- new internal/sysadmin package (overview/kb/features/settings) with small
port interfaces; business packages stay unaware of sysadmin
- new routes /api/v1/admin/system/{overview,kb,features,settings} guarded
by requireSystemAdmin
- goose 00049: system_settings table (key/jsonb value, updated_by/at)
- SettingSpec whitelist registry with DB > env > default precedence
- register sysadmin in module-boundaries.yaml (archtest rules)
Two 00048 files made goose panic on CollectMigrations, blocking all
TEST_DATABASE_URL PG suites including FullNone and nightly.
Co-authored-by: Cursor <cursoragent@cursor.com>
Panel and view-model label server risk/lineage separately from PI narrative;
add change_report_narrative_v1 helper aligned with typed-result patterns.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use shared DATA_DIR permissions (umask/chmod) and drop obsolete sync
notify asserts so governance PG PI chains can complete on MiniMax runner.
Co-authored-by: Cursor <cursoragent@cursor.com>
Dev already applied 00046 (projects only) before session retirement
was folded into that file; 00047 closes the gap idempotently.
Co-authored-by: Cursor <cursoragent@cursor.com>
Extend unapplied migration to mark 6001–6010 sessions demo_retired
and filter them (and retired projects) out of ListChatSessions.
Co-authored-by: Cursor <cursoragent@cursor.com>
Mark projects 6001–6010 as demo_retired and exclude them from default
project list queries so demo seeds no longer pollute real workspaces.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remote /v1/run now emits additive result_v1; Go validates run_id, digest, and paths before materializing, and only accepts missing typed payloads with an explicit legacy handshake.
Co-authored-by: Cursor <cursoragent@cursor.com>
HTTP Runtime does not start the worker. Each compose environment gets its own events service, health port, and bounded pool.
Co-authored-by: Cursor <cursoragent@cursor.com>
E0B needs an additive lease audit trail and a cluster-level off/shadow/live table before any worker can claim. FAV remains constrained to off.
Co-authored-by: Cursor <cursoragent@cursor.com>
E0A needs additive tables for classification and per-consumer identities before any dispatcher can claim work. FAV principals are rejected at the schema check.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist typed RunManifest bytes and SHA per run, and allow a finalizing status so U8 can freeze a unique terminal without sharing env databases.
Co-authored-by: Cursor <cursoragent@cursor.com>
Goose 00036 is a renumbered copy of the vault tables. Degraded read stays off by default and only runs after authorization; tombstones and unpublished artifacts fail closed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Agent commits append a validated envelope inside the command unit of work. SKIP LOCKED is only used to claim, and stale fencing plus integrity failures go to quarantine or dead-letter.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cross-module callers get an opaque ref plus rotating lease tokens so stale writers fail closed, and file I/O is refused inside a unit of work.
Co-authored-by: Cursor <cursoragent@cursor.com>
00028 check constraints would reject a real PG apply. Add goose 00032
with Up/Down so repair snapshots can persist.
Co-authored-by: Cursor <cursoragent@cursor.com>
Align document slots to project document_duty even when the wrong ID is
an active member, and fail generate/list instead of returning stale
placeholder duties. Owner author backfill now picks creator, else lowest ID.
Co-authored-by: Cursor <cursoragent@cursor.com>
Project access roles cannot carry reviewer. Persist a separate exclusive document_duty so later controlled docs can inherit the assigned reviewer.
Co-authored-by: Cursor <cursoragent@cursor.com>
runner.mjs imports ./settle-policy.mjs but the Dockerfile only copied
runner.mjs, which crashed shuimu-pi-agent-dev on import. COPY the
runtime module and assert every relative import is in the image set.
Co-authored-by: Cursor <cursoragent@cursor.com>
auto_retry_end success=true now drops providerTransient and lastErr so
a later agent_settled can succeed when the in-process retry landed a
real target. A new error after recovery still fails.
Co-authored-by: Cursor <cursoragent@cursor.com>
*.md was excluding templates/docs from Docker context, so COPY and
go:embed could not see prelim_design.md at /app. Un-ignore those trees
and assert the smoke image can cat the official file.
Co-authored-by: Cursor <cursoragent@cursor.com>
agent_settled after terminated or auto_retry_end success=false is not a
deliverable. Return retryable for provider transients and keep clean
missing targets permanent.
Co-authored-by: Cursor <cursoragent@cursor.com>
agent_settled after exhausted retries is not success; missing or empty target files must return ok:false instead of an empty patch list.
Co-authored-by: Cursor <cursoragent@cursor.com>
App images have no templates/ checkout, so GetDocTemplate fell back to a two-section stub and prelim_design lost its real contract.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist owner-scoped client_key on freeform_documents so upload create
can retry safely without inventing local doc-upload orphans.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist workflow_instance_id, stage_instance_id, scope_kind on chat
messages and task runs; resolve scope from live instance for chat and
document tasks so refresh can apply consistent stage authorization.
Co-authored-by: Cursor <cursoragent@cursor.com>
Introduce catalog governance tables and extend workflow schema v2 so only the three official workflows are selectable at runtime.
Co-authored-by: Cursor <cursoragent@cursor.com>
Close P0 auth gaps for lineage/runs, stage ABAC fail-closed, and
project:create; add IAM migrations 00021-23, me settings APIs, schema v2
manifests, orchestrator skeleton, and gate A regression coverage.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use pgvector image with extensions-only init, seed legacy users before project/chat fixtures, and align test compose with goose-only schema bootstrap.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add confirm-gated resume API with resumable flag, Phase 5 finalize fault
and rolling-restart replay tests, Mermaid strict mode, request body limits,
and optional Runner Bearer auth between app and pi-agent.
Co-authored-by: Cursor <cursoragent@cursor.com>
Introduce goose v20 lease columns with heartbeat loops so only expired
leases are marked interrupted on restart; add PG tests for concurrent
stage advance, active lease survival, and backup migration idempotency.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add goose v19 task_runs/task_run_events tables with PG store for restart
replay, orphan interruption on startup, strict /ready checks, and strip
client work_dir from chat/SSE paths per P0 path sandbox requirements.
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen