fix(gateway): thread agent_team through all 27 lifecycle Context sites

Arms the team-match spec gate that sat in its permissive fallback since
shipping: cell-scoped roles are now rejected on cross-team verbs at the
gateway (a misrouted frontend PM blocked, escalated, and held a backend
task live 2026-07-02). Org-wide roles remain exempt via the policy-side
_ORG_WIDE_ROLES. Test mocks aligned to carry consistent teams.
This commit is contained in:
Renn F
2026-07-02 15:44:34 +02:00
parent 0f1ed3cc6a
commit 8e5f84c4eb
18 changed files with 65 additions and 9 deletions
+1 -1
View File
@@ -757,7 +757,7 @@ async def test_complete_dispatches_cell_pm() -> None:
after = MagicMock(**{**t.__dict__, "status": "completed"})
task_svc = AsyncMock()
task_svc.get.return_value = t
task_svc.agent_for.return_value = MagicMock(role="cell_pm")
task_svc.agent_for.return_value = MagicMock(role="cell_pm", team="backend")
task_svc.all_subtasks_terminal.return_value = True
task_svc.cell_pm_complete.return_value = after
git_svc = AsyncMock()