DB-backed repo_path_allowlist reader (deny-all until admin seeds), per-prefix admin test_commands (goose 00075), execution evidence table (goose 00074), isolated git-worktree patch executor with command allowlist/time/output caps and failure-stops evidence; controlled_patch creation/preview unlocked only with an allowlisted repo binding (projectworkflow gate + catalog flag); creator-only server endpoints for bindings/executions; merge/push/deploy stay behind a typed separate-authorization boundary. Module boundary: app->swboot composition import registered.
活协作区(.doc/ops)
Agent 会话级协作文档。完整 taxonomy 见 ../README.md。
用法
- 会话开始读 CURRENT.md(含并行认领 + 集成槽位)
- 新任务复制 templates/ 到对应目录
- 结束按 session-close-checklist.md;换人写 handoffs/
状态
- current:进行中 + CURRENT.md
- historical:标
done并移入 ../archive/ops/
SSOT 关系
| 类型 | 路径 |
|---|---|
| 协作焦点 | CURRENT |
| 模块完成度 | FEATURE-MATRIX |
| 发布缺口 | gap-matrix |
| 验收报告 | test-reports |
通用纪律见 AGENTS.md。