Agent guidance previously ranked existing implementation and tests ahead
of documented contracts without distinguishing observed behavior from
intended requirements. The root guidance and bilingual documentation
index now make that distinction and require investigating whether a
disagreement comes from a defect, stale documentation, or an unresolved
requirement. Existing product, delivery, and release constraints remain
intact.
Validation: the scoped local pre-push checks passed, including source
syntax and local Markdown links; the changelog-fragment policy also
passed.
## Development claim / 开发声明
- Domain: `release-control-plane`
- Claim: `engineering-speedup`
- Base commit: `d2040c4922d4b021eedc4cd0eae953537c28d0fb`
- Release preparation: `no`
- Focused validation:
- `python3 script/tests/test_validation_tooling.py`
- `./script/validate_build_scripts_safety.sh --static-only`
<!-- apc-engineering-coordination-v1
{"claim_overlap_rejections":4,"merge_tree_conflicts":0,"schema_version":"apc.engineering-coordination.v1","task_created_at":"2026-09-09T02:21:17Z","train_conflict_resolutions":0}
-->
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
AGENTS.md loaded detailed product and delivery procedures for every
repository task. It now keeps essential repository boundaries and
task-specific links to the owning documents, reducing the file from 15
KB to 5 KB. Missing navigation, placement, sizing, session identity, and
bundled-pet details are preserved in existing contracts; protected
worktrees, credentials, and exact-commit release acceptance remain
explicit.
The documentation review also removes repeated delivery instructions
from CONTRIBUTING, corrects the obsolete direct/train changelog policy
in the fragment README and documentation index, supplies the required
release-preparation/version/date arguments in the consume example, and
distinguishes the V3 two-second per-frame limit from current creation
defaults.
项目 AGENTS.md
精简为关键约束与按任务读取入口；补齐对应产品契约，收拢贡献流程，并修正变更片段、汇总命令与动画时长的旧说明。仅调整项目指令和文档。
Validation:
- Local pre-push gate: source syntax, local Markdown links, and diff
hygiene passed.
- Existing exact-commit Computer Use release-contract test passed.
- Six existing changelog fragment tests and development changelog policy
passed.
- Removed product requirements mapped to existing architecture,
connector, V3, and release documents; command flags and timing defaults
checked against implementation.
The broader review also identified an existing live Studio validator
assertion that requires canceled threads to stay unavailable, whereas
the runtime attempts to unarchive stopped transcripts for viewing. No
live generation was run and no validation script is changed by this
documentation PR.
---------
Co-authored-by: lilei <lilei@xmfunny.com>
Codex repository work now has a versioned `gpt-6-astra` default in
`.codex/config.toml`, preserving the contributor's reasoning effort.
AGENTS.md defines execution, authorization reuse, focused clarification,
communication, and proportionate validation for Astra. The contributor
guide, documentation index, development contract, and both public
READMEs are aligned.
The earlier Studio runtime migration is already on main through #61.
This change documents the separate repository-development and in-App
Studio settings. The Codex environment Run action, plugin manifest, and
Maker/Studio Skills were inspected; they contain no old model selection
requiring migration, and their existing production contracts remain
applicable.
Validation:
- Required local pre-push gate, source/Markdown link checks, TOML
parsing, and changelog policy passed.
- Real Codex App Server `config/read` confirms `gpt-6-astra` now
originates from this project's `.codex` directory, while the existing
`high` reasoning effort still originates from user configuration.
- Reviewed the complete staged diff; no live model turn or pet
generation was run.
References: [Astra migration and prompting
guidance](https://developers.openai.com/api/docs/guides/latest-model?model=gpt-6-astra),
[Codex
configuration](https://learn.chatgpt.com/zh-Hans/docs/config-file/config-reference).
Direct development lane. The coordinating agent owns the user-requested
project configuration, AGENTS.md, and documentation updates; the
registered shared-path approvals cover the Agent/contributor
instructions, documentation, and changelog. No
CI/Release/merge/proof/ruleset implementation changes are included.
<!-- apc-engineering-coordination-v1
{"claim_overlap_rejections":1,"merge_tree_conflicts":0,"schema_version":"apc.engineering-coordination.v1","task_created_at":"2026-09-05T15:54:25Z","train_conflict_resolutions":0}
-->
Co-authored-by: lilei <lilei@xmfunny.com>
AI Pet Maker now uses `gpt-6-astra` when no valid explicit model
override is configured. This applies to both new and resumed Studio
turns. Medium reasoning, native user questions, and
`APC_PET_STUDIO_CODEX_MODEL` keep their current behavior. The owning
runtime documentation and bilingual changelog fragment describe the
default.
The [official GPT-6 Astra migration
guidance](https://developers.openai.com/api/docs/guides/latest-model?model=gpt-6-astra)
supports retaining medium reasoning. Model execution uses the existing
Codex App Server integration.
Validation:
- Required local pre-push gate and changelog policy passed.
- 8 App Server unit tests and 21 App Server transport integration tests
passed.
- The installed ChatGPT-bundled Codex App Server lists `gpt-6-astra`
with medium reasoning and text/image input support.
- Live pet generation was not run.
Development lane: direct to `main`; runtime claim: `maker-generation /
generation-runtime`. The coordinating agent also owns the accompanying
documentation and changelog fragment for this change.
<!-- apc-engineering-coordination-v1
{"claim_overlap_rejections":1,"merge_tree_conflicts":0,"schema_version":"apc.engineering-coordination.v1","task_created_at":"2026-09-05T15:16:49Z","train_conflict_resolutions":0}
-->
Co-authored-by: lilei <lilei@xmfunny.com>
## Summary / 摘要
- Fully revert the production behavior, contracts, documentation, and
frame-preparation changes introduced by PR #58.
- Restore the previous fully opaque flat-chroma source workflow and its
bounded transparency, edge-repair, and QA pipeline for Maker and Studio
production.
- Rewrite the existing unreleased native-Alpha-default changelog
fragment so the eventual release notes contain only the final rollback
state.
- Keep the Codex plugin and both bundled Skills monotonic at version
0.5.8; no native-Alpha-default behavior is retained by that
metadata-only bump.
## Why / 原因
The current built-in imagegen tool exposes only prompt and
reference-image selection fields, not a transparent-background control.
Direct generation can return real Alpha, but controlled reference-image
generation and editing returned opaque PNGs. Native transparency is
therefore not reliable enough to be the product default.
当前内置 imagegen 仅暴露提示词和参考图选择字段，未暴露透明背景控制。直接生图可以返回真实
Alpha，但受控参考图生图与编辑返回了不透明 PNG，因此原生透明能力尚不具备默认投产条件。
## Validation / 验证
- `./script/validate_pre_push.sh`
- `./script/changelog_fragments.py policy --base-ref
5e94852241 --release-preparation false`
- `uv run --with pillow python -m unittest discover -s
skills/agent-pet-maker/tests -p test_*.py` — 88 passed
- `cargo test -p petcore --test integration_b --locked` — 42 passed
- `DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer swift test
--package-path apps/macos --filter PortableMakerSkillManagementTests` —
5 passed
- Behavioral tree comparison matches PR #58 parent
`2844e0803734247f16d3667711479856249d13ae`; only monotonic 0.5.8
metadata, its matching Swift expectations, and the corrected retained
changelog fragment differ.
## Development claim / 开发声明
- Domain: `maker-generation`
- Claim: `maker-skills`
- Base commit: `5e9485224140e5f30ced42d598eba87b4f8b26e6`
- Release preparation: `no`
- Scope note: direct hotfix that atomically reverts the cross-contract
PR #58 delivery.
- Focused validation:
- `cargo test -p petcore --test integration_b --locked`
- `./script/validate_pet_skills.sh`
<!-- apc-engineering-coordination-v1
{"claim_overlap_rejections":3,"merge_tree_conflicts":0,"schema_version":"apc.engineering-coordination.v1","task_created_at":"2026-09-01T15:10:18Z","train_conflict_resolutions":0}
-->
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Summary / 摘要
- Make ChatGPT/Codex built-in `imagegen` the default image path for low
and standard pet creation, requesting genuine transparent PNG source
art.
- Add version 2 `native_alpha` frame jobs that preserve authored Alpha
and visible RGBA, clear only hidden RGB under Alpha 0, keep
source-resolution masters, and perform at most one premultiplied
linear-light downscale.
- Retain version 1 readability and an explicit version 2 `chroma_key`
compatibility path for opaque-only providers; native failures never
silently fall back to chroma.
- Synchronize Studio prompts, Maker/Studio skills, V3 contracts,
architecture/public docs, plugin version 0.5.7, and the unreleased
changelog fragment.
## Validation / 验证
- `./script/validate_pre_push.sh`
- 103 Python pet-production and Skill contract tests
- 42 PetCore `integration_b` tests
- Focused PetCore external-helper prompt contract test
- 5 Portable Maker Skill Swift tests
- Plugin version and changelog policy validators
## Development claim / 开发声明
- Domain: `maker-generation`
- Claim: `maker-skills`
- Base commit: `2844e0803734247f16d3667711479856249d13ae`
- Release preparation: `no`
- Scope note: this is one atomic cross-contract delivery spanning the
Maker skills, Studio generation prompt, durable contracts, public
documentation, and their synchronized version tests.
- Focused validation:
- `cargo test -p petcore --test integration_b --locked`
- `./script/validate_pet_skills.sh`
<!-- apc-engineering-coordination-v1
{"claim_overlap_rejections":2,"merge_tree_conflicts":0,"schema_version":"apc.engineering-coordination.v1","task_created_at":"2026-09-01T02:45:18Z","train_conflict_resolutions":0}
-->
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Summary
- DSH final `assistant/message` now projects immediately at the message
boundary instead of waiting for `turn/end`: visible `text` blocks become
bounded Agent body copy, explicit string `reasoning` blocks become
bounded thinking body copy, and a message carrying both lets the visible
text win the same-sequence selection. The edge is display-only
(`affects_activity=false`), so it never restarts a thinking animation or
pulls an in-progress tool state back to start/thinking.
- A text-less final step clears the cached assistant text so a terminal
edge cannot resurrect stale body copy over newer thinking.
- `user/message` now reads the real rc.7 direct payload shape
(`event.data` is the `UserMessage`); a bounded historical nested `{
message }` fallback is retained, and only `source.kind === 'user'`
counts as user context.
- `todo/write` projects exactly one closed, bounded plan line (first
`in_progress`, else first `pending`, else last `completed`); the whole
list is never serialized.
- Streaming deltas remain dropped locally; tool args/results, usage,
credentials, and full host objects never cross the contract.
- DSH connector contract bumped to `dsh-v0.1.0-rc.7-events-v3` across
plugin template, Rust constant, fixtures, and validations (host version
is diagnostic context only, not a compat gate).
- Current-state `docs/integrations/agent-connectors.md` updated;
changelog fragment added under `changes/unreleased/`.
## Verification
- `node --test plugins/connector-privacy.test.mjs` — real-shape rc.7
fixtures, immediate assistant/message delivery, reasoning/text
precedence, stale-cache clearing, todo selection, non-user source
suppression: pass
- `cargo test -p petcore --lib dsh_adapter_tests` — 5 pass
- `cargo test -p petcore --test integration_d --locked` — 164 pass,
including the new real-chain regression
`dsh_real_chain_keeps_latest_agent_and_thinking_body_across_tool_activity`
(raw envelopes through `parse_dsh` → `agent.ingest` → bubble projection)
- `./script/validate_connectors_runtime.sh`,
`./script/validate_security_boundaries.sh` — pass
- `./script/validate_pre_push.sh` — pass; `cargo clippy` clean
- UI acceptance not claimed: no live macOS bubble observation was made
in this task; structural/automated proof only.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
## Development claim / 开发声明
- Domain: `agent-connections`
- Claim: `dsh-connector`
- Base commit: `836419bb616e7ad03b8545e005274683d8785335`
- Release preparation: `no`
- Focused validation:
- `cargo test -p petcore --test integration_d --locked`
- `./script/validate_connectors_runtime.sh`
<!-- apc-engineering-coordination-v1
{"claim_overlap_rejections":1,"merge_tree_conflicts":0,"schema_version":"apc.engineering-coordination.v1","task_created_at":"2026-08-19T05:53:48Z","train_conflict_resolutions":0}
-->
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary
- retain the Claude `background_active` projection when a delayed
`idle_prompt` arrives while background work is unresolved
- keep the idle event in bounded audit history and allow later same-turn
background activity
- preserve ordinary Claude idle completion, explicit terminal edges, and
every other Agent mapping
## Validation
- `cargo test -p petcore --locked`
- `./script/validate_connectors_runtime.sh`
- `./script/validate_pre_push.sh --base origin/main`
- `./script/changelog_fragments.py policy --base-ref origin/main
--release-preparation false`
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Summary
- render each GitHub Release body from the exact version section in
`CHANGELOG.md`
- place categorized bilingual version changes before a concise bilingual
installation and first-open note
- remove internal changelog fragment markers from public notes and
verify the published body exactly matches the generated file
- update release contracts, validation ownership, documentation, and
regression tests
## Root cause
The Release workflow assembled one fixed three-step installation
template and never consumed the version-specific changelog section, so
every Release body omitted its actual changes.
## Validation
- `./script/validate_pre_push.sh`
- `./script/validate_build_scripts_safety.sh --static-only`
- `python3 script/tests/test_validation_tooling.py` (58 passed)
- `python3 script/tests/test_release_distribution_contracts.py` (44
passed)
- generated and inspected the complete `0.4.5` preview
This PR changes the Release control plane and therefore requires a
trusted manual squash merge after CI.
## Development claim / 开发声明
- Domain: `release-control-plane`
- Claim: `control-plane`
- Base commit: `80f7912026e531c22a50de82036705e19b03669a`
- Release preparation: `no`
- Focused validation:
- `python3 script/tests/test_validation_tooling.py`
- `./script/validate_build_scripts_safety.sh --static-only`
<!-- apc-engineering-coordination-v1
{"claim_overlap_rejections":2,"merge_tree_conflicts":0,"schema_version":"apc.engineering-coordination.v1","task_created_at":"2026-08-17T07:11:03Z","train_conflict_resolutions":0}
-->
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Summary / 摘要
- Make one coordinator the sole owner of Control Center presentation,
activation, exact-window registration, and key-window state across cold
launch, reopen, menu, overlay, and update paths.
- Remove the startup alpha/input gate; appearance hydration now applies
only `NSAppearance` while the window stays visible and interactive.
- Keep overlay panels passive by default and grant the session bubble
keyboard focus only through an explicit, revocable lease.
- Add bounded lifecycle diagnostics and a fail-closed cold-launch
release gate that rebuilds the exact worktree App and proves singleton
identity, layer, alpha, nonblank pixels, overlay ordering, and retained
focus.
- Replace every retention-sensitive fixed Rust event timestamp with one
current UTC fixture base plus relative offsets; the audit removed 25
calendar-dependent timestamps, including the failing 2026-07-17 cases,
imminent 2026-07-20 cases, and 2099 escape fixtures.
- Add a CI-enforced Rust source validator that follows same-file fixture
helpers, rejects fixed RFC 3339 timestamps crossing real event-retention
APIs, and permits isolated deterministic schema/serialization/migration
samples.
## Validation / 验证
- `cargo test --workspace --locked` — complete Rust workspace passed
(petcore unit 279; integration A/B/C/D 96/40/66/160; CLI and type suites
passed).
- `cargo clippy -p petcore --all-targets --locked -- -D warnings`
passed.
- `python3 script/validate_time_independent_tests.py --root .` passed;
running the same validator against the unfixed main tree reports all 25
risky timestamps.
- `python3 script/tests/test_validation_tooling.py` — 56 tests passed.
- `./script/validate_swift_tests.sh --scope all` — 749 tests passed.
- `./script/validate_app_lifecycle_contract.sh` — 16/16 passed.
- `APC_VALIDATE_HOST_UI=1 APC_MAIN_UI_COLD_LAUNCH_ITERATIONS=20
./script/validate_main_window_ui.sh` — 20/20 cold launches passed.
- Computer Use acceptance — five destinations, three bundled pets,
action preview, pet hide/show, Control Center close/reopen, and two
consecutive quit/relaunch cycles passed.
- `./script/validate_pre_push.sh` passed after the Rust and source-gate
update.
- `./script/validate_test_isolation.sh` and
`./script/validate_build_scripts_safety.sh --static-only` passed.
This PR updates the release-control-plane inventory, so it must complete
PR CI and then receive a trusted manual squash merge.
## Development claim / 开发声明
- Domain: `release-control-plane`
- Claim: `control-plane`
- Base commit: `e216a4fd13af88902cf2bd77d23939fe606c9383`
- Release preparation: `no`
- Focused validation:
- `python3 script/tests/test_validation_tooling.py`
- `./script/validate_build_scripts_safety.sh --static-only`
<!-- apc-engineering-coordination-v1
{"claim_overlap_rejections":1,"merge_tree_conflicts":0,"schema_version":"apc.engineering-coordination.v1","task_created_at":"2026-08-16T12:09:52Z","train_conflict_resolutions":0}
-->
---------
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Development lane / 开发通道
- Lane / 通道: `direct-to-main` (`release-preparation`)
- Base branch / 目标分支: `main`
- Active train / 所属 train: `n/a`
- Owning Agent/session / 写入负责人: primary release coordinator
## Scope and dependencies / 范围与依赖
- Owned paths / 独占修改路径: release control-plane claim
- Shared files and coordinator / 共享文件及协调者: `AppStore.swift`,
`ControlCenterShellTests.swift`, `docs/architecture/overview.md`,
`CHANGELOG.md`, and `changes/unreleased/**`; coordinated by the release
owner
- Depends on / 依赖 PR: none
- Blocks / 阻塞 PR: GitHub Release `v0.4.5`
## Change / 改动
- Preserve the Control Center as the key window after the desktop-pet
panels are first presented during cold launch.
- Restore focus only when the Control Center was already key and remains
open and visible while the App is still active, so switching to another
App is never overridden.
- Add the regression policy test and update the current architecture
contract.
- Consume the hotfix fragment into the already-prepared but unpublished
`0.4.5` changelog section.
## Validation / 验证
- Local fast gate: `./script/validate_pre_push.sh` passed on the
release-preparation head.
- Focused checks: `./script/validate_swift_tests.sh --scope all` — 749
tests passed; `./script/validate_app_lifecycle_contract.sh` — 12/12
passed; changelog validation, consumption, and release-preparation
policy passed.
- Environment-dependent gates skipped: authoritative GitHub CI and final
exact-`main` full UI acceptance run after merge.
- Visible UI evidence, when applicable: two independent cold launches of
the exact hotfix code were observed with Computer Use; both opened
directly to the usable standard Control Center window with all five
navigation entries, without invoking the reopen shortcut.
## Risk / 风险
- Privacy/security: no new data collection, credentials, or external
channels.
- Migration/compatibility: no schema or persisted-data migration.
- Performance/accessibility: one bounded main-queue focus restoration
after initial overlay ordering; explicit session-bubble keyboard focus
remains unchanged.
- Release/version impact: amends the unpublished `v0.4.5` release
candidate; no version-number change.
## Development claim / 开发声明
- Domain: `release-control-plane`
- Claim: `control-plane`
- Base commit: `e7d793b69d73c92830cd1c706afc394b2ae229ca`
- Release preparation: `yes`
- Focused validation:
- `python3 script/tests/test_validation_tooling.py`
- `./script/validate_build_scripts_safety.sh --static-only`
<!-- apc-engineering-coordination-v1
{"claim_overlap_rejections":0,"merge_tree_conflicts":0,"schema_version":"apc.engineering-coordination.v1","task_created_at":"2026-08-15T18:31:12Z","train_conflict_resolutions":0}
-->
---------
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
Land the B0/M0-M5/E0-E4/P0-P3 engineering-speedup control plane, including exact Swift caching, measured engineering metrics, canonical Rust identity validation, deterministic test isolation, proof fallback/promotion, and supporting architecture splits.\n\nRelease validation and dispatch are intentionally deferred to the next release.
## Summary
- move initial appearance reveal ownership from transient SwiftUI hosts
to one NSWindow coordinator
- fail open when the final gate host disappears and keep the desktop pet
visible during appearance hydration
- add host-replacement regressions, on-screen window validation, and
bump App/PetCore to 0.4.2
## Root cause
The 0.4.1 deferred reveal callback was owned by a short-lived
representable host. SwiftUI could replace or dismantle that host before
the next main-queue turn, leaving the actual control-center NSWindow at
alpha 0 and non-interactive. A duplicate host could also record that
concealed state as its restoration baseline.
## Validation
- ./script/validate_swift_tests.sh --scope all: 738 tests passed
- ./script/validate_pre_push.sh: passed
- APC_VALIDATE_HOST_UI=1 ./script/validate_main_window_ui.sh: passed
- Computer Use: all five destinations, three bundled pets/action
preview, pet hide/show, close/reopen passed
- Computer Use: two consecutive full quit/relaunch cold starts produced
new App processes and a visible usable control center each time
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Summary
- defer the initial Control Center reveal until SwiftUI finishes the
current render pass
- avoid synchronous AppKit layout/display calls from updateNSView
- add a regression test and bilingual changelog entry
- require exact-commit local Computer Use acceptance before every GitHub
Release
- block tag creation and archive builds when live UI acceptance failed,
is missing, or targets another commit
## Root cause
The initial appearance gate called layoutSubtreeIfNeeded() and
displayIfNeeded() while SwiftUI was rendering its NSHostingView. macOS
reported a reentrant layout fault and skipped the content render,
leaving the installed 0.4.0 Control Center visually blank even though
its accessibility tree was present.
The previous Release path could miss this because packaged UI validation
deliberately ran without a real main window and live Computer Use
verification was optional.
## Impact
The installed macOS App now presents onboarding or Control Center
content normally on launch while still suppressing the pre-theme
title-bar flash.
Release publication is now explicit-dispatch only. Before dispatch, the
exact clean main commit must pass the documented local Computer Use
checklist: visible nonblank launch, all five destinations, bundled pets
and preview, desktop-pet hide/show, window reopen, and quit/relaunch.
The workflow requires the same full commit in host_ui_tested_commit and
host_ui_result=passed before it can create a tag or build archives.
Failed or unobservable checks stop publication and leave the next action
to the user.
## Validation
- ./script/validate_swift_tests.sh --scope all — 735 tests passed
- ./script/build_and_run.sh --run — bundle built, signed, launched, and
synchronized with PetCore; 124 overlay/interaction checks passed
- Computer Use visual verification — first-run onboarding and all three
bundled pet cards rendered correctly
- unified log verification — the fixed build no longer emitted the
NSHostingView reentrant-layout fault
- python3 -m unittest script.tests.test_release_distribution_contracts —
44 tests passed
- ./script/validate_build_scripts_safety.sh — passed
- actionlint .github/workflows/release.yml — passed
---------
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Summary
- Treat the Pulls list response as closed-PR discovery only.
- Resolve merged state, exact base/head identity, and merge commit from
the authoritative single-PR API before replay.
- Document the recovery trust boundary and include it in the 0.4.0
changelog.
## Root cause
PR #12 merged successfully, but GitHub temporarily returned
merge_commit_sha as null in the Pulls list response while the single-PR
endpoint already returned the correct merge identity. The replay filter
therefore could not locate the merged PR to recover exact-main dispatch.
## Validation
- Red/green closed replay regression test
- 53 Release and CI proof tests
- actionlint .github/workflows/auto-merge.yml
- static build and Release safety contracts
- ./script/validate_pre_push.sh
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## What changed
- add App and PetCore portable Agent Pet Maker skill management, with
fd-relative ownership and race-safe install/uninstall
- improve Pi no-model failure projection, session bubble message
selection, child-session filtering, onboarding rendering, and related
App behavior
- delete verified PR source branches with exact leases after merge while
dispatching exact-main CI first
- document direct/train multi-agent delivery, explicit
add/commit/clean/push checks, post-merge worktree audits, and exact-SHA
release proof
## Validation
- full `cargo test -p petcore`
- Swift package suite: 734 tests
- Pi connector privacy tests
- promotion/release Python tests and actionlint
- `./script/validate_pre_push.sh`
- independent specification and safety reviews: no remaining blockers
This PR changes the protected CI control plane, so it is intended for
full CI followed by trusted exact-head squash merge.
---------
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Summary
- emit one run/attempt-scoped completion artifact per Rust test shard
- require the exact five-shard marker set before candidate proof, main
source proof, or Required CI can succeed
- document full-workflow rerun recovery and cover missing, extra, and
malformed marker cases
## Evidence
- real run 31501024780 completed successfully while the Jobs API
retained integration-a as queued
- 85 Python workflow/tooling tests
- build/release static safety suites (31 + 8 + 4)
- actionlint for CI, auto-merge, and Release workflows
- Release shell contracts and git diff check
This changes the CI control plane, so the trusted merger must
intentionally refuse privileged auto-merge; merge only through the
documented trusted manual squash path after Required CI succeeds.
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Summary
- emit a bounded candidate proof after complete direct or final train PR
CI
- promote that proof to an identical squash-merged `main` tree and issue
a main-bound Release source proof without repeating Rust, Swift,
integration, stress, overlay, or App assembly jobs
- fail closed to complete main CI for missing/ambiguous evidence,
changed parents or tree, expired artifacts, API inconsistency, or
CI/Release proof-control changes
- keep task → train PRs path-scoped with no post-merge train CI or
Release candidate
This rollout changes the proof control plane, so its first merge
intentionally takes the complete main-CI fallback. Later ordinary
direct/train merges can use the fast promotion path.
## Validation
- `actionlint .github/workflows/ci.yml .github/workflows/release.yml
.github/workflows/auto-merge.yml`
- 75 focused Python and Release contract tests
- `script/tests/test_release_shell_contracts.sh`
- `./script/validate_source_syntax.sh`
- `./script/validate_build_scripts_safety.sh --skip-source-syntax
--static-only`
- live read-only selector check against Actions run `31490206146`,
including its empty `pull_requests` API payload
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Development lane / 开发通道
- Lane: `direct-to-main` bootstrap
- Base branch: `main`
- Active train: `n/a`
- Owning Agent/session: workflow coordinator
## Change / 改动
- Split authoritative CI into parallel static, contract, Rust lint/test
shards, Swift interaction, stress, overlay, bundle, and stable `Required
CI` jobs.
- Make every ready PR to `main` a complete gate while keeping task PRs
to `gd-ops/train/*` path-scoped.
- Add direct/train worktree coordination, bounded changelog fragments,
protected main/train ruleset automation, and safe same-repository squash
auto-merge.
- Let GitHub Release promote an exact successful main commit, reuse its
source proof, and create a missing release tag only after proof
validation.
- Keep local pre-push validation bounded to basic syntax, formatting,
contracts, and compilation; complete duplicate proof stays in GitHub CI.
This is the one bootstrap PR: the auto-merge workflow and required rules
do not exist on the base branch yet. After this PR passes and is merged
once, the exact `main` push must pass `Required CI`; then the
fail-closed applicator can activate both rulesets and all later ready
`gd-ops/*` PRs follow the automated path.
## Validation / 验证
- `actionlint .github/workflows/ci.yml .github/workflows/release.yml
.github/workflows/auto-merge.yml`
- `./script/validate_source_syntax.sh`
- `./script/validate_build_scripts_safety.sh --skip-source-syntax`
- Exact staged diff was reapplied to a clean detached worktree before
the final validation run.
- 28 validation-tooling tests, 40 release-distribution tests, macOS
build-contract tests, Release shell contracts, and test-isolation
validation passed.
## Risk / 风险
- No product runtime or credential access is added.
- `pull_request_target` never checks out or executes PR code and only
enables auto-merge after API verification of active PR and `Required CI`
rules.
- Full ruleset activation fails closed until the exact remote main
commit has a trusted successful GitHub Actions push run.
- Reversible repository settings are already enabled: auto-merge,
squash-only, update branch, and delete merged branches.
---------
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
