Root causes of the remaining 5 CI PG failures (and the hidden flaky set):
1. All PG-integration packages shared ONE database under parallel package
execution - migrations/seeds/truncates raced (nondeterministic failure
sets, locally and in CI).
Fix: RequireTestDatabaseURL/SkipIfNoTestDatabaseURL now derive a
per-package database (<base>_<pkgHash>, advisory-lock-guarded
CREATE); 9 raw-env straggler tests funnelled through the helpers;
db-package tests call it unqualified (no import cycle).
2. Approval-chain fixtures were not production-shaped: freezeReviewSnapshot
only honors head_snapshot_id, fake content hashes never froze a
snapshot, so ApproverApprove rejected with 'approved requires frozen
review_snapshot_id'. Errors were swallowed (_, _ =) hiding this.
Fix (ownership-respecting, arch-enforced):
- docrevision.SeedContentSnapshotForTest seeds the ledger tables it owns
- docgov GovernanceEngine.FreezeHeadSnapshotForTest freezes head/review
pointers on document_records (docgov-owned) and clears engine cache
- all four integration fixtures use the pair; swallowed errors checked
3. Fixed-name fixtures collide once a package shares one DB (projects
uq_projects_name_global): uniquified in projectinstance + server tests.
4. CAS/ctxmgr tests never bootstrapped migrations (relied on other packages
having migrated the shared DB): explicit RunMigrationsOnceForTest.
Verified: full parallel short suite = 75 packages, 0 failures against an
isolated throwaway PG. CI skip list removed - short tests fully required.
os.WriteFile mode is masked by umask (022 in CI turns 0666 into 0644),
making the writable-file rejection test environment-dependent; chmod the
explicit bits after write
Root cause: the 2026-09-28 controlled-projection hardening added the
ErrUnboundControlledProject guard, and the server path got session project
binding backfilled - but two paths missed:
- CLI chat mode never called session.SetProjectID (only -project name)
- coordinator handleAdvanceStage built StageRunRequest without
ProjectID/UserID, so every stage-advance squad task was rejected
Fixes:
- handleChatMode gains projectID param (wired from -project-id flag);
session binding follows the server convention
- handleAdvanceStage passes parseDecimalID(UserCtx.Project/User.ID)
- CLI chat tests get hermetic env (unreachable DB + ALLOW_IN_MEMORY) so
local runs stop accidentally hitting the real dev DB on :5433
- stale test TestBindSessionProjectContext_KeepsExistingProjectID asserted
the pre-fix 'switch does not propagate' bug; updated to assert switch
propagation + bind no-overwrite
Result: go test -short ./... = 75 packages, 0 failures (first time).
Short tests promoted from report-only back into the required CI gate.
- server config check: load + validate + masked summary; exit 1 on issues
- no side effects: creates no DB, starts nothing, writes no business dirs
- Config.Check() (production secrets, port range, data dir) exported for
reuse; MaskedSummary never prints credential values
- default no-arg invocation unchanged (serve); help added
- smoke-verified: pass exit 0, invalid port exit 1 with issue line
- layer-source attribution (config explain) deferred to U10b ConfigSnapshot
- configs package embeds agents/ + shared/ prompt assets; templates package
embeds xlsx/ (cdo_quote.xlsx)
- template.GetAgentInstructionFile: disk-first with embedded fallback for
instructions and writing.md (dev behavior unchanged)
- quote.CalculateAndFill: embedded xlsx fallback when the on-disk template
walk misses (single-binary deployments)
- presence test guards the embedded asset set
- verified: vet + template/quote/bizdev/squad/arch green
- deploy/postgres (package dbassets) embeds the full goose chain;
RunMigrations prefers the on-disk dir (dev behavior unchanged) and falls
back to the embedded FS when the source tree is absent (single-binary
deployments per plan U10/KTD16)
- goose SetBaseFS global state reset after use
- TestRunMigrationsEmbeddedFallback verified against a throwaway isolated
pgvector container: nonexistent dir -> embedded chain -> version 78,
migration gate count agrees
KTD1 fifth step (behavior preserved):
- squad.AssetProvider{DocTemplate,RenderDoc,AgentInstruction,
AgentInstructionFile} injected via Options.Assets into Service,
WorkspaceEngine and AdaptivePlanner
- bizdev templateAssetProvider maps port to internal/template (assembly side)
- nil-provider paths degrade to the same fallbacks the old error branches
used (placeholder template, role header) — fail-visible, no guessing
- squad -> template import eliminated; arch edge moved bizdev->template
- verified: build/vet/arch green, squad+bizdev short tests pass
KTD1 second step (behavior preserved):
- squad defines ProgressSink (EmitPhase/Detail/Deliverable/Summary/Briefing)
with its own DetailEvent/ToolEvent types; zero internal/stream imports left
- bizdev assembly maps port to SSE streamer (squad_progress_adapter) and
injects via ctx at the four squad entry points
- process_bridge tests rewritten as port-contract tests (captureSink)
- verified: build+vet clean, squad/bizdev/archtest green
Non-author triggers were denied by dutyAuthorizer because AutoCommitUserID was the triggering user. Record that user on OnBehalfOf and surface the duty mismatch in the task error.
Registration always writes role-guest; a deleted standard role became a masked INTERNAL. Username unique violations are now a 400 instead of an infrastructure 500.
The static adapter catalog still read I2-era states (degraded/shadow) after
the 2026-09-26 dev rollout, so the admin features page showed 降级 for flags
already enabled. Update six entries to live+ready with evidence-dated
reasons (I2/I3/P8 acceptance, P8 per-key gates kept visible, shadow
visibility digest now persisted, REPLACE wildcard wiring, PI narrative dev
rollout); keep FAV red lines untouched. Tests updated; FAV now carries the
configured-value-must-not-imply-readiness assertion.
agent-bot
weichen