Root causes of the remaining 5 CI PG failures (and the hidden flaky set):
1. All PG-integration packages shared ONE database under parallel package
execution - migrations/seeds/truncates raced (nondeterministic failure
sets, locally and in CI).
Fix: RequireTestDatabaseURL/SkipIfNoTestDatabaseURL now derive a
per-package database (<base>_<pkgHash>, advisory-lock-guarded
CREATE); 9 raw-env straggler tests funnelled through the helpers;
db-package tests call it unqualified (no import cycle).
2. Approval-chain fixtures were not production-shaped: freezeReviewSnapshot
only honors head_snapshot_id, fake content hashes never froze a
snapshot, so ApproverApprove rejected with 'approved requires frozen
review_snapshot_id'. Errors were swallowed (_, _ =) hiding this.
Fix (ownership-respecting, arch-enforced):
- docrevision.SeedContentSnapshotForTest seeds the ledger tables it owns
- docgov GovernanceEngine.FreezeHeadSnapshotForTest freezes head/review
pointers on document_records (docgov-owned) and clears engine cache
- all four integration fixtures use the pair; swallowed errors checked
3. Fixed-name fixtures collide once a package shares one DB (projects
uq_projects_name_global): uniquified in projectinstance + server tests.
4. CAS/ctxmgr tests never bootstrapped migrations (relied on other packages
having migrated the shared DB): explicit RunMigrationsOnceForTest.
Verified: full parallel short suite = 75 packages, 0 failures against an
isolated throwaway PG. CI skip list removed - short tests fully required.
User authorized lifting CURRENT FAV whole-branch merge protection on
2026-09-23. Keep FAV_DEGRADED_READ/FAV_PUBLISHER_ENABLED default false.
Drop duplicate goose 00034 (local_dev already has 00036). Preserve
agentx workspace admin routes and pin-export wiring.
Move document_records duty-slot writes into docgov, project ledger
heads through docgov/freedoc ports, and workspace deliverable I/O
through DeliverableStore so arch-check baseline drops to sql_write:1
path:13.
Record SWBOOT L1–L4 (no real repo write), FAV ObserveShadow gates and
observation-window prerequisites, D7 Track E ID-only checklist, and stronger
PI narrative fallback negatives while keeping all redline flags off.
A candidate used the same report later attached to the version, so a preview could be treated as the formal result. Proposed reports now close on replace or reject, and only the commit writes an authoritative successor.
The narrator only received counts, so it could not describe the actual change. Caps keep the full document out and leave the input digest unchanged; the flag stays off.
Co-authored-by: Cursor <cursoragent@cursor.com>
The human ledger and the document body are different stores. Record the projection intent in the same transaction as the ledger, and clear it only when the body write succeeds so a retry cannot append a second revision.
Co-authored-by: Cursor <cursoragent@cursor.com>
Flag-on CreateAgentCandidate asks the product PI runner for
change_report_narrative_v1 after the real digest is known; timeout
and malformed payloads stay full fallback. Default flag remains off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Introduce PI_CHANGE_REPORT_NARRATIVE (default off). When on, consume typed
narrative bound to input digest only; malformed/timeout paths fully fall back
without mixing fields or lowering server risk.
Co-authored-by: Cursor <cursoragent@cursor.com>
docgov saves content hashes through the new leaf module so it no longer
imports docrevision. Existing docrevision exports stay as thin wrappers.
Co-authored-by: Cursor <cursoragent@cursor.com>
Agent commits append a validated envelope inside the command unit of work. SKIP LOCKED is only used to claim, and stale fencing plus integrity failures go to quarantine or dead-letter.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cross-pool idempotency is same key plus same digest; a stale in-memory
head from the seeder hid the one-winner four-session lock.
Co-authored-by: Cursor <cursoragent@cursor.com>
Occupy the integration slot for M1 live sign-off, cover two pgx pools plus four sessions, and add a Playwright spec that treats projection consistency as 200 rather than 404.
Co-authored-by: Cursor <cursoragent@cursor.com>
Lock the document row and re-authorize duty before edit, agent commit, approve, or reject share a single transaction. Characterization tests pin ETag races, one legal approve/reject terminal, and same-key digest conflicts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Give each document command one postgres transaction and only let table owners unwrap the scope, so cross-owner writes can roll back together.
Co-authored-by: Cursor <cursoragent@cursor.com>
Approve/commit now write FAV staging in the domain transaction, recover-apply materializes scratch collections, and unpublished or GET paths cannot mutate the registry.
Co-authored-by: Cursor <cursoragent@cursor.com>
Approve and index only ledger blobs; task success now completes the chat turn and recomputes export columns.
Co-authored-by: Cursor <cursoragent@cursor.com>
Live apply now accepts only :5433/agent_system_dev plus a data/dev
host root, maps stored work dirs fail-closed, and reports unique
O_EXCL backups after a parent-directory fsync.
Co-authored-by: Cursor <cursoragent@cursor.com>
Apply now writes the destructive old head markdown beside the original
file, refuses to clobber existing backups, and fsyncs the parent
directory after the atomic persist.
Co-authored-by: Cursor <cursoragent@cursor.com>
migration_repair is not a human revision. HashUpdater now loads from DB
and retries still sync. Content reads return a structured drift conflict
instead of the destructive old head.
Co-authored-by: Cursor <cursoragent@cursor.com>
Opening a template stored database IDs without advancing nextSnapID, so the next temporary snapshot could overwrite and then delete the real baseline. Adopt helpers now bump every counter and only drop a map entry when it still points at the same object.
Co-authored-by: Cursor <cursoragent@cursor.com>
When a candidate is already committed, matching expected hashes return the
current revision state so projection and MarkProposalApplied can finish;
reject on an already-committed candidate stays an error.
Co-authored-by: Cursor <cursoragent@cursor.com>
Materialize needs_confirmation restores ledger head to output.md and
document_records hash; only committed heads update DocGov. Decision
handler projects after commit or reject. Stage gates DocGov proposals
via PendingProposal, not bare RequiresAuthorApproval.
Co-authored-by: Cursor <cursoragent@cursor.com>
Surface pending_candidate_id, report id, and risk so NeedsConfirmation
candidates are discoverable before they enter the version list.
Co-authored-by: Cursor <cursoragent@cursor.com>
TaskRunResult now fails visibly when ledger/report materialization errors;
invalid or unassessed reports are never auto-committed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Open an explicit empty baseline then create a deterministic candidate/report
so the first squad success is visible as fallback analysis, not OpenTemplate-only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stage generation without a real document must not panic or enter the ledger.
Unknown orphan IDs are denied, write paths check author/lease/lifecycle, PATCH
no longer returns a fake 200, and overlay matching survives client/server block id drift.
Co-authored-by: Cursor <cursoragent@cursor.com>
agent-bot
weichen