Give later waves a measurable import/table/path baseline without changing business behavior or occupying the integration slot.
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop live roster/policy and herdr-agent start/dispatch helpers so collaboration follows AGENTS worktree/mutex only; archive prior governance evidence.
Co-authored-by: Cursor <cursoragent@cursor.com>
Heal used to resolve and backfill on the pool without the member-write advisory lock, so a stale snapshot of reviewer A could overwrite a committed transfer to B. Lock, resolve, and document updates now share one transaction and the same lock key.
Co-authored-by: Cursor <cursoragent@cursor.com>
Duty revoke must share the project advisory lock with reading old holders and writing members, so a post-commit service snapshot cannot miss a transfer. Heal still fills the new holder after commit, and sync failure stays ERR_DUTY_SYNC.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove now reconciles document slots and returns ERR_DUTY_SYNC on
failure. CreateOrGetDocument errors abort the task. The frontend
refreshes workflow docs after add, update, restore, and remove.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require TEST_DATABASE_URL and refuse agent_system_dev. Script creates a
throwaway database, runs packages serially, then drops it.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replay 358 linear commits as 14 feature/fix epics with merge --no-ff;
include manifest, rewrite script, SHA map, and git-workflow-helper alignment.
Co-authored-by: Cursor <cursoragent@cursor.com>
Support dev/test/main pg_dump backups with RPO manifest metadata and a restore drill that validates dump integrity and migration idempotency.
Co-authored-by: Cursor <cursoragent@cursor.com>
Wire RUNNER_AUTH_TOKEN through dev/test/main Compose, validate uploads
with extension whitelist and content sniffing, add readiness soak script
and short PG loop test, and require runner token in prod when URL is set.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.
Provide SQL migration and Python helper to import review demo sessions
and seed messages from tenProjectsSeed.json into Postgres.
Co-authored-by: Cursor <cursoragent@cursor.com>
