Retry U8 product quality flakes once in nightly; formalize Playwright
dual-tab as long-term gated; closeout handoff and DoD notes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add schedule/dispatch nightly entry that classifies infra vs product
failures, and require a valid receipt (or waiver) before promote/release.
Co-authored-by: Cursor <cursoragent@cursor.com>
Nightly and promote gates need auditable pass/product_fail/infra_fail
receipts under test-reports assets, plus timed owner waivers.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record Wave 1–4 evidence, fix FEATURE-MATRIX schema-47 note, harden
promote-to-test against origin rebase, and mark infra task done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop shipping hard-coded demo docs/projects into production builds,
drop local mock items on authoritative empty server lists, and purge
stale demo seed residue from localStorage on boot.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add ValidateOpsCutover, eventmode CLI, and a host script that pin agent_system_dev and refuse FAV plus test/main before any cluster mode write.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move construction and document OnOutbox out of server, give HTTP/CLI a shared task use case, and block already-cleared import/event arch rules.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace whole-repo grep with four production-only gates so Goose and tests stop looking like writer debt, and so new SQL, path, or event crossings fail immediately.
Co-authored-by: Cursor <cursoragent@cursor.com>
Heal used to resolve and backfill on the pool without the member-write advisory lock, so a stale snapshot of reviewer A could overwrite a committed transfer to B. Lock, resolve, and document updates now share one transaction and the same lock key.
Co-authored-by: Cursor <cursoragent@cursor.com>
Duty revoke must share the project advisory lock with reading old holders and writing members, so a post-commit service snapshot cannot miss a transfer. Heal still fills the new holder after commit, and sync failure stays ERR_DUTY_SYNC.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove now reconciles document slots and returns ERR_DUTY_SYNC on
failure. CreateOrGetDocument errors abort the task. The frontend
refreshes workflow docs after add, update, restore, and remove.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require TEST_DATABASE_URL and refuse agent_system_dev. Script creates a
throwaway database, runs packages serially, then drops it.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replay 358 linear commits as 14 feature/fix epics with merge --no-ff;
include manifest, rewrite script, SHA map, and git-workflow-helper alignment.
Co-authored-by: Cursor <cursoragent@cursor.com>
Support dev/test/main pg_dump backups with RPO manifest metadata and a restore drill that validates dump integrity and migration idempotency.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wire RUNNER_AUTH_TOKEN through dev/test/main Compose, validate uploads
with extension whitelist and content sniffing, add readiness soak script
and short PG loop test, and require runner token in prod when URL is set.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.
Provide SQL migration and Python helper to import review demo sessions
and seed messages from tenProjectsSeed.json into Postgres.
Co-authored-by: Cursor <cursoragent@cursor.com>
