2 Commits

Include renames

Author	SHA1	Message	Date
4 people	109b4d4d82	[4baffaa3] Batch A: extract route helpers (tasks/a2a/orchestrator/video/journals/role_dep/roadmap/prompter_live) (#738) ... * [4baffaa3] refactor(api): relocate route-layer helpers out of batch-A files into services/schemas/deps Move every non-@router-decorated top-level function out of roboco/api/routes/{tasks,a2a,orchestrator,video,v1/_role_dep,roadmap,prompter_live}.py (journals.py had none) into the module that owns its kind of concern: - DB/side-effecting logic -> the paired roboco/services module (task.py, a2a.py, video_engine.py, video_post_service.py, prompter.py) - DTO-conversion helpers -> roboco/api/schemas/{tasks,video,roadmap}.py, matching tasks.py's existing task_to_response pattern - small HTTP-layer auth guards -> roboco/api/deps.py, matching its existing require_ceo_role/require_pm_or_above pattern Redundant per-file _require_ceo(agent) wrappers (a2a/orchestrator/video/ roadmap) that just partial-applied an already-existing deps.py function were inlined to direct require_ceo_role(...) calls instead of duplicated across services. v1/_role_dep.py keeps its per-role frozenset variable bindings since those are assignments, not function definitions, and aren't flagged by the architectural-conventions classifier. Route paths, schemas, and observable behavior are unchanged. Updated 5 existing test files whose imports or monkeypatch targets pointed at the old private route-module names. * [4baffaa3] test(conventions): pin batch-A route files already free of helper findings * [4baffaa3] fix(api): restore fail-closed _auth_required() fallback (GHSA-4f7g-w95g-5q2c) The batch-A route-helper relocation accidentally narrowed _auth_required() to a truthy-only check, dropping the unset-value fallback to settings.environment == "production". An unconfigured production deploy would then always return False, silently accepting unauthenticated X-Agent-Role: ceo header spoofing. Restore the three-branch logic (explicit true/false honored, unset falls back to the production check) and the GHSA docstring paragraph explaining it. * [4baffaa3] fix(services): restore missing Board-Program/X-engine source-tag constants in task.py The batch-A route-helper relocation's task.py edits had dropped ~24 module-level source-tag constants (BARFLY_SOURCE, CORONER_SOURCE, DOGFOOD_SOURCE, LIBRARIAN_SOURCE, MEGAPHONE_SOURCE, MIRROR_SOURCE, PERISCOPE_SOURCE, PEST_CONTROL_SOURCE, SCALES_SOURCE, SENTINEL_SOURCE, SPACKLE_SOURCE, WAR_ROOM_SOURCE, their *_ITEM_SOURCE materialized-task counterparts, ENV_SYNC_SOURCE, EVAL_BENCH_SOURCE, and the later X-engine held-draft tags X_EDITORIAL_SOURCE/X_CAMPAIGN_SOURCE/X_BARFLY_SOURCE) that ~20 downstream service/engine modules and orchestrator.py's dispatch table import, breaking the whole FastAPI app's import chain (deps.py -> AgentOrchestrator -> orchestrator.py -> task.py) and failing collection on 7 test files. Restored every missing constant in the same style/location as the existing block, values cross-checked against board_programs.py's PROGRAMS registry and hardcoded-string test assertions. Folded the three new X-engine tags into X_SOURCES (x_post_service.py's task.source not in X_SOURCES membership check gates their approve/reject). Also closes a pre-existing PLR0917 (too-many-positional-args) gap in pyproject.toml's per-file-ignores for roboco/api/routes/*.py, roboco/api/deps.py, and roboco/services/prompter.py: these files already carry an established PLR0913 ignore with a documented FastAPI-DI-contract / MegaTask-contract rationale that applies equally to PLR0917, which ruff was flagging on the same pre-existing signatures (get_current_agent_id, get_current_agent_slug, _cloud_auth_agent_context, get_agent_context, list_tasks_summary, _rewrite_batch_children). * [4baffaa3] fix(api): restore verb-rejection logging and fix stale monkeypatch target in orchestrator auth tests Two regressions surfaced by re-running the full unit test suite after restoring task.py's import chain (previously masked because the whole app failed to import): 1. envelope_to_response() (relocated into roboco/api/deps.py from v1/_role_dep.py during the batch-A helper extraction) dropped the "verb rejected" structlog event an error envelope must leave — a rejected envelope rides a 200, so without this the access log can't distinguish a verb an agent couldn't satisfy from one that worked (four Board Programs died that way on 2026-07-25 with no recoverable reason, per tests/unit/api/routes/v1/ test_verb_rejection_logging.py's docstring). Restored the log call: verb name from the request path, error/detail/remediate from the envelope, agent_id/agent_role from the request headers. 2. tests/unit/api/test_orchestrator_auth.py's two cloud-auth session tests monkeypatched "roboco.api.routes.orchestrator. resolve_session_user", the pre-relocation location. The guard that actually calls resolve_session_user (require_orchestrator_ceo) now lives in roboco/api/deps.py, same as the other route auth test files' already-updated pattern (test_deps.py); repointed both patches there. Verified via a full tests/unit/api/ + tests/unit/conventions/ test_route_helper_placement_batch_a.py run: 605 passed, 18 skipped (Postgres-gated), 1 pre-existing failure unrelated to this diff (test_cloud_auth.py's oauth2-form test needs a live production DB connection, not available in this sandboxed workspace). * [4baffaa3] docs(api-routes-schemas): reflect batch-A route-helper relocation into services/schemas/deps --------- Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech> Co-authored-by: Backend Documenter <be-doc@roboco.tech>	2026-07-30 10:30:13 +00:00
3 people	cfde4369b1	Token optimization levers — claim-scoped briefing, payload caps, role-scoped optimal, notification-spawn cooldown (#292) ... * feat(gateway): claim-scoped context briefing — heavy sections only on context-acquisition verbs * feat(gateway): cap unbounded LLM-facing payloads — embedded diffs, notification bodies, handoff journal content, north star * feat(mcp): role-scope the optimal server's tool groups; index management becomes dev/test-only * feat(mcp): cap per-result content on kb/error/learning search, mentor sources, rag citations * refactor(gateway): extract heavy-briefing sections + clip helper to keep xenon ranks * feat(orchestrator): cross-tick cooldown for notification-triggered spawns * feat(usage,orchestrator): scope spawn-waste to anthropic sessions; cap agent Bash output via settings env * docs: claim-scoped briefing, payload caps, optimal role-scoping, notification-spawn cooldown * test(mcp): type the mixed-item cap fixture explicitly * fix(orchestrator): lazy-init the notification-spawn cooldown store * fix(lifecycle): admin-override claim reconciliation + PM request_changes verb (S6 postmortem B3+B4) B3 — admin_set_status now reconciles claim ownership when leaving BLOCKED: review/queue targets clear claimed_by/claimed_at/active_claimant_id and consume the pre-block snapshot (a stale escalation claim was stranding the next claimant: give_me_work handed the task out while note() bounced not_authorized — the live b8fe0494 wedge). The pending/in_progress restore path also syncs active_claimant_id, and a REST PATCH unassign releases the claim with it. B4 — new PM verb request_changes: awaiting_pm_review -> needs_revision with concrete issues. The PM previously had no reject at merge review (only complete/escalate), so an AC/scope violation looped i_am_blocked->escalate 4x live. Full vertical: lifecycle transition + ActionSpec + IntentSpec, TaskService.request_changes (routes like a QA fail — original dev for a leaf, revision PM for assembled; issues appended to dev_notes), verb-runner compose, choreographer verb (spec gate + non-empty issues + soup check + a2a delivery of the reject reason), HTTP routes on both PM flows, MCP tool, journal:decision tracing, PM prompts, regenerated lifecycle artifacts. * fix(panel): stop scorecard fetches for fallback-roster placeholder ids useAgents() serves the static AGENT_ROSTER (ids "1".."22") while agent definitions load; the Scorecards tab fetched a member scorecard per row immediately, firing 22 guaranteed-422 requests per refetch cycle. Through the browser's per-origin connection limit those queued every metrics-page query behind them (~10s of skeletons on every tab). Gate the fetch on a real member id (agent UUID or the "ceo" alias). * Upgraded uv.lock * fix(sequencing): declared deps become real edges + full loop-breaker coverage + assembled-branch freshness (S6 postmortem B1/B2/B6 + breaker) B1a — code delegations REQUIRE a collision surface: new TASK_AT_DELEGATE completeness spec (conditional FieldRequirement, when=('task_type','code')) enforced at the gateway delegate gate. A no-surface code sibling is 'parallel to everything' by analyzer design, which is how two devs ran the CEO's explicitly-ordered work out of order (f3e1afc5: seq#1 started before seq#0, zero dependency edges). PM prompts updated; REST/manual creation (TASK_AT_CREATE) unchanged. B1b — the CEO's declared 'Depends on' lists become real edges: DraftSurface gains declared_depends_on; SequencingService.analyze unions declared edges (validated: self/out-of-range rejected) with the derived collision rules, cycle-checked by the existing toposort. confirm_live_batch/preview_batch map each draft's depends_on through (string indices coerced); intake tool doc + prompter role prompt instruct verbatim copying. The live S6 root got 1 of its 3 declared in-batch edges and started alongside still-running R3. Breaker coverage — the progress-aware respawn circuit breaker (_pm_respawn_should_gate: strike counting, status-advance reset, tracing-gap budget, DB durability, one-shot CEO notification) was consulted by only 3 spawn paths; the doc/QA/dev/PR-review/PR-gate/revision/board paths spawned unguarded at fixed cadence (the 26-respawn fe-doc loop, ~$7.20). Now consulted at every task-keyed spawn site (14 total). B2 — assembled-branch freshness: submit_up/submit_root auto-sync the assembled branch when it has fallen behind its base (children are terminal at submit time, so the rebase is safe; master is never written). A rebase conflict is a hard reject naming the files instead of a blind re-review — kills the needs_revision↔awaiting_pr_review ping-pong of re-submitting a stale head. Leaf i_am_done already had the behind-base gate; claim-time fetch-fresh cut already existed. B6 — documenter revision-pass loop: the awaiting_documentation bail rejections (i_am_blocked/unclaim) now name the actual exit (i_documented re-affirm) and the documenter prompt gets an explicit revision-pass rule. * fix(orchestration): assembly-integrity gate + dispatcher heartbeat (incidents #11, #1) Assembly integrity — submit_up/submit_root refuse when a completed child's commits are not patch-present in the assembled branch (git cherry — rebase-safe; branch pruned after merge or any git error fails open). Live incident #11: a completed revert subtask's merge was lost from the cell branch and the review gate re-flagged the exact violation the revert fixed, spawning another revision cycle. Dispatcher heartbeat — a dispatcher.alive audit row every 5 minutes from the dispatch loop. The 2026-07-01 outage was 4h25m of fleet-wide silence with no way to distinguish 'loop dead' from 'no work'; the loop's stdout died with the container while audit_log survives. CHANGELOG for tonight's full sweep included. * style: ruff format for the orchestration sweep * refactor(gateway): fold the assembled-submit guards + trim complexity under the xenon gate _assembled_submit_guards combines the #11 integrity check and B2 freshen for submit_up/submit_root; lifecycle's invalid-source remediate and git's per-child cherry probe extracted into helpers. Test harnesses built via __new__ stub the respawn tracker (the breaker now runs on their paths). --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-02 05:46:01 +02:00