- H4: sliding-window rate limiter (10 attempts / 5min per IP+username)
on login and register; successful login resets the counter; pure
stdlib, no new dependency
- H8: docker-compose.test.yml DB/ADMIN passwords now :?required (align
with main); docker-compose.main.yml AUTH_REGISTRATION_ENABLED
defaults to false
- M8: fix FAV_PUBLISHER_ENABLE -> FAV_PUBLISHER_ENABLED typo so the
gate test actually guards the real flag
Co-authored-by: Cursor <cursoragent@cursor.com>
- H1: log legacy test-principal fallback (path/method/remote_addr) via
slog.Warn so silent unauthenticated access is observable
- H2: AddComment/Claim now derive actor ID/Name/Role from the auth
principal and server-side doc duty resolution (resolveDocGovRole),
never from request body; GetDocument/ListComments/ListAuditLogs now
require project membership via requireDocGovDocAccess
- H3: handleGetChatTurn asserts session ownership; handleListChatSessions
and handleGetUserContext reject cross-user user_id (403) and stop
defaulting to user id=1
Co-authored-by: Cursor <cursoragent@cursor.com>
- getOrCreateSession now takes ctx; GetSessionOwnerID/
RestoreSessionContext/CompilePromptGuidance run under
context.WithTimeout(5s) instead of context.Background()
- SyncRecentDialogue's rolling summary uses a 30s timeout context
instead of Background, so client disconnect cancels the LLM call
Co-authored-by: Cursor <cursoragent@cursor.com>
- Add Store.SavePlanWithRevision: single-transaction planning upsert +
revision bump (bump first with optimistic lock, conflict rolls back
before any plan write), closing the SaveWorkflowPlan split-transaction
race where plan content and revision could diverge
- AdvanceStage now takes operatorID and writes completed_by explicitly
instead of SELECT activated_by, so the completing operator is the
actual advancing user, not the original activator
- Service.SaveWorkflowPlan/AdvanceStage pass userID through; memStore
implements SavePlanWithRevision under its single mutex
Co-authored-by: Cursor <cursoragent@cursor.com>
- Session gains mu sync.RWMutex + SnapshotMessages/AppendMessage/
TouchLastAccessed/SetProjectID/Project accessors
- sendMessageInternal, hydrateVisibleHistory, getOrCreateSession,
cleanStaleSessionsLocked, handleChat, handleChatStream,
enrichSessionWorkflowStage, bindSessionDocumentSummaryReader all use
locked accessors instead of raw field access
- ProjectID mutation now goes through SetProjectID (only when changed),
closing the cross-project pollution window in handleChat/handleChatStream
Co-authored-by: Cursor <cursoragent@cursor.com>
- persistLeaseLocked now returns error; AcquireLease rolls back in-memory
lease on DB failure so memory and PG stay consistent
- appendAuditLocked uses request ctx and logs audit INSERT failures
instead of swallowing them with context.Background()
- loadDocumentFromDBLocked now SELECTs lease_fencing_token so fencing
survives process restart
- SaveDocumentContent/RecordDocumentViewed/RecordDocumentEdited/
DecideModificationProposal/SetDocumentWorkDir log persist failures
via slog.Error instead of silent _, _
Co-authored-by: Cursor <cursoragent@cursor.com>
The untracked node_modules tree and the local feature branch are gone.
The remote branch was left in place.
Co-authored-by: Cursor <cursoragent@cursor.com>
Progress tracking now lives in a separate project. Drop the server,
docs, and module-boundary entries without restoring engineering-dashboard.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the unit, live LLM, and SPA walkthrough evidence, and mark the
control-center row done now that engineering-dashboard is superseded.
Co-authored-by: Cursor <cursoragent@cursor.com>
The compose file published 5440 on all interfaces. Match the other
environment databases and listen only on 127.0.0.1.
Co-authored-by: Cursor <cursoragent@cursor.com>
Real highspeed responses wrap reasoning in think tags that contain
brackets, which made the JSON span extractor fail before the array.
Co-authored-by: Cursor <cursoragent@cursor.com>
Gate the merge on unit coverage for the three packages that previously
had none: env precedence, migrate/query, and claim/heartbeat/reap.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep Control Center and drop engineering-dashboard. Resolve CURRENT
claim rows and module-boundaries by removing the superseded dashboard
entry.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prefer error_code when present and route projectMembers/freeformDoc/
taskRuns/chatSessions failures through the shared structured parser.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove the skipped client work_dir resume coverage that targeted a deleted
entry point, and document why the real-PI stop-gate stays redirected to
internal/server to avoid an import cycle.
Co-authored-by: Cursor <cursoragent@cursor.com>
Carry the done checklist and test-report link that lagged the Wave 2
merge tip so Wave 3 starts from a consistent ops state.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pin E-3/E-4/E-6 compose declarations so dead runner config and missing
flag wiring cannot silently regress.
Co-authored-by: Cursor <cursoragent@cursor.com>
Placeholder cursor-agent service is gone; keep CURSOR_API_KEY/MODEL/BIN
for the local cursor-cli subprocess backend.
Co-authored-by: Cursor <cursoragent@cursor.com>
Also declare SEMANTIC_SUMMARY_SHADOW and PI_CHANGE_REPORT_NARRATIVE on
test/main, remove dead CURSOR_RUNNER_URL/cursor-agent, and set main
SEED_DEMO_USERS=false. Defaults stay legacy/false (no behavior change).
Co-authored-by: Cursor <cursoragent@cursor.com>
Close short-term task, mark remediation Wave 1 done, release integration
slot, and record main env=main / schema 52 / modes-off smoke evidence.
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop Env==\"\" as a dev alias; pin compose app/events ENV alignment and
main depends_on events with unit tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
Set app ENV=main (was prod) and require events service_healthy before
app starts so goose migrations finish before app queries new columns.
Co-authored-by: Cursor <cursoragent@cursor.com>
Close short-term task, mark remediation Wave 0 done, release integration
slot, and attach real pi-agent SSE heartbeat log plus suite results.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pass userId on every saveSessionWindowCache write, LRU-evict full cache
keys, and applyRestoredFileRaw so mount restore cannot drop newer deliverables.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive the 2026-09-17 health-check audit/remediation and short-term Wave 0
task so P0 SSE/cache fixes can proceed under mutex chat+web.
Co-authored-by: Cursor <cursoragent@cursor.com>
