fix: prod triage 2026-07-08 — MCP auth residue, gateway envelopes, verb-loop cap, A2A interjection, manual spawn UX (#334)

* fix(auth): pass agent UUID to CLI-arg MCP servers (optimal/docs/search)

The container token is HMAC-signed over the agent UUID (#314), but the
optimal/docs/search MCP servers received the slug as their CLI arg and
sent X-Agent-ID=<slug>, so every research/RAG/docs call 401ed with
signature mismatch under enforced auth. Pass the already-computed
agent_uuid in the three args lists instead.

* fix(gateway): include remediate in gateway.rejected audit details

Conventions-gate rejections carry the offending file:line listing only
in the envelope's remediate field, which the audit row dropped -- ops
logs showed just the violation count with no way to see what blocked.

* fix(gateway): return envelope on do/commit git failure

A GitError from the commit verb propagated to the generic middleware
handler, so agents got a raw error blob with no remediate/next. Catch
it and return an error envelope; 'no changes added to commit' with an
explicit files list now names the mismatch and the omit-files fallback.

* fix(agent-sdk): absolute rejection cap breaks slow-drip verb loops

The verb circuit breaker only counted rejections inside a 60s sliding
window, so an agent retrying i_am_done every 3-4 minutes looped for 30+
minutes without tripping it. Add a session-scoped cumulative per-(verb,
task) cap at 3x the windowed limit that trips regardless of pacing.

* feat(a2a): CEO chime-in interjects into the viewed conversation

Previously reply_as_ceo re-homed the message into a canonical CEO<->target
conversation with no panel surface, so a chime-in reported success but was
invisible and only opportunistically delivered. interject_as_ceo now inserts
the message into the conversation being viewed (from_agent=ceo, directed via
an @target content prefix), bumps that conversation's counters with the
unread ping keyed to the addressed participant, and both participants see it
in transcript and read_a2a.

* feat(panel): manual spawn carries task + message, surfaces refusals

The agent detail page spawned with no request body (task/message impossible),
the spawn button could double-fire (2.5ms double-POST seen live), and refusal
reasons never reached the UI: readiness refusals were generic 500s and the
already-running no-op looked like success. Detail page now uses
SpawnAgentDialog, a synchronous ref guard blocks re-entry, AgentReadinessError
maps to 409 with its reason shown, already_running is signalled and toasted,
and a task_id builds a task-aware prompt instructing the claim (task_id alone
never did), with the CEO's message appended as a note.

* test(panel): align a2a page test with the interjection footer copy

The chime-in rebuild changed the composer footer; the page-level test
asserting the old copy was outside the rebuild's scoped vitest run.

* fix(api): commit the request DB session before the response is sent

FastAPI unwinds yield-dependencies after the response bytes go out, so
get_db's post-yield commit raced the client's next request -- a verb
could return ok while its claim/status write was still uncommitted (the
e2e ok-without-effect flake family), and a failed commit was silently
lost behind an already-sent 200. DbCommitMiddleware (innermost, pure
ASGI) commits the session stashed by get_db_committed before forwarding
http.response.start; commit failure now surfaces as a 5xx. get_db is
untouched for its direct non-request callers.

* fix(db): invalidate, not rollback, the session on request cancellation

With the commit moved into the send path, the flow-verb timeout can
cancel mid-commit; rolling back then issues another command over an
asyncpg connection stranded mid-wire-protocol, and the poisoned
connection segfaults uvloop/asyncpg when a later checkout recycles it
(3/3 identical CI faulthandler dumps). On CancelledError discard the
connection via session.invalidate() -- SQLAlchemy's documented handling
for a timeout during commit -- and keep rollback for plain exceptions.

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/unit/agent_sdk/test_verb_circuit_breaker.py

@@ -20,7 +20,11 @@ from unittest.mock import patch
 import pytest
 import roboco.agent_sdk.server as srv
 from fastapi.testclient import TestClient
-from roboco.foundation.policy.agent_loop import VERB_RETRY_LIMITS, retry_limit_for
+from roboco.foundation.policy.agent_loop import (
+    VERB_RETRY_LIMITS,
+    absolute_retry_limit_for,
+    retry_limit_for,
+)
 from roboco.services.gateway.envelope import Envelope
 
 if TYPE_CHECKING:
@@ -428,3 +432,168 @@ def test_qa_handoff_retry_keys_match_mcp_verb_names() -> None:
     assert "fail" in VERB_RETRY_LIMITS
     assert retry_limit_for("pass") == VERB_RETRY_LIMITS["pass"]
     assert retry_limit_for("fail") == VERB_RETRY_LIMITS["fail"]
+
+
+# ---------------------------------------------------------------------------
+# ABSOLUTE (session-scoped, never-pruned) breaker — the slow-drip fix
+#
+# Production, 2026-07-08: an agent's i_am_done was rejected once every 3-4
+# minutes for 30+ minutes. Each rejection arrived alone in an empty 60s
+# window, so `_check_verb_circuit` never saw more than 1 attempt at a time
+# and never tripped. `_verb_absolute_attempts` counts cumulatively across
+# the whole container session (never pruned) so pacing can't defeat it.
+# ---------------------------------------------------------------------------
+
+_I_AM_DONE_ABSOLUTE_CAP = 9  # VERB_RETRY_LIMITS["i_am_done"] * multiplier(3)
+
+
+def test_i_am_done_absolute_cap_matches_foundation() -> None:
+    """Pin the effective absolute cap so a foundation change is caught here too."""
+    assert absolute_retry_limit_for("i_am_done") == _I_AM_DONE_ABSOLUTE_CAP
+
+
+def test_absolute_tracker_keys_per_verb_task_pair() -> None:
+    """Different tasks accumulate independent absolute counts."""
+    a_count = 5
+    b_count = 2
+    for _ in range(a_count):
+        srv._record_verb_attempt_absolute("i_am_done", "task-A")
+    for _ in range(b_count):
+        srv._record_verb_attempt_absolute("i_am_done", "task-B")
+
+    assert srv._verb_absolute_attempt_count("i_am_done", "task-A") == a_count
+    assert srv._verb_absolute_attempt_count("i_am_done", "task-B") == b_count
+
+
+def test_absolute_tracker_keys_per_verb_independent_of_task() -> None:
+    """Different verbs on the same task don't share the cumulative counter."""
+    done_count = 4
+    submit_count = 1
+    for _ in range(done_count):
+        srv._record_verb_attempt_absolute("i_am_done", "task-A")
+    for _ in range(submit_count):
+        srv._record_verb_attempt_absolute("submit_up", "task-A")
+
+    assert srv._verb_absolute_attempt_count("i_am_done", "task-A") == done_count
+    assert srv._verb_absolute_attempt_count("submit_up", "task-A") == submit_count
+
+
+def test_absolute_counter_never_prunes_with_time() -> None:
+    """Unlike the windowed deque, a huge time jump does not reset the count."""
+    base = 1000.0
+    expected = 2
+    with patch("roboco.agent_sdk.server.time.monotonic") as mock_time:
+        mock_time.return_value = base
+        srv._record_verb_attempt_absolute("i_am_done", "task-A")
+        mock_time.return_value = base + 10_000.0  # far past any sliding window
+        srv._record_verb_attempt_absolute("i_am_done", "task-A")
+    assert srv._verb_absolute_attempt_count("i_am_done", "task-A") == expected
+
+
+def test_slow_drip_never_trips_window_but_trips_absolute_cap() -> None:
+    """Rejections spaced > 60s apart never trip `_check_verb_circuit`, but
+    the absolute cap still trips once the cumulative count reaches it —
+    the exact production scenario this breaker was added to close.
+    """
+    cap = absolute_retry_limit_for("i_am_done")
+    assert cap is not None
+    base = 1000.0
+    with patch("roboco.agent_sdk.server.time.monotonic") as mock_time:
+        for i in range(cap):
+            mock_time.return_value = base + i * 200.0  # always > 60s apart
+            srv._record_verb_attempt("i_am_done", "task-A")
+            srv._record_verb_attempt_absolute("i_am_done", "task-A")
+            # The sliding window is always empty when this attempt lands.
+            assert srv._check_verb_circuit("i_am_done", "task-A") is None
+
+        result = srv._check_verb_absolute_circuit("i_am_done", "task-A")
+    assert result is not None
+    assert result["error"] == "circuit_open"
+    assert "absolute cap" in result["message"]
+    assert "i_am_blocked" in result["remediate"]
+
+
+def test_absolute_check_returns_none_below_cap() -> None:
+    """One rejection short of the cap, the absolute breaker stays closed."""
+    cap = absolute_retry_limit_for("i_am_done")
+    assert cap is not None
+    for _ in range(cap - 1):
+        srv._record_verb_attempt_absolute("i_am_done", "task-A")
+    assert srv._check_verb_absolute_circuit("i_am_done", "task-A") is None
+
+
+def test_absolute_check_returns_none_for_unlimited_retry_verbs() -> None:
+    """give_me_work stays exempt from the absolute cap too."""
+    assert absolute_retry_limit_for("give_me_work") is None
+    for _ in range(50):
+        srv._record_verb_attempt_absolute("give_me_work", None)
+    assert srv._check_verb_absolute_circuit("give_me_work", None) is None
+
+
+def test_combined_check_still_trips_fast_storm_via_window() -> None:
+    """Windowed behavior is unchanged: 3 fast rejections (the existing
+    i_am_done cap) still trip via the combined check, well below the
+    absolute cap of 9 — and the message reads as a windowed trip, not a
+    session one.
+    """
+    limit = retry_limit_for("i_am_done")
+    assert limit is not None
+    for _ in range(limit):
+        srv._record_verb_attempt("i_am_done", "task-A")
+        srv._record_verb_attempt_absolute("i_am_done", "task-A")
+
+    result = srv._check_any_verb_circuit("i_am_done", "task-A")
+    assert result is not None
+    assert result["error"] == "circuit_open"
+    assert "this session" not in result["message"]
+    assert "in last" in result["message"]
+
+
+def test_verb_attempted_endpoint_trips_absolute_cap_on_slow_drip() -> None:
+    """End-to-end repro through the real /verb/attempted endpoint: rejections
+    paced far past 60s apart never open the windowed breaker but do open the
+    absolute one once the cumulative count reaches the cap.
+    """
+    client = TestClient(srv.app)
+    cap = absolute_retry_limit_for("i_am_done")
+    assert cap is not None
+    last_body: dict[str, object] | None = None
+    with patch("roboco.agent_sdk.server.time.monotonic") as mock_time:
+        for i in range(cap):
+            mock_time.return_value = 1000.0 + i * 200.0
+            resp = client.post(
+                "/verb/attempted",
+                json={
+                    "verb": "i_am_done",
+                    "task_id": "task-A",
+                    "rejection_kind": "tracing_gap",
+                },
+            )
+            assert resp.status_code == _OK
+            last_body = resp.json()
+            if i < cap - 1:
+                assert last_body["open"] is False
+
+    assert last_body is not None
+    assert last_body["open"] is True
+    env = last_body["circuit_envelope"]
+    assert isinstance(env, dict)
+    assert env["error"] == "circuit_open"
+    assert "absolute cap" in env["message"]
+
+
+def test_state_reset_clears_verb_absolute_attempts() -> None:
+    """_state.reset() (a fresh container spawn) wipes the absolute tracker too."""
+    expected = 3
+    for _ in range(expected):
+        srv._record_verb_attempt_absolute("i_am_done", "task-A")
+    assert srv._verb_absolute_attempt_count("i_am_done", "task-A") == expected
+
+    srv._state.reset()
+    assert srv._verb_absolute_attempt_count("i_am_done", "task-A") == 0
+
+
+def test_verb_absolute_attempts_default_is_zero() -> None:
+    """defaultdict yields 0 for unseen keys — sanity check."""
+    fresh = srv._SessionState()
+    assert fresh.verb_absolute_attempts[("never_seen", None)] == 0