weichen/Agent-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

U10c 首切片：实例身份标记/单启锁/可写根校验 + systemd 模板 #15

Merged
weichen merged 1 commits from feature/u10c-instance-bootstrap-2026-09-29 into dev 2026-09-29 08:37:26 +00:00
Conversation 1 Commits 1 Files Changed 7
+296 -1
agent-bot commented 2026-09-29 08:32:16 +00:00
Collaborator
Copy Link
Copy Source
  • EnsureInstance（serve 路径）：目录归一化+symlink 复核、vault/data 包含式重叠拒绝、根目录拒绝
  • instance-marker.json：异实例拒绝（须显式收养）；instance.lock flock 误重复启动检测（零治理工具依赖）
  • Config.InstanceID（default 兜底）入 instance-settings 引导禁改清单
  • 认证为 Bearer+localStorage（按 origin 隔离，无 cookie）——跨端口天然隔离，结论入 systemd 模板注释
  • agent-system@.service 实例单元模板（%i 参数化 env/data、加固）
  • 6 项单测含进程内双启动检测
- EnsureInstance（serve 路径）：目录归一化+symlink 复核、vault/data 包含式重叠拒绝、根目录拒绝 - instance-marker.json：异实例拒绝（须显式收养）；instance.lock flock 误重复启动检测（零治理工具依赖） - Config.InstanceID（default 兜底）入 instance-settings 引导禁改清单 - 认证为 Bearer+localStorage（按 origin 隔离，无 cookie）——跨端口天然隔离，结论入 systemd 模板注释 - agent-system@.service 实例单元模板（%i 参数化 env/data、加固） - 6 项单测含进程内双启动检测
agent-bot added 1 commit 2026-09-29 08:32:16 +00:00
feat(bootstrap): instance identity, single-start lock, root checks (U10c slice 1)
CI / backup-restore-drill (pull_request) Successful in 27s
Details
CI / web (pull_request) Successful in 32s
Details
CI / go-vet (pull_request) Successful in 14s
Details
CI / short-tests-report (pull_request) Failing after 36s
Details
2ad1ef393a 
- internal/bootstrap.EnsureInstance on the serve path: normalized writable
  roots, symlink-aware validation, data-root vs vault containment rejection,
  filesystem-root refusal
- instance-marker.json in data root: first boot creates; foreign instance
  ID fails closed (explicit adopt/migrate required, KTD18)
- instance.lock non-blocking flock detects duplicate starts locally without
  any governance tooling; ownership held until process exit
- Config.InstanceID (INSTANCE_ID env/file key; default 'default') joins the
  instance-settings bootstrap denylist (identity cannot be self-overwritten)
- auth is Bearer+localStorage per origin (no cookies) - browser isolation
  holds across ports; documented in the unit template
- deploy/systemd/agent-system@.service template (instance %i: env file,
  DATA_DIR, hardened service scope)
- tests: marker create/foreign reject, vault overlap, invalid IDs, root
  refusal, in-process duplicate-start detection
weichen approved these changes 2026-09-29 08:37:26 +00:00
weichen left a comment
Owner
Copy Link
Copy Source

实例引导批准：6 单测全过。

实例引导批准：6 单测全过。
weichen merged commit 5d96114777 into dev 2026-09-29 08:37:26 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
weichen
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
agent-bot weichen
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: weichen/Agent-System#15