr-orchestration-v12"}
@@ -0,0 +1,4 @@
+{
+  "herdr-orchestration-v12": "cannot verify cwd of same-user process 3854,128511,736400,987545,2019599,2201773,2201926,2202198; cleanup_pending",
+  "integrate-herdr-orchestration-v12": "cannot verify cwd of same-user process 3854,128511,736400,987545,2019599,2201773,2201926,2202198; cleanup_pending"
+}