From 670622554482a161de911d1e9ba79b8307426f0b Mon Sep 17 00:00:00 2001
From: agent-exec-transport <agent-exec-transport@localhost.invalid>
Date: Sat, 17 Oct 2026 08:43:27 +0000
Subject: [PATCH] agent-exec transport
 8bc2c2e6dfb442518564682a3f3aee9b/eeb4bdaf4d3d

---
 .gitea/workflows/ci.yml       | 26 ++++++++++++++++++++++++--
 policy/guidelines-adoption.md |  2 +-
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index a084d4c..6ebd9c9 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -8,7 +8,18 @@ jobs:
   vet-and-test:
     runs-on: nightly
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          # 自包含检出（runner 无法访问 github.com 上的 actions/checkout）：固定 SHA 浅取回，凭据只以 URL 限定的 extraheader 存在于单个 git 进程。
+          case "$GITHUB_SHA" in *[!0-9a-fA-F]*|"") echo "Checkout requires a fixed commit SHA" >&2; exit 1;; esac
+          url="${GITHUB_SERVER_URL%/}/${GITHUB_REPOSITORY}.git"
+          git init -q .
+          git -c "http.${url}.extraheader=AUTHORIZATION: token ${TOKEN}" -c credential.helper= -c core.hooksPath=/dev/null fetch -q --depth=1 "$url" "$GITHUB_SHA"
+          git checkout -q --detach FETCH_HEAD
+          unset TOKEN
       - run: go vet ./... && go test -count=1 ./...
   docker-checkout-hostgateway:
     runs-on: ubuntu-latest
@@ -16,5 +27,16 @@ jobs:
     env:
       GITHUB_SERVER_URL: http://gitea:3000
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          # 自包含检出（runner 无法访问 github.com 上的 actions/checkout）：固定 SHA 浅取回，凭据只以 URL 限定的 extraheader 存在于单个 git 进程。
+          case "$GITHUB_SHA" in *[!0-9a-fA-F]*|"") echo "Checkout requires a fixed commit SHA" >&2; exit 1;; esac
+          url="${GITHUB_SERVER_URL%/}/${GITHUB_REPOSITORY}.git"
+          git init -q .
+          git -c "http.${url}.extraheader=AUTHORIZATION: token ${TOKEN}" -c credential.helper= -c core.hooksPath=/dev/null fetch -q --depth=1 "$url" "$GITHUB_SHA"
+          git checkout -q --detach FETCH_HEAD
+          unset TOKEN
       - run: test -f go.mod && echo "docker-mode checkout via host-gateway OK"
diff --git a/policy/guidelines-adoption.md b/policy/guidelines-adoption.md
index 33633a0..40c6487 100644
--- a/policy/guidelines-adoption.md
+++ b/policy/guidelines-adoption.md
@@ -7,7 +7,7 @@
 - 过程文档位置：`.task/`（任务卡与交付流程证据，随 PR 维护）；`docs/records/`（其他过程记录，项目内固定目录豁免，方案与验证记录）；任务主记录在 Gitea PR
 - 版本权威：本仓 gitlink `deps/development-guidelines` @ `2688fd2be6a5`（完整 SHA `2688fd2be6a52c0bf110e7e6366b6f291ab5e4eb`，内容版本 `0.1.0-draft.12`）；无可读发布标签；治理工具 gitlink `deps/development-manager` @ `bd3a7de57a3a`（完整 SHA `bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c`）
 - 批准/生效依据：`feature/governance-adoption PR（Logging-System）`；合入前须在 `.task/feature-governance-adoption.md` 记录正负例、Review 与 CI 结果
-- 替代范围和迁移说明：本次把 Guidelines gitlink 从 `26b562d2e34f`（`0.1.0-draft.6`）升级到 `2688fd2be6a5`，并接入共享治理套件（`scripts/dm`、`scripts/agent-exec`、`scripts/task`、`scripts/hooks/pre-commit`、`.gitea/workflows/governance.yml`）。无旧 Agent 执行器需要替代。
+- 替代范围和迁移说明：本次把 Guidelines gitlink 从 `26b562d2e34f`（`0.1.0-draft.6`）升级到 `2688fd2be6a5`，并接入共享治理套件（`scripts/dm`、`scripts/agent-exec`、`scripts/task`、`scripts/hooks/pre-commit`、`.gitea/workflows/governance.yml`）。无旧 Agent 执行器需要替代。`.gitea/workflows/ci.yml` 两个 job 原有的 `uses: actions/checkout@v4` 步骤已替换为自包含内联检出，因为 runner 无法访问 github.com；run 步骤未改变。
 
 | 规范/工作流 | 适用条件与范围 | 采纳或不适用理由 | 执行方式/证据 |
 |---|---|---|---|