[F109] playbook curation status guards: approve/reject draft-only, archive approved-only

tests/unit/gateway/test_playbook_verbs.py

@@ -11,6 +11,7 @@ from unittest.mock import AsyncMock, MagicMock
 from uuid import uuid4
 
 import pytest
+from roboco.services.base import ConflictError
 from roboco.services.gateway.content_actions import ContentActions, ContentActionsDeps
 from roboco.services.gateway.role_config import get_role_config
 
@@ -140,3 +141,45 @@ async def test_reject_playbook_archives_for_auditor(
     # F057: de-index is the post-commit step (commit gates it).
     actions.task.session.commit.assert_awaited_once()
     svc.unindex_playbook.assert_awaited_once_with(archived)
+
+
+@pytest.mark.asyncio
+async def test_archive_playbook_retires_approved_for_auditor(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """archive_playbook is the distinct APPROVED->archived retire path (F109):
+    it calls ``svc.archive`` (NOT ``svc.reject``), commits, then de-indexes."""
+    archived = MagicMock()
+    archived.id = uuid4()
+    archived.status = "archived"
+    svc = MagicMock()
+    svc.archive = AsyncMock(return_value=archived)
+    svc.reject = AsyncMock()
+    svc.unindex_playbook = AsyncMock()
+    monkeypatch.setattr("roboco.services.playbook.get_playbook_service", lambda _s: svc)
+    actions = _actions("auditor")
+    env = await actions.archive_playbook(agent_id=uuid4(), playbook_id=uuid4())
+    assert env.status == "playbook_archived"
+    svc.archive.assert_awaited_once()
+    svc.reject.assert_not_awaited()
+    actions.task.session.commit.assert_awaited_once()
+    svc.unindex_playbook.assert_awaited_once_with(archived)
+
+
+@pytest.mark.asyncio
+async def test_approve_playbook_invalid_state_envelope(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A status-precondition ConflictError from the service becomes a clean
+    invalid_state envelope (not a 500) — the agent gets a remediate hint to
+    re-fetch the playbook's current status before re-trying (F109)."""
+    svc = MagicMock()
+    svc.approve = AsyncMock(
+        side_effect=ConflictError("not draft", resource_type="playbook")
+    )
+    monkeypatch.setattr("roboco.services.playbook.get_playbook_service", lambda _s: svc)
+    env = await _actions("auditor").approve_playbook(
+        agent_id=uuid4(), playbook_id=uuid4()
+    )
+    assert env.error == "invalid_state"
+    assert env.remediate  # the agent is told how to recover

tests/unit/services/test_playbook_index_ordering.py

@@ -37,7 +37,10 @@ _APPROVER = uuid4()
 def _playbook_mock() -> Any:
     pb = MagicMock(name="playbook")
     pb.id = _PID
-    pb.status = "approved"
+    # approve/reject act on a DRAFT (their legitimate starting state — F109
+    # guards both to DRAFT-only). The index/unindex ordering assertions below
+    # are independent of the starting status.
+    pb.status = "draft"
     pb.title = "T"
     pb.problem = "P"
     pb.procedure = "Pr"

tests/unit/services/test_playbook_unindex.py

@@ -1,14 +1,16 @@
-"""PlaybookService.reject must flush the status change WITHOUT de-indexing
-inline, and ``unindex_playbook`` is the separate post-commit de-index step.
+"""PlaybookService.reject/archive must flush the status change WITHOUT
+de-indexing inline, and ``unindex_playbook`` is the separate post-commit step.
 
 A rejected/archived playbook that was previously approved must stop surfacing in
-agent briefings, so a reject drops its chunks + tracking row. Originally (F011)
-``reject`` called an ``_unindex_playbook`` helper inline. F057 split that out:
-the RAG index write runs through its own auto-committing pool connection, so
-de-indexing inline (before the caller commits the status) would drop a playbook
-from the corpus even if the status transaction rolled back — a divergence. So
-``reject`` now flushes the status ONLY; ``unindex_playbook`` is a separate
-public step the caller runs AFTER committing. Both helpers stay gated on
+agent briefings, so the curation drop its chunks + tracking row. Originally
+(F011) ``reject`` called an ``_unindex_playbook`` helper inline. F057 split that
+out: the RAG index write runs through its own auto-committing pool connection,
+so de-indexing inline (before the caller commits the status) would drop a
+playbook from the corpus even if the status transaction rolled back — a
+divergence. So ``reject``/``archive`` now flush the status ONLY;
+``unindex_playbook`` is a separate public step the caller runs AFTER
+committing. F109 split the APPROVED->archived retire path into ``archive``
+(distinct from ``reject``, which declines a DRAFT). Both helpers stay gated on
 ``org_memory_enabled`` (inert when the loop is off) and best-effort.
 """
 
@@ -49,11 +51,13 @@ def _session_with(pb: Any) -> MagicMock:
 
 
 @pytest.mark.asyncio
-async def test_reject_archives_but_does_not_deindex_inline(
+async def test_archive_archives_but_does_not_deindex_inline(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    """``reject`` flushes the ARCHIVED status but must NOT touch the RAG index —
-    the de-index is a separate post-commit step (F057 ordering)."""
+    """``archive`` flushes the ARCHIVED status but must NOT touch the RAG index —
+    the de-index is a separate post-commit step (F057 ordering). Archive retires
+    an APPROVED playbook (F109); the previously-approved one was indexed on
+    approval, so the post-commit ``unindex_playbook`` is what removes it."""
     monkeypatch.setattr(settings, "org_memory_enabled", True)
     playbook_id = uuid4()
     pb = _mock_playbook(playbook_id, status=PlaybookStatus.APPROVED.value)
@@ -67,7 +71,7 @@ async def test_reject_archives_but_does_not_deindex_inline(
             AsyncMock(return_value=optimal),
         ),
     ):
-        out = await svc.reject(playbook_id, approver_id=uuid4(), reason="stale")
+        out = await svc.archive(playbook_id, approver_id=uuid4())
 
     assert out.status == PlaybookStatus.ARCHIVED.value
     optimal.unindex_playbook.assert_not_awaited()