T20-I2/I3/I5/I8: dev compose /api/v1/ready, main events networks match test/dev, Dockerfile golang:1.27.1-bookworm, and testing.Short skip for pi-agent docker build.
Cache MinerU parse results by blob hash and store project-scoped
chunk embeddings for large uploaded materials.
Co-authored-by: Cursor <cursoragent@cursor.com>
Absorb stalled capability fixes and avoid goose out-of-order on schema 57 DBs by shipping chat_summaries as 00058.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace per-creator name uniqueness with a global index among
non-retired projects, and reject cross-user duplicate creates with 409.
Co-authored-by: Cursor <cursoragent@cursor.com>
The checksum-immutable note inside 00001 contained a goose annotation and would fail a new database. Keep that warning out of files goose already applied.
Co-authored-by: Cursor <cursoragent@cursor.com>
The human ledger and the document body are different stores. Record the projection intent in the same transaction as the ledger, and clear it only when the body write succeeds so a retry cannot append a second revision.
Co-authored-by: Cursor <cursoragent@cursor.com>
Health checks reuse a two-second snapshot and bound the schema query. Task SSE writes an error frame when an event cannot be encoded. ResolveDocTask errors when the frozen plan has no duty row, while explicit none-duties stay zero. Drop the unwired semantic-summary replace env, record the intentional dev versus release model split, document the test/main cutover path, and archive pre-goose SQL.
Co-authored-by: Cursor <cursoragent@cursor.com>
Goose checksums forbid rewriting applied files. Document that 00001-00009
have no down migration and that 00012's unconditional DELETE is demo-only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Progress tracking now lives in a separate project. Drop the server,
docs, and module-boundary entries without restoring engineering-dashboard.
Co-authored-by: Cursor <cursoragent@cursor.com>
The compose file published 5440 on all interfaces. Match the other
environment databases and listen only on 127.0.0.1.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep Control Center and drop engineering-dashboard. Resolve CURRENT
claim rows and module-boundaries by removing the superseded dashboard
entry.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stamp instance-governed document duties at create time so heal/revoke can
skip locked rows without importing projectinstance.
Co-authored-by: Cursor <cursoragent@cursor.com>
Prevent preview tokens from activating after the governance switch
revision changes by storing the revision on each confirmation token.
Co-authored-by: Cursor <cursoragent@cursor.com>
- new internal/sysadmin package (overview/kb/features/settings) with small
port interfaces; business packages stay unaware of sysadmin
- new routes /api/v1/admin/system/{overview,kb,features,settings} guarded
by requireSystemAdmin
- goose 00049: system_settings table (key/jsonb value, updated_by/at)
- SettingSpec whitelist registry with DB > env > default precedence
- register sysadmin in module-boundaries.yaml (archtest rules)
Two 00048 files made goose panic on CollectMigrations, blocking all
TEST_DATABASE_URL PG suites including FullNone and nightly.
Co-authored-by: Cursor <cursoragent@cursor.com>
Panel and view-model label server risk/lineage separately from PI narrative;
add change_report_narrative_v1 helper aligned with typed-result patterns.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use shared DATA_DIR permissions (umask/chmod) and drop obsolete sync
notify asserts so governance PG PI chains can complete on MiniMax runner.
Co-authored-by: Cursor <cursoragent@cursor.com>
Dev already applied 00046 (projects only) before session retirement
was folded into that file; 00047 closes the gap idempotently.
Co-authored-by: Cursor <cursoragent@cursor.com>
Extend unapplied migration to mark 6001–6010 sessions demo_retired
and filter them (and retired projects) out of ListChatSessions.
Co-authored-by: Cursor <cursoragent@cursor.com>
Mark projects 6001–6010 as demo_retired and exclude them from default
project list queries so demo seeds no longer pollute real workspaces.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remote /v1/run now emits additive result_v1; Go validates run_id, digest, and paths before materializing, and only accepts missing typed payloads with an explicit legacy handshake.
Co-authored-by: Cursor <cursoragent@cursor.com>
HTTP Runtime does not start the worker. Each compose environment gets its own events service, health port, and bounded pool.
Co-authored-by: Cursor <cursoragent@cursor.com>
E0B needs an additive lease audit trail and a cluster-level off/shadow/live table before any worker can claim. FAV remains constrained to off.
Co-authored-by: Cursor <cursoragent@cursor.com>
E0A needs additive tables for classification and per-consumer identities before any dispatcher can claim work. FAV principals are rejected at the schema check.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist typed RunManifest bytes and SHA per run, and allow a finalizing status so U8 can freeze a unique terminal without sharing env databases.
Co-authored-by: Cursor <cursoragent@cursor.com>
Goose 00036 is a renumbered copy of the vault tables. Degraded read stays off by default and only runs after authorization; tombstones and unpublished artifacts fail closed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Agent commits append a validated envelope inside the command unit of work. SKIP LOCKED is only used to claim, and stale fencing plus integrity failures go to quarantine or dead-letter.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cross-module callers get an opaque ref plus rotating lease tokens so stale writers fail closed, and file I/O is refused inside a unit of work.
Co-authored-by: Cursor <cursoragent@cursor.com>
WeiCHEN