Goose 00036 is a renumbered copy of the vault tables. Degraded read stays off by default and only runs after authorization; tombstones and unpublished artifacts fail closed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Agent commits append a validated envelope inside the command unit of work. SKIP LOCKED is only used to claim, and stale fencing plus integrity failures go to quarantine or dead-letter.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cross-module callers get an opaque ref plus rotating lease tokens so stale writers fail closed, and file I/O is refused inside a unit of work.
Co-authored-by: Cursor <cursoragent@cursor.com>
Rebuild, real PI, browser reload, and two-pool sessions all passed, so
the live report's last sentence is 继续 M2 and the integration slot is idle.
Co-authored-by: Cursor <cursoragent@cursor.com>
Create-project candidates come from the in-session user directory, so a
fresh admin page never saw B/C unless the console refresh ran first.
Co-authored-by: Cursor <cursoragent@cursor.com>
Live M1 sign-off needs browser proof that missing projection is not 404,
outsiders share DOCUMENT_NOT_FOUND, and a real PI compile survives reload.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cross-pool idempotency is same key plus same digest; a stale in-memory
head from the seeder hid the one-winner four-session lock.
Co-authored-by: Cursor <cursoragent@cursor.com>
Occupy the integration slot for M1 live sign-off, cover two pgx pools plus four sessions, and add a Playwright spec that treats projection consistency as 200 rather than 404.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep the short and isolated PostgreSQL/race outputs next to the stop-the-line report so the unsigned PI/browser/rebuild columns stay auditable.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unit, isolated PostgreSQL, and target-package race passed, but real PI, browser, and rebuild were not signed, so the report concludes 停止扩面 and keeps U5–U12 closed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Concurrent HumanEdit/Approve used to assign the default authorizer on the shared Commands value, which raced under -race. Read a local authorizer instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
Authorize first, then return immutable ledger markdown with typed consistency so a missing or drifted projection is no longer a 404/409. GET stays read-only and FAV degraded read stays off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Lock the document row and re-authorize duty before edit, agent commit, approve, or reject share a single transaction. Characterization tests pin ETag races, one legal approve/reject terminal, and same-key digest conflicts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Give each document command one postgres transaction and only let table owners unwrap the scope, so cross-owner writes can roll back together.
Co-authored-by: Cursor <cursoragent@cursor.com>
Capture the replayable import/sql/path/event counts and the owned exceptions that later milestones must shrink.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace whole-repo grep with four production-only gates so Goose and tests stop looking like writer debt, and so new SQL, path, or event crossings fail immediately.
Co-authored-by: Cursor <cursoragent@cursor.com>
Land the revised modular-monolith scheme on the implementation branch so U1–U4 can proceed against a frozen design, and register the docgov mutex without occupying the integration slot.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the real-page and API matrix, release the workflow mutex, and point FEATURE-MATRIX / gap-matrix at the report.
Co-authored-by: Cursor <cursoragent@cursor.com>
Avoid matching the blocked-run hint when opening settings, and close leftover modals before project 143.
Co-authored-by: Cursor <cursoragent@cursor.com>
G5 starts merging and smoke on the shared dev stack; Playwright matrix
is ready for the real page pass after rebuild.
Co-authored-by: Cursor <cursoragent@cursor.com>
Read-only dev query shows 83 planning rows with a leftover key; all are
paired PROJ_MGR/TEST_PROJ fixtures, none are live business projects.
Co-authored-by: Cursor <cursoragent@cursor.com>
Hide submit/review/approve on none docs, surface the blocked-run hint in
chat, and warn that unmanaged duties cannot be added after activation.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pin unmanaged-doc button visibility and treat blocked_pending_governance
as a governance hint, not a successful generation.
Co-authored-by: Cursor <cursoragent@cursor.com>
Validate the catalog key only and stop writing lifecycle=active so
activation stays on the settings DutyMode path.
Co-authored-by: Cursor <cursoragent@cursor.com>
Creating with initial_workflow_key must stay in planning with an empty
active key while the catalog still mounts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep 202 for unactivated document runs, persist blocked_pending_governance,
and refuse submit/review/approve/edit until a live workflow exists.
Co-authored-by: Cursor <cursoragent@cursor.com>
Route run/edit/submit/review/approve to a single duty, drop full-doc
creator bypass, and keep view listing independent of stage narrowing.
Co-authored-by: Cursor <cursoragent@cursor.com>
Lock the full/none/pre-activation matrix so creator no longer implies
document-task privilege and unactivated runs stay WORKFLOW_NOT_ACTIVATED.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wave 5 is on local dev@19f6df5; claim the workflow mutex and
register the implementation worktree for G1–G5.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the real UI matrix, release the integration slot, and leave
the unrun PI generation/approval path as an explicit residual.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wait for the workflow select step before clicking next, scope duty
dropdowns by role, and finish first-login reset so dual-tab and
member checks reach the real frozen UI.
Co-authored-by: Cursor <cursoragent@cursor.com>
