mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
3753fbccc4f638c1adaa563c1a4f9c1ceb9bbd2a
250
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Renn F
|
3753fbccc4 |
feat(grok): Grok-native interactive runtime (opencode serve) — container side
Builds the Grok analogue of the Claude intake/secretary live-session runtime, satisfying the same IntakeSession seam so the existing IntakeDriver loop, message source, relay, and StreamChunk panel contract are reused unchanged: - OpencodeServeSession: a held-open `opencode serve` session (context persists across turns) where each human turn is one synchronous POST /session/:id/ message; normalize_opencode_message maps the reply parts to text/thinking/ tool_use/draft/turn_end chunks (draft via a propose_draft tool part or the fenced roboco-draft fallback). Doc-verified against opencode's server API. - grok_intake_main / grok_secretary_main: container entrypoints mirroring the Claude mains but yielding an OpencodeServeSession; they render opencode.json (xAI provider + MCP + system prompt) first, then run the receiver + driver. - roboco-agent-grok-prompter / -secretary images (FROM roboco-agent-grok) + their builder services in all three compose files. UNVERIFIED-LIVE: the opencode serve flow + exact Part schema + draft path need a live run against grok-build-0.1 (the part mapping is defensive). The orchestrator wiring that routes a GROK intake/secretary route to these images is the next step (a design decision is open — see the handoff notes). |
||
|
Renn F
|
6f60d180e9 |
feat(grok): make interactive spawns first-class on AgentProvider (additive)
The AgentProvider ABC modelled only the one-shot lifecycle (spawn/stop/ health_check/remove), so the interactive intake/secretary roles could never route through a provider. Add an opt-in interactive surface: - supports_interactive class flag (default False). - InteractiveSpawnSpec: the resolved AgentConfig + session id + role-specific image + optional HMAC token — everything a provider needs without importing orchestrator internals. - spawn_interactive(spec): a non-abstract default that declines via ProviderError, so every existing one-shot provider is unchanged. Pure scaffolding — no provider opts in yet (GrokProvider flips the flag when its interactive driver lands). Zero behavioural change. |
||
|
Renn F
|
e36549f01f |
feat(grok): capture one-shot Grok usage/cost from the opencode store
A GROK agent runs opencode, not Claude Code: it has no SDK /usage/status server and writes no Claude transcript, so _resolve_final_token_usage found nothing and every Grok agent finalized at 0 tokens / $0 — the opencode_usage reader existed but had no caller. - Mount a per-agent opencode data dir ($DATA/opencode/<agent_id> → /home/agent/.local/share/opencode) so opencode.db is captured, and mount the same host dir into the orchestrator (/data/opencode) in all three compose files so the finalizer can read it back — the opencode analogue of the mounted Claude transcript. - _resolve_final_token_usage branches on provider_type: GROK reads opencode.db via opencode_usage (reasoning folded into output, billed at the output rate) and skips the SDK/transcript path. A 0-token read logs a WARNING so a silent mount failure isn't mistaken for a real zero-cost run. - ROBOCO_OPENCODE_DATA_DIR overrides the in-orchestrator path for local runs. |
||
|
Renn F
|
7e077fe642 |
feat(grok): guard interactive roles from GROK routes (interim)
intake (prompter) and secretary run a held-open chat session driven by the Claude Agent SDK. GROK has no interactive runtime yet, and a GROK route for those slugs would be spawned with the route creds injected as ANTHROPIC_* against api.x.ai/v1 — the wrong protocol — producing a silent, empty reply (the blank intake we observed). Downgrade a GROK route for intake-1/secretary-1 to the Anthropic default with a logged warning. The one-shot delivery roles route to GROK unchanged. This guard is replaced by the real interactive fork once the opencode interactive driver lands. |
||
|
Renn F
|
b61148cdc9 |
feat(grok): reaper watchdog kills wedged opencode containers
The heartbeat reaper deliberately skips a task whose assignee holds a live ACTIVE container, so a Claude agent deep in a long edit/test cycle isn't churned out from under live work. A wedged opencode container breaks that assumption: it stays ACTIVE while firing no gateway verb, so its heartbeat never advances and the live-instance skip would shield its task forever — the exact way the Grok pr_reviewer parked in_progress. Add a longer grok-idle kill threshold (ROBOCO_GROK_IDLE_KILL_SECONDS, default 900s, well past the stream chunk timeout). A GROK instance idle past it is force-removed (its logs dumped to disk first) and evicted from the instance registry, so the same reaper pass then releases the task. Only GROK runtimes are eligible — a quiet Claude agent keeps the heartbeat-skip protection. |
||
|
Renn F
|
ff8867dd1f |
fix(grok): stop opencode subagent-stream hang at the config layer
The Grok pr_reviewer wedged in_progress forever: opencode's default agent ran with the subagent `task` tool enabled, spawned an Explore subagent on grok-build-0.1 whose model call opened an SSE stream that went idle, and the run hung with no timeout. - Hard-disable opencode's subagent `task` tool in the generated opencode.json. No RoboCo role uses opencode-internal subagents — work flows through the gateway verbs — so removing the tool kills the hang trigger outright. - Set provider.xai.options.timeout + chunkTimeout (operator-tunable via ROBOCO_GROK_REQUEST_TIMEOUT_MS / ROBOCO_GROK_CHUNK_TIMEOUT_MS) as the defence-in-depth backstop; chunkTimeout aborts an idle stream. - Bundle the permission + timeout + subagent knobs into an OpencodeGuards dataclass (keeps the builder under the arg-count gate). - Drop the dead ROBOCO_AGENT_TOOLS spawn env (it had no consumer); opencode tool restriction lives in the rendered config now. |
||
|
Renn F
|
5725ec998b |
feat(grok): reasoning-effort by role (cut grok-build cost on cheap roles)
grok-build-0.1 reasons heavily by default and reasoning bills at the output rate (a live "say ok" call emitted ~300 reasoning tokens, ~85% of its cost). Confirmed live that opencode's `--variant minimal` cuts reasoning ~54% (298 -> 136 tokens, same prompt). GrokProvider now picks reasoning effort by role: code-quality roles (developer, qa, pr_reviewer) keep full reasoning; coordination / docs / board roles (cell_pm, main_pm, documenter, product_owner, head_marketing, auditor, prompter, secretary) run "minimal". It's passed to opencode via the entrypoint's `--variant`. Operators can force one effort for ALL grok agents with the ROBOCO_GROK_REASONING_EFFORT env (minimal | high | max, or default/full). Tests cover the role map, the env override, and the spawn env wiring. |
||
|
Renn F
|
b0857915a1 |
fix(grok): correct opencode provider (Responses API), stdin, reasoning cost
A live opencode run against api.x.ai/v1 surfaced three real bugs: 1. Provider package — grok-build-0.1 is driven via the OpenAI Responses API (opencode calls model.responses()). @ai-sdk/openai-compatible is chat/completions only and errors "responses is not a function". Switch the generated opencode.json provider + the grok image to @ai-sdk/openai. 2. Headless hang — `opencode run` blocks after init without a TTY; close stdin (`< /dev/null`) in the entrypoint so it proceeds to the model call. 3. Reasoning-token cost — grok-build-0.1 is a reasoning model; reasoning tokens bill as output but opencode stores them in a separate column. cost_for_session folds tokens_reasoning into output (else ~22x undercount). Verified end-to-end against a real session row (input=6120, output=1, reasoning=226, cache_read=1856): our pricing reproduces opencode's stored USD cost ($0.0069452) exactly. Tests anchored to that real row. |
||
|
Renn F
|
af6cad98d8 |
feat(grok): read opencode session usage for cost capture
Confirmed by inspecting a local opencode run: opencode persists per-session usage in SQLite at ~/.local/share/opencode/opencode.db — the `session` table carries cost + tokens_input/output/reasoning/cache_read/cache_write. xAI's response usage object (prompt_tokens, completion_tokens, prompt_tokens_details.cached_tokens, completion_tokens_details.reasoning_tokens) maps directly onto those columns. Add opencode_usage.read_session_usage / cost_for_session: read the opencode DB and price the tokens via roboco.billing.pricing (our cost stays authoritative; opencode's own `cost` column is kept for reference). Tested against a fixture DB mirroring the real schema (single session, summed sessions, missing/empty DB). Remaining wiring (for the live spawn): mount the opencode data dir on grok spawn + call cost_for_session at reap to record the usage rollup. |
||
|
Renn F
|
07f55117de |
feat(grok): price grok-build-0.1 + secret-scrub opencode plugin
- pricing.py: add grok-build-0.1 rates ($1/1M input, $0.20 cached, $2/1M output), verified against xAI's published pricing. Grok is a priced non-Anthropic model, so cost computes the moment usage is captured. - secret-scrub.js: an opencode tool.execute.before plugin porting the security-critical bash-guard deny rules (git network ops, credential-file reads, /proc env, internal-host HTTP, roboco.* imports, ROBOCO_AGENT_ID forgery, env dumps, destructive rm) to the opencode runtime — restoring the guard the Claude Code hook can't provide there. Throwing denies the call (confirmed by opencode's env-protection example). Wired into the generated opencode.json plugin array + baked into the grok image. Deny logic verified via node (9 deny + 5 allow cases). UNVALIDATED against a live opencode runtime: confirm it fires in the live E2E spawn before a Grok dev-agent touches a real repo; the bash permission is operator-tunable as a second gate. Cost CAPTURE (distinct from pricing) is intentionally NOT built yet: opencode's plugin hooks expose model info but no token/usage object, so the capture path is unconfirmed and needs the live spawn to settle. |
||
|
Renn F
|
085414dcf5 |
feat(providers): native Grok runtime — opencode image, config gen, panel key
Complete the native Grok (xAI) path so grok-build-0.1 runs as a real RoboCo agent, not just the provider seam. - roboco-agent-grok image (docker/agent-grok.Dockerfile): FROM agent-base + opencode (the OpenAI-protocol runtime). One image serves every role; role behaviour comes from the mounted manifest / mcp-config / system prompt, exactly as on the Claude path. - Entrypoint renders opencode.json at spawn from the GrokProvider env contract + the mounted Claude Code mcp-config.json (roboco.llm.providers.opencode_config): translates RoboCo's gateway servers (roboco-flow / roboco-do / ...) into opencode's mcp block, declares the xAI OpenAI-compatible provider + model, and wires permissions + instructions. Pure, unit-tested translation. - Orchestrator registers GrokProvider with the registry-qualified image (_qualify_agent_image) so it resolves in local and registry deploys. - Compose (both files + the registry compose) gain an agent-grok-image builder service. - Panel: a Grok (xAI) API key card on the AI Providers page, plus the grok ModelProvider value. KNOWN PARITY GAP (opencode runtime): the bash-guard PAT-scrub and the transcript-based usage/cost capture are Claude Code hooks and do not transfer to opencode. bash permission is operator-tunable (ROBOCO_GROK_BASH_PERMISSION) so a deployment can fail closed until a security/usage-parity opencode plugin lands. That plugin and live E2E validation are the remaining work to finalize with xAI. |
||
|
Renn F
|
a956083f9f |
feat(providers): pluggable agent providers + Grok (xAI) backend
Add a roboco/llm/providers/ seam — an AgentProvider lifecycle ABC and a ProviderRegistry keyed by ModelProvider — so the orchestrator can drive agent backends other than Claude Code. The first non-Claude backend is GrokProvider for xAI's grok-build-0.1. xAI is OpenAI-compatible only (no Anthropic-Messages endpoint), so a Grok agent runs an OpenAI-protocol runtime pointed at https://api.x.ai/v1 rather than the ANTHROPIC_BASE_URL injection the other providers use. It reuses the orchestrator's existing mount/auth assembly, so it inherits the same MCP gateway + tool-manifest wiring as every other agent by construction, and passes its prompt via env (never an argv positional). The change is purely additive: only GROK routes through the registry; Anthropic / Ollama Cloud / self-hosted spawns run the existing _spawn_container path unchanged. Includes: - ModelProvider.GROK (migration 038) + a seeded Grok provider row (migration 039) + a grok-build-0.1 catalog entry - GET/PUT /api/providers/grok-key to store the xAI key (Fernet-encrypted, reusing the existing provider-key machinery) - ClaudeCodeProvider reference adapter over the current spawn - unit tests for the registry, GrokProvider (gateway wiring, no ANTHROPIC_* leak, prompt-injection safety, failure paths) and routing The dedicated roboco-agent-grok image and the exact OpenAI-protocol CLI invocation are the remaining piece to finalise with xAI. |
||
|
|
6007f47fc9 |
[ef7b7cb9] Add Company Scorecard to Business Goals tab (#212)
* [0c7a4732] feat(cockpit): add completed_30d and median_lead_time_hours to delivery summary (#207) (#210) - Extend DeliverySummary schema with completed_30d: int = 0 and median_lead_time_hours: float | None = None fields - Add TaskService.get_delivery_stats_30d() that queries tasks completed in the last 30 days and computes statistics.median of lead times - Update CockpitService.summary() to source both new keys from get_delivery_stats_30d() and include them in the delivery dict - Update tests: mock new method in _patch(), assert new fields in test_summary_aggregates, fix test_route_ok_for_ceo dict, add three new unit tests for get_delivery_stats_30d (empty, multi, single) Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> * [d2647edf] Frontend: Build CompanyScorecard card on Goals tab (#211) * [12569f37] Extend CockpitSummary type and build CompanyScorecardCard component (#208) * [12569f37] feat(cockpit): extend CockpitSummary type with completed_30d and median_lead_time_hours Add optional delivery.completed_30d (number) and top-level median_lead_time_hours (number | null, optional) to CockpitSummary interface in panel/src/lib/api/cockpit.ts so the API shape captures the new backend fields without breaking existing consumers. * [12569f37] feat(business): add CompanyScorecardCard component Create panel/src/components/business/company-scorecard-card.tsx exporting CompanyScorecardCard. The card fetches /cockpit/summary via useQuery and renders five always-visible sections: - Delivery: in_flight, blocked, awaiting_ceo, completed_30d tiles (all from API response; no hardcoded numbers) - Spend: 30d spend + projected monthly; muted 'No budget cap set' when cap is null; red/destructive styling only when cap is a non-null number AND over_budget is true - Speed: 'X.Xh median — target: < 24h' when value present; 'No data yet' when null/undefined; '0h' never rendered - Two stub Objectives with 'Not tracked yet' label, muted text, and dashed-border styling — no fabricated numeric values - Loading: three grouped Skeleton blocks - Error: OfflineState with title 'Could not load scorecard data' --------- Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> * [f1f5cded] Integrate CompanyScorecardCard into GoalsTab and pass quality gate (#209) * [f1f5cded] feat(cockpit): extend CockpitSummary with completed_30d and median_lead_time_hours Add optional delivery.completed_30d (number) and top-level median_lead_time_hours (number | null, optional) to CockpitSummary interface in panel/src/lib/api/cockpit.ts. Backward compatible. * [f1f5cded] feat(business): add CompanyScorecardCard component Create panel/src/components/business/company-scorecard-card.tsx exporting CompanyScorecardCard. Fetches /cockpit/summary via useQuery and renders five always-visible sections: Delivery (no hardcoded numbers), Spend (muted 'No budget cap set' when null; red only when cap set AND over_budget true), Speed (X.Xh median or 'No data yet'), two stub Objectives with dashed border and 'Not tracked yet' label. Loading: three skeleton groups. Error: OfflineState 'Could not load scorecard data'. * [f1f5cded] feat(goals-tab): integrate CompanyScorecardCard into GoalsTab Import and render CompanyScorecardCard below the charter form in goals-tab.tsx. The scorecard fetches its own data independently so all loading/error states are handled per-card. Both cards are always rendered in the Goals tab. * [f1f5cded] fix(scorecard-tests): add vitest framework and CompanyScorecardCard test suite Install vitest + @testing-library/react + @testing-library/jest-dom + jsdom + @vitest/coverage-v8 as devDependencies in panel/. Add panel/vitest.config.ts (jsdom env, @/* alias, coverage on company-scorecard-card.tsx with 80% threshold). Add panel/src/test/setup.ts (jest-dom matchers). Update panel/package.json: add test, test:watch, typecheck scripts. Update panel/eslint.config.mjs: ignore coverage/ directory to keep lint clean of generated files. Write panel/src/components/business/__tests__/company-scorecard-card.test.tsx with 8 tests covering all 7 AC2 scenarios: - loading skeleton rendered - OfflineState on error - OfflineState when data undefined - delivery counts from mock data - spend 'No budget cap set' when cap null - spend destructive styling when cap non-null and over_budget true - speed 'No data yet' when lead time null - speed formatted value when lead time present pnpm lint: 0 errors pnpm typecheck: 0 errors pnpm test: 8/8 pass coverage: stmts 95% branches 90% fns 91% lines 95% --------- Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> --------- Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> --------- Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> |
||
|
Renn F
|
32b6d72933 |
fix(test): get-or-create seed agents in self-heal DB tests (unbreak CI)
The self-heal origination tests blind-inserted the fixed-uuid foundation system agent (and a main-pm agent). In the full CI suite the app lifespan seeds + commits those agents first, so the insert hit a duplicate-key on pk_agents — green in isolation, red in CI. Get-or-create both (by id / by slug) so the tests pass whether or not the agents already exist. Verified against the real ordering (an app-lifespan integration test before this file): 187 passed. |
||
|
Renn F
|
33fa21d00a |
feat(self-heal): scope CI signal to a workflow + warn on missing target
Two hardening fixes from the gap review: - Optional self_heal_ci_workflow scopes the CI signal to one workflow file (the workflow-scoped Actions endpoint). Without it, "latest completed run across all workflows" could miss a red CI run masked by a later passing workflow, or false-trigger on a non-CI workflow — unreliable on a multi-workflow repo. - The loop logs a warning when self-heal is armed but self_heal_project_slug is unset, so a misconfiguration isn't mistaken for "all green". Tests cover the workflow-scoped endpoint. |
||
|
Renn F
|
7ef7d8414e |
fix(self-heal): hold an unconfirmed fix task out of dispatch until CEO approval
Adversarial review found the load-bearing invariant broken at the dispatch layer: _dispatch_pm_work skipped only PR_REVIEW_SOURCES, so a PENDING team=main_pm self_heal task (assigned_to=None, confirmed_by_human=False) was routed to Main PM and spawned BEFORE the CEO approved it — the "never start until you approve" promise didn't hold. Fix: the PM dispatcher now also skips source='self_heal' while confirmed_by_human is False (before the assigned/unassigned split, so it holds either way); the task still shows in the panel so the CEO can see and approve it. approve_and_start flips confirmed_by_human=True (the CEO's start IS the human confirmation), so it dispatches normally afterward. Other sources are unaffected. Tests: a unit test that the dispatcher holds an unconfirmed self_heal task but routes a confirmed one and ordinary tasks, plus a DB test that approve_and_start flips the gate. (The readiness gate was deliberately not used — a blocker there marks the task `blocked`; the dispatch skip leaves it cleanly PENDING.) |
||
|
Renn F
|
49c7b3c42a |
test(self-heal): httpx-mock coverage for get_latest_ci_conclusion
The CI telemetry call is the feature's only real-world I/O and was previously exercised only through a fake source. Cover the GitHub Actions request shape (/actions/runs, branch/status/per_page, auth) and response parsing, plus the safe-None paths (missing token, GitHub error, no runs). |
||
|
Renn F
|
a9064decb7 |
feat(self-heal): wire the dormant orchestrator loop
Register _self_heal_loop alongside the other background loops (created in start, cancelled in stop). It returns immediately unless self_heal_enabled, so a standard deployment adds zero behaviour and makes no CI call; when on it runs one engine cycle per interval and commits any opened fix task. A test pins the default-off dormancy (no sleep / CI / DB when disabled). |
||
|
Renn F
|
bd1fb84198 |
feat(self-heal): open a PENDING fix task on regression, then stop
Behind the second opt-in (self_heal_originate_enabled), a detected regression also opens a fix task into RoboCo's own delivery lifecycle and STOPS: PENDING, unassigned, confirmed_by_human=False, team=main_pm, source=self_heal, with synthesized acceptance criteria and a self_heal_fp= dedupe marker. It rides the normal dispatchers only once the CEO Approve-&-Starts it; the loop itself never calls start / approve / merge / deploy. - TaskService: SELF_HEAL_SOURCE, extract_self_heal_fingerprint, and list_open_self_heal_tasks (the dedupe + open-cap basis) - SelfHealEngine._originate: per-signal fingerprint dedupe, per-cycle and rolling open-task caps, repo resolved to RoboCo's own project (notify-only when it can't be resolved) - 7 DB-backed tests including the never-start / never-approve invariant |
||
|
Renn F
|
606ccc3327 |
feat(self-heal): regression engine — detect + notify the CEO (dormant)
The detect side of the self-healing loop, modeled on the strategy engine: a pure assess() turns breaching telemetry samples into RegressionObservations (with a stable per-signal fingerprint for later dedupe), and run_cycle() is a no-op unless self_heal_enabled and otherwise only sends the CEO one ack-notification per regression. Detect + notify only — it never originates, starts, merges, or deploys; the telemetry source is injectable for testing. 6 unit tests. |
||
|
Renn F
|
7e02713cc6 |
feat(self-heal): CI telemetry source for RoboCo's own repo (dormant)
First slice of the production self-healing loop: a read-only telemetry source that watches RoboCo's OWN repo CI and normalizes the latest GitHub Actions run conclusion into breach / no-breach samples for the regression detector. It targets only the single project named by self_heal_project_slug — RoboCo healing itself, never other/client repos; the org's repo-agnostic delivery flow is untouched. - config: self_heal_enabled / self_heal_project_slug / self_heal_originate_enabled plus interval and open-task / per-cycle caps, all default-off - GitService.get_latest_ci_conclusion: per-project Actions-run lookup (graceful None on missing token / no runs / error; never raises into the loop) - TelemetrySample + TelemetrySource contract + GitHubCITelemetrySource - 5 unit tests |
||
|
Renn F
|
c826b03ac2 |
test(task): DB-backed coverage for the PR-review lifecycle methods
Real-Postgres round-trips for the external/internal PR-review TaskService helpers that the existing mock tests can't prove actually persist: - ingest_external_pr — create-once, head-SHA dedup (unchanged head skips), and re-review on a new head; internal_pr source wording; - pr_review_claim / complete_review — the planless, branchless pending -> in_progress -> completed lifecycle, with re-claim / re-complete no-ops and the "complete requires in_progress" guard; - create_supersede_umbrella / find_supersede_umbrella — created on the same repo (not parented), idempotent lookup, non-review rejection, and the pr=5-vs-pr=50 exact-marker disambiguation; - list_external_pr_reviews — source isolation, the data-layer half of the dispatcher contract (regular tasks never leak into the review queue). Writes use flush (not commit) so the rollback-per-test fixture keeps each case isolated from the others against the shared session-scoped test DB. |
||
|
Renn F
|
f27a9f9447 |
feat(settings): panel-tunable feature flags
Add a Feature Flags card to the Settings page that toggles env-gated subsystems (external/internal PR review, web research, strategy engine, pitch provisioning, RAG auto-update, transcript pruning) directly from the panel instead of hand-editing environment variables. Flags persist in system_settings as 'true'/'false' and are overlaid onto the live config singleton at startup; an unset flag keeps its environment/config default. A toggle takes effect on the next backend restart — no per-consumer re-routing. Backend: FEATURE_FLAGS registry + bool validator + get_bool accessor on SettingsService; feature_flag_effective_values and apply_persisted_feature_flags; GET /settings/feature-flags; best-effort startup overlay in the app lifespan. Frontend: settingsApi.getFeatureFlags / setFeatureFlag and a FeatureFlagsCard rendered full-width below the settings grid. |
||
|
Renn F
|
eec35c0357 |
fix(orchestrator): un-deadlock a CEO-rejected coordination root
A coordination root (team=main_pm, product-linked, no repo) the CEO sends back lands in needs_revision, but the dev dispatcher skips it (not a cell team) and the closure path only handles paused parents — so it sat in needs_revision forever. (NOT a foundation-spec gap: the spec already allows needs_revision -> claimed for any role.) - _dispatch_revision_coordination_roots: re-spawn the owning PM for a needs_revision coordination root so it re-coordinates the revision (registered in the dispatch loop after PM closure) - _readiness_check_role_for_status: widen the dev-owned states (needs_revision, verifying) to also accept cell_pm/main_pm for coordination roots — a pure widening; normal code tasks stay dev/doc-only - 16 unit tests (dispatcher decision + readiness widening) |
||
|
Renn F
|
748ff7813e |
test(git): httpx-mock coverage for list_open_prs + get_pr_diff
Covers the inbound-PR read surface: list_open_prs normalization + fork/internal classification (and the recent _fetch_open_prs/_normalize_open_pr refactor), plus get_pr_diff's diff-media-type request — both with their safe-empty paths on missing token / GitHub error. The DB-backed paths (ingest/complete_review/pr_review_claim/supersede umbrella) are covered separately. |
||
|
Renn F
|
66a8ad40eb |
feat(pr-review): internal-PR safety reviewer — review off-task-flow org PRs
Extend the inbound-PR reviewer beyond external/fork PRs to internal org-repo PRs that bypassed the agent task-flow (a human-pushed branch). The org's own in-flight integration PRs are skipped — a live task owns their branch and they already pass QA + PM review — so the reviewer only flags off-process PRs. - config: internal_pr_enabled (default OFF, like external_pr_enabled) - PR_REVIEW_SOURCES = (external_pr, internal_pr); generalize dispatch, dedup, the decision queue, the git-gate exemption, and supersede to both sources - TaskService.active_task_owns_branch (skip lifecycle PRs) + ingest source param with source-aware wording - poll loop runs when EITHER flag is on; _ingest_pr_if_reviewable picks the source per PR (external: flag+author-allow; internal: flag+not-task-owned) - 11 unit tests (decision logic + branch-ownership) |
||
|
Renn F
|
94395d408d |
feat(gateway): structured required_cells gate — reject i_am_idle on a dropped named cell
The companion to the prompt rule (
|
||
|
Renn F
|
9cc63125d2 |
feat(external-pr): surface in-flight reviews in the panel, not just completed
The PR-review queue only listed COMPLETED reviews and hid when empty, so while a review was in_progress the panel showed nothing — no sign a review was happening or where its findings go (the reviewer posts its change-request on the PR itself). Add TaskService.list_external_pr_reviews (active reviews + awaiting-decision, minus cancelled/decided/dismissed); the route uses it. The panel card now shows active reviews with a 'Reviewing' badge and a link to the PR where the change-request lands, and the Supersede/Dismiss actions only once the review completes. |
||
|
|
818f2ac7a6 |
[21e195cd] Panel-wide UI standardization and usability pass (#194)
* [4c179e3a] Add git pull, fetch, and rebase backend endpoints (#190) * [f966f772] feat(git): add pull, fetch, and rebase endpoints with integration tests (#185) - Add GitPullRequest/Response, GitFetchRequest/Response, GitRebaseRequest/Response schemas - Add GitService.pull(), fetch(), and rebase() methods using _network_git_timeout() - Add POST /api/git/pull, /api/git/fetch, /api/git/rebase route handlers - Rebase detects conflicts via git diff --name-only --diff-filter=U and aborts cleanly - Integration tests cover success path and GitCommandError→500 for all three endpoints - Rebase conflict test verifies conflict=True with populated conflicted_files list Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> * [26e2b7af] test(git): add AsyncMock unit tests for rebase_onto_base conflict-state handling (#186) New test_git_rebase.py covers three branches of rebase_onto_base: - success path: rebase exits 0, returns rebased status, abort never called - conflict path: non-zero exit → diff → abort → returns conflict+files - resilience: both rebase and abort exit non-zero, still returns conflict dict without exception All tests use AsyncMock with side_effect sequences to mock _run_git at the service-method level. Co-authored-by: Backend Developer 2 <be-dev-2@agents.roboco.dev> --------- Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> Co-authored-by: Backend Developer 2 <be-dev-2@agents.roboco.dev> * [551b1dbf] Panel-wide frontend UI standardization and page fixes (#193) * [1ec787b2] feat(panel): design-system sweep — full-width layouts, scrollbar fix, Secretary button, component audit (#188) - Settings page: remove max-w-3xl, wrap cards in grid-cols-1 lg:grid-cols-2 two-column layout - AI Providers page: remove max-w-5xl so AIRoutingCard fills available width - Journals AgentList: replace ScrollArea with overflow-y-auto div to eliminate nested scrollbar - Secretary chat input: add items-stretch to flex row so Send/Start button matches Textarea height - Component audit: replace all raw <button>/<input>/hand-rolled badge spans outside components/ui/ with canonical Button, Checkbox, Badge variants across 15 files: - ai-routing-card.tsx: ModeButton → Button, checkbox → Checkbox, badge spans → Badge - self-hosted-section.tsx: eye-toggle → Button ghost icon-sm, badge spans → Badge - journals/agent-item.tsx, communications/channel-item.tsx → Button ghost - kb-search-bar.tsx, kb-filters.tsx → Button ghost - kb-category-nav.tsx, git-log-panel.tsx → Button ghost - communications/page.tsx (channel + group lists) → Button ghost - projects/project-table.tsx, products/product-table.tsx → Button link - git-branch-panel.tsx (local + remote lists) → Button ghost - tasks/dependency-selector.tsx: Button ghost + Checkbox for visual indicator - tasks/task-table.tsx: sortable header + expand toggle → Button ghost - business/goals-tab.tsx: hidden button → Button Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> * [435b37b4] feat(metrics,notifications): URL-persisted tab state, semantic chart colors, humanized counts (#187) - Notifications page: replace useState with useSearchParams/useRouter for ?tab= URL parameter (all/unread/pending, default: unread); Suspense wrapper with skeleton fallback for SSR compatibility. - Metrics page: split into Performance tab (Velocity + Task Status + Agent Status + Team Health) and Token Usage tab (TokenUsageCostsSection) with ?tab= URL parameter (default: performance); Suspense wrapper; Refresh button moved inside PerformanceTabContent; humanizeCount() helper applies K/M suffixes to all MetricCard numeric values >= 1000. - Chart components (usage-time-series, agent-usage, team-usage, model-donut): replace var(--chart-N) CSS vars with explicit semantic hex colors — #3b82f6 blue for informational, #f59e0b amber for warning/pending, #22c55e green for success/healthy, #ef4444 red for error/blocked, #a855f7 purple for supplemental. pnpm lint and pnpm typecheck pass with zero new errors. Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev> * [ccd256f4] Kanban mobile viewport: 375px layout, column navigation, 44px touch targets (#191) * [ccd256f4] feat(kanban): mobile 375px layout with column navigator and 44px touch targets - KanbanBoard: add activeColumnIndex state + mobile prev/next column navigator (lg:hidden); existing horizontal-scroll layout hidden on mobile (hidden lg:flex). Desktop DnD behavior unchanged. - KanbanColumn: add optional className prop (cn-based) so mobile view can pass w-full/sm:w-full to fill the viewport. - KanbanCard: bump all action buttons to min-h-11 (44px) touch targets (Assign, Pass, Fail, Move-forward). * [ccd256f4] fix(kanban): change breakpoint from lg to sm for mobile/desktop layout switch AC3 requires >=640px viewport to show multi-column layout (sm: breakpoint). Previous impl used lg: (1024px), leaving 640-1023px in single-column mode. Change: - Mobile navigator div: lg:hidden → sm:hidden - Desktop multi-column div: hidden lg:flex → hidden sm:flex At <640px: single-column with prev/next navigator (375px mobile use case). At >=640px: full horizontal-scroll multi-column layout (per AC3). DnD behavior and all other layout unchanged. --------- Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> * [23f02af4] Agents page On-Demand section + Board composition; Overview Quick Actions visibility + Team Health Intake/Secretary (#189) * [23f02af4] feat(agents,overview): On-Demand section, Board composition fix, Intake/Secretary in Quick Actions + Team Health - agent-definitions.ts: remove AgentRole.MAIN_PM from getBoardAgents (Main PM has its own dedicated section; including it there was redundant). Add getOnDemandAgents() that catches agents not in any standard team (board/main_pm/backend/frontend/ux_ui/marketing) and not a standard cell role — surfaces prompter/intake agents that the API may return. - agents/page.tsx: import getOnDemandAgents; add a conditional 'On-Demand Agents' AgentGrid section (only rendered when the API returns at least one matching agent, e.g. the Intake interviewer). - quick-actions-bar.tsx: add 'Task Intake' button (→/prompter, Sparkles icon) and 'Secretary' button (→/business?tab=secretary, Bot icon) alongside existing quick actions so operators can reach on-demand agents from the Overview in one click. - team-health-cards.tsx: add OnDemandAgentCard sub-component (link card with On-Demand badge) and render static cards for 'Task Intake' and 'Secretary' appended after the API-driven TeamHealthCard list, giving them equal visual presence in the Team Health section. pnpm lint and pnpm typecheck pass with zero new errors. * [23f02af4] fix(agents,overview): QA revision — enum entries, QuickActions placement, On-Demand title, Board PR_REVIEWER AC3: types/index.ts AgentRole enum adds PR_REVIEWER, PROMPTER, SECRETARY. agent-selector.tsx ROLE_LABELS exhaustive Record updated accordingly. AC4: command-center.tsx QuickActionsBar moved to after Team Health section, before CEO Approval Queue and data-heavy grid rows — visible without scrolling on a 900px viewport. AC1: agents/page.tsx On-Demand AgentGrid title fixed to 'On-Demand' (was 'On-Demand Agents' in prior commit). AC2: agent-definitions.ts getBoardAgents adds explicit PR_REVIEWER inclusion and uses inclusion-based getOnDemandAgents (PROMPTER|SECRETARY roles). AC5: team-health-cards.tsx static OnDemandAgentCard implementation refined with correct fallback rendering when no API team data. AC6: pnpm lint and pnpm typecheck (src only) pass with zero new errors. --------- Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev> Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> * [b1c59206] Git page: Pull, Fetch, Rebase buttons wired to backend; Rebase destructive confirmation dialog (#192) * [b1c59206] feat(git): add Pull, Fetch, Rebase operations to Git page with destructive confirmation dialog for Rebase - Add GitPullRequest/Response, GitFetchRequest/Response, GitRebaseRequest/Response types - Add gitApi.pull(), gitApi.fetch(), gitApi.rebase() with mock stubs for /git/pull, /git/fetch, /git/rebase - Add useGitPull, useGitFetch, useGitRebase mutation hooks with cache invalidation; exported via useGitOperations - Add Pull (Download icon), Fetch (RefreshCcw icon), Rebase (GitGraph icon) buttons to GitActionsPanel - Rebase button triggers AlertDialog with destructive confirmation before calling API - Wire handlePull, handleFetch, handleRebase handlers in git-browser.tsx with toast feedback * [b1c59206] fix(git): add destructive styling and branch name to Rebase AlertDialog - Add className='border-destructive bg-destructive/5' to AlertDialogContent so the dialog container has the required red-tinted styling (AC3) - Update AlertDialogDescription to interpolate status?.current_branch so the dialog body explicitly names the branch being rebased (AC3) --------- Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev> --------- Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev> * [3f305ed9] Frontend: Fix git control contract, complete Secretary restyling, and apply polish (CEO revision) (#199) * [72de8a65] fix(git): correct Pull/Fetch/Rebase types, API mocks, request fields, and toast handlers (#197) - types/git.ts: GitPullResponse and GitFetchResponse now have current_branch, has_changes, staged_files, unstaged_files, untracked_files, ahead, behind (matching backend GitStatusResponse); removed nonexistent commits_received/ refs_updated/remote fields - types/git.ts: GitRebaseRequest now uses target_branch: string (not onto?: string); GitRebaseResponse now has conflict: boolean and conflicted_files: string[] (removed branch/onto/commits_rebased); task_id made optional on all three request types - lib/api/git.ts: Updated mock returns for pull/fetch/rebase to match new types - git-actions-panel.tsx: onRebase prop now (targetBranch: string) => void; Rebase AlertDialog now contains an Input for target_branch; AlertDialogAction disabled when targetBranch empty and passes the value to onRebase - git-browser.tsx: handlePull and handleFetch toast references result.current_branch; handleRebase accepts targetBranch, sends target_branch in payload, toasts result.conflict and result.conflicted_files; no 'manual' task_id for any pull/fetch/rebase operation Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> * [be6a17fc] feat(ui): design-system polish — chart tokens, KB aria-label, Kanban touch targets (#196) - kb-search-bar.tsx: add aria-label="Clear search" to the clear (X) button - model-usage-donut.tsx: replace hex CHART_COLORS with var(--chart-1)…var(--chart-5) - usage-time-series-chart.tsx: replace hex stopColor/stroke with var(--chart-1)/var(--chart-2) - agent-usage-chart.tsx: Bar fill hex → var(--chart-1) - team-usage-chart.tsx: Bar fill hex → var(--chart-1) - kanban-card.tsx: min-h-11 → max-sm:min-h-11 (44px touch target mobile-only, 3 buttons) - secretary-tab.tsx: already compliant (Button + design-system tokens), no change needed Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev> --------- Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev> * [d62036bd] Backend: Fix git endpoint schemas, add safety gates, and unit tests (CEO revision) (#200) * [d0593fe3] feat(git): remove agent_id from schemas and add service-layer safety gates (#195) - Remove agent_id field from all 9 git request schemas (GitCreateBranchRequest, GitCheckoutRequest, GitCommitRequest, GitPushRequest, GitCreatePRRequest, GitMergePRRequest, GitPullRequest, GitFetchRequest, GitRebaseRequest); agent identity comes from JWT auth context - Make task_id Optional[UUID]=None in GitPullRequest, GitFetchRequest, GitRebaseRequest - Add field_validator to GitRebaseRequest rejecting target_branch starting with '-' or equal to 'master'/'main' - Add lightweight PullRequest, FetchRequest, RebaseRequest schemas for gateway layer - Add dirty-workspace check to GitService.pull() (raises ValidationError if porcelain output) - Switch GitService.pull() to --ff-only; raises ValidationError with diverged-branch message on non-zero exit - Add master/main guard to GitService.rebase() for both head_branch and target_branch - Update callers: routes/tasks.py (2x), services/task.py, tests/unit/services/test_git.py (2x) Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> * [a2f96961] Add role-gated rebase endpoint and unit tests (test_git_rebase.py) (#198) * [a2f96961] feat(git): add role-gated rebase endpoint and unit tests Add role-gate to POST /rebase restricting access to DEVELOPER and CELL_PM roles; add master/main protected-branch guard to GitService.rebase() before any git subprocess runs; add 4 unit tests in tests/unit/services/test_git_rebase.py covering both target-branch and head-branch REBASE_FORBIDDEN cases * [a2f96961] fix(git): invert rebase role gate, add ownership check, schema validator, and missing tests - _REBASE_ALLOWED_ROLES changed from {DEVELOPER, CELL_PM} to {CEO, CELL_PM, MAIN_PM} so developers correctly receive 403 per AC1/AC2 - rebase_branch() now verifies task ownership for non-CEO PM callers: if task_id is provided and the task is not assigned to the calling agent, returns 403/404 - GitRebaseRequest.target_branch gets a @field_validator rejecting '-' prefix names and protected branch names (main, master, develop) - GitService.pull() gains pre-flight safety gates: raises ValidationError DIRTY_TREE when staged/unstaged changes exist, DIVERGED_BRANCH when ahead > 0 and behind > 0 - test_git_rebase.py adds 9 new tests: pull() dirty-tree ValidationError, pull() diverged-branch ValidationError, pull() success path, schema validator for '-' prefix and protected names, and route-level tests confirming HTTP 403 for DEVELOPER and HTTP 200 for CELL_PM on POST /rebase * [a2f96961] fix(tests): add type annotations for tuple variables in test_git_rebase.py mypy needs explicit tuple type annotations when assigning bare tuples to variables used as mock side_effect return values — fixes var-annotated error caught by the server-side quality gate --------- Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> Co-authored-by: Renn F <rennf93@users.noreply.github.com> --------- Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> Co-authored-by: Renn F <rennf93@users.noreply.github.com> * [94015c6d] Frontend R3: Fix legacy git taskId coercion + rebase placeholder + phantom fields (#204) * [401ddb40] fix(git): remove phantom fields from GitPullRequest/GitFetchRequest and make task_id optional in write request interfaces; use taskId || undefined in git-browser.tsx handlers to avoid 422 errors when no task context is active (#201) Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> * [cca8d0c0] fix(git): fix rebase placeholder and surface backend error in toast (#202) git-actions-panel.tsx: change rebase target_branch Input placeholder from "e.g. main or origin/main" to "Remote ref (e.g. origin/HEAD)" so no default branch name (main/master/develop) is suggested. git-browser.tsx: import getErrorMessage from @/lib/api/client and use it in handleRebase catch block instead of the hardcoded string "Failed to rebase". getErrorMessage extracts the real detail from AxiosError.response.data.detail and falls back to a non-empty generic message, satisfying both the detail-surfacing and fallback criteria. Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev> --------- Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev> * [1ea0fbcb] Backend R3: Relax legacy git schemas + fix integration tests (#206) * [219c539b] Make task_id Optional in git request schemas and update service methods (#205) * [219c539b] feat(git): make task_id Optional in git schemas and add None-guards in service methods - GitCommitRequest, GitPushRequest, GitCreatePRRequest, GitMergePRRequest now have task_id: UUID | None = None - commit_for_task, push_for_task, create_pr_for_task, merge_pr_for_task skip ownership/state checks when task_id is None and proceed to the git operation - Added 16 unit tests in tests/unit/api/routes/test_git_optional_task_id.py covering schema validation and HTTP endpoint responses - Added 4 integration tests in tests/integration/test_git_routes.py for no-422 behaviour - All quality gates pass: ruff format, ruff check, mypy, pytest * [219c539b] fix(tests): remove unused type-ignore comments, redundant cast, and invalid agent_id kwarg in git_optional_task_id unit tests --------- Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> * [de95ce94] test(git): fix 3 rebase integration tests to use non-protected target_branch (#203) - Add pm_git_client fixture (CELL_PM role) needed for the role-gated rebase endpoint - Change target_branch from 'main' to 'develop' in test_rebase_success, test_rebase_conflict, and test_rebase_git_command_error - Remove task_id from request bodies (optional field; random UUIDs trigger 404) - Switch all 3 rebase tests to use pm_git_client instead of git_client Co-authored-by: Backend Developer 2 <be-dev-2@agents.roboco.dev> --------- Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> Co-authored-by: Backend Developer 2 <be-dev-2@agents.roboco.dev> * chore: ruff format test_agent_image_registry.py (unblock quality gate) --------- Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> Co-authored-by: Backend Developer 2 <be-dev-2@agents.roboco.dev> Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev> Co-authored-by: Renn F <rennf93@users.noreply.github.com> |
||
|
Renn F
|
e71a746499 |
fix(orchestrator): give pr_reviewer a spawn manifest so it can claim work
pr_reviewer was absent from GATEWAY_ENABLED_ROLES, so the spawn mounted no tool-manifest and set ROBOCO_GATEWAY_ENABLED=false. The reviewer booted with no flow verbs, could never claim its external-PR task, exited, and was respawned on the same task every tick — an endless loop that burned tokens. Add pr_reviewer to the set, plus a regression invariant asserting every spawnable seeded role has a manifest (only the never-spawned roles — prompter/secretary/ceo/system — may be absent) and a direct pr-reviewer-1 manifest test checking its claim_pr_review/post_pr_review verbs are present. |
||
|
Renn F
|
98c2a1f25f |
feat(external-pr): CEO decision surface — backend (notify + list + dismiss)
A notification can't be the gate: the reviewer is read-only and the CEO
decides what happens next. Backend for a real PR-review decision queue:
- post_pr_review now notifies the CEO (send_external_pr_reviewed_notification,
APPROVAL/HIGH, related_task_id) the moment a review lands — server-side
best-effort (the reviewer has no notify verb).
- TaskService.list_external_pr_reviews_awaiting_decision(): completed
external_pr reviews the CEO has neither superseded (confirmed_by_human) nor
dismissed (quick_context dismissed=1 marker).
- TaskService.dismiss_external_pr_review(): CEO declines → marker → leaves queue.
- GET /api/tasks/external-pr-reviews (PM+/CEO) and CEO-only
POST /api/tasks/{id}/dismiss-external-pr. Supersede already exists.
Panel queue wiring follows in the next commit.
|
||
|
Renn F
|
b069e1bce4 |
feat(external-pr): re-review on change, skip unchanged (head-SHA dedup)
The reviewer was one-shot: external_review_task_exists deduped on (project, pr_number) only, so an external PR was reviewed exactly once ever — a contributor pushing a fix never triggered a re-review (the review went stale). Drive re-review off the PR's head commit instead: - list_open_prs now returns head_sha (the change signal). - ingest records the reviewed SHA as an external_pr_head=<sha> marker in the review task's quick_context. - external_review_task_exists is head-SHA aware: same SHA -> skip (unchanged); new SHA -> open a fresh review (changed); no task yet -> first review; legacy/markerless task or unknown SHA -> skip (never re-review on a guess, so existing reviews don't re-fire after deploy). No migration — reuses quick_context, like the supersede markers. |
||
|
Renn F
|
6d02b75c15 |
fix(orchestrator): repo-aware external-PR polling (monorepo no longer triplicates)
Multiple projects can map to ONE repo — a monorepo product's backend/ frontend/ux cells each have their own Project pointing at the same git_url. The poll ingested per-project with a per-(project,pr) dedup, so one external PR (e.g. #170 on github.com/rennf93/roboco) created one review task per cell project — three identical reviews for the same PR. Collapse active projects to one canonical project per distinct repo before polling (_projects_one_per_repo, deterministic by slug so the pick is stable across polls). A monorepo product now yields ONE review per external PR; genuinely separate repos (multi-repo) each still get polled. |
||
|
Renn F
|
7a8c083c31 |
feat(deploy): give the PR reviewer its own image, like every other agent
pr-reviewer-1 was the one agent with no dedicated image and no compose builder service — it reused roboco-agent-base, which left it absent from the compose files entirely (so it looked like the PR reviewer simply was not there). Make it first-class for parity: add docker/agent-pr-reviewer.Dockerfile (FROM the base — read-only reviewer, no extra toolchain), an agent-pr-reviewer-image builder service in both compose files and the registry compose, the image in the release workflow's publish list, and map pr-reviewer-1 -> roboco-agent-pr-reviewer in the orchestrator plus its lazy-build dockerfile map. Supersedes the earlier base-reuse mapping. |
||
|
Renn F
|
1dc9e8e47a |
feat(deploy): run RoboCo from pre-built registry images
The orchestrator spawned agents only by bare image names and built any
missing image from source on the host, so a deployment had to carry the
build context and a toolchain — there was no way to just pull and run the
images the release workflow publishes.
Add two settings (default empty = unchanged local-build behavior):
ROBOCO_AGENT_IMAGE_REGISTRY and ROBOCO_AGENT_IMAGE_TAG. When a registry is
set, the orchestrator spawns and ensures {registry}/roboco-agent-*[:tag] and
pulls (never builds) any image it lacks. Also adds the previously-missing
agent-secretary image to the lazy-build map.
Ship docker-compose.registry.yml: a standalone compose that pulls every
published image (GHCR or Docker Hub, pinnable version) and wires the
orchestrator to spawn the matching pre-built agent images. The existing
build compose files are unchanged.
|
||
|
Renn F
|
a9fc870415 |
fix(orchestrator): harden external-PR supersede close-on-land
Scope close_pull_request repo resolution by project_id and thread the umbrella's project into close-on-land, so a contributor PR is never resolved (or closed) against a same-numbered PR in another project's repo. Skip the comment + close PATCH when the PR is already closed, so a retried sweep never re-posts the 'superseded' comment. Require a non-cancelled descendant that actually landed a PR before retiring the contributor PR, so an umbrella force-completed over a cancelled code subtask leaves the contributor's still-valid PR open. Run close-on-land from the always-on sweeper rather than the default-off poll loop, so a supersede that lands after the feature is toggled off is still reconciled. Serialize concurrent supersede triggers under a lock so a double-click can't cut two branches / spawn two umbrellas. Anchor the supersede marker checks to the marker line so appended CEO notes can't be mistaken for the closed/dedup tokens. Make the fork-head branch cut idempotent (forced refspec) so a commit-fail retry converges. Also drop an importlib.reload(roboco.config) in a unit test that rebound the settings singleton and leaked into the PM decision-window test. |
||
|
Renn F
|
5511cf6e79 |
feat(supersede): close + link the contributor PR on land
When a supersede umbrella reaches COMPLETED (our own PR merged), close-on-land retires the contributor's PR with a linking thank-you comment: - TaskService.supersede_umbrellas_pending_close() finds landed umbrellas not yet marked closed=1; mark_supersede_pr_closed() records the close (idempotent). - orchestrator._close_superseded_prs runs in the external-PR poll tick: parses the contributor PR# from the umbrella's quick_context and calls GitService.close_pull_request(delete_branch=False) — we never touch the contributor's fork branch. _parse_supersede_pr is unit-tested. Completes the supersede flow: CEO authorizes -> fork branch -> Main PM -> cell -> our PR -> CEO merge -> contributor PR closed + linked. ruff + mypy clean (279); foundation + gateway suites green (5208). |
||
|
Renn F
|
f41f9548a8 |
feat(orchestrator): author allowlist for inbound external-PR review
At ingest, a non-empty external_pr_author_allowlist restricts which external PRs are reviewed to those GitHub logins (case-insensitive). An empty allowlist (default) reviews every external PR — safe because the review is read-only; the confirmed_by_human gate still guards any later supersede that runs fork code. Unit-tested (_pr_author_allowed). |
||
|
Renn F
|
c69900ee9c |
feat(git): post_pr_review — post one change-request to a PR
GitService.post_pr_review posts a single review via POST /pulls/{n}/reviews
(REQUEST_CHANGES by default; APPROVE/COMMENT supported) — the first /reviews
call in the codebase. Resolves owner/repo/token from the project slug,
authenticates as the PAT owner (Bearer), and raises GitError on any token or
GitHub failure so the calling side-effect can surface it. This is the capability
the pr_reviewer's post_pr_review verb invokes after its DB commit. httpx fully
mocked in tests (request shape, auth, error paths).
|
||
|
Renn F
|
beb2287316 |
feat(orchestrator): inbound external-PR discovery + review-task ingestion
Add the dormant inbound path for external-PR review (gated by external_pr_enabled, off by default): - GitService.list_open_prs lists a project's open PRs, normalized with fork / author-association classification (the inbound counterpart to the org's outbound, head-filtered PR calls). - TaskService.ingest_external_pr + external_review_task_exists create one de-duped review task per newly-seen external PR (source='external_pr', confirmed_by_human=False) — a gate so no agent fetches or runs contributor code until a human confirms the PR. - A poll loop in the orchestrator, mirroring the strategy-engine loop: only when enabled it lists each active project's open PRs, ingests the external ones, and wakes the dispatcher. The trust-critical author/fork classifier is unit-tested; the GitHub-list and DB-ingest paths are exercised by the integration gate. |
||
|
|
1757659754 |
[27208d92] Consolidate Cockpit/Goals/Secretary/Pitches into a Business page (#184)
* [0c66b856] Frontend: Build tabbed Business page consolidating Goals/Secretary/Pitches (#183) * [c9f00d0d] feat(business): add /business tabbed page consolidating Goals, Secretary, Pitches (#182) - Create src/app/(dashboard)/business/page.tsx with URL-driven Tabs (goals|secretary|pitches), reading ?tab= via useSearchParams; defaults to 'goals' - Create src/components/business/goals-tab.tsx: key-introspected form fields for objectives items and operating_policy (no raw JSON textareas), updated_at/updated_by metadata, skeleton loading, OfflineState on error - Create src/components/business/secretary-tab.tsx: ReactMarkdown (GFM) chat bubbles, structured directive cards with labeled key-value rows, RequiredNotesDialog for reject, skeleton loading, OfflineState on error - Create src/components/business/pitches-tab.tsx: sub-header Refresh button, PitchCard skeleton loading, OfflineState on error (not empty-state text), RequiredNotesDialog for both Approve and Reject - Create src/components/ui/required-notes-dialog.tsx: Submit disabled on empty/whitespace, Cancel closes without action, state resets on each open via key pattern - Update sidebar.tsx: remove Cockpit/Company Goals/Secretary/Pitches entries, add single Business entry (Building2 icon, /business) - Replace company-goals/page.tsx, secretary/page.tsx, pitches/page.tsx with server-side redirect() to /business?tab=X - Replace cockpit/page.tsx with notFound() (404) - All tabs: shadcn Card + Skeleton, sonner toast for success/error Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> * [e3e5ff9b] feat(dashboard): add StrategySignalsPanel next to CeoApprovalQueue in a 2-column grid layout (#181) Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev> --------- Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev> * refactor(panel): delete the consolidated old routes instead of stubbing them cockpit/company-goals/secretary/pitches are fully consolidated into /business, so the old route pages are dead code. Remove the four page.tsx files outright rather than keep redirect/404 stubs — the clean move is to delete, not add. The sidebar already points only at /business; no internal links reference the old routes (the remaining /company-goals|/secretary|/pitches|/cockpit strings are backend API paths the API clients call, unaffected). Old bookmarks now resolve to Next's default 404, which is correct for a removed route. * perf(cockpit): light /cockpit/signals endpoint for the Dashboard panel The relocated Strategy Signals panel was calling /cockpit/summary, which runs the whole fan-out (company goals + usage/spend + task-counts + pitches + strategy assess) just to read the signals. Add CockpitService.signals() + GET /api/cockpit/signals (CockpitSignals schema, same _COCKPIT_ROLES gate) that runs only StrategyEngine.assess(), and repoint the panel (+ cockpitApi.signals() client method, CockpitSignal type). Now the Dashboard fetches only what it shows. Backend gated: ruff + full mypy + 6 cockpit tests green (live DB). --------- Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev> Co-authored-by: Renn F <rennf93@users.noreply.github.com> |
||
|
Renn F
|
de1336c74d |
fix(gateway): let a dev idle past lane-held code-queue siblings
Per-dev sequenced queues (the prior commit) have a PM delegate a dev's whole code queue up front, so a dev owns several pending, assigned-but-unclaimed code leaves at once (seq0 + seq2). The orchestrator's lane barrier holds the seq2 SPAWN while seq0 is non-terminal — but _pending_assignment_guard rejected i_am_idle for ANY pending assigned task, with no lane awareness. So a dev whose current leaf just moved to QA (awaiting_qa) could neither idle (guard rejects) nor proceed cleanly: it was steered to claim seq2 early (the claim path has no lane/sequence check, since delegate sets `sequence` not `dependency_ids`), jumping its own queue order, or it looped on the rejection. An adversarial review of the queue work surfaced this; it is latent until PMs actually delegate multi-item per-dev queues, so the green suite hid it. Fix: TaskService.has_earlier_incomplete_code_sibling mirrors the orchestrator's lane barrier in the service layer; _pending_assignment_guard now drops a dev's lane-held pending code leaves (via _pending_blocking_idle / _pending_not_lane_held) so the dev idles cleanly and the orchestrator spawns the next queue item when the lane clears — preserving one-leaf-at-a-time, in order. `is not True` keeps it inert under partial test mocks. Tests cover the service primitive (live / terminal / higher-seq / non-code / missing-field) and the guard (dev idles when lane-held; still blocks a non-lane-held pending leaf). Full mypy + xenon green. |
||
|
Renn F
|
e209e285b8 |
feat(dispatch): per-dev sequenced queues for code subtasks (guardrails spec 3)
True two-dev parallelism: a cell PM delegates the FULL set of code units up front — each dev gets its own queue, both build at the same time, each works its queue one task at a time in order. Replaces the old ceiling (≤2 code subtasks per parent, one per dev) which structurally forced under-decomposition. - Cap: `code` removed from `_SPINE_TYPE_CAPS` — no per-parent code cap (total fan-out still bounded by `_SUBTASK_HARD_CAP=12`); `planning`/`documentation` stay sequential at 1. `_same_assignee_rejection` exempts `code` so a dev may own a queue, but still rejects an exact same-title duplicate (the accidental re-delegation bug). `_spine_type_dup_envelope` simplified to the sequential spine it now only serves. - Dispatch barrier: `_blocked_by_earlier_lane_sibling` holds a dev's higher-sequence pending code leaf while it still has an earlier non-terminal code sibling under the same parent (keyed on assignee, gates only code) — the dev works its queue in order. Wired into `_spawn_pending_dev`. Loop-free (skip the tick, no reject/respawn) and best-effort (lookup failure → dispatch), mirroring the existing merge barrier. The merge barrier is unchanged: leaf PRs still merge serially in sequence order into the shared cell branch, so the independent build lanes never wedge it. - Prompt: cell_pm role guidance rewritten from the two-subtask-cap model to the per-dev-queue model (delegate all units now; dependent units go in one dev's queue, upstream first). Independent per-dev queues (each lane advances at its own pace) rather than strict cross-dev wave-sync, by design — more parallel and leaves the wedge-prone merge barrier untouched. Pairs with the spec-2 idle coverage gate: removing the code cap lets a PM claim every criterion up front, so that gate is always satisfiable. |
||
|
Renn F
|
1fb723174a |
feat(gateway): decomposition coverage gate + AC visibility (guardrails spec 2)
The decomposition floor that pairs with the roll-up gate (spec 4): a PM
cannot finish decomposing a parent while one of its acceptance criteria has
no subtask responsible for it — the "two leaves, half the ACs silently
dropped" pattern. Three parts:
- Gate: i_am_idle is rejected for a cell_pm/main_pm whose owned parent still
has criteria in unclaimed_parent_acceptance_criteria (claimed = referenced
by any live, non-cancelled child). Distinct from the roll-up gate, which
fires at submit_up/complete and demands a *completed* child; this fires
earlier and asks only that every criterion be *claimed*. Safe-by-
construction: inert until a PM declares coverage, so legacy / not-yet-
adopted decompositions are never blocked.
- Visibility: PM-facing briefings (give_me_work, i_will_plan, submit_up) and
every delegate response now carry parent_ac_coverage ({id,text,claimed,
verified} per criterion) + unclaimed_parent_acs, so a PM can map subtasks
to criterion ids via covers_parent_criteria and see what is still
uncovered after each delegate. Off for leaf roles, so a developer's own
criteria never surface as bogus "unclaimed" noise.
- Prompts: cell_pm / main_pm role prompts document covers_parent_criteria and
the new idle enforcement in the existing Coverage discipline.
TaskService.{parent_ac_coverage,unclaimed_parent_acceptance_criteria} added
beside uncovered_parent_acceptance_criteria; all three refactored onto a
shared _parent_ac_ref_sets helper (keeps each under the xenon B ceiling,
preserves the committed roll-up behavior). Verb tables regenerated for the
new delegate param — the regen also syncs pre-existing table drift that was
never regenerated after earlier merges (read_messages, pass_review
ac_verdicts, board pitch). Two brand-new generated tables (prompter,
secretary) are left untracked pending a separate decision.
|
||
|
Renn F
|
0fd9aee88d |
feat(gateway): roll-up AC-verification gate (guardrails spec 4/4)
A parent could complete / submit_up / escalate_to_ceo once its subtasks were merely terminal — never checking whether the parent's acceptance criteria were actually satisfied. That's how PR #175's half-built umbrella sailed to CEO approval (escalate_to_ceo had no subtask/AC check at all). - TaskService.uncovered_parent_acceptance_criteria(parent): parent ACs not covered by a COMPLETED child (via parent_ac_refs). Safe-by-construction — returns [] unless a child declares coverage, so it is INERT for tasks decomposed before coverage tracking and activates only once a PM maps children to parent criteria. Cancelled children do not count. - _parent_acs_covered_envelope wired into all four roll-up gates: cell_pm_complete, main_pm_complete, submit_up, and escalate_to_ceo (the weakest — previously only journal:decision). isinstance guard keeps it inert under partial mocks. - 4 new tests; 57 task + 89 gateway tests green. Pairs with spec 2 (coverage at decompose-time forces the linkage this enforces). |
||
|
Renn F
|
87ca142f4e |
feat(tasks): AC identity + child->parent AC linkage (guardrails spec 1/4)
Foundation for the decomposition-coverage and roll-up AC-verification gates. Acceptance criteria were a flat list[str] with no per-criterion identity, so nothing could relate a child task's criteria to the parent's — letting a PM drop half a parent's ACs unnoticed (PR #175). - migration 036: additive acceptance_criteria_ids + parent_ac_refs array columns; backfills stable md5(task_id:index) ids for existing rows. - Task model + TaskCreateRequest + db table: the two fields. - TaskService.create generates one stable id per criterion (1:1) when absent. - DelegateInputs.covers_parent_criteria -> child.parent_ac_refs (the linkage), propagated through create_subtask. - regression-safe (53 task tests green) + 1 new test. Coverage gate (spec 2), roll-up AC gate (spec 4), per-dev sequenced queues (spec 3) build on this. Design: docs/SPEC_AC_GUARDRAILS_2026-06-16.md. |
||
|
Renn F
|
55ff05e6ec |
fix(task): restore pre-block owner when an admin override leaves blocked
A developer that hits a wall calls i_am_blocked, which escalates the code task
to its cell PM (assigned_to=PM, BLOCKED) and snapshots the dev as
pre_block_assignee — the intended dev->cell-PM triage handoff. The in-band
recovery (unblock(restore=True)) hands ownership back to the dev. But the
OUT-OF-BAND paths — the operator PATCH /tasks/{id} status override and the
orchestrator's own _auto_recover_blocked_parent / _auto_resume_paused_parent —
go through admin_set_status, which set only status and never restored the owner.
The task re-entered pending/in_progress still owned by the PM, and the dispatcher
then execute-spawned the PM on a code task it cannot do ('break this down and
delegate' against the task itself) -> respawn loop.
admin_set_status now, when taking a task out of 'blocked' into pending/in_progress
with a pre-block snapshot present, routes through the existing
_apply_pre_block_restore primitive (the same one unblock(restore=True) uses) to
hand ownership back to the executor. Every other override is unchanged, and the
escalate/apply_escalation/block-down path is untouched, so the dev->cell-PM
handoff still works. + 2 regression tests.
|
||
|
Renn F
|
3d8c0e1c54 |
fix(git): create_pr auto-creates a missing PR base branch on origin
open_pr -> GitService.create_pr posted "base": parent straight to GitHub, so
when the parent (an ancestor task's integration branch) was never pushed — a PM
paused before its first push, or the workspace was wiped — GitHub 422'd "base
field invalid" and stranded every child PR. The base-existence fallback added
in
|
||
|
Renn F
|
25aed51c04 |
fix(agent): launch agent uv-run subprocesses with --no-sync
Agents with a write workspace (developer/product_owner/head_marketing/documenter) run with cwd = their git workspace clone. Claude Code launches each MCP server (flow/do/git-readonly/optimal/docs/search) and the SDK server as `uv run python -m ...` from that cwd. When the clone's uv.lock drifts from the baked image, `uv run` re-resolves and re-syncs /app/.venv against the clone's lock — a multi-minute stall on a cold wheel cache — so the servers never reach "connected": they sit at status="pending" and the agent gets ZERO gateway verbs. It then can't claim/commit/idle (all MCP verbs), its Stop is rejected, and it respawns in a loop redoing work it can't submit. UV_PROJECT_ENVIRONMENT pins the venv location but does NOT stop the cwd-relative resolve/sync (confirmed empirically on uv 0.11.1); `--no-sync` does, so the servers reuse the baked /app/.venv as-is and start instantly. The /app-cwd roles (qa/cell_pm/main_pm/auditor) were unaffected because their env already matches. - orchestrator.py: --no-sync on all 6 generated MCP servers - docker/scripts/sdk-startup-hook.sh: --no-sync on the agent_sdk.server launch - test_spawn_strict_mcp.py: assert every server's args start with run,--no-sync |
||
|
|
46d89b58fe |
feat: company-in-a-box — goal-aware company layer (0.4.0) (#171)
* feat(goals): company charter singleton — data layer (Business Goals slice 1)
First slice of the company-in-a-box "Business Goals" phase: a single CEO-owned
charter row (north star + objectives + constraints + operating policy) that
will be injected into every agent's context_briefing so all work is goal-aware.
- CompanyGoalsTable: singleton table (all-zeros id), JSON objectives /
constraints / operating_policy, updated_at / updated_by.
- migration 032: create + seed the singleton row (offline-renderable; column
server-defaults fill an INSERT of just the id).
- CompanyGoalsService: get() (empty defaults when unset) + upsert() (singleton,
partial update, caller commits).
- tests: empty defaults, roundtrip, singleton + partial-update preservation.
Next slices (mapped, not yet built): briefing injection (BriefingInputs +
build_context_briefing + EvidenceRepo), API route (GET any / PUT CEO-only),
panel /goals page, and base/Board/PM prompt mentions.
* feat(goals): inject the company charter into every agent briefing (slice 2)
The charter is now goal-aware context for every agent:
- BriefingInputs gains company_goals; build_context_briefing surfaces it.
- EvidenceRepo.company_goals(): single-row lookup returning a COMPACT charter
(north star + objectives + constraints + operating policy; audit columns
dropped, lists capped) or None when unset, so an empty charter never bloats
the per-verb briefing.
- _briefing_for wires it into every context_briefing.
Tests: briefing surfaces company_goals (defaults None); repo returns None for an
absent/empty charter and the compact dict when set.
* feat(goals): company charter API — GET any agent, PUT CEO-only (slice 3)
- routes/company_goals.py: GET returns the charter (any authenticated agent —
it drives every briefing); PUT is CEO-only (403 otherwise), partial update via
model_dump(exclude_unset=True), explicit commit.
- schemas/company_goals.py: response + partial-update models.
- registered at /api/company-goals.
- tests: GET open to any role, CEO update persists + is readable, non-CEO 403.
* feat(goals): make the company charter actionable in agent prompts (slice 5)
Agents already receive company_goals in the briefing (slice 2); now tell them to
act on it:
- base.md: universal "Align with the company charter" section — favour work and
trade-offs that advance the objectives, honour the constraints, flag conflicts;
never a license to leave your role.
- board / main_pm / cell_pm: role-specific lines tying triage / cell-routing /
subtask decomposition to the charter.
Prompts are composed at spawn from base.md + roles/*.md directly (compose_prompt),
so no _generated regeneration is needed.
* feat(goals): company charter panel page (slice 4)
CEO-facing editor for the charter at /company-goals:
- lib/api/company-goals.ts: get / update (PUT) client.
- company-goals-card.tsx: edit north star + constraints (one per line) +
objectives / operating_policy (JSON, parsed + validated with toast errors);
display derives from server state (no set-state-in-effect).
- (dashboard)/company-goals/page.tsx + a "Company Goals" sidebar nav link.
tsc --noEmit + eslint clean. Completes Phase 1 (Business Goals): data, briefing
injection, API, prompts, panel.
* fix(test): make test_app route assertions robust to FastAPI 0.137 _IncludedRouter
FastAPI 0.137 stopped flattening include_router into app.routes — each include is
now an _IncludedRouter (a BaseRoute with no .path), so `{r.path for r in
app.routes}` raised AttributeError and the two router-registration tests failed
(the bump arrived via the claude-agent-sdk update in uv.lock). Add
_registered_paths(): OpenAPI schema paths (the stable public contract) plus each
included router's prefix, which also covers the websocket /ws mount (never in the
schema). Drops the now-incorrect type: ignore[attr-defined].
* feat(research): pluggable web search/fetch for Board + PM agents
Add a provider-agnostic web-research capability so the Board and PMs can
ground decisions in current external evidence the knowledge base can't
answer.
- ResearchService selects a provider adapter from config: Tavily, Brave,
and Exa adapters plus a NullProvider that degrades gracefully when no
key is set. Result count and fetched-content size are clamped to caps.
- /api/research/search and /api/research/fetch: role-gated to Board + PMs
(and the CEO), with a per-agent/day Redis quota that fails open.
- roboco-search MCP server (web_search / web_fetch) calls those routes;
the provider key stays server-side and agent containers never egress.
Mounted per role by the orchestrator, behind a master switch.
- Charter-aware prompt guidance for Board, Main PM, and Cell PM.
Additive: with no key configured it is a no-op and the existing delivery
lifecycle is unchanged.
* feat(pitch): Board pitch -> CEO approve -> auto-provision repos
Add an additive origination path so a product can be proposed, approved,
and stood up without manual repo/Project setup.
- Pitch entity + migration (pitches table); PitchService create/list/
reject/approve.
- GitHubProvisioningService: the one place that creates repos (POST
/orgs/{org}/repos). Server-side token/org; when unconfigured the whole
approve path is inert and nothing is created.
- On approval: provision one repo per target cell, register a Project per
repo, create a Product when multi-cell, and seed one Main-PM delivery
task — all reusing the existing Product / coordination-task machinery.
- /api/pitches: Board authors (PO/HoM), CEO approves/rejects, Board+PM+CEO
view. Errors mapped via a single translator.
Additive: the delivery lifecycle is untouched; with no provisioning token
the capability is a no-op. Agent-facing pitch tool + panel are follow-ups.
* feat(strategy): dormant autonomous strategy engine (engine 2)
Add a second, optional engine that watches the company against its
standing goals and surfaces what needs the CEO — without touching the
delivery lifecycle (engine 1).
- StrategyEngine.assess() reports observations: the company is idle while
goals stand, and tasks stranded in 'blocked' past a threshold.
- run_cycle() notifies the CEO (notify-only; it never spends, builds, or
auto-approves — originating work stays a CEO decision).
- Orchestrator runs it on its own interval, started/stopped with the other
background loops; the loop returns immediately unless enabled.
DORMANT by default (strategy_engine_enabled=False): the loop never runs and
a standard deployment is unchanged. Auto-origination is a further opt-in.
* docs(changelog): record Business Goals, Web Research, Pitch->Provision, and the dormant strategy engine under Unreleased
* feat(secretary): wire the Secretary role end-to-end (foundation)
Add SECRETARY as a distinct role — the CEO's conversational chief-of-staff,
governed separately from the Prompter (which stays read-only/human-only).
This is the role foundation only; authority, the live agent, and the panel
land in following commits.
- foundation/identity: Role.SECRETARY (board level), seeded secretary-1 agent,
role-level mapping.
- journaling read tier (ALL — it advises the CEO), role_config entry,
per-role model (opus), prompt-layer mapping + roles/secretary.md.
- i_am_idle gains SECRETARY so the role has a verb surface.
- migration 034: add 'secretary' to the agentrole enum (mirrors 025).
- Role-registry tests updated for the new role.
Inert by itself (nothing spawns it yet); additive — existing roles unchanged.
* feat(secretary): directives + gate-list authority (backend)
The Secretary acts only under CEO command. Low-risk directives (relay a
dictated message) execute immediately; high-impact ones — charter edits,
task start/cancel/override, pitch approval, announcements — are recorded
pending and run only after the CEO confirms (the gate list).
- secretary_directives table (migration 035) as the command audit + queue.
- SecretaryService: read company state; submit (direct->run, gated->queue +
notify CEO); confirm/reject; execution runs with the CEO as actor through
the existing services (the Secretary never holds CEO authority itself).
- /api/secretary: submit + state/task reads (Secretary or CEO); list/confirm/
reject (CEO only). Writes commit explicitly.
* feat(secretary): live conversational agent (container + bridge)
Stand up the Secretary as a persistent Claude-SDK container the CEO chats
with, mirroring the Intake agent and reusing its driver/session machinery.
- secretary_driver: build_secretary_options exposes read_company_state /
read_task / submit_directive as SDK tools that call /api/secretary/* with
the agent's HMAC token; backend-call logic is module-level + tested.
- secretary_main: container entrypoint (receiver + relay) reusing IntakeDriver.
- orchestrator: start/spawn/reap secretary session + run-cmd builder; no
workspace clone (reads state via API), mints a role=secretary token.
- secretary_live routes: panel <-> container bridge over the live registry.
- agent-secretary image (Dockerfile + compose build service).
Inert until a session is started; additive — intake and all agents unchanged.
* feat(secretary): panel chat + directive confirmation queue
The CEO's Secretary surface: a live chat (SSE) to talk to the Secretary, and
a 'Needs your confirmation' queue listing gated directives the Secretary
proposed — each with Confirm / Reject. Adds the sidebar nav entry.
- lib/api/secretary.ts: live (start/stream/status/send/stop) + directive
(list/confirm/reject) + state clients (all as the CEO).
- hooks/use-secretary.ts: drives one chat, accumulating SSE token deltas.
- secretary page: chat pane + pending-directive cards.
Completes the Secretary end-to-end (role + authority + live agent + panel).
* feat(pitch): agent-facing pitch tool + pitches panel
Complete the pitch path: the Board can now author pitches through the gateway,
and the CEO reviews/approves them in the panel.
- content_actions.pitch (Board-only) -> PitchService.create, returning an
Envelope; wired as a do-tool (do_server + /api/v1/do/pitch + schema) and
added to the Board's do-tools.
- Panel /pitches page: lists pitches with CEO Approve & provision / Reject;
sidebar nav entry.
Pitch (Phase 4) is now end-to-end: author -> CEO approve -> auto-provision.
* feat(cockpit): read-only 'is the business winning?' summary
A pure aggregation for the CEO over existing data — no new state, no writes.
- CockpitService.summary(): charter north-star/objectives, delivery counts
(in-flight/blocked/awaiting-CEO), 30-day spend vs the charter's budget cap,
pending pitches, and the strategy engine's signals (what needs you). Stamped
basis='proxy' — performance is a proxy until real launches.
- GET /api/cockpit/summary (CEO / Board / Main PM / Secretary).
- Panel /cockpit page + sidebar nav.
Reuses goals + usage + StrategyEngine.assess(); reads only.
* docs(changelog): add the Secretary and Cockpit to Unreleased
* fix(test): isolate the company-goals empty-defaults test from committed state
The shared test DB persists committed writes across tests; a route test
commits a charter, so the unit test's 'unset' assertion must establish its
own clean precondition rather than assume global emptiness.
* fix(gateway): lower evidence_repo complexity to rank A (xenon gate)
company_goals()'s 4-way `or` emptiness check tipped the module average to
rank B; `any(...)` is equivalent and keeps the module under the gate's A bar.
* chore(compose): mirror agent-secretary-image build into docker-compose.yaml
Both compose files are byte-identical and tracked; .yaml carries the same
agent-secretary-image build service already present in docker-compose.yml.
* chore(lifecycle): regenerate artifacts for secretary i_am_idle
The secretary role gained i_am_idle in the lifecycle spec; regenerate the
generated prompt/doc/json artifacts so foundation-check stays green.
* docs(changelog): cut the company-in-a-box phases to 0.4.0
Label the six additive phases (business goals, web research, pitch-provision,
strategy engine, secretary, cockpit) as 0.4.0; tag v0.4.0 is held until the
branch merges to master so it points at the release commit.
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
|