fix(gateway): thread agent_team through all 27 lifecycle Context sites

Arms the team-match spec gate that sat in its permissive fallback since
shipping: cell-scoped roles are now rejected on cross-team verbs at the
gateway (a misrouted frontend PM blocked, escalated, and held a backend
task live 2026-07-02). Org-wide roles remain exempt via the policy-side
_ORG_WIDE_ROLES. Test mocks aligned to carry consistent teams.
This commit is contained in:
Renn F
2026-07-02 15:44:34 +02:00
parent 0f1ed3cc6a
commit 8e5f84c4eb
18 changed files with 65 additions and 9 deletions
+3 -3
View File
@@ -59,7 +59,7 @@ def _make_deps(**overrides: Any) -> ChoreographerDeps:
async def test_resume_transitions_paused_to_in_progress() -> None:
aid = uuid4()
tid = uuid4()
t = MagicMock(id=tid, status="paused", assigned_to=aid)
t = MagicMock(id=tid, status="paused", assigned_to=aid, team="backend")
task_svc = AsyncMock()
task_svc.get.return_value = t
task_svc.agent_for.return_value = MagicMock(
@@ -108,7 +108,7 @@ async def test_resume_rejects_when_not_claimant() -> None:
aid = uuid4()
other = uuid4()
tid = uuid4()
t = MagicMock(id=tid, status="paused", assigned_to=other)
t = MagicMock(id=tid, status="paused", assigned_to=other, team="backend")
task_svc = AsyncMock()
task_svc.get.return_value = t
task_svc.agent_for.return_value = MagicMock(
@@ -177,7 +177,7 @@ async def test_resume_success_writes_heartbeat() -> None:
"""Heartbeat fires on success — agent is back to active work."""
aid = uuid4()
tid = uuid4()
t = MagicMock(id=tid, status="paused", assigned_to=aid)
t = MagicMock(id=tid, status="paused", assigned_to=aid, team="backend")
task_svc = AsyncMock()
task_svc.get.return_value = t
task_svc.agent_for.return_value = MagicMock(