fix(gateway): dm catches A2AAccessDeniedError; circuit breakers handle dict errors

Smoke-7 surfaced: be-qa called dm(recipient='qa-all', ...) — 'qa-all'
is a channel slug, not an agent. A2A enforcement raised
A2AAccessDeniedError. It propagated past dm(), past content_actions,
got caught by FastAPI middleware which renders RobocoError.to_dict()
as {'error': {'code': ..., 'message': ..., 'details': ...}} — a
DICT-shaped 'error' field.

do_server's circuit-breaker check (and flow_server's mirror) did
`payload.get('error') in _CIRCUIT_REJECTION_KINDS` — trying to hash
a dict against a frozenset → `TypeError: unhashable type: 'dict'`.
The agent saw "Error executing tool dm: unhashable type: 'dict'"
and got stuck calling dm in a loop.

Two-layer fix:

1. content_actions.dm now catches A2AAccessDeniedError and returns
   Envelope.not_authorized with the original reason + route_hint as
   remediate. This is the right shape — content tools always emit
   Envelopes; RobocoErrors escaping to the middleware is a bug.

2. Defense-in-depth: do_server._record_and_check_circuit and
   flow_server._record_and_check_circuit now guard against non-string
   error fields. Any future RobocoError-leak that bypasses (1) will
   pass through untouched instead of crashing the tool call.

3 new tests pin the contracts:
- dm A2A denial returns Envelope.not_authorized (not propagated)
- do_server circuit-breaker doesn't crash on dict-shaped errors

roboco/mcp/do_server.py

@@ -130,7 +130,14 @@ def _record_and_check_circuit(
     the original payload. The breaker is a safety net; it must never
     break the gateway path.
     """
+    # Gateway envelopes use a string `error` (kind); RobocoError-derived
+    # exceptions surface a dict-shaped error via FastAPI's middleware
+    # (smoke-7: TypeError on `dict in frozenset`). Defend against the
+    # dict shape — only string kinds count toward the breaker, dicts pass
+    # straight through.
     rejection_kind = payload.get("error")
+    if not isinstance(rejection_kind, str):
+        return payload
     if rejection_kind not in _CIRCUIT_REJECTION_KINDS:
         return payload
 

roboco/mcp/flow_server.py

@@ -140,7 +140,12 @@ def _record_and_check_circuit(
     the original payload. The breaker is a safety net; it must never
     break the gateway path.
     """
+    # Gateway envelopes use a string `error` (kind); RobocoError-derived
+    # exceptions surface a dict-shaped error via FastAPI's middleware. Only
+    # string kinds count toward the breaker; dicts pass straight through.
     rejection_kind = payload.get("error")
+    if not isinstance(rejection_kind, str):
+        return payload
     if rejection_kind not in _CIRCUIT_REJECTION_KINDS:
         return payload
 

roboco/services/gateway/content_actions.py

@@ -537,13 +537,28 @@ class ContentActions:
                 remediate="provide task_id explicitly or claim a task first",
                 context_briefing={},
             )
-        await self.a2a.send(
-            from_agent=agent_id,
-            to_agent=recipient,
-            task_id=task_id,
-            body=text,
-            skill=skill,
-        )
+        # Catch A2A access denials and return an Envelope. If the
+        # error escapes here it's caught by FastAPI's middleware and
+        # rendered as RobocoError.to_dict() — a dict-shaped 'error'
+        # field that breaks do_server's circuit-breaker frozenset
+        # check (smoke-7: TypeError: unhashable type: 'dict').
+        from roboco.enforcement.a2a_access import A2AAccessDeniedError
+
+        try:
+            await self.a2a.send(
+                from_agent=agent_id,
+                to_agent=recipient,
+                task_id=task_id,
+                body=text,
+                skill=skill,
+            )
+        except A2AAccessDeniedError as e:
+            remediate = e.route_hint or e.reason
+            return Envelope.not_authorized(
+                message=e.message,
+                remediate=remediate,
+                context_briefing={},
+            )
         return Envelope.ok(
             status="sent",
             task_id=str(task_id),

tests/unit/gateway/test_dm_a2a_denied.py

@@ -0,0 +1,79 @@
+"""Smoke-7: dm catches A2AAccessDeniedError as Envelope.not_authorized.
+
+Original bug: be-qa called dm(recipient='qa-all', ...) — 'qa-all' is a
+channel slug, not an agent slug. A2A enforcement raised
+A2AAccessDeniedError. It propagated past dm(), past content_actions,
+and got caught by FastAPI's middleware which renders RobocoError.to_dict()
+as `{'error': {'code': ..., 'message': ..., 'details': ...}}`.
+
+do_server's circuit-breaker check then did
+`dict_error in _CIRCUIT_REJECTION_KINDS` and crashed with
+`TypeError: unhashable type: 'dict'`. The agent saw a generic
+"Error executing tool dm: unhashable type: 'dict'" and got stuck.
+
+The do_server defense-in-depth test lives in
+tests/unit/mcp_servers/test_do_server_circuit_breaker.py.
+"""
+
+from __future__ import annotations
+
+from unittest.mock import AsyncMock, MagicMock
+from uuid import uuid4
+
+import pytest
+from roboco.enforcement.a2a_access import A2AAccessDeniedError
+from roboco.services.gateway.content_actions import ContentActions, ContentActionsDeps
+
+
+def _make_deps(**overrides: object) -> ContentActionsDeps:
+    base: dict[str, object] = {
+        "task": AsyncMock(),
+        "git": AsyncMock(),
+        "messaging": AsyncMock(),
+        "a2a": AsyncMock(),
+        "journal": AsyncMock(),
+        "workspace": AsyncMock(),
+        "notifications": AsyncMock(),
+    }
+    base.update(overrides)
+    return ContentActionsDeps(**base)
+
+
+@pytest.mark.asyncio
+async def test_dm_a2a_denied_returns_envelope_not_authorized() -> None:
+    """A2AAccessDeniedError is caught and returned as Envelope.not_authorized."""
+    agent_id = uuid4()
+    task_id = uuid4()
+    task_obj = MagicMock(id=task_id, status="in_progress", assigned_to=agent_id)
+
+    task_svc = AsyncMock()
+    task_svc.agent_for.return_value = MagicMock(role="qa")
+    task_svc.get_journal_context_task_for_agent.return_value = task_obj
+    task_svc.get_active_task_for_agent.return_value = task_obj
+    task_svc.get.return_value = task_obj
+
+    a2a_svc = AsyncMock()
+    a2a_svc.send.side_effect = A2AAccessDeniedError(
+        from_agent="be-qa",
+        to_agent="qa-all",
+        reason="Cannot A2A unknown. Route: be-qa → be-pm → main-pm.",
+        route_hint="be-qa → be-pm → main-pm",
+    )
+
+    deps = _make_deps(task=task_svc, a2a=a2a_svc)
+    actions = ContentActions(deps)
+
+    env = await actions.dm(
+        agent_id=agent_id,
+        recipient="qa-all",
+        text="PASS notice",
+        task_id=task_id,
+    )
+
+    assert env.error == "not_authorized", (
+        f"A2A denial must surface as not_authorized envelope, got {env.error!r}. "
+        "If it escapes to FastAPI middleware, RobocoError.to_dict() renders the "
+        "error as a dict and the do_server circuit breaker crashes."
+    )
+    assert "be-qa" in env.message
+    assert env.remediate is not None

tests/unit/mcp_servers/test_do_server_circuit_breaker.py

@@ -260,3 +260,30 @@ def test_verb_extracted_from_path(do_module: types.ModuleType) -> None:
         do_module.commit(message="[abc12345] test commit message under 20 chars")
     sdk_body = next(body for url, body in captured if "test-sdk" in url)
     assert sdk_body["verb"] == "commit"
+
+
+def test_dict_shaped_error_does_not_crash(do_module: types.ModuleType) -> None:
+    """A RobocoError.to_dict()-shaped response must pass through without TypeError.
+
+    Smoke-7: A2AAccessDeniedError escaped to middleware and was rendered as
+    {'error': {'code': ..., 'message': ..., 'details': ...}}. The circuit
+    breaker's `error in frozenset` check then crashed with
+    `TypeError: unhashable type: 'dict'`.
+    """
+    factory, captured = _make_client(
+        orchestrator_response={
+            "error": {
+                "code": "A2A_ACCESS_DENIED",
+                "message": "be-qa cannot A2A with qa-all",
+                "details": {},
+            }
+        },
+        sdk_response=None,  # SDK must not be touched
+    )
+    # No TypeError; payload passes through untouched.
+    with patch("httpx.Client", side_effect=factory):
+        result = do_module.dm(recipient="qa-all", text="x")
+    assert isinstance(result["error"], dict)
+    assert result["error"]["code"] == "A2A_ACCESS_DENIED"
+    # SDK breaker MUST NOT have been called for a non-string error.
+    assert all("test-sdk" not in url for url, _ in captured)