All three compose files must carry the same app env; the registry one had
external-PR but was missing the self-heal block. Add it (identical to the build
compose) so docker-compose.yml / .yaml / .registry.yml agree — the registry
file still differs only in image source (registry pulls) and host-env paths.
Both compose files are git-TRACKED, and Docker picks docker-compose.yaml over
.yml — so the NAS reads the .yaml. The self-heal env (and prior changes) had
only been committed to the .yml, leaving the tracked .yaml stale in the repo.
Commit the .yaml so both carry the same config. Going forward: commit BOTH.
It's a monorepo registered as three cell-projects (BE/FE/UXUI) sharing one
git_url, so the CI signal is identical whichever is named; point self-heal at
roboco-api. Overridable via ROBOCO_SELF_HEAL_PROJECT_SLUG. Mirrored into the
untracked .yaml.
Plumb the self-healing knobs into the orchestrator service so a NAS deploy is
configured without hand-editing env: both toggles default OFF (armed from
Settings -> Feature Flags), the CI signal is scoped to ci.yml (RoboCo has
several workflows, so the unscoped "latest completed run" would be
unreliable), and PROJECT_SLUG is left for the deployment to set (which
registered project IS RoboCo). Mirrored byte-identically into the untracked
docker-compose.yaml the NAS uses.
Two hardening fixes from the gap review:
- Optional self_heal_ci_workflow scopes the CI signal to one workflow file
(the workflow-scoped Actions endpoint). Without it, "latest completed run
across all workflows" could miss a red CI run masked by a later passing
workflow, or false-trigger on a non-CI workflow — unreliable on a
multi-workflow repo.
- The loop logs a warning when self-heal is armed but self_heal_project_slug
is unset, so a misconfiguration isn't mistaken for "all green".
Tests cover the workflow-scoped endpoint.
Adversarial review found the load-bearing invariant broken at the dispatch
layer: _dispatch_pm_work skipped only PR_REVIEW_SOURCES, so a PENDING
team=main_pm self_heal task (assigned_to=None, confirmed_by_human=False) was
routed to Main PM and spawned BEFORE the CEO approved it — the "never start
until you approve" promise didn't hold.
Fix: the PM dispatcher now also skips source='self_heal' while
confirmed_by_human is False (before the assigned/unassigned split, so it holds
either way); the task still shows in the panel so the CEO can see and approve
it. approve_and_start flips confirmed_by_human=True (the CEO's start IS the
human confirmation), so it dispatches normally afterward. Other sources are
unaffected.
Tests: a unit test that the dispatcher holds an unconfirmed self_heal task but
routes a confirmed one and ordinary tasks, plus a DB test that approve_and_start
flips the gate. (The readiness gate was deliberately not used — a blocker there
marks the task `blocked`; the dispatch skip leaves it cleanly PENDING.)
The CI telemetry call is the feature's only real-world I/O and was previously
exercised only through a fake source. Cover the GitHub Actions request shape
(/actions/runs, branch/status/per_page, auth) and response parsing, plus the
safe-None paths (missing token, GitHub error, no runs).
Add self_heal_enabled (detect + notify) and self_heal_originate_enabled (also
open fix tasks) to the panel feature-flags registry + card, so the loop can be
armed/disarmed from Settings instead of editing env. Effect is on the next
restart, like the other flags; the self_heal_project_slug target (which repo is
RoboCo) stays a deployment env setting.
Register _self_heal_loop alongside the other background loops (created in
start, cancelled in stop). It returns immediately unless self_heal_enabled, so
a standard deployment adds zero behaviour and makes no CI call; when on it runs
one engine cycle per interval and commits any opened fix task. A test pins the
default-off dormancy (no sleep / CI / DB when disabled).
Behind the second opt-in (self_heal_originate_enabled), a detected regression
also opens a fix task into RoboCo's own delivery lifecycle and STOPS: PENDING,
unassigned, confirmed_by_human=False, team=main_pm, source=self_heal, with
synthesized acceptance criteria and a self_heal_fp= dedupe marker. It rides the
normal dispatchers only once the CEO Approve-&-Starts it; the loop itself never
calls start / approve / merge / deploy.
- TaskService: SELF_HEAL_SOURCE, extract_self_heal_fingerprint, and
list_open_self_heal_tasks (the dedupe + open-cap basis)
- SelfHealEngine._originate: per-signal fingerprint dedupe, per-cycle and
rolling open-task caps, repo resolved to RoboCo's own project (notify-only
when it can't be resolved)
- 7 DB-backed tests including the never-start / never-approve invariant
The detect side of the self-healing loop, modeled on the strategy engine: a
pure assess() turns breaching telemetry samples into RegressionObservations
(with a stable per-signal fingerprint for later dedupe), and run_cycle() is a
no-op unless self_heal_enabled and otherwise only sends the CEO one
ack-notification per regression. Detect + notify only — it never originates,
starts, merges, or deploys; the telemetry source is injectable for testing.
6 unit tests.
First slice of the production self-healing loop: a read-only telemetry source
that watches RoboCo's OWN repo CI and normalizes the latest GitHub Actions run
conclusion into breach / no-breach samples for the regression detector. It
targets only the single project named by self_heal_project_slug — RoboCo
healing itself, never other/client repos; the org's repo-agnostic delivery flow
is untouched.
- config: self_heal_enabled / self_heal_project_slug / self_heal_originate_enabled
plus interval and open-task / per-cycle caps, all default-off
- GitService.get_latest_ci_conclusion: per-project Actions-run lookup (graceful
None on missing token / no runs / error; never raises into the loop)
- TelemetrySample + TelemetrySource contract + GitHubCITelemetrySource
- 5 unit tests
The first pass under-represented the release. Make the inbound-PR-review
scope explicit (real GitHub review, author allowlist, head-SHA re-review,
repo-aware polling, 22nd agent with its own image, migration 037); add the
PR-reviewer respawn-loop fix and supersede close-on-land hardening to
Fixed; and note the richer agent-facing RAG docs (new Prompter / Secretary
/ PR-reviewer role docs + the company layer) under Changed.
Bump the version to 0.6.0 across pyproject, the package, the config, and
the panel, and add the 0.6.0 CHANGELOG entry: inbound external/internal PR
review with a CEO decision queue and supersede, the panel feature-flags
card, the required-cells decomposition gate, the CEO-rejected
coordination-root deadlock fix, the panel UI pass, and registry-image
deploy.
Also refresh the locked dependencies, update the release-tag examples in
the README and deployment docs, and correct the package docstring's agent
count to 22.
The cell-pm role doc showed delegate with a nonexistent nested body={...}
and omitted covers_parent_criteria, so an agent following it would make a
malformed call and burn turns rediscovering the real shape. Both PM docs now
match the actual flow_server.delegate signature (flat keywords, with
covers_parent_criteria; the subtask inherits the parent's project — resolved
from the product cell→project map for coordination roots, never passed).
Also document reassign (cell PM could call it but it was undocumented) and
cross-link the two roles: cell-pm explains submit_up hands finished work to
Main PM; main-pm explains the receiving side — the integration-branch chain,
that its complete on the root opens the master PR, and that only Main PM and
the CEO act on master.
The business-workflow chapter said neither capability has a panel switch —
no longer true once the Feature Flags card shipped. Reframe both as
panel-toggleable (effect on next restart), with the env vars kept as the
same toggles at the source plus the bits the panel doesn't surface (the
research provider and its server-side API key).
Real-Postgres round-trips for the external/internal PR-review TaskService
helpers that the existing mock tests can't prove actually persist:
- ingest_external_pr — create-once, head-SHA dedup (unchanged head skips),
and re-review on a new head; internal_pr source wording;
- pr_review_claim / complete_review — the planless, branchless
pending -> in_progress -> completed lifecycle, with re-claim / re-complete
no-ops and the "complete requires in_progress" guard;
- create_supersede_umbrella / find_supersede_umbrella — created on the same
repo (not parented), idempotent lookup, non-review rejection, and the
pr=5-vs-pr=50 exact-marker disambiguation;
- list_external_pr_reviews — source isolation, the data-layer half of the
dispatcher contract (regular tasks never leak into the review queue).
Writes use flush (not commit) so the rollback-per-test fixture keeps each
case isolated from the others against the shared session-scoped test DB.
Add a Feature Flags card to the Settings page that toggles env-gated
subsystems (external/internal PR review, web research, strategy engine,
pitch provisioning, RAG auto-update, transcript pruning) directly from
the panel instead of hand-editing environment variables.
Flags persist in system_settings as 'true'/'false' and are overlaid onto
the live config singleton at startup; an unset flag keeps its
environment/config default. A toggle takes effect on the next backend
restart — no per-consumer re-routing.
Backend: FEATURE_FLAGS registry + bool validator + get_bool accessor on
SettingsService; feature_flag_effective_values and
apply_persisted_feature_flags; GET /settings/feature-flags; best-effort
startup overlay in the app lifespan.
Frontend: settingsApi.getFeatureFlags / setFeatureFlag and a
FeatureFlagsCard rendered full-width below the settings grid.
A coordination root (team=main_pm, product-linked, no repo) the CEO sends back
lands in needs_revision, but the dev dispatcher skips it (not a cell team) and
the closure path only handles paused parents — so it sat in needs_revision
forever. (NOT a foundation-spec gap: the spec already allows needs_revision ->
claimed for any role.)
- _dispatch_revision_coordination_roots: re-spawn the owning PM for a
needs_revision coordination root so it re-coordinates the revision (registered
in the dispatch loop after PM closure)
- _readiness_check_role_for_status: widen the dev-owned states (needs_revision,
verifying) to also accept cell_pm/main_pm for coordination roots — a pure
widening; normal code tasks stay dev/doc-only
- 16 unit tests (dispatcher decision + readiness widening)
Covers the inbound-PR read surface: list_open_prs normalization + fork/internal
classification (and the recent _fetch_open_prs/_normalize_open_pr refactor),
plus get_pr_diff's diff-media-type request — both with their safe-empty paths
on missing token / GitHub error. The DB-backed paths
(ingest/complete_review/pr_review_claim/supersede umbrella) are covered
separately.
Extend the inbound-PR reviewer beyond external/fork PRs to internal org-repo
PRs that bypassed the agent task-flow (a human-pushed branch). The org's own
in-flight integration PRs are skipped — a live task owns their branch and they
already pass QA + PM review — so the reviewer only flags off-process PRs.
- config: internal_pr_enabled (default OFF, like external_pr_enabled)
- PR_REVIEW_SOURCES = (external_pr, internal_pr); generalize dispatch, dedup,
the decision queue, the git-gate exemption, and supersede to both sources
- TaskService.active_task_owns_branch (skip lifecycle PRs) + ingest source param
with source-aware wording
- poll loop runs when EITHER flag is on; _ingest_pr_if_reviewable picks the
source per PR (external: flag+author-allow; internal: flag+not-task-owned)
- 11 unit tests (decision logic + branch-ownership)
- Kanban card: show the short 8-char task id (full id on hover) instead of the
full UUID, which was one unbreakable token that ran off the card edge
- PR Review queue: render an empty-state card instead of returning null when
empty, so the surface is always visible on the Command Center (matching the
CEO Approval Queue) rather than vanishing when there's nothing to decide
The companion to the prompt rule (60de3499): when the brief explicitly names
cells, the Main PM must create a subtask for each and not silently collapse one
into a neighbour. Records the named cells as a 'required_cells:' marker on the
parent's quick_context (no migration — same pattern as the other markers), and
adds a _pm_uncovered_required_cells_guard at i_am_idle that refuses to idle
while a named cell has no subtask. Inert when no parent carries the marker, so
legacy decompositions are never blocked (mirrors the AC-coverage guard).
TaskService.uncovered_required_cells + extract_required_cells + 7 unit tests.
- Settings: cards reordered to User Info / Appearance / Data & Refresh /
Transcript Retention / Notifications / Connection Info (the 3x2 grid)
- Journals: the page now fills the viewport; the agent list and the entry
detail each scroll inside their own panel — removes the page + list +
fixed-500px triple scrollbar (real layout, not bolted-on magic heights)
- Agent item: distinct per-team avatar with initials, clear selected/hover
states, truncation, focus ring (was a generic icon repeated on every row)
- Kanban: the board fills the viewport and each column's card list scrolls
inside it, so a full Done column no longer overflows down the page
- Projects: drop the misleading Workspace column — it read the legacy
per-project workspace_path (never set in the per-agent workspace model), so
it always showed 'No workspace'
The Start/Send buttons used items-stretch with a fixed-height button, pinning
a cramped button to the top of a tall textarea. Bottom-align the row, give
Start a real primary size and Send a proper square icon button, and cap the
textarea height so the composer reads as a deliberate input.
The PR-review queue only listed COMPLETED reviews and hid when empty, so while
a review was in_progress the panel showed nothing — no sign a review was
happening or where its findings go (the reviewer posts its change-request on
the PR itself). Add TaskService.list_external_pr_reviews (active reviews +
awaiting-decision, minus cancelled/decided/dismissed); the route uses it. The
panel card now shows active reviews with a 'Reviewing' badge and a link to the
PR where the change-request lands, and the Supersede/Dismiss actions only once
the review completes.
Decompose the single docs/how-to.md into an indexed 5-chapter guide under
docs/how-to/: README (index/pitch/teaser/TOC), 01 the company, 02 it starts
with you, 03 the cells build it, 04 the last call and the loop. Image/video
paths rewritten to ../, inter-chapter nav added, the Prompter-build screenshots
preserved. Adds a new chapter 05 — the business workflow: the charter, the
Cockpit, the Secretary, and the web-research / strategy-engine config toggles,
with the end-to-end 'feel it' walkthrough. README links repointed to
docs/how-to/README.md. All image links verified; reflow-check clean.
* [4c179e3a] Add git pull, fetch, and rebase backend endpoints (#190)
* [f966f772] feat(git): add pull, fetch, and rebase endpoints with integration tests (#185)
- Add GitPullRequest/Response, GitFetchRequest/Response, GitRebaseRequest/Response schemas
- Add GitService.pull(), fetch(), and rebase() methods using _network_git_timeout()
- Add POST /api/git/pull, /api/git/fetch, /api/git/rebase route handlers
- Rebase detects conflicts via git diff --name-only --diff-filter=U and aborts cleanly
- Integration tests cover success path and GitCommandError→500 for all three endpoints
- Rebase conflict test verifies conflict=True with populated conflicted_files list
Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev>
* [26e2b7af] test(git): add AsyncMock unit tests for rebase_onto_base conflict-state handling (#186)
New test_git_rebase.py covers three branches of rebase_onto_base:
- success path: rebase exits 0, returns rebased status, abort never called
- conflict path: non-zero exit → diff → abort → returns conflict+files
- resilience: both rebase and abort exit non-zero, still returns conflict dict without exception
All tests use AsyncMock with side_effect sequences to mock _run_git at the service-method level.
Co-authored-by: Backend Developer 2 <be-dev-2@agents.roboco.dev>
---------
Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev>
Co-authored-by: Backend Developer 2 <be-dev-2@agents.roboco.dev>
* [551b1dbf] Panel-wide frontend UI standardization and page fixes (#193)
* [1ec787b2] feat(panel): design-system sweep — full-width layouts, scrollbar fix, Secretary button, component audit (#188)
- Settings page: remove max-w-3xl, wrap cards in grid-cols-1 lg:grid-cols-2 two-column layout
- AI Providers page: remove max-w-5xl so AIRoutingCard fills available width
- Journals AgentList: replace ScrollArea with overflow-y-auto div to eliminate nested scrollbar
- Secretary chat input: add items-stretch to flex row so Send/Start button matches Textarea height
- Component audit: replace all raw <button>/<input>/hand-rolled badge spans outside components/ui/ with canonical Button, Checkbox, Badge variants across 15 files:
- ai-routing-card.tsx: ModeButton → Button, checkbox → Checkbox, badge spans → Badge
- self-hosted-section.tsx: eye-toggle → Button ghost icon-sm, badge spans → Badge
- journals/agent-item.tsx, communications/channel-item.tsx → Button ghost
- kb-search-bar.tsx, kb-filters.tsx → Button ghost
- kb-category-nav.tsx, git-log-panel.tsx → Button ghost
- communications/page.tsx (channel + group lists) → Button ghost
- projects/project-table.tsx, products/product-table.tsx → Button link
- git-branch-panel.tsx (local + remote lists) → Button ghost
- tasks/dependency-selector.tsx: Button ghost + Checkbox for visual indicator
- tasks/task-table.tsx: sortable header + expand toggle → Button ghost
- business/goals-tab.tsx: hidden button → Button
Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev>
* [435b37b4] feat(metrics,notifications): URL-persisted tab state, semantic chart colors, humanized counts (#187)
- Notifications page: replace useState with useSearchParams/useRouter for
?tab= URL parameter (all/unread/pending, default: unread); Suspense wrapper
with skeleton fallback for SSR compatibility.
- Metrics page: split into Performance tab (Velocity + Task Status + Agent
Status + Team Health) and Token Usage tab (TokenUsageCostsSection) with
?tab= URL parameter (default: performance); Suspense wrapper; Refresh button
moved inside PerformanceTabContent; humanizeCount() helper applies K/M
suffixes to all MetricCard numeric values >= 1000.
- Chart components (usage-time-series, agent-usage, team-usage, model-donut):
replace var(--chart-N) CSS vars with explicit semantic hex colors —
#3b82f6 blue for informational, #f59e0b amber for warning/pending,
#22c55e green for success/healthy, #ef4444 red for error/blocked,
#a855f7 purple for supplemental.
pnpm lint and pnpm typecheck pass with zero new errors.
Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev>
* [ccd256f4] Kanban mobile viewport: 375px layout, column navigation, 44px touch targets (#191)
* [ccd256f4] feat(kanban): mobile 375px layout with column navigator and 44px touch targets
- KanbanBoard: add activeColumnIndex state + mobile prev/next column
navigator (lg:hidden); existing horizontal-scroll layout hidden on
mobile (hidden lg:flex). Desktop DnD behavior unchanged.
- KanbanColumn: add optional className prop (cn-based) so mobile view
can pass w-full/sm:w-full to fill the viewport.
- KanbanCard: bump all action buttons to min-h-11 (44px) touch targets
(Assign, Pass, Fail, Move-forward).
* [ccd256f4] fix(kanban): change breakpoint from lg to sm for mobile/desktop layout switch
AC3 requires >=640px viewport to show multi-column layout (sm: breakpoint).
Previous impl used lg: (1024px), leaving 640-1023px in single-column mode.
Change:
- Mobile navigator div: lg:hidden → sm:hidden
- Desktop multi-column div: hidden lg:flex → hidden sm:flex
At <640px: single-column with prev/next navigator (375px mobile use case).
At >=640px: full horizontal-scroll multi-column layout (per AC3).
DnD behavior and all other layout unchanged.
---------
Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev>
* [23f02af4] Agents page On-Demand section + Board composition; Overview Quick Actions visibility + Team Health Intake/Secretary (#189)
* [23f02af4] feat(agents,overview): On-Demand section, Board composition fix, Intake/Secretary in Quick Actions + Team Health
- agent-definitions.ts: remove AgentRole.MAIN_PM from getBoardAgents
(Main PM has its own dedicated section; including it there was redundant).
Add getOnDemandAgents() that catches agents not in any standard team
(board/main_pm/backend/frontend/ux_ui/marketing) and not a standard cell
role — surfaces prompter/intake agents that the API may return.
- agents/page.tsx: import getOnDemandAgents; add a conditional
'On-Demand Agents' AgentGrid section (only rendered when the API returns
at least one matching agent, e.g. the Intake interviewer).
- quick-actions-bar.tsx: add 'Task Intake' button (→/prompter, Sparkles
icon) and 'Secretary' button (→/business?tab=secretary, Bot icon)
alongside existing quick actions so operators can reach on-demand agents
from the Overview in one click.
- team-health-cards.tsx: add OnDemandAgentCard sub-component (link card
with On-Demand badge) and render static cards for 'Task Intake' and
'Secretary' appended after the API-driven TeamHealthCard list, giving
them equal visual presence in the Team Health section.
pnpm lint and pnpm typecheck pass with zero new errors.
* [23f02af4] fix(agents,overview): QA revision — enum entries, QuickActions placement, On-Demand title, Board PR_REVIEWER
AC3: types/index.ts AgentRole enum adds PR_REVIEWER, PROMPTER, SECRETARY.
agent-selector.tsx ROLE_LABELS exhaustive Record updated accordingly.
AC4: command-center.tsx QuickActionsBar moved to after Team Health section,
before CEO Approval Queue and data-heavy grid rows — visible without
scrolling on a 900px viewport.
AC1: agents/page.tsx On-Demand AgentGrid title fixed to 'On-Demand'
(was 'On-Demand Agents' in prior commit).
AC2: agent-definitions.ts getBoardAgents adds explicit PR_REVIEWER inclusion
and uses inclusion-based getOnDemandAgents (PROMPTER|SECRETARY roles).
AC5: team-health-cards.tsx static OnDemandAgentCard implementation refined
with correct fallback rendering when no API team data.
AC6: pnpm lint and pnpm typecheck (src only) pass with zero new errors.
---------
Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev>
Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev>
* [b1c59206] Git page: Pull, Fetch, Rebase buttons wired to backend; Rebase destructive confirmation dialog (#192)
* [b1c59206] feat(git): add Pull, Fetch, Rebase operations to Git page with destructive confirmation dialog for Rebase
- Add GitPullRequest/Response, GitFetchRequest/Response, GitRebaseRequest/Response types
- Add gitApi.pull(), gitApi.fetch(), gitApi.rebase() with mock stubs for /git/pull, /git/fetch, /git/rebase
- Add useGitPull, useGitFetch, useGitRebase mutation hooks with cache invalidation; exported via useGitOperations
- Add Pull (Download icon), Fetch (RefreshCcw icon), Rebase (GitGraph icon) buttons to GitActionsPanel
- Rebase button triggers AlertDialog with destructive confirmation before calling API
- Wire handlePull, handleFetch, handleRebase handlers in git-browser.tsx with toast feedback
* [b1c59206] fix(git): add destructive styling and branch name to Rebase AlertDialog
- Add className='border-destructive bg-destructive/5' to AlertDialogContent
so the dialog container has the required red-tinted styling (AC3)
- Update AlertDialogDescription to interpolate status?.current_branch so
the dialog body explicitly names the branch being rebased (AC3)
---------
Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev>
---------
Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev>
Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev>
* [3f305ed9] Frontend: Fix git control contract, complete Secretary restyling, and apply polish (CEO revision) (#199)
* [72de8a65] fix(git): correct Pull/Fetch/Rebase types, API mocks, request fields, and toast handlers (#197)
- types/git.ts: GitPullResponse and GitFetchResponse now have current_branch,
has_changes, staged_files, unstaged_files, untracked_files, ahead, behind
(matching backend GitStatusResponse); removed nonexistent commits_received/
refs_updated/remote fields
- types/git.ts: GitRebaseRequest now uses target_branch: string (not onto?: string);
GitRebaseResponse now has conflict: boolean and conflicted_files: string[]
(removed branch/onto/commits_rebased); task_id made optional on all three
request types
- lib/api/git.ts: Updated mock returns for pull/fetch/rebase to match new types
- git-actions-panel.tsx: onRebase prop now (targetBranch: string) => void;
Rebase AlertDialog now contains an Input for target_branch; AlertDialogAction
disabled when targetBranch empty and passes the value to onRebase
- git-browser.tsx: handlePull and handleFetch toast references result.current_branch;
handleRebase accepts targetBranch, sends target_branch in payload, toasts
result.conflict and result.conflicted_files; no 'manual' task_id for any
pull/fetch/rebase operation
Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev>
* [be6a17fc] feat(ui): design-system polish — chart tokens, KB aria-label, Kanban touch targets (#196)
- kb-search-bar.tsx: add aria-label="Clear search" to the clear (X) button
- model-usage-donut.tsx: replace hex CHART_COLORS with var(--chart-1)…var(--chart-5)
- usage-time-series-chart.tsx: replace hex stopColor/stroke with var(--chart-1)/var(--chart-2)
- agent-usage-chart.tsx: Bar fill hex → var(--chart-1)
- team-usage-chart.tsx: Bar fill hex → var(--chart-1)
- kanban-card.tsx: min-h-11 → max-sm:min-h-11 (44px touch target mobile-only, 3 buttons)
- secretary-tab.tsx: already compliant (Button + design-system tokens), no change needed
Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev>
---------
Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev>
Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev>
* [d62036bd] Backend: Fix git endpoint schemas, add safety gates, and unit tests (CEO revision) (#200)
* [d0593fe3] feat(git): remove agent_id from schemas and add service-layer safety gates (#195)
- Remove agent_id field from all 9 git request schemas (GitCreateBranchRequest, GitCheckoutRequest, GitCommitRequest, GitPushRequest, GitCreatePRRequest, GitMergePRRequest, GitPullRequest, GitFetchRequest, GitRebaseRequest); agent identity comes from JWT auth context
- Make task_id Optional[UUID]=None in GitPullRequest, GitFetchRequest, GitRebaseRequest
- Add field_validator to GitRebaseRequest rejecting target_branch starting with '-' or equal to 'master'/'main'
- Add lightweight PullRequest, FetchRequest, RebaseRequest schemas for gateway layer
- Add dirty-workspace check to GitService.pull() (raises ValidationError if porcelain output)
- Switch GitService.pull() to --ff-only; raises ValidationError with diverged-branch message on non-zero exit
- Add master/main guard to GitService.rebase() for both head_branch and target_branch
- Update callers: routes/tasks.py (2x), services/task.py, tests/unit/services/test_git.py (2x)
Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev>
* [a2f96961] Add role-gated rebase endpoint and unit tests (test_git_rebase.py) (#198)
* [a2f96961] feat(git): add role-gated rebase endpoint and unit tests
Add role-gate to POST /rebase restricting access to DEVELOPER and
CELL_PM roles; add master/main protected-branch guard to
GitService.rebase() before any git subprocess runs; add 4 unit tests
in tests/unit/services/test_git_rebase.py covering both
target-branch and head-branch REBASE_FORBIDDEN cases
* [a2f96961] fix(git): invert rebase role gate, add ownership check, schema validator, and missing tests
- _REBASE_ALLOWED_ROLES changed from {DEVELOPER, CELL_PM} to {CEO, CELL_PM, MAIN_PM}
so developers correctly receive 403 per AC1/AC2
- rebase_branch() now verifies task ownership for non-CEO PM callers: if task_id
is provided and the task is not assigned to the calling agent, returns 403/404
- GitRebaseRequest.target_branch gets a @field_validator rejecting '-' prefix
names and protected branch names (main, master, develop)
- GitService.pull() gains pre-flight safety gates: raises ValidationError
DIRTY_TREE when staged/unstaged changes exist, DIVERGED_BRANCH when
ahead > 0 and behind > 0
- test_git_rebase.py adds 9 new tests: pull() dirty-tree ValidationError,
pull() diverged-branch ValidationError, pull() success path, schema
validator for '-' prefix and protected names, and route-level tests
confirming HTTP 403 for DEVELOPER and HTTP 200 for CELL_PM on POST /rebase
* [a2f96961] fix(tests): add type annotations for tuple variables in test_git_rebase.py
mypy needs explicit tuple type annotations when assigning bare tuples
to variables used as mock side_effect return values — fixes var-annotated
error caught by the server-side quality gate
---------
Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev>
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
---------
Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev>
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* [94015c6d] Frontend R3: Fix legacy git taskId coercion + rebase placeholder + phantom fields (#204)
* [401ddb40] fix(git): remove phantom fields from GitPullRequest/GitFetchRequest and make task_id optional in write request interfaces; use taskId || undefined in git-browser.tsx handlers to avoid 422 errors when no task context is active (#201)
Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev>
* [cca8d0c0] fix(git): fix rebase placeholder and surface backend error in toast (#202)
git-actions-panel.tsx: change rebase target_branch Input placeholder
from "e.g. main or origin/main" to "Remote ref (e.g. origin/HEAD)" so
no default branch name (main/master/develop) is suggested.
git-browser.tsx: import getErrorMessage from @/lib/api/client and use
it in handleRebase catch block instead of the hardcoded string "Failed
to rebase". getErrorMessage extracts the real detail from
AxiosError.response.data.detail and falls back to a non-empty generic
message, satisfying both the detail-surfacing and fallback criteria.
Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev>
---------
Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev>
Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev>
* [1ea0fbcb] Backend R3: Relax legacy git schemas + fix integration tests (#206)
* [219c539b] Make task_id Optional in git request schemas and update service methods (#205)
* [219c539b] feat(git): make task_id Optional in git schemas and add None-guards in service methods
- GitCommitRequest, GitPushRequest, GitCreatePRRequest, GitMergePRRequest now have task_id: UUID | None = None
- commit_for_task, push_for_task, create_pr_for_task, merge_pr_for_task skip ownership/state checks when task_id is None and proceed to the git operation
- Added 16 unit tests in tests/unit/api/routes/test_git_optional_task_id.py covering schema validation and HTTP endpoint responses
- Added 4 integration tests in tests/integration/test_git_routes.py for no-422 behaviour
- All quality gates pass: ruff format, ruff check, mypy, pytest
* [219c539b] fix(tests): remove unused type-ignore comments, redundant cast, and invalid agent_id kwarg in git_optional_task_id unit tests
---------
Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev>
* [de95ce94] test(git): fix 3 rebase integration tests to use non-protected target_branch (#203)
- Add pm_git_client fixture (CELL_PM role) needed for the role-gated rebase endpoint
- Change target_branch from 'main' to 'develop' in test_rebase_success, test_rebase_conflict, and test_rebase_git_command_error
- Remove task_id from request bodies (optional field; random UUIDs trigger 404)
- Switch all 3 rebase tests to use pm_git_client instead of git_client
Co-authored-by: Backend Developer 2 <be-dev-2@agents.roboco.dev>
---------
Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev>
Co-authored-by: Backend Developer 2 <be-dev-2@agents.roboco.dev>
* chore: ruff format test_agent_image_registry.py (unblock quality gate)
---------
Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev>
Co-authored-by: Backend Developer 2 <be-dev-2@agents.roboco.dev>
Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev>
Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev>
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
pr_reviewer was absent from GATEWAY_ENABLED_ROLES, so the spawn mounted no
tool-manifest and set ROBOCO_GATEWAY_ENABLED=false. The reviewer booted with
no flow verbs, could never claim its external-PR task, exited, and was
respawned on the same task every tick — an endless loop that burned tokens.
Add pr_reviewer to the set, plus a regression invariant asserting every
spawnable seeded role has a manifest (only the never-spawned roles —
prompter/secretary/ceo/system — may be absent) and a direct pr-reviewer-1
manifest test checking its claim_pr_review/post_pr_review verbs are present.
The panel half of the PR-review gate. A PrReviewQueue card on the Command
Center lists external PRs the org has reviewed and awaiting the CEO's call,
each with Supersede / Dismiss / View-on-GitHub. Hidden when empty.
- tasksApi.getExternalPrReviews / supersedeExternalPr / dismissExternalPr,
typed to the exact backend response shapes (GET /tasks/external-pr-reviews,
POST /tasks/{id}/supersede-external-pr, POST .../dismiss-external-pr).
- Mock mode returns [] so the queue hides and the actions are unreachable —
no mock-masked contract (the #194 trap avoided; verified FE paths/shapes
against the real routes + route ordering).
A notification can't be the gate: the reviewer is read-only and the CEO
decides what happens next. Backend for a real PR-review decision queue:
- post_pr_review now notifies the CEO (send_external_pr_reviewed_notification,
APPROVAL/HIGH, related_task_id) the moment a review lands — server-side
best-effort (the reviewer has no notify verb).
- TaskService.list_external_pr_reviews_awaiting_decision(): completed
external_pr reviews the CEO has neither superseded (confirmed_by_human) nor
dismissed (quick_context dismissed=1 marker).
- TaskService.dismiss_external_pr_review(): CEO declines → marker → leaves queue.
- GET /api/tasks/external-pr-reviews (PM+/CEO) and CEO-only
POST /api/tasks/{id}/dismiss-external-pr. Supersede already exists.
Panel queue wiring follows in the next commit.
The reviewer was one-shot: external_review_task_exists deduped on
(project, pr_number) only, so an external PR was reviewed exactly once ever —
a contributor pushing a fix never triggered a re-review (the review went
stale). Drive re-review off the PR's head commit instead:
- list_open_prs now returns head_sha (the change signal).
- ingest records the reviewed SHA as an external_pr_head=<sha> marker in the
review task's quick_context.
- external_review_task_exists is head-SHA aware: same SHA -> skip (unchanged);
new SHA -> open a fresh review (changed); no task yet -> first review;
legacy/markerless task or unknown SHA -> skip (never re-review on a guess,
so existing reviews don't re-fire after deploy).
No migration — reuses quick_context, like the supersede markers.
Multiple projects can map to ONE repo — a monorepo product's backend/
frontend/ux cells each have their own Project pointing at the same git_url.
The poll ingested per-project with a per-(project,pr) dedup, so one external
PR (e.g. #170 on github.com/rennf93/roboco) created one review task per cell
project — three identical reviews for the same PR.
Collapse active projects to one canonical project per distinct repo before
polling (_projects_one_per_repo, deterministic by slug so the pick is stable
across polls). A monorepo product now yields ONE review per external PR;
genuinely separate repos (multi-repo) each still get polled.
The build compose got ROBOCO_EXTERNAL_PR_ENABLED (default true) but the
registry compose's orchestrator env was missed, so a pull-based deploy would
have defaulted it off — inconsistent. Add the same external-PR block so both
deploy paths behave identically.
Wire the external-PR settings into the orchestrator env in both compose
files: ROBOCO_EXTERNAL_PR_ENABLED defaults to true (overridable via .env),
with require_human_confirm kept true and the poll-interval/allowlist knobs
documented inline. The config default stays off (safe for library use); the
deployment compose turns the read-only review on. The code default is
unchanged — only the shipped compose flips it.
Read-only: enabling this only discovers inbound external/fork PRs and posts
one change-request. The supersede that builds contributor code is still
CEO-triggered and human-confirm gated.
pr-reviewer-1 was the one agent with no dedicated image and no compose
builder service — it reused roboco-agent-base, which left it absent from the
compose files entirely (so it looked like the PR reviewer simply was not
there). Make it first-class for parity: add docker/agent-pr-reviewer.Dockerfile
(FROM the base — read-only reviewer, no extra toolchain), an
agent-pr-reviewer-image builder service in both compose files and the registry
compose, the image in the release workflow's publish list, and map
pr-reviewer-1 -> roboco-agent-pr-reviewer in the orchestrator plus its
lazy-build dockerfile map. Supersedes the earlier base-reuse mapping.
scripts/reflow_md.py joins hard-wrapped markdown prose to one line per
paragraph, leaving code fences, tables, headings, blockquotes, and front
matter byte-identical, and refusing to touch any file whose non-whitespace
token sequence would change (so it can only ever edit whitespace). Add
`make reflow-docs` (apply) and `make reflow-check` (fail if any in-scope doc
is hard-wrapped), and wire reflow-check into `make quality` so CI keeps the
manual ~75-char line breaks from creeping back in.
Markdown and editors soft-wrap on their own, so the manual ~75-char line
breaks across the docs added nothing but noise. Join wrapped prose, list
items, and paragraphs into single lines across 67 docs — README, CLAUDE.md,
deployment, usage, the RAG knowledge base, and the agent role prompts.
Whitespace-only: code fences, tables, and blockquote alerts are byte-identical
and the change is token-verified (no content altered). Applied with a
deterministic reflow tool (committed separately).
Also lands two doc edits that were awaiting commit: the measured under-load
resource numbers in usage.md and the pr_reviewer additions to the
org-structure RAG doc.
pr-reviewer-1 was the only role without an AGENT_IMAGES entry, relying on
the silent base-image fallback — which reads as a missing image. It is a
read-only reviewer (diff via API, grep, post one change-request; never runs
code), so the base image is the right fit. Map it explicitly to
AGENT_BASE_IMAGE so the choice is visible; no new image is built or
published. Behavior unchanged (get_agent_image still returns base).
The verb table predates both roles. Add pr_reviewer (give_me_work,
claim_pr_review, post_pr_review — read-only reviewer) and secretary
(human-only, i_am_idle only), note their content-tool restrictions, and
correct the canonical-source reference to lifecycle.intents_for_role.
A panel-wide UI task that asked for the UX/UI and Frontend cells was
decomposed into Backend + Frontend only — the Main PM judged the UI work
collapsible into Frontend and dropped UX/UI entirely. Its prompt gave full
cell discretion ('you decide which cells', 'most roots only touch one
cell') with no rule to honor cells the brief names.
Add a rule: when the brief, acceptance criteria, or PO/HoM handoff
explicitly call for a cell, the Main PM must create a subtask for each
named cell and never collapse one into a neighbour — its discretion covers
only un-named scope; a genuinely-unnecessary named cell must be confirmed
via escalate_up/dm, not silently dropped. Matching anti-pattern added.
The companion finding (cross-dev sequencing) needed no change: the Cell PM
prompt already keeps dependent units in one dev's lane and splits only
independent units, and cross-cell order is enforced by the dependency_ids
gate, not sequence.
README + deployment guide now show three ways to run RoboCo — pull the
pre-built images (docker-compose.registry.yml), build from source, or the
local-dev flow — instead of only the dev path. Add the ROBOCO_REGISTRY /
ROBOCO_VERSION knobs and the required ROBOCO_ENCRYPTION_KEY (which was
missing) to .env.example, and fix a stale piragi reference there.
usage.md drops the unmeasured per-agent RAM ceiling and records the figures
measured on the live stack: RAM is low and Ollama-dominated, storage is the
real cost (images share the agent-base layer). Idle numbers — peak under an
active task is best read live with docker stats.
The orchestrator spawned agents only by bare image names and built any
missing image from source on the host, so a deployment had to carry the
build context and a toolchain — there was no way to just pull and run the
images the release workflow publishes.
Add two settings (default empty = unchanged local-build behavior):
ROBOCO_AGENT_IMAGE_REGISTRY and ROBOCO_AGENT_IMAGE_TAG. When a registry is
set, the orchestrator spawns and ensures {registry}/roboco-agent-*[:tag] and
pulls (never builds) any image it lacks. Also adds the previously-missing
agent-secretary image to the lazy-build map.
Ship docker-compose.registry.yml: a standalone compose that pulls every
published image (GHCR or Docker Hub, pinnable version) and wires the
orchestrator to spawn the matching pre-built agent images. The existing
build compose files are unchanged.
The secretary agent image landed with the company layer (0.4.0) and is
built by docker-compose + referenced by the orchestrator, but the release
workflow's publish list was never updated, so it was absent from GHCR and
Docker Hub. Add it so a pull-based deploy has the full image set.
Add the 2.5-hour 'Working with RoboCo' build session (a conversation to a
shipped feature) as a second hero thumbnail beside the 26-min intro.
Update the agent count from 20 to 22 across the README, CLAUDE.md, usage,
the base agent prompt, the how-to guide, and the org-structure RAG doc:
the standing org gains the PR Reviewer (board-level, read-only), and the
on-demand Intake and Secretary are now counted. The org-structure doc
gains the PR Reviewer in the hierarchy, count table, board team, and
communication matrix. The historical 0.1.0 changelog entry is left as-is.
Rewrite the resource-usage section: drop the unmeasured per-agent RAM
ceiling (RAM is low and agents run few-at-a-time) and lead with storage —
the image set's shared base layer — which is what docker prune reclaims.
Scope close_pull_request repo resolution by project_id and thread the
umbrella's project into close-on-land, so a contributor PR is never
resolved (or closed) against a same-numbered PR in another project's
repo. Skip the comment + close PATCH when the PR is already closed, so a
retried sweep never re-posts the 'superseded' comment.
Require a non-cancelled descendant that actually landed a PR before
retiring the contributor PR, so an umbrella force-completed over a
cancelled code subtask leaves the contributor's still-valid PR open.
Run close-on-land from the always-on sweeper rather than the default-off
poll loop, so a supersede that lands after the feature is toggled off is
still reconciled. Serialize concurrent supersede triggers under a lock so
a double-click can't cut two branches / spawn two umbrellas. Anchor the
supersede marker checks to the marker line so appended CEO notes can't be
mistaken for the closed/dedup tokens. Make the fork-head branch cut
idempotent (forced refspec) so a commit-fail retry converges.
Also drop an importlib.reload(roboco.config) in a unit test that rebound
the settings singleton and leaked into the PM decision-window test.
When a supersede umbrella reaches COMPLETED (our own PR merged), close-on-land
retires the contributor's PR with a linking thank-you comment:
- TaskService.supersede_umbrellas_pending_close() finds landed umbrellas not yet
marked closed=1; mark_supersede_pr_closed() records the close (idempotent).
- orchestrator._close_superseded_prs runs in the external-PR poll tick: parses
the contributor PR# from the umbrella's quick_context and calls
GitService.close_pull_request(delete_branch=False) — we never touch the
contributor's fork branch. _parse_supersede_pr is unit-tested.
Completes the supersede flow: CEO authorizes -> fork branch -> Main PM -> cell
-> our PR -> CEO merge -> contributor PR closed + linked. ruff + mypy clean
(279); foundation + gateway suites green (5208).
A second adversarial review of the supersede flow found a feature-breaking HIGH
plus correctness gaps:
- HIGH: parenting the umbrella to the review task burned a MAX_TASK_DEPTH level
(review->umbrella->cell-PM->dev = depth 4 > 3), so the dev code task could
never be created and the work never reached a cell. Fix: the umbrella is now a
ROOT task; the contributor PR# + review link ride quick_context (also
simplifies close-on-land — no parent walk).
- MED: no dedup — a repeat CEO trigger created duplicate umbrellas / two racing
PRs. Fix: find_supersede_umbrella() makes the trigger idempotent (returns the
existing umbrella).
- LOW: supersede worked on un-reviewed/cancelled review tasks. Fix: require
review.status == COMPLETED (review-first).
- LOW: a partial failure could orphan a pushed fork branch. Fix: create the
umbrella before the push, and log the branch so any orphan is discoverable.
ruff + mypy clean (279).
Renn F