go test under internal/server previously preferred package-local
data/test, so materials never reached the pi-agent bind mount and
intake quality gates failed closed on empty sandboxes.
Align prepared clients with role budgets and automatic approvals. Keep uncertain delivery from triggering duplicate work and preserve task worktree gates.
Consolidate approved policies and add local lease, document CAS, commit, candidate and environment gates. Preserve conservative recovery and cleanup limits.
Load backup credentials from env/secrets files and push via a temporary credential helper so tokens never appear in process listings.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record E2E PASS for global unique names, member session visibility,
and asset raw preview; release integration slot and mark task done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Deny foreign user_id upsert without manage rights (403); unique project
names in ctxmgr PG fixture for global name index; add test-env data repair SQL.
Co-authored-by: Cursor <cursoragent@cursor.com>
Progress tracking now lives in a separate project. Drop the server,
docs, and module-boundary entries without restoring engineering-dashboard.
Co-authored-by: Cursor <cursoragent@cursor.com>
- delete cmd/engineering-dashboard, internal/engineeringdashboard, scripts/engineering-dashboard.sh
- archive old design doc to .doc/archive/design/ with deprecation banner
- FEATURE-MATRIX: mark old row removed, add removed to status contract
- system-design README: section 8 now points to Control Center SSOT
Add test report, FEATURE-MATRIX row, archive the short-term task,
mark CURRENT claim done, and ship the thin serve/export script.
Co-authored-by: Cursor <cursoragent@cursor.com>
Retry U8 product quality flakes once in nightly; formalize Playwright
dual-tab as long-term gated; closeout handoff and DoD notes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add schedule/dispatch nightly entry that classifies infra vs product
failures, and require a valid receipt (or waiver) before promote/release.
Co-authored-by: Cursor <cursoragent@cursor.com>
Nightly and promote gates need auditable pass/product_fail/infra_fail
receipts under test-reports assets, plus timed owner waivers.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record Wave 1–4 evidence, fix FEATURE-MATRIX schema-47 note, harden
promote-to-test against origin rebase, and mark infra task done.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop shipping hard-coded demo docs/projects into production builds,
drop local mock items on authoritative empty server lists, and purge
stale demo seed residue from localStorage on boot.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add ValidateOpsCutover, eventmode CLI, and a host script that pin agent_system_dev and refuse FAV plus test/main before any cluster mode write.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move construction and document OnOutbox out of server, give HTTP/CLI a shared task use case, and block already-cleared import/event arch rules.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace whole-repo grep with four production-only gates so Goose and tests stop looking like writer debt, and so new SQL, path, or event crossings fail immediately.
Co-authored-by: Cursor <cursoragent@cursor.com>
Heal used to resolve and backfill on the pool without the member-write advisory lock, so a stale snapshot of reviewer A could overwrite a committed transfer to B. Lock, resolve, and document updates now share one transaction and the same lock key.
Co-authored-by: Cursor <cursoragent@cursor.com>
Duty revoke must share the project advisory lock with reading old holders and writing members, so a post-commit service snapshot cannot miss a transfer. Heal still fills the new holder after commit, and sync failure stays ERR_DUTY_SYNC.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove now reconciles document slots and returns ERR_DUTY_SYNC on
failure. CreateOrGetDocument errors abort the task. The frontend
refreshes workflow docs after add, update, restore, and remove.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require TEST_DATABASE_URL and refuse agent_system_dev. Script creates a
throwaway database, runs packages serially, then drops it.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replay 358 linear commits as 14 feature/fix epics with merge --no-ff;
include manifest, rewrite script, SHA map, and git-workflow-helper alignment.
Co-authored-by: Cursor <cursoragent@cursor.com>
Support dev/test/main pg_dump backups with RPO manifest metadata and a restore drill that validates dump integrity and migration idempotency.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wire RUNNER_AUTH_TOKEN through dev/test/main Compose, validate uploads
with extension whitelist and content sniffing, add readiness soak script
and short PG loop test, and require runner token in prod when URL is set.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.
Provide SQL migration and Python helper to import review demo sessions
and seed messages from tenProjectsSeed.json into Postgres.
Co-authored-by: Cursor <cursoragent@cursor.com>
WeiCHEN