Capture trigger_user HITL expectations from dialogue adjudication (previously
dropped at the bizdev call site), project them as chat confirmation cards via
taskrun OnTerminal (exactly-once), arm the session PendingExpectation, and
handle confirm_context_fact hits through the supplement-info blackboard path.
Decline (纠正) guides the user to state the correct fact.
Bring pinative/agentx workspace registry and A-B harness onto current
local_dev; renumber goose agentx registry 00062→00066 to avoid clash
with chat-summary/provenance migrations. Keep CURRENT/MATRIX as ours
for later docs apply; union module-boundaries agentx import tree.
Path literals use workspace constants for arch-check.
Close T20-B2/B6/B8/B9/B10 low-risk leaks: map-backed cancel reclaim, idempotency lock TTL in cleanupLoop, sync.Once information_schema probe, InvalidateLayer after chat memory upsert, and Subscribe before SSE headers.
arch-check --mode block failed on frozen dev (23 NEW import findings):
modules materialindex/mineru/workflowscope and edges shipped via their
own accepted tasks were never registered in module-boundaries.yaml.
Register the intentional allowlist edges (precedent 97b868a9); no new
exceptions are added.
7 PG tests fell back to a hardcoded dev DB (127.0.0.1:5433) when
TEST_DATABASE_URL/CONTEXT_DB_DSN were unset, contradicting the isolated
test-DB contract (BUG-08) and polluting dev on a bare 'go test -short'.
Change the fallback to skip when no isolated DB env is provided.
Co-authored-by: Cursor <cursoragent@cursor.com>
The task run API was emitting PascalCase fields, so the client never saw status or error_message and treated every disconnect as a network error.
Co-authored-by: Cursor <cursoragent@cursor.com>
Normalize empty TEXT[] binds, isolate step-changed aggregates from plan
revision uniqueness, propagate AdvanceEligible errors, and emit
taskrun.completed to the registered notify consumer so finalize no longer
rolls back live receipts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require ResolveBackendInEnv to deny stub (and empty stub fallback) when
env is main/prod so production cannot request simulated agent output.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use an isolated dual-pool database so idempotent finalize, cancel CAS, commit-fail SSE, and receipt-gated cleanup are proven without a process mutex.
Co-authored-by: Cursor <cursoragent@cursor.com>
CAS the unique terminal status with the assistant turn, frozen manifest, envelope and FAV staging, and join ctxmgr writes through the same UoW instead of a process mutex.
Co-authored-by: Cursor <cursoragent@cursor.com>
Give each document command one postgres transaction and only let table owners unwrap the scope, so cross-owner writes can roll back together.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist workflow_instance_id, stage_instance_id, scope_kind on chat
messages and task runs; resolve scope from live instance for chat and
document tasks so refresh can apply consistent stage authorization.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add confirm-gated resume API with resumable flag, Phase 5 finalize fault
and rolling-restart replay tests, Mermaid strict mode, request body limits,
and optional Runner Bearer auth between app and pi-agent.
Co-authored-by: Cursor <cursoragent@cursor.com>
Introduce goose v20 lease columns with heartbeat loops so only expired
leases are marked interrupted on restart; add PG tests for concurrent
stage advance, active lease survival, and backup migration idempotency.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add goose v19 task_runs/task_run_events tables with PG store for restart
replay, orphan interruption on startup, strict /ready checks, and strip
client work_dir from chat/SSE paths per P0 path sandbox requirements.
Co-authored-by: Cursor <cursoragent@cursor.com>
Extend taskrun executors to return full TaskRunResult, finalize assistant
placeholder content with artifact metadata, and map quality_failed terminal
state instead of metadata-only updates.
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen