Move the reviewed durable-event, HTTP envelope, and PI typed-result
designs off the docs/ prefix so Track E can start from latest dev.
Co-authored-by: Cursor <cursoragent@cursor.com>
Local merged side branches and their worktrees are gone; FAV/herdr/diagnosis/old-linear stay unmerged on purpose.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record project 6275 PI 409 DOC_BUSY plus Docker screenshots, mark CHAT-INTENT-STATE PASS, and archive the short-term so CURRENT has no in_progress rows.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record schema 38 health/ready plus the new agent-dev-app digest, then mark the composition-root slice done so intent dual-tab can take the idle slot.
Co-authored-by: Cursor <cursoragent@cursor.com>
Contract tests, target-package race, and arch-check --mode block passed; merge to dev still needs the integration slot rebuild.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move construction and document OnOutbox out of server, give HTTP/CLI a shared task use case, and block already-cleared import/event arch rules.
Co-authored-by: Cursor <cursoragent@cursor.com>
Archive the finished chat mutex tasks, attach PI idle-chat refresh same-set evidence for project 6252, and stop expansion after in-place ports without a package split.
Co-authored-by: Cursor <cursoragent@cursor.com>
Ignore request user_id as identity, authorize from the session Principal, and hydrate restore/memory from the same visible set so HTTP, SSE, and prompt assembly cannot amplify hidden messages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep ctxmgr as table owner and filter the authorized visible set in-process so window, stats, restore, digest, and prompt assembly share one Principal-scoped collection without a package move.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use an isolated dual-pool database so idempotent finalize, cancel CAS, commit-fail SSE, and receipt-gated cleanup are proven without a process mutex.
Co-authored-by: Cursor <cursoragent@cursor.com>
Hash deliverables through Capability.ReadArtifact, resolve backends on the server, and refuse workspace removal until frozen members match FAV receipts.
Co-authored-by: Cursor <cursoragent@cursor.com>
CAS the unique terminal status with the assistant turn, frozen manifest, envelope and FAV staging, and join ctxmgr writes through the same UoW instead of a process mutex.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist typed RunManifest bytes and SHA per run, and allow a finalizing status so U8 can freeze a unique terminal without sharing env databases.
Co-authored-by: Cursor <cursoragent@cursor.com>
Register feature/taskrun-runmanifest on the taskrun mutex so U8 can start without occupying chat/intent or writing U9–U12.
Co-authored-by: Cursor <cursoragent@cursor.com>
U5–U7 passed isolation-db, race, goose Down, and schema-36 rebuild. The report last sentence is 继续 M3; the integration slot is idle.
Co-authored-by: Cursor <cursoragent@cursor.com>
Goose 00036 is a renumbered copy of the vault tables. Degraded read stays off by default and only runs after authorization; tombstones and unpublished artifacts fail closed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Agent commits append a validated envelope inside the command unit of work. SKIP LOCKED is only used to claim, and stale fencing plus integrity failures go to quarantine or dead-letter.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cross-module callers get an opaque ref plus rotating lease tokens so stale writers fail closed, and file I/O is refused inside a unit of work.
Co-authored-by: Cursor <cursoragent@cursor.com>
Rebuild, real PI, browser reload, and two-pool sessions all passed, so
the live report's last sentence is 继续 M2 and the integration slot is idle.
Co-authored-by: Cursor <cursoragent@cursor.com>
Create-project candidates come from the in-session user directory, so a
fresh admin page never saw B/C unless the console refresh ran first.
Co-authored-by: Cursor <cursoragent@cursor.com>
Live M1 sign-off needs browser proof that missing projection is not 404,
outsiders share DOCUMENT_NOT_FOUND, and a real PI compile survives reload.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cross-pool idempotency is same key plus same digest; a stale in-memory
head from the seeder hid the one-winner four-session lock.
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen