5 Commits

Include renames

Author	SHA1	Message	Date
3 people	401f8a2cc9	feat(board): Board Programs — the complete twelve-program catalog (Phases 1-3) (#699) ... * feat(board): Pest Control — the first project-scoped Board Program The Product Owner hunts latent defects (what the org records but nobody reads): a weekly cycle — accelerated off-schedule when the trailing-7-day rework rate crosses pest_rework_threshold, with the cheap dedup/scope gates evaluated before the metrics queries — opens one held exploration task against the least-recently-explored opted-in project (deterministic round-robin; opted_in_projects gains a stable ORDER BY), with server- assembled evidence in the spawn prompt (rework hotspots, recurring-findings and waived-minor ledger aggregates, all capped) plus prior-cycle LEARN context. The PO calls the new PO-only propose_bug_hunt verb once: ≤5 items, evidence required per item, targets validated against pest_control participation. CEO decides per item — approve materializes a BACKLOG task (source pest_control, never auto-starts), reject records the reason; both feed the LEARN ledger by exploration task id; all-terminal completes the cycle. Telegram queue pushes carry working Approve/Reject handlers mirroring the roadmap kind. Doctrine: board.md Pest Control section + product-owner verb entry + regenerated verb tables. * feat(panel): Pest Control review queue Command Center gains the pest review queue (per-item approve/reject with reason, mirroring the roadmap queue); the Programs card and the project settings participates-in checkboxes pick the new program up registry-driven — the settings section renders for the first time now that a project-scoped program exists. * feat(board): Periscope — HoM market-research brief program Weekly org-scoped cycle: a solo HoM spawn researches the market (web research with mandatory source URLs — uncited findings are rejected) and files one structured brief via the new HoM-only propose_market_brief verb: headline, cited findings, threats/opportunities, positioning note, all soup-checked and screened through the injection guard at persist time (web-derived text later reaches prompts; flags recorded, content never dropped). A brief is a report, not a proposal: the verb completes the exploration in the same call (the x_feature asymmetry), the cycle ledger auto-closes, and the CEO gets a best-effort notification with no approve/reject surface (periscope deliberately never joins Telegram's action kinds). The latest brief is injected into the roadmap exploration prompt — Periscope feeds Printer, the first cross-role program input. * feat(panel): Market Briefs tab (read-only) Business page gains a Market Briefs tab listing Periscope briefs — headline, cited findings, threats/opportunities — read-only by design; a report has nothing to approve. * feat(board): Coroner — event-triggered Auditor postmortems The first EVENT program: no cron — three best-effort hooks open an autopsy when a task bounces to its 3rd revision (the audit chokepoint), is cancelled after work started, or is budget-blocked; all gated on arming + one-open-autopsy dedup, none can fail the underlying transition. A solo Auditor spawn reads the incident (server-assembled findings + transition context) and files one propose_postmortem: incident summary, root cause, failed stage (validated against the real status vocabulary), and ONE process change — a playbook-kind change drafts via PlaybookService directly into the normal pending-curation queue; the briefed draft_playbook manifest grant was deliberately NOT added, preserving the existing 'auditor curates but never drafts' invariant test. Complete-at-propose (report asymmetry), cycle ledger auto-closes, CEO notified link-only. Integrated as a union with Periscope across the shared program surfaces. * feat(panel): Coroner postmortems card Read-only postmortems list under Business → Programs — incident, root cause, failed stage, process change; nothing to approve, the process-change artifact (a draft playbook) rides the existing curation queue. * feat(board): Sentinel — Auditor drift-watch quality reports Weekly org-scoped cycle: a solo Auditor spawn receives a server-assembled drift context (waived-findings trend, open findings by severity, conventions-violation hotspots, top spend — all capped, pure ORM) and files one propose_quality_report: headline, 1-7 area-validated items with evidence and suggested actions, overall assessment. Report semantics — complete-at-propose, cycle auto-closes, CEO notified display-only (never on Telegram's approve/reject surface); items are structured so a later convert-to-task control is cheap. Integration adopts Sentinel's module- level dict-dispatch for board-program routing (xenon-driven), folding all prior programs in; app router mounting extracted to a helper for the same budget. * feat(panel): Quality Reports tab (read-only) Business page gains the Sentinel quality-reports tab — headline, per-area observations with evidence and suggested actions; read-only, a report has nothing to approve. * feat(board): Spackle — gap-fill audit program Biweekly project-scoped PO cycle over the half-shipped surface area: API routes without panel surfaces (and vice versa), armed flags without docs, docs promises the code doesn't keep, dead-end tabs — the inventory diffing is the PO's own read-tool work, ordered by the spawn prompt with file:line citations required; the server injects only prior-cycle LEARN and the rotation target. Rotation is now a shared module-level helper (pick_rotation_target, parameterized by source) both project-scoped engines use — pest_control delegates to it, behavior-identical, with a cross-pollution test proving the two programs' rotations stay independent. propose_gap_fill mirrors the bug-hunt verb (≤5 items, two-sided evidence required, participation gate); per-item CEO decide materializes BACKLOG source=spackle tasks; full Telegram kind incl. approve/reject handlers. All seven program routers now mount from one helper. * feat(panel): Spackle gap-fill review queue Command Center gains the gap-fill queue mirroring the pest-control one — per-item approve/reject with the two-sided gap evidence rendered. * feat(board): Scales — monthly portfolio rebalance Org-scoped PO cycle over the stale backlog: the spawn receives a capped stale-task snapshot (BACKLOG/PENDING unclaimed >30 days) plus the charter and prior-cycle LEARN, and files one propose_rebalance — 1-7 items, each a resolvable task_ref with action reprioritize (validated new priority) or cancel, rationale required. Per-item CEO decide: approve EXECUTES the action (audited priority update, or the normal cancel path) — the first program whose materializer mutates existing tasks instead of creating them; reject records the reason; LEARN by exploration task id; all-terminal completes the cycle. Full Telegram decide-kind wiring. Integrated as the eight-program union (registry, dict dispatch, routers helper, teardown enumerations). * feat(panel): Scales rebalance review queue Command Center gains the rebalance queue — per-item approve/reject with the action, target task, and rationale rendered. * feat(board): Mirror — quarterly positioning audit Project-scoped HoM cycle over messaging surfaces: README claims vs shipped reality, docs-site promises vs code, charter alignment — the audit is the HoM's own read-tool work with citations required; the server injects the charter, prior-cycle LEARN, and the shared rotation target. propose_ messaging_fixes mirrors the gap-fill verb (≤5 items, drift evidence naming claim + contradicting reality, participation gate); per-item CEO decide materializes BACKLOG source=mirror documentation tasks; full Telegram decide-kind wiring. Nine-program union across the shared surfaces. * feat(panel): Mirror messaging-fixes review queue * feat(board): Megaphone — HoM standing editorial calendar Cron cycle (3 days, org-scoped, gated on X credentials — drafting content nobody can post is pointless): the HoM receives a shipped-this-week digest plus Unreleased changelog bullets and files one propose_editorial_post (angle-validated, ≤280, brand voice) that materializes a held x_editorial draft through the SAME X-queue origination chokepoint release posts use — zero new approval surface, notifications and CEO decide for free. Complete-at-propose; cycle auto-closes. Ten-program union. * feat(panel): x_editorial source labels in the X queue surfaces * feat(board): Librarian — proactive playbook mining Biweekly org-scoped Auditor cycle: mines recurring non-private learning journals (≥2-count grouping with a recency fallback) against the existing playbook-title inventory and files one propose_playbook_drafts — 1-3 drafts, each with the repeated-pattern evidence that justifies it, duplicate titles rejected in-batch and against the live store. Drafts are created via PlaybookService directly (the Coroner precedent — the 'auditor curates but never drafts' do-verb invariant stays intact and tested) and land in the normal pending-curation queue the Auditor's own triage already surfaces; no new panel surface. Complete-at-propose; display-only CEO notification. Eleven-program union. * feat(board): War Room — release campaign planning EVENT program with a REAL originator (unlike coroner's stub): a release publish hooks a campaign brief beside the release-post seam, and the CEO's run-now originates on demand — the cron loop never fires it. The HoM designs a 2-6 post arc (teaser → launch → follow-up → spotlight; 280-cap, future strictly-ascending publish_after, stage vocabulary) and one propose_campaign call materializes each post as a held x_campaign draft through the X-queue chokepoint. V1 is manual-cadence by design: publish_ after renders as queue guidance and the CEO approves each post at its moment — nothing auto-posts, ever; the auto-schedule upgrade is a documented ceiling. Twelve-program union: full registry complete. * feat(panel): x_campaign labels + publish-after guidance in the X queue * feat(board): Barfly — adjacent-conversation replies Cron cycle (2 days, org-scoped, X-credentials gated): the engine searches X for conversations where RoboCo is relevant but unmentioned (new OAuth- signed search_recent on the client; queries + candidate cap configurable), screens every fetched tweet through the injection guard (stored unclamped — a clamp was truncating the candidate under the envelope, caught by the dev's own tests), dedupes via the existing x_seen_mentions ledger (no migration; also prevents double-drafting against the mentions poll), and opens one held HoM exploration carrying the screened candidates. propose_ conversation_replies enforces candidate-id-only replies (≤5, 280-cap); each materializes a held x_barfly draft through the X-queue chokepoint, threaded via a new in_reply_to seam on post_tweet that only x_barfly drafts use. The X redraft machinery is now dict-dispatch over per-source extractors with reply-ref carry for x_barfly. Thirteen-program registry. War Room's test fakes gained the new abstract search_recent stub. * feat(board): Dogfood — the PO walks the product The fourteenth and final registry entry, completing the catalog. EVENT program (release-publish hook beside the war-room hook + CEO run-now, both through the same real originator; the cron loop never fires it), project- scoped with shared rotation. The permission surface is the careful part: the PO's dogfood spawn — and ONLY that spawn — gets the Playwright MCP mounted, via a task-scoped fail-closed probe mirroring the video-authoring precedent (a PO spawned for roadmap/pest/scales never sees browser tools; tested both ways); the PM agent image bakes chromium unconditionally like the ux image, the mount stays task-gated in code. The walk targets the rotation target's live surfaces (panel_base_url only when the target is the org's own project, honest degradation otherwise); propose_friction_ fixes files ≤5 walked-path-evidenced items; per-item CEO decide materializes BACKLOG source=dogfood tasks; full Telegram decide kind. Also: megaphone/librarian/war_room arming keys restored to the settings validator — their panel toggles would have been rejected (dropped in earlier unions; the same silent-arming class the drill killed once already). * feat(panel): Dogfood friction review queue * chore(board): final whole-branch sweep fixes The night's closing adversarial pass over the integrated fourteen-program registry found ONE functional defect — the war-room test fakes' post_tweet predated Barfly's in_reply_to_tweet_id kwarg (LSP violation, the only red in an otherwise fully green gate) — plus doc/test drift, all fixed: the source-parity test completes to fourteen (spackle/mirror were silently absent while its neighboring comment claimed full coverage), the PO identity doc gains its missing Dogfood verb, the auditor quick-list gains propose_postmortem, three stale comments corrected (rotation docstring, panel registry header, X source enumerations), the dogfood release-hook gains the exception-swallow test its four sibling hooks already had, and the CHANGELOG's Unreleased section documents the whole Board Programs train. Full make quality: exit 0, all gates green. * docs: full documentation sweep for the Board Programs train CLAUDE.md's roadmap-engine entry superseded by the Board Program registry entry (all fourteen programs, arming, scoping, LEARN, guardrails) with the role verb tables and playwright row refreshed; docs/rag gains the agent- facing architecture doc plus full propose_* call-shape sections in the three board role docs, and corrects the strategy-engine section to shipped reality (only idle→roadmap is wired); docs/map covers the registry + all twelve engines with flags, gotchas, and drift notes. The 0.27.0 reference inventory confirmed only the release-executor's canonical set carries the version — left for the 0.28.0 cut. * feat(board): human titles + descriptions on every program surface Raw registry keys rendered as bare panel labels — an operator reading x_feature had no idea what enabling or running it does. The registry dataclass gains title/description (test-enforced non-empty for every entry, unique titles), the API passes them through, and every surface renders title-with-description-tooltip instead of the key: the Programs card (label, toggle hint, run-now toast), and the project settings participates-in/excluded-from checkboxes. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-25 17:13:32 +02:00
3 people	baa87d584a	feat(tg): Mini App V4 — Today brief, native approvals, live data, bot tier, chat bridges (#576) ... * feat(tg): P0 — dev mock bridge + Telegram-native foundations Mini App V4 phase 0. The (tg) shell gains the groundwork every later phase builds on: - Dev mock bridge: outside Telegram, a development build falls back to a no-op WebApp object and skips the webapp-auth POST (the regular panel session cookie authorizes API calls), so the cockpit is workable in a plain browser. Production keeps the "Open from Telegram" wall. - Telegram theme adoption: themeParams map onto the shadcn CSS variables scoped to #tg-shell (desktop dashboard untouched), colorScheme drives the dark class, themeChanged re-applies live. Non-hex values are dropped at the trust boundary. - Viewport/swipe correctness: shell height rides Telegram's own --tg-viewport-stable-height (100dvh fallback), vertical swipe-to-close disabled so list scrolling can't dismiss the app. - Native chrome bindings: TgWebAppProvider context plus useMainButton / useBackButton declarative hooks and a null-safe haptics helper — consumers never touch window.Telegram directly. * feat(tg): P1 — Today home tab + one-round-trip /telegram/today brief Mini App V4 phase 1: the cockpit now opens on a "Today" brief answering "does anything need me?" in one glance. Backend: GET /api/telegram/today (CEO-gated, rate-limited) returns the whole brief in one round trip via the new TgCockpitService — needs-you items (awaiting-CEO + blocked tasks capped for a phone screen, held-draft counts across release/X/video/roadmap queues), a fleet snapshot with per-agent current-task titles, today's spend from the day rollup (degrading to zeros on a usage hiccup, mirroring the CEO overview), and ship state. Deliberately DB-only: no live GitHub calls, no readiness snapshot (that path clones), no orchestrator singleton — the CI red/green proxy is the set of open ci_watch fix tasks. Panel: TgTodayTab is the new default tab (Gauge icon) — needs-you rows and draft chips deep-link into the tab that acts on them (with a haptic tap), fleet/spend/ship render as dense cards, 45s refetch until the P3 WebSocket wiring lands. * fix(tg): dev mock engages when the CDN bridge loads outside Telegram Live browser smoke caught it: a bare tab still loads telegram-web-app.js, so window.Telegram.WebApp EXISTS outside Telegram — just with empty initData. The dev fallback keyed on a null bridge only, so a dev browser went down the real-auth path and posted empty initData instead of mounting the mock. The fallback now treats bridge-with-no-initData the same as no bridge (a real Telegram launch always carries initData); production behavior is unchanged. * feat(tg): P2 — native approvals card stack Mini App V4 phase 2: the Approvals tab stops stacking the four desktop queue cards and becomes a phone-native flow — one normalized list across release proposal / X drafts / video drafts / proposed roadmap items, and a full-context detail per item: - Release: version/bump/gate badges, changelog draft, gaps, migration notes, in-flight + failed-execute banners; approve runs the fail-closed executor, reject requires a substantive change request (10 chars). - X: editable body with the live 280 counter, replied-to mention quoted; approve sends the edited body only when actually edited. - Video: cut-toggled player (blob-fetched through the authed client — a bare <video src> would 401), per-platform caption edits with 280/2200 counters; approve sends only checked-in edits. - Roadmap: the PO's full pitch (description, rationale, ACs); approve materializes into the backlog per item. The detail's primary action rides Telegram's native MainButton and back navigation rides the BackButton, with visible fallbacks outside Telegram (dev mock, old clients). Haptics fire on outcomes. An acted-on item vanishes from the refetched queue, popping back to the list by construction. A failed queue source is surfaced ("list may be incomplete" / "couldn't load") instead of masquerading as an empty queue — caught live in the browser smoke. * feat(tg): dev demo mode — /tg?demo=1 renders canned cockpit data Development-only: with the flag param present, the Today brief and the four approval queues resolve typed fixtures (dynamically imported, so production bundles never carry them) instead of hitting the backend — the cockpit is fully browsable with zero stack running. Mutations still go to the real API and fail loudly; it's a showroom, not a simulator. * feat(tg): P3 — cockpit rides /ws/system live Chat adopts the desktop A2A invalidate-on-frame idiom over the shared ref-counted /ws/system socket: every a2a.message frame refreshes the conversation list and the affected thread, missed-frame gaps are healed by a reconnect refetch, and the 10s thread poll turns off entirely while the socket is up (it remains the fallback). The Today brief refreshes on each USAGE_SNAPSHOT push so the spend line tracks the sweeper live, with the 45s poll as the socket-down fallback. No new sockets, no backend changes — the WS gate already accepts the cloud-auth session cookie. * feat(tg): P4 — deterministic bot command tier + self-syncing menu Mini App V4 phase 4 (deterministic half): three new bot commands beside /status /queue /task — - /agents: who's mid-task right now, from the same TgCockpitService fleet snapshot the Today brief renders (now public `fleet()`). - /usage: today's spend from the day rollup. - /blocked: awaiting-you + blocked tasks, deep-linked into the panel, capped per section, titles HTML-escaped. BOT_COMMANDS is the single registry driving /help AND a once-per-process Bot API setMyCommands sync on the first poll cycle (new client method, best-effort), so the Telegram command menu can never drift from what the code implements. The interactive tier (/secretary, /newtask riding a live Intake interview in-thread) is specced but not in this commit. * feat(tg): direction-C styling pass — Telegram palette, RoboCo voice The cockpit stops wearing default-shadcn and gets its own visual language on top of the P0 themeParams bridge (colors stay CSS-variable driven, so inside Telegram everything still adopts the user's theme): - Shared primitives (components/tg/ui.tsx): TgSection grouped cards with tracked micro-label headers, TgRow list rows (44px targets, press feedback, 1/2-line clamp), TgRowIcon glyph tiles, TgStat tabular-nums figures. Every tab composes the same three, so density and rhythm are identical across the surface. - Shell renders a centered 430px column (sm:border-x) — the phone UI no longer stretches across a desktop dev browser. - Tab bar: tighter type, active stroke-weight shift, backdrop blur. - Today: needs-you count badge, divided task rows with inline blocked marker, fleet as mono-named rows, spend/ship as stat tiles. - Approvals rows as icon-tile cards; detail header gains the kind glyph. - Inbox/Chat rows aligned to the same card language. * feat(tg): P5 — /secretary and /newtask live-chat bridges The bot's interactive tier: both commands bridge the CEO's Telegram chat into the same in-process runtimes the panel drives — the persistent Secretary container and the scoped Intake interview. There is no synchronous send→reply seam (replies land on the session's single-consumer relay queue), so each bridged session runs one long-lived consumer task (roboco/services/telegram_bridge.py) that drains PrompterLiveRegistry.stream and pushes one Telegram message per completed turn. While a session is live, plain chat text IS the conversation; /end closes it. /newtask resolves the intake scope (single project auto-picked, multiple offered as a tap-to-pick keyboard holding the initial text), and the interview happens in-thread. A draft proposal renders as a card with Send-to-Board / Discard buttons: confirm routes through the normal board-review path (PrompterService.confirm_live_draft, route=board) and PARKS the session — board feedback later streams straight back into the same thread, closing the redraft loop from the phone. MegaTask batches still confirm in the panel only. The consumer's open stream arms the registry's 60s keepalive, so the bridge runs its own idle TTL (same setting, parked sessions exempt). State is per-process in-memory by design (the _PENDING_REPLIES posture); intake/secretary containers are process-wide singletons, so a bridged session preempts a live panel session of the same kind by construction. * feat(tg): cockpit skin — RoboCo dark deck with a constant amber accent The cockpit no longer inherits the dashboard's white default outside Telegram: #tg-shell carries its own standing skin (deep slate surfaces, amber primary) so the Mini App looks like RoboCo everywhere. Inside Telegram the themeParams bridge now overrides SURFACE tokens only — background/card/text/hint/border repaint to the user's Telegram theme while --primary/--ring stay RoboCo amber: Telegram's surfaces, RoboCo's voice. Demo fixtures also rewritten to neutral content (they previously depicted unbuilt forge work and already-shipped roadmap items as live). --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-19 07:29:04 +02:00
Renn F	99224e65cd	fix(tests): satisfy mypy on the queue-item push tests ... The #568 tests unpacked AsyncMock.await_args without narrowing its Optional type and passed a SimpleNamespace where _format_task_detail is annotated TaskTable. Narrow with the repo-standard 'assert await_args is not None' and cast the fake task at the call sites.	2026-07-18 16:35:28 +02:00
3 people	ff78618b76	feat: Telegram messages get real formatting + push DMs at draft origination (#568) ... * feat(telegram): HTML-styled bot messages + push DMs at held-draft origination * fix(telegram): attr-context escaping, balance-aware truncation, send observability; docs --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-18 15:54:49 +02:00
3 people	9fbec78126	feat: Telegram V2 — inbound commands + actionable approve/reject from chat (#551) ... * feat(telegram): V2 inbound — command router, actionable approve/reject keyboards, chat-gated poll loop * fix(release,x,video,telegram): terminal-state guards on approve/reject; sender-identity check * docs(map,rag): Telegram V2 inbound surfaces and terminal-state approve/reject guards --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-18 00:47:09 +02:00