- server config check: load + validate + masked summary; exit 1 on issues
- no side effects: creates no DB, starts nothing, writes no business dirs
- Config.Check() (production secrets, port range, data dir) exported for
reuse; MaskedSummary never prints credential values
- default no-arg invocation unchanged (serve); help added
- smoke-verified: pass exit 0, invalid port exit 1 with issue line
- layer-source attribution (config explain) deferred to U10b ConfigSnapshot
- configs package embeds agents/ + shared/ prompt assets; templates package
embeds xlsx/ (cdo_quote.xlsx)
- template.GetAgentInstructionFile: disk-first with embedded fallback for
instructions and writing.md (dev behavior unchanged)
- quote.CalculateAndFill: embedded xlsx fallback when the on-disk template
walk misses (single-binary deployments)
- presence test guards the embedded asset set
- verified: vet + template/quote/bizdev/squad/arch green
- deploy/postgres (package dbassets) embeds the full goose chain;
RunMigrations prefers the on-disk dir (dev behavior unchanged) and falls
back to the embedded FS when the source tree is absent (single-binary
deployments per plan U10/KTD16)
- goose SetBaseFS global state reset after use
- TestRunMigrationsEmbeddedFallback verified against a throwaway isolated
pgvector container: nonexistent dir -> embedded chain -> version 78,
migration gate count agrees
KTD1 fifth step (behavior preserved):
- squad.AssetProvider{DocTemplate,RenderDoc,AgentInstruction,
AgentInstructionFile} injected via Options.Assets into Service,
WorkspaceEngine and AdaptivePlanner
- bizdev templateAssetProvider maps port to internal/template (assembly side)
- nil-provider paths degrade to the same fallbacks the old error branches
used (placeholder template, role header) — fail-visible, no guessing
- squad -> template import eliminated; arch edge moved bizdev->template
- verified: build/vet/arch green, squad+bizdev short tests pass
KTD1 second step (behavior preserved):
- squad defines ProgressSink (EmitPhase/Detail/Deliverable/Summary/Briefing)
with its own DetailEvent/ToolEvent types; zero internal/stream imports left
- bizdev assembly maps port to SSE streamer (squad_progress_adapter) and
injects via ctx at the four squad entry points
- process_bridge tests rewritten as port-contract tests (captureSink)
- verified: build+vet clean, squad/bizdev/archtest green
Non-author triggers were denied by dutyAuthorizer because AutoCommitUserID was the triggering user. Record that user on OnBehalfOf and surface the duty mismatch in the task error.
Registration always writes role-guest; a deleted standard role became a masked INTERNAL. Username unique violations are now a 400 instead of an infrastructure 500.
The static adapter catalog still read I2-era states (degraded/shadow) after
the 2026-09-26 dev rollout, so the admin features page showed 降级 for flags
already enabled. Update six entries to live+ready with evidence-dated
reasons (I2/I3/P8 acceptance, P8 per-key gates kept visible, shadow
visibility digest now persisted, REPLACE wildcard wiring, PI narrative dev
rollout); keep FAV red lines untouched. Tests updated; FAV now carries the
configured-value-must-not-imply-readiness assertion.
docflow Commands.run takes SELECT ... FOR UPDATE on document_records inside
its unit of work before calling ApproverApprove; persistApproveAndFAV then
opened a second pool connection and its UPDATE blocked on that row lock until
statement timeout (SQLSTATE 57014), failing every final approval. Join the
ambient uow scope (doc sync + FAV staging on the caller tx, commit owned by
the uow); only open an own tx when no scope is present. Regression test
reproduces the production shape (FOR UPDATE + FAV wiring inside Within).
loadDocumentFromDBLocked selected every column except review_snapshot_id,
so any document loaded after a restart or cache miss lost its frozen review
snapshot and ApproverApprove failed with "approved requires frozen
review_snapshot_id". PG regression test seeds a snapshot and asserts a
fresh engine carries the id through load.
Runtime verification found the deterministic generator merges the prior
served narrative, so a replaced (semantic) narrative would linger after
rollback. Store the displaced deterministic narrative in the shadow report
(persisted via shadow_json) and merge that instead when the prior summary
source is semantic_replace.
Unseal SEMANTIC_SUMMARY_REPLACE under explicit user authorization with a
defense-in-depth session allowlist (SEMANTIC_SUMMARY_REPLACE_SESSIONS):
swap happens only for allowlisted sessions after result digests and served
watermark validation, bounded narrative size; facts/counts stay deterministic
and the daily digest stays advisory. Master flag alone replaces nothing.
Capture trigger_user HITL expectations from dialogue adjudication (previously
dropped at the bizdev call site), project them as chat confirmation cards via
taskrun OnTerminal (exactly-once), arm the session PendingExpectation, and
handle confirm_context_fact hits through the supplement-info blackboard path.
Decline (纠正) guides the user to state the correct fact.
agent-bot
weichen