2 Commits

Include renames

Author	SHA1	Message	Date
agent-bot	2ad1ef393a	feat(bootstrap): instance identity, single-start lock, root checks (U10c slice 1) ... - internal/bootstrap.EnsureInstance on the serve path: normalized writable roots, symlink-aware validation, data-root vs vault containment rejection, filesystem-root refusal - instance-marker.json in data root: first boot creates; foreign instance ID fails closed (explicit adopt/migrate required, KTD18) - instance.lock non-blocking flock detects duplicate starts locally without any governance tooling; ownership held until process exit - Config.InstanceID (INSTANCE_ID env/file key; default 'default') joins the instance-settings bootstrap denylist (identity cannot be self-overwritten) - auth is Bearer+localStorage per origin (no cookies) - browser isolation holds across ports; documented in the unit template - deploy/systemd/agent-system@.service template (instance %i: env file, DATA_DIR, hardened service scope) - tests: marker create/foreign reject, vault overlap, invalid IDs, root refusal, in-process duplicate-start detection	2026-09-29 08:32:15 +00:00
agent-bot	28a2c8ca2b	feat(config): instance-settings fifth layer (U10b core 2, KTD16/17) ... - <config_root>/instance-settings.json is the final config layer: default > env-file(s) > process-env > cli > instance-settings - LoadForServe wires the CLI mutation hook BEFORE instance settings; serve/check/explain all use it; plain Load keeps legacy behavior - bootstrap denylist (env) fails closed (no self-locating file loop); SETTINGS_MODE=ignore skips the layer as the recovery path - reflection-based typed application: string/int/bool/duration(string or seconds)/string-array; unknown fields and type mismatches fail closed - group/world-writable settings file rejected; absent key = inherit - sources table gains the instance-settings layer; e2e smoke verified (override applies; ignore-mode reverts to default)	2026-09-29 08:17:21 +00:00