feat(board): Board Programs — the complete twelve-program catalog (Phases 1-3) (#699)

* feat(board): Pest Control — the first project-scoped Board Program The Product Owner hunts latent defects (what the org records but nobody reads): a weekly cycle — accelerated off-schedule when the trailing-7-day rework rate crosses pest_rework_threshold, with the cheap dedup/scope gates evaluated before the metrics queries — opens one held exploration task against the least-recently-explored opted-in project (deterministic round-robin; opted_in_projects gains a stable ORDER BY), with server- assembled evidence in the spawn prompt (rework hotspots, recurring-findings and waived-minor ledger aggregates, all capped) plus prior-cycle LEARN context. The PO calls the new PO-only propose_bug_hunt verb once: ≤5 items, evidence required per item, targets validated against pest_control participation. CEO decides per item — approve materializes a BACKLOG task (source pest_control, never auto-starts), reject records the reason; both feed the LEARN ledger by exploration task id; all-terminal completes the cycle. Telegram queue pushes carry working Approve/Reject handlers mirroring the roadmap kind. Doctrine: board.md Pest Control section + product-owner verb entry + regenerated verb tables. * feat(panel): Pest Control review queue Command Center gains the pest review queue (per-item approve/reject with reason, mirroring the roadmap queue); the Programs card and the project settings participates-in checkboxes pick the new program up registry-driven — the settings section renders for the first time now that a project-scoped program exists. * feat(board): Periscope — HoM market-research brief program Weekly org-scoped cycle: a solo HoM spawn researches the market (web research with mandatory source URLs — uncited findings are rejected) and files one structured brief via the new HoM-only propose_market_brief verb: headline, cited findings, threats/opportunities, positioning note, all soup-checked and screened through the injection guard at persist time (web-derived text later reaches prompts; flags recorded, content never dropped). A brief is a report, not a proposal: the verb completes the exploration in the same call (the x_feature asymmetry), the cycle ledger auto-closes, and the CEO gets a best-effort notification with no approve/reject surface (periscope deliberately never joins Telegram's action kinds). The latest brief is injected into the roadmap exploration prompt — Periscope feeds Printer, the first cross-role program input. * feat(panel): Market Briefs tab (read-only) Business page gains a Market Briefs tab listing Periscope briefs — headline, cited findings, threats/opportunities — read-only by design; a report has nothing to approve. * feat(board): Coroner — event-triggered Auditor postmortems The first EVENT program: no cron — three best-effort hooks open an autopsy when a task bounces to its 3rd revision (the audit chokepoint), is cancelled after work started, or is budget-blocked; all gated on arming + one-open-autopsy dedup, none can fail the underlying transition. A solo Auditor spawn reads the incident (server-assembled findings + transition context) and files one propose_postmortem: incident summary, root cause, failed stage (validated against the real status vocabulary), and ONE process change — a playbook-kind change drafts via PlaybookService directly into the normal pending-curation queue; the briefed draft_playbook manifest grant was deliberately NOT added, preserving the existing 'auditor curates but never drafts' invariant test. Complete-at-propose (report asymmetry), cycle ledger auto-closes, CEO notified link-only. Integrated as a union with Periscope across the shared program surfaces. * feat(panel): Coroner postmortems card Read-only postmortems list under Business → Programs — incident, root cause, failed stage, process change; nothing to approve, the process-change artifact (a draft playbook) rides the existing curation queue. * feat(board): Sentinel — Auditor drift-watch quality reports Weekly org-scoped cycle: a solo Auditor spawn receives a server-assembled drift context (waived-findings trend, open findings by severity, conventions-violation hotspots, top spend — all capped, pure ORM) and files one propose_quality_report: headline, 1-7 area-validated items with evidence and suggested actions, overall assessment. Report semantics — complete-at-propose, cycle auto-closes, CEO notified display-only (never on Telegram's approve/reject surface); items are structured so a later convert-to-task control is cheap. Integration adopts Sentinel's module- level dict-dispatch for board-program routing (xenon-driven), folding all prior programs in; app router mounting extracted to a helper for the same budget. * feat(panel): Quality Reports tab (read-only) Business page gains the Sentinel quality-reports tab — headline, per-area observations with evidence and suggested actions; read-only, a report has nothing to approve. * feat(board): Spackle — gap-fill audit program Biweekly project-scoped PO cycle over the half-shipped surface area: API routes without panel surfaces (and vice versa), armed flags without docs, docs promises the code doesn't keep, dead-end tabs — the inventory diffing is the PO's own read-tool work, ordered by the spawn prompt with file:line citations required; the server injects only prior-cycle LEARN and the rotation target. Rotation is now a shared module-level helper (pick_rotation_target, parameterized by source) both project-scoped engines use — pest_control delegates to it, behavior-identical, with a cross-pollution test proving the two programs' rotations stay independent. propose_gap_fill mirrors the bug-hunt verb (≤5 items, two-sided evidence required, participation gate); per-item CEO decide materializes BACKLOG source=spackle tasks; full Telegram kind incl. approve/reject handlers. All seven program routers now mount from one helper. * feat(panel): Spackle gap-fill review queue Command Center gains the gap-fill queue mirroring the pest-control one — per-item approve/reject with the two-sided gap evidence rendered. * feat(board): Scales — monthly portfolio rebalance Org-scoped PO cycle over the stale backlog: the spawn receives a capped stale-task snapshot (BACKLOG/PENDING unclaimed >30 days) plus the charter and prior-cycle LEARN, and files one propose_rebalance — 1-7 items, each a resolvable task_ref with action reprioritize (validated new priority) or cancel, rationale required. Per-item CEO decide: approve EXECUTES the action (audited priority update, or the normal cancel path) — the first program whose materializer mutates existing tasks instead of creating them; reject records the reason; LEARN by exploration task id; all-terminal completes the cycle. Full Telegram decide-kind wiring. Integrated as the eight-program union (registry, dict dispatch, routers helper, teardown enumerations). * feat(panel): Scales rebalance review queue Command Center gains the rebalance queue — per-item approve/reject with the action, target task, and rationale rendered. * feat(board): Mirror — quarterly positioning audit Project-scoped HoM cycle over messaging surfaces: README claims vs shipped reality, docs-site promises vs code, charter alignment — the audit is the HoM's own read-tool work with citations required; the server injects the charter, prior-cycle LEARN, and the shared rotation target. propose_ messaging_fixes mirrors the gap-fill verb (≤5 items, drift evidence naming claim + contradicting reality, participation gate); per-item CEO decide materializes BACKLOG source=mirror documentation tasks; full Telegram decide-kind wiring. Nine-program union across the shared surfaces. * feat(panel): Mirror messaging-fixes review queue * feat(board): Megaphone — HoM standing editorial calendar Cron cycle (3 days, org-scoped, gated on X credentials — drafting content nobody can post is pointless): the HoM receives a shipped-this-week digest plus Unreleased changelog bullets and files one propose_editorial_post (angle-validated, ≤280, brand voice) that materializes a held x_editorial draft through the SAME X-queue origination chokepoint release posts use — zero new approval surface, notifications and CEO decide for free. Complete-at-propose; cycle auto-closes. Ten-program union. * feat(panel): x_editorial source labels in the X queue surfaces * feat(board): Librarian — proactive playbook mining Biweekly org-scoped Auditor cycle: mines recurring non-private learning journals (≥2-count grouping with a recency fallback) against the existing playbook-title inventory and files one propose_playbook_drafts — 1-3 drafts, each with the repeated-pattern evidence that justifies it, duplicate titles rejected in-batch and against the live store. Drafts are created via PlaybookService directly (the Coroner precedent — the 'auditor curates but never drafts' do-verb invariant stays intact and tested) and land in the normal pending-curation queue the Auditor's own triage already surfaces; no new panel surface. Complete-at-propose; display-only CEO notification. Eleven-program union. * feat(board): War Room — release campaign planning EVENT program with a REAL originator (unlike coroner's stub): a release publish hooks a campaign brief beside the release-post seam, and the CEO's run-now originates on demand — the cron loop never fires it. The HoM designs a 2-6 post arc (teaser → launch → follow-up → spotlight; 280-cap, future strictly-ascending publish_after, stage vocabulary) and one propose_campaign call materializes each post as a held x_campaign draft through the X-queue chokepoint. V1 is manual-cadence by design: publish_ after renders as queue guidance and the CEO approves each post at its moment — nothing auto-posts, ever; the auto-schedule upgrade is a documented ceiling. Twelve-program union: full registry complete. * feat(panel): x_campaign labels + publish-after guidance in the X queue * feat(board): Barfly — adjacent-conversation replies Cron cycle (2 days, org-scoped, X-credentials gated): the engine searches X for conversations where RoboCo is relevant but unmentioned (new OAuth- signed search_recent on the client; queries + candidate cap configurable), screens every fetched tweet through the injection guard (stored unclamped — a clamp was truncating the candidate under the envelope, caught by the dev's own tests), dedupes via the existing x_seen_mentions ledger (no migration; also prevents double-drafting against the mentions poll), and opens one held HoM exploration carrying the screened candidates. propose_ conversation_replies enforces candidate-id-only replies (≤5, 280-cap); each materializes a held x_barfly draft through the X-queue chokepoint, threaded via a new in_reply_to seam on post_tweet that only x_barfly drafts use. The X redraft machinery is now dict-dispatch over per-source extractors with reply-ref carry for x_barfly. Thirteen-program registry. War Room's test fakes gained the new abstract search_recent stub. * feat(board): Dogfood — the PO walks the product The fourteenth and final registry entry, completing the catalog. EVENT program (release-publish hook beside the war-room hook + CEO run-now, both through the same real originator; the cron loop never fires it), project- scoped with shared rotation. The permission surface is the careful part: the PO's dogfood spawn — and ONLY that spawn — gets the Playwright MCP mounted, via a task-scoped fail-closed probe mirroring the video-authoring precedent (a PO spawned for roadmap/pest/scales never sees browser tools; tested both ways); the PM agent image bakes chromium unconditionally like the ux image, the mount stays task-gated in code. The walk targets the rotation target's live surfaces (panel_base_url only when the target is the org's own project, honest degradation otherwise); propose_friction_ fixes files ≤5 walked-path-evidenced items; per-item CEO decide materializes BACKLOG source=dogfood tasks; full Telegram decide kind. Also: megaphone/librarian/war_room arming keys restored to the settings validator — their panel toggles would have been rejected (dropped in earlier unions; the same silent-arming class the drill killed once already). * feat(panel): Dogfood friction review queue * chore(board): final whole-branch sweep fixes The night's closing adversarial pass over the integrated fourteen-program registry found ONE functional defect — the war-room test fakes' post_tweet predated Barfly's in_reply_to_tweet_id kwarg (LSP violation, the only red in an otherwise fully green gate) — plus doc/test drift, all fixed: the source-parity test completes to fourteen (spackle/mirror were silently absent while its neighboring comment claimed full coverage), the PO identity doc gains its missing Dogfood verb, the auditor quick-list gains propose_postmortem, three stale comments corrected (rotation docstring, panel registry header, X source enumerations), the dogfood release-hook gains the exception-swallow test its four sibling hooks already had, and the CHANGELOG's Unreleased section documents the whole Board Programs train. Full make quality: exit 0, all gates green. * docs: full documentation sweep for the Board Programs train CLAUDE.md's roadmap-engine entry superseded by the Board Program registry entry (all fourteen programs, arming, scoping, LEARN, guardrails) with the role verb tables and playwright row refreshed; docs/rag gains the agent- facing architecture doc plus full propose_* call-shape sections in the three board role docs, and corrects the strategy-engine section to shipped reality (only idle→roadmap is wired); docs/map covers the registry + all twelve engines with flags, gotchas, and drift notes. The 0.27.0 reference inventory confirmed only the release-executor's canonical set carries the version — left for the 0.28.0 cut. * feat(board): human titles + descriptions on every program surface Raw registry keys rendered as bare panel labels — an operator reading x_feature had no idea what enabling or running it does. The registry dataclass gains title/description (test-enforced non-empty for every entry, unique titles), the API passes them through, and every surface renders title-with-description-tooltip instead of the key: the Programs card (label, toggle hint, run-now toast), and the project settings participates-in/excluded-from checkboxes. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>
2026-08-03 07:23:24 +02:00 · 2026-07-25 17:13:32 +02:00
parent e77c3b7a63
commit 401f8a2cc9
201 changed files with 38811 additions and 202 deletions
@@ -0,0 +1,362 @@
+"""Scenario: the Scales (Board Program) loop end to end.
+
+Mirrors test_pest_control_loop.py's arm -> originate -> dedup -> approve
+shape (org-scoped like Periscope: no per-project opt-in is needed to RUN,
+but the exploration task's project_id still resolves against the RoboCo
+project) AND test_periscope_loop.py's do_server wiring-regression check +
+real-route propose call. The genuinely new piece: a rebalance item targets a
+LIVE task, and approving it EXECUTES the action (reprioritize or cancel)
+against that task — never materializes a new one.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+from uuid import UUID, uuid4
+
+from roboco.foundation import identity as _foundation
+from tests.e2e_smoke.harness import ScriptedAgent, expect_ok
+
+if TYPE_CHECKING:
+    from sqlalchemy.ext.asyncio import AsyncSession
+    from tests.e2e_smoke.harness import E2EStack
+
+ONE = 1
+ZERO = 0
+TWO = 2
+
+
+def _seed_system_and_po(stack: E2EStack) -> tuple[str, Any]:
+    """Seed ``system`` + ``product-owner`` at their FIXED foundation UUIDs,
+    plus a project those two own — mirrors test_periscope_loop.py's
+    ``_seed_system_and_hom``: the exploration task's ``project_id`` resolves
+    against this project (the RoboCo-project FK anchor every org-scoped
+    program's task still needs). Returns (project slug, project id).
+    """
+    from roboco.db.tables import AgentTable, ProjectTable
+    from roboco.models import AgentRole, AgentStatus, Team
+
+    slug = f"e2e-scales-{uuid4().hex[:8]}"
+    project_id = uuid4()
+
+    async def _run(session: AsyncSession) -> None:
+        for agent_uuid, agent_slug, role, team in (
+            (_foundation.AGENTS["system"].uuid, "system", AgentRole.SYSTEM, None),
+            (
+                _foundation.AGENTS["product-owner"].uuid,
+                "product-owner",
+                AgentRole.PRODUCT_OWNER,
+                Team.BOARD,
+            ),
+        ):
+            if await session.get(AgentTable, agent_uuid) is not None:
+                continue
+            session.add(
+                AgentTable(
+                    id=agent_uuid,
+                    name=agent_slug,
+                    slug=agent_slug,
+                    role=role,
+                    team=team,
+                    status=AgentStatus.ACTIVE,
+                    model_config={},
+                    system_prompt=agent_slug,
+                    capabilities=[],
+                    permissions={},
+                    metrics={},
+                )
+            )
+        session.add(
+            ProjectTable(
+                id=project_id,
+                name="RoboCo",
+                slug=slug,
+                git_url="https://example.com/roboco.git",
+                default_branch="master",
+                protected_branches=["master"],
+                assigned_cell=Team.BACKEND,
+                created_by=_foundation.AGENTS["system"].uuid,
+                is_active=True,
+            )
+        )
+
+    stack.run_db(_run)
+    return slug, project_id
+
+
+def _seed_target_task(
+    stack: E2EStack, project_id: Any, *, title: str, priority: int = 2
+) -> Any:
+    from roboco.db.tables import TaskTable
+    from roboco.models import Team
+    from roboco.models.base import Complexity, TaskNature, TaskStatus, TaskType
+
+    task_id = uuid4()
+
+    async def _run(session: AsyncSession) -> None:
+        session.add(
+            TaskTable(
+                id=task_id,
+                title=title,
+                description="A live backlog task the rebalance plan targets",
+                acceptance_criteria=["done"],
+                status=TaskStatus.BACKLOG,
+                priority=priority,
+                task_type=TaskType.CODE,
+                nature=TaskNature.TECHNICAL,
+                estimated_complexity=Complexity.LOW,
+                created_by=_foundation.AGENTS["system"].uuid,
+                project_id=project_id,
+                team=Team.BACKEND,
+            )
+        )
+
+    stack.run_db(_run)
+    return task_id
+
+
+def _arm(stack: E2EStack, project_slug: str) -> None:
+    """Arm via the settings-store key — the ONLY arming path (no legacy env
+    flag exists for scales) — and point ``self_heal_project_slug`` at the
+    seeded project (the RoboCo-project resolution roadmap/periscope share)."""
+    from roboco.config import settings as cfg
+    from roboco.db.tables import SystemSettingTable
+
+    cfg.self_heal_project_slug = project_slug
+
+    async def _run(session: AsyncSession) -> None:
+        session.add(
+            SystemSettingTable(key="board_program.scales.enabled", value="true")
+        )
+
+    stack.run_db(_run)
+
+
+def _run_due_programs(stack: E2EStack) -> list[str]:
+    from roboco.services.board_programs import get_board_program_engine
+
+    async def _run(session: AsyncSession) -> list[str]:
+        return await get_board_program_engine(session).run_due_programs()
+
+    result: list[str] = stack.run_db(_run)
+    return result
+
+
+def _find_scales_task(stack: E2EStack) -> dict[str, Any]:
+    from roboco.db.tables import TaskTable
+    from roboco.services.task import SCALES_SOURCE
+    from sqlalchemy import select
+
+    async def _run(session: AsyncSession) -> dict[str, Any]:
+        rows = (
+            (
+                await session.execute(
+                    select(TaskTable).where(TaskTable.source == SCALES_SOURCE)
+                )
+            )
+            .scalars()
+            .all()
+        )
+        return {
+            "count": len(rows),
+            "rows": [
+                {
+                    "id": r.id,
+                    "status": str(r.status),
+                    "assigned_to": r.assigned_to,
+                    "source": r.source,
+                    "confirmed_by_human": r.confirmed_by_human,
+                }
+                for r in rows
+            ],
+        }
+
+    state: dict[str, Any] = stack.run_db(_run)
+    return state
+
+
+def _cycle_counters(stack: E2EStack) -> dict[str, Any]:
+    from roboco.db.tables import BoardProgramCycleTable
+    from sqlalchemy import select
+
+    async def _run(session: AsyncSession) -> dict[str, Any]:
+        row = (
+            (
+                await session.execute(
+                    select(BoardProgramCycleTable)
+                    .where(BoardProgramCycleTable.program_key == "scales")
+                    .order_by(BoardProgramCycleTable.opened_at.desc())
+                    .limit(1)
+                )
+            )
+            .scalars()
+            .first()
+        )
+        assert row is not None
+        return {
+            "items_proposed": row.items_proposed,
+            "items_approved": row.items_approved,
+            "items_rejected": row.items_rejected,
+        }
+
+    state: dict[str, Any] = stack.run_db(_run)
+    return state
+
+
+def _approve_item(stack: E2EStack, task_id: Any, item_id: str, ceo_id: Any) -> str:
+    from roboco.services.scales_service import get_scales_service
+
+    async def _run(session: AsyncSession) -> str:
+        result = await get_scales_service(session).approve_item(
+            task_id, item_id, created_by=ceo_id
+        )
+        assert result is not None
+        return result.status
+
+    status: str = stack.run_db(_run)
+    return status
+
+
+def _target_state(stack: E2EStack, task_id: Any) -> dict[str, Any]:
+    from roboco.db.tables import TaskTable
+    from sqlalchemy import select
+
+    async def _run(session: AsyncSession) -> dict[str, Any]:
+        row = (
+            await session.execute(select(TaskTable).where(TaskTable.id == task_id))
+        ).scalar_one()
+        return {"status": str(row.status), "priority": row.priority}
+
+    state: dict[str, Any] = stack.run_db(_run)
+    return state
+
+
+def test_scales_loop_originates_dedups_proposes_and_executes(
+    e2e_stack: E2EStack,
+) -> None:
+    stack = e2e_stack
+    project_slug, project_id = _seed_system_and_po(stack)
+    _arm(stack, project_slug)
+
+    reprioritize_target = _seed_target_task(
+        stack, project_id, title="Stale onboarding polish", priority=2
+    )
+    cancel_target = _seed_target_task(
+        stack, project_id, title="Dead-weight experiment", priority=2
+    )
+
+    opened = _run_due_programs(stack)
+    assert opened == ["scales"], opened
+
+    state = _find_scales_task(stack)
+    assert state["count"] == ONE, state
+    row = state["rows"][0]
+    assert row["status"] == "pending"
+    assert row["assigned_to"] == _foundation.AGENTS["product-owner"].uuid
+    assert row["confirmed_by_human"] is False
+
+    # The dispatcher's own dev-work skip recognizes this exact task shape —
+    # board_scales is board-dispatched (one-shot PO spawn), never handed to
+    # the generic dev dispatch loop's give_me_work/claim path.
+    from roboco.runtime.orchestrator import _is_non_dev_dispatch_source
+
+    assert _is_non_dev_dispatch_source({"source": row["source"]}) is True
+
+    # Second tick: the open cycle blocks re-origination — no second task.
+    opened_again = _run_due_programs(stack)
+    assert opened_again == [], opened_again
+    state_after = _find_scales_task(stack)
+    assert state_after["count"] == ONE, state_after
+
+    # The Product Owner authors the plan through the REAL do_server module +
+    # /api/v1/do/propose_rebalance route + ContentActions + SCALES service
+    # wiring — the same wiring-regression class check test_periscope_loop.py
+    # guards (a verb granted in role_config but missing from do_server._TOOLS
+    # is unreachable over MCP).
+    po = ScriptedAgent(
+        stack,
+        _foundation.AGENTS["product-owner"].uuid,
+        "product-owner",
+        "product_owner",
+    )
+    do_module = po._module("roboco.mcp.do_server")
+    assert "propose_rebalance" in do_module._TOOLS, (
+        "propose_rebalance missing from do_server._TOOLS — the MCP server "
+        "has no way to expose it to any role"
+    )
+    assert "propose_rebalance" in do_module._REGISTERED_TOOLS, (
+        "propose_rebalance is granted to product_owner in role_config but "
+        "absent from this agent's _register_tools() output — the manifest "
+        "-> _register_tools -> callable chain dropped it"
+    )
+
+    env = expect_ok(
+        po.do(
+            "propose_rebalance",
+            items=[
+                {
+                    "task_ref": str(reprioritize_target)[:8],
+                    "action": "reprioritize",
+                    "new_priority": 0,
+                    "rationale": (
+                        "Onboarding friction is this quarter's top charter goal"
+                    ),
+                },
+                {
+                    "task_ref": str(cancel_target)[:8],
+                    "action": "cancel",
+                    "rationale": (
+                        "Superseded by the new dashboard; no longer on the roadmap"
+                    ),
+                },
+            ],
+        ),
+        "po propose_rebalance",
+    )
+    assert env.get("status") == "rebalance_proposed", env
+    task_id = UUID(env["task_id"])
+    assert task_id == row["id"]
+
+    # Approving each item EXECUTES its action against the live target task —
+    # neither materializes a new task.
+    ceo_id = _foundation.AGENTS["ceo"].uuid
+    from roboco.db.tables import AgentTable
+    from roboco.models import AgentRole, AgentStatus
+
+    async def _seed_ceo(session: AsyncSession) -> None:
+        if await session.get(AgentTable, ceo_id) is not None:
+            return
+        session.add(
+            AgentTable(
+                id=ceo_id,
+                name="ceo",
+                slug="ceo",
+                role=AgentRole.CEO,
+                team=None,
+                status=AgentStatus.ACTIVE,
+                model_config={},
+                system_prompt="ceo",
+                capabilities=[],
+                permissions={},
+                metrics={},
+            )
+        )
+
+    stack.run_db(_seed_ceo)
+
+    reprioritize_status = _approve_item(stack, task_id, "item-0", ceo_id)
+    assert reprioritize_status == "approved"
+    cancel_status = _approve_item(stack, task_id, "item-1", ceo_id)
+    assert cancel_status == "approved"
+
+    reprioritize_state = _target_state(stack, reprioritize_target)
+    assert reprioritize_state["status"] == "backlog"
+    assert reprioritize_state["priority"] == 0
+
+    cancel_state = _target_state(stack, cancel_target)
+    assert cancel_state["status"] == "cancelled"
+
+    counters = _cycle_counters(stack)
+    assert counters["items_proposed"] == TWO
+    assert counters["items_approved"] == TWO
+    assert counters["items_rejected"] == ZERO