3 Commits

Include renames

Author	SHA1	Message	Date
Renn F	f48106cbb6	docs: reflow hard-wrapped prose to one line per paragraph ... Markdown and editors soft-wrap on their own, so the manual ~75-char line breaks across the docs added nothing but noise. Join wrapped prose, list items, and paragraphs into single lines across 67 docs — README, CLAUDE.md, deployment, usage, the RAG knowledge base, and the agent role prompts. Whitespace-only: code fences, tables, and blockquote alerts are byte-identical and the change is token-verified (no content altered). Applied with a deterministic reflow tool (committed separately). Also lands two doc edits that were awaiting commit: the measured under-load resource numbers in usage.md and the pr_reviewer additions to the org-structure RAG doc.	2026-06-16 23:18:55 +02:00
3 people	9f8834155a	Feature: prompter gold upgrade (#84) ... * feat(prompter): make the assistant a RoboCo insider and fully wire launch The Prompter's intelligence lived in two thin static prompts, so it asked generic checklist questions and produced a flat task. The launch path was also only half-wired: the panel called the generic task-create endpoint with no project, bypassing the Prompter's own confirm flow. Interview brain - Rewrite the chat system prompt with RoboCo's org model, the task-spec standard, a dimensions playbook, and a reflect-back, 1-2-questions-per-turn, auto-stop discipline. - Inject the live projects/products list each turn so the assistant grounds questions in real surfaces and resolves the target itself. - Replace the brittle phrase-match readiness with a parsed roboco-meta control block (parse_readiness); the block is stripped from the visible reply and the turn now returns draft_ready + scale. Structured GOLD draft - Add first-class draft fields (objective, what_this_builds, the_work, notes) carried in the existing draft_data JSONB — no migration. - Compose the GOLD markdown description deterministically from those fields (compose_description); the model never hand-formats the body. Adaptive routing + wired launch - Confirm now runs through the Prompter confirm endpoint with the human's project/product choice and edited structured draft. - Single-cell targets a project and the cell team; a multi-cell feature targets a product and becomes a Main-PM coordination root that fans out. Frontend - Turn-envelope draft_ready (drop the duplicated phrase-match), structured draft card, confirm dialog with a project/product picker and a per-cell The Work editor, and the corrected priority labels (0 highest .. 3 lowest). * fix(prompter): commit session writes so they survive across requests Session create returned 201 but the row was never durably committed, so the immediately-following /messages call could not find it and 404'd. The prompter routes were the only write surface that never called db.commit() — every other write route (tasks, a2a, groups, docs, product) commits explicitly rather than rely on the request-teardown auto-commit, which is sensitive to middleware and teardown ordering under the production server. - Commit explicitly in all four prompter write routes (create session, send message, get/generate draft, confirm). - Fix _get_session's NotFoundError: it passed a full sentence as resource_type, producing the doubled "... not found not found" message; now uses the (resource_type, resource_id) signature. - Panel: when a message hits a session the server no longer has, start a fresh session and retry once instead of dead-ending on a stale id. Add a regression test that gives each request its own non-committing session — the real cross-request boundary the shared-session integration tests never crossed. It reproduces the production 404 without the route commit and passes with it. * refactor(prompter): drop the "GOLD" jargon for plain wording "GOLD" was informal shorthand for "a good/well-formed spec" that should never have been baked into the LLM prompts, comments, and docstrings as if it were a defined term. Replace it everywhere with plain language ("a well-formed task", "a complete task spec", "the markdown description", "structured spec fields"). No behaviour change. * feat(intake): add the intake interviewer agent role (static definition) Phase 1 of the intake-agent feature: a new first-class `prompter` role — the intake interviewer the CEO chats with to draft a task. This commit defines the role across every foundation layer (no runtime yet); spawning + the live session come next. - identity: Role.PROMPTER, RoleLevel.INTAKE (lowest authority), an AGENTS row (intake-1) on the board team, ROLE_LEVEL entry. Deliberately NOT in BOARD_ROLES — it interviews, it does not review. - lifecycle: gets i_am_idle like every agent (its only verb); no delivery-lifecycle intents. - journaling: ReadTier.OWN — isolated, reads only its own journal. - role_config: human-only manifest — note + evidence only, no say/dm/notify/ channels; allows_subagent=True (research), allows_write=False. - agents_config derives it automatically and correctly excludes it from TASK_CREATOR_ROLES (it drafts, it never creates tasks). - seed presentation ("Intake"); regenerated lifecycle artifacts. - role system prompt: read the code first, single-CEO awareness, propose rather than interrogate — written against the failures we saw. - docs: roster count 19 -> 20, org charts, verb-surface table, usage roster. All foundation drift checks pass; role/manifest/permission tests green. * feat(intake): migrate agentrole enum to add 'prompter' ALTER TYPE agentrole ADD VALUE IF NOT EXISTS 'prompter' so the intake agent row seeds/spawns against a migrated production DB. Forward-only (postgres can't drop enum values), guarded for offline mode — matches migration 012. * style(intake): ruff format the role additions * fix(intake): unguard the agentrole migration so it renders offline The enum-migration-parity test renders 'alembic upgrade head --sql' (offline) and greps for ALTER TYPE ... ADD VALUE. The is_offline_mode() guard skipped emitting it, so the parity check couldn't see 'prompter'. Drop the guard — PG16 permits ADD VALUE in a transaction, same as migration 020's backfill. * feat(intake): the live-session driver (Claude Agent SDK loop) Phase 2 begins. The intake agent isn't a one-shot `claude -p`; it's a live Claude Code session the human chats with. This driver is the container's loop: open one long-lived claude-agent-sdk ClaudeSDKClient, then per human message run a turn (query + receive_response) and stream its events out, keeping conversation context in-process — verified against the real SDK (v0.2.94). - StreamChunk + normalize(): map SDK messages (StreamEvent text deltas, AssistantMessage text/thinking/tool_use blocks, ResultMessage→session_id) to panel-facing chunks. Duck-typed, so it works on real SDK objects and on test fakes alike — SDK-free, fully unit-tested. - IntakeDriver.run(): the loop, with injected session/source/sink seams; a turn failure surfaces as an error chunk without killing the session. - SdkIntakeSession + build_intake_options: the only SDK-coupled code (lazy import; needs the live claude binary, so excluded from coverage). - Add claude-agent-sdk dependency + mypy ignore-missing-stubs. Relay, panel SSE, and the persistent on-demand spawn are the next steps. * Updated uv.lock * feat(intake): the panel<->agent live bridge (registry, routes, entrypoint, image) Wires the live intake chat end to end (Phase 2 integration layer): - prompter_live.py: the orchestrator-side per-session registry — open/close, push (agent->panel), stream (SSE drain), deliver (panel->container). In-process (the orchestrator is single-process). 7 unit tests. - routes/prompter_live.py: GET /live/{id}/stream (SSE), POST /live/{id}/messages (deliver), POST /live/{id}/events (relay in); registered under /api/prompter. 5 integration tests. - agent_sdk/intake_main.py: the container entrypoint — a POST /turn receiver (the driver's MessageSource) + a relay-poster EventSink + the ClaudeSDKClient session, run concurrently. 4 unit tests on the wiring helpers. - docker/agent-prompter.Dockerfile: FROM base, ENTRYPOINT = the driver (not the one-shot `claude` the other agents use). Remaining for Phase 2: the orchestrator persistent-spawn path (scope->workspace clone, CMD = driver, registry.open on spawn, reap-on-confirm) — the deploy-side piece, best finalized against a buildable image. * feat(intake): orchestrator persistent spawn + start/stop for the live chat Add the task-free spawn path for the intake (prompter) agent: one fixed intake-1 container running the Agent-SDK driver (image ENTRYPOINT, not claude -p), one live session at a time. - spawn_intake_session clones the scope's repo(s) via WorkspaceService (project -> one; product -> each distinct project, primary first), composes the intake-1 prompt, resolves the model, and builds docker run via _build_intake_run_cmd: no settings/hook mount (driver owns 9000), no MCP config, no -w; registers the live relay and best-effort delivers the opening message once the receiver is up. - reap_intake_session closes the relay and stops the container. - Routes: POST /live/start (project XOR product) and POST /live/{id}/stop. - ROLE_MODEL_MAP[prompter]=opus; intake-1 -> roboco-agent-prompter image map. - Replace the budget-sweep try/except/continue with _fetch_budget_status, which logs the swallow at debug instead of silently dropping it. 25 new tests; docker + the clone are mocked. End-to-end container spawn is pending a built image and the stack. * feat(intake): wire /prompter to the live agent — scope form + SSE chat Replace the Ollama chat loop on /prompter with the spawned-agent flow. - IntakeForm: pick scope (project XOR product) + opening message + Start before the chat; the agent clones that scope and reads the real code. - use-prompter rewritten as the live brain (lib/api/prompter-live.ts): Start spawns via POST /live/start, then an EventSource on /live/{id}/stream streams the agent working — token deltas fill the assistant bubble, tool_use/thinking drive a live activity line, a draft event renders the existing DraftProposalCard. Messages go via POST /live/{id}/messages. - Chat UX unchanged (Keep Chatting / Review & Confirm / ConfirmDialog reused); reap-on-confirm and reap-on-leave call POST /live/{id}/stop. - Drop the dead Ollama prompterApi client; trim prompter.ts to shared types. Frontend gate green (tsc --noEmit, lint, build). The draft event + the /live/{id}/confirm endpoint are the Phase 4 backend seam. * feat(intake): confirm draft -> backlog task + agent draft emission Complete the live intake vertical: the agent proposes a structured draft and Review & Confirm turns it into a task. - Draft emission: the prompter prompt instructs the agent to emit a fenced roboco-draft JSON block when the spec is ready; the driver parses it into a 'draft' event over the existing relay -> the panel's DraftProposalCard. The panel strips the raw block from the chat bubble. - Fix a double-text bug: with include_partial_messages the reply arrives as both StreamEvent deltas and the final AssistantMessage; the driver now takes text from deltas only and the AssistantMessage for thinking/tool_use/draft. - POST /live/{id}/confirm -> confirm_live_draft, reusing a draft->task core extracted from confirm_draft; reaps the session on success. - Both prompter confirm paths create at BACKLOG, not pending: backlog is the holding area a draft waits in until it's reviewed and promoted to pending (TaskService.activate). The legacy Ollama confirm was creating at pending, skipping that gate — fixed. - Remove the dead 'context' bootstrap param from the Ollama session-create chain (schema + route + method + tests), superseded by the live scope form. - No suppressions: replace every type:ignore/noqa across the intake surface with a real fix (ORM .id -> UUID(str(x)); fakes -> monkeypatch.setattr; lazy imports -> pyproject per-file ignore; union-attr -> recipients[0]). Full make quality green; frontend tsc + lint green. * build(intake): add the agent-prompter image builder to compose The orchestrator references roboco-agent-prompter (AGENT_IMAGES + the _ensure_agent_image dockerfile map) and docker/agent-prompter.Dockerfile exists, but docker-compose.yml built every other agent image up front and left this one out — so the image wasn't pre-built for a stack bring-up. Mirror the other specialized agent-*-image builders: build from docker/agent-prompter.Dockerfile, tag roboco-agent-prompter, depend on agent-base-image. * Created docker-compose.yaml for the NAS * fix(intake): non-blocking /live/start so spawn never times out The start POST awaited the whole spawn — workspace clone + first-time image build + docker run — which blew past the panel's 60s HTTP timeout ('Request timed out. The server may be busy.') and triggered a duplicate send. Found on the 2026-06-09 NAS smoke. - start_intake_session opens the live relay synchronously, then spawns the container in the background (_spawn_intake_container_guarded). The route returns the session id immediately; the panel opens the SSE stream right away. - A background spawn failure is pushed onto the relay as an 'error' event and closes the session, so the panel shows it instead of hanging. - spawn_intake_session stays as the synchronous variant for direct callers/tests. - Panel shows a 'Preparing the agent…' indicator until the first event arrives. 18 intake-spawn tests green; tsc + lint green. E2E re-validates on next smoke. * fix(intake): propose_draft MCP tool + lock the agent down Smoke 2026-06-09 exposed two compounding problems: the agent never reliably emitted the draft (it narrated the spec instead of typing the magic fence), and it had inherited the CEO's entire Claude Code env — Write/Edit/Bash + Gmail/ Notion/Calendar/Drive MCP — because bypassPermissions ignored the allowlist and the mounted ~/.claude leaked the host MCP config. - propose_draft: build_intake_options now registers an in-process SDK MCP tool (create_sdk_mcp_server + @tool). The agent calls it to submit the draft; the driver turns that ToolUseBlock into a 'draft' event (_is_propose_draft / _draft_from_tool_input, tolerant of nested/flat/JSON-string input). The fenced roboco-draft block stays as a fallback. - Lockdown: strict_mcp_config=True + setting_sources=[] (ignore host MCP + settings); permission_mode 'dontAsk' + a can_use_tool gate enforcing a hard allowlist (Read/Grep/Glob/Task + propose_draft) replaces bypassPermissions. - Prompt: call propose_draft (not a fence); the draft's downstream chain is backlog -> Board (PO + HoM) -> CEO approve -> Main PM, and the agent's job ends at the draft (it never routes or hands off). SDK API verified against the installed claude-agent-sdk. Driver detection unit- tested; the SDK-construction is validated on the next NAS smoke (incl. that setting_sources=[] doesn't break the mounted-~/.claude auth). * fix(intake): panel UX cluster from the smoke (#3/#4/#6/#12) - #3 message boundaries: a tool call now ends the current text bubble, so the agent's words before and after a tool render as separate messages instead of one merged wall (the 'two waves merged into one bubble' the CEO saw). - #4 activity indicator: promoted from tiny grey text to a prominent primary- tinted pill so 'watch it work' is actually visible. - #12 End chat: a header button (any chat state) reaps the agent and resets to the form, reusing startAnother (which already stops the session). Backend POST /live/{id}/stop already existed. - #6 log noise: the opening-message delivery retry logs at debug, not error — those failures are expected until the container receiver is up. - Also fix a latent test gap from the #1 commit: the live-route test's fake orchestrator now exposes start_intake_session (the route's non-blocking entry). Frontend tsc + lint green; live-route + prompter_live tests green. * fix(intake): render markdown in the chat bubbles (#8) The agent emits rich markdown (### headers, **bold**, tables, lists) but the bubble rendered raw text, so it was illegible (CEO-flagged on the smoke). Render assistant content with react-markdown + remark-gfm (GFM tables) in a prose container. Adds react-markdown + remark-gfm to the panel. * feat(intake): #14 — two start routes (Board review vs straight to Main PM) Per the CEO spec, the draft confirm now starts the task at PENDING with an explicit assignment instead of parking it at backlog: - route="board" (Board review & Start): assigned to the Product Owner, so the orchestrator dispatches the full Board review (PO + Head of Marketing) before the Main PM picks it up. - route="main_pm" (Approve & Start): assigned straight to the Main PM, who delegates to the cells (Board review skipped). create_task_from_draft gains status + assigned_to params (default BACKLOG, so the legacy confirm_draft is unchanged); confirm_live_draft + the /live/{id}/confirm request carry the route. Service tests cover both routes. * feat(intake): #14 draft-card buttons — Board review vs Approve & Start Three buttons on the draft card now (CEO spec): Keep chatting / Board review & Start / Approve & Start. The two action buttons confirm directly with their route — launchTask(route) sends route to POST /live/{id}/confirm, which starts the task at pending assigned to the Board (PO+HoM) or straight to the Main PM. Supersedes the ConfirmDialog review step (scope is chosen up front in the form), so it's removed from the page flow. The ConfirmDialog component + its sub-editors are now unused — flagged for a follow-up cleanup, left in place to avoid churn. tsc + lint green. * fix(intake): keep the live SSE stream bound to its relay session The orchestrator opened the relay session twice per live chat — once on the request path (before the start call returns) and again inside the background container spawn. The SSE stream binds to the session's queue the moment the panel connects, so the second open swapped in a fresh queue and stranded the stream: the agent replied normally, but its events went to the new queue while the panel kept reading the old one, so the chat looked frozen on "Preparing…". The second open was always redundant (the relay is opened by the caller before the spawn). Remove it, and make open() idempotent so a live session is never replaced out from under a stream that is already connected to it. * fix(intake): draft-card launch buttons silently did nothing The launch path required a `description` field, but the prompter draft schema intentionally has none — it sends `objective` + the structured spec and the backend composes the description (compose_description). `editableDraft.description` was therefore undefined, so `description.trim()` inside launch validation threw a TypeError that propagated out of the button's onClick. Clicking "Board review & Start" / "Approve & Start" did nothing, with no feedback — the wall blocking the whole confirm → task → reap flow. - Map a proposed draft's description from `objective` as a fallback. - Make launch validation null-safe. - Replace the silent early-return with a toast that names what's missing, so a blocked launch is never a dead, feedback-less button again. * fix(intake): steer the agent to ask inline, not via AskUserQuestion The intake's job is to ask clarifying questions, so it reached for the AskUserQuestion tool — which isn't wired to the live chat panel and isn't in its allowlist. The bare deny left it to stumble ("let me clarify… — no worries, let me just lay it out") and waste a visible turn. - Prompt: spell out that it asks by writing in the chat (the human reads every message live) and that no question/prompt tool is available to it. - Gate: give AskUserQuestion a specific deny message that nudges it to ask inline, so even a reflex attempt degrades gracefully. Also refresh the now-stale "what happens after propose_draft" section: the draft card has three choices (Keep chatting / Board review & Start / Approve & Start) and produces a pending task — not the old two-button "backlog" description. * feat(intake): copy buttons on agent messages and the draft card The CEO asked for a way to save the agent's plan/spec elsewhere "just in case" — a cheap manual backstop until refresh-durability lands. - New CopyButton: async Clipboard API when available, plus a legacy textarea+execCommand fallback. The fallback is load-bearing — the panel is served over plain http on a LAN IP, where navigator.clipboard is absent (clipboard needs a secure context), so the modern API alone would never copy. - Copy button under each assistant message (copies its text). - Copy button on the draft card (copies the full spec as markdown: title, objective, what-this-builds, the-work per cell, notes, success criteria). * feat(intake): unbuffer logs + log each turn so the container isn't a black box Debugging the intake smoke was painful for two reasons: (a) the orchestrator block-buffered stdout, so `docker logs` lagged minutes behind reality, and (b) the intake container logged only "session opened" then went silent for the whole conversation (the chat streams to the relay, not stdout). - Set PYTHONUNBUFFERED=1 on the orchestrator and agent-base images so structured logs reach `docker logs` in real time instead of in large delayed chunks. - Log each intake turn: "turn received" (with char count) and "turn streamed" (chunk count + whether a draft was emitted), so the container logs show the conversation's shape at a glance. * chore(intake): remove the dead ConfirmDialog draft editor The three-button draft card (Keep chatting / Board review & Start / Approve & Start) replaced the old review-modal confirm flow, leaving ConfirmDialog and its sub-editors (StringListEditor, TheWorkEditor) referenced by nothing but the barrel export. Remove the three files and the export — typecheck + lint confirm no remaining references. * fix(intake): coerce bad draft enums on confirm instead of hard-failing The intake agent is an LLM and will emit off-enum values — e.g. task_type="feature", which is not a valid TaskType (code/documentation/research/planning/design/ administrative). `_coerce_draft_enums` called `TaskType(value)` directly, which raised, and the confirm 400'd with "Draft has invalid or missing required fields: 'feature' is not a valid TaskType". That forced the agent to discover the valid values and self-correct in-chat — unacceptable: clicking "Approve & Start" must never blow up on a cosmetic enum guess. Coerce each enum to a sane default on invalid/missing (task_type→code, nature→technical, complexity→medium); team falls back to the first valid cell in the_work, then backend. `_lead_cell_team` now skips invalid cell names too. The confirm/launch action no longer hard-fails on an enum the model got wrong. * fix(intake): draft card no longer renders above the user's latest message attachDraft fell back to "the last assistant message anywhere" when the current turn had no streamed text yet (propose_draft called first). That last message was often the PREVIOUS turn's — sitting above the user's "Yes, propose it" — so the draft card rendered above the user's message. Attach only to the current turn's streaming message; otherwise append a fresh assistant message so the card always lands at the bottom of the thread. * test(intake): guard draft enum coercion + invalid-cell skipping Regression tests for the confirm-time enum coercion: an off-enum task_type ("feature") / nature / complexity coerce to code/technical/medium instead of raising, and _lead_cell_team skips invalid cell names. Locks in that a bad enum guess from the agent can never 400 the launch again. * fix(intake): stop the agent fumbling through Claude Code meta-tools In smoke it reflexively probed CC built-ins before reaching propose_draft — plan mode + ExitPlanMode (it announced a written plan and waited instead of emitting the draft), ToolSearch, Write — each correctly denied by the lockdown but stumbly, and it only proposed after explicit CEO nudges. - Gate: ExitPlanMode now gets a specific deny nudge ("you don't use plan mode; call propose_draft"), and the generic deny names the actual toolset instead of a bare "not available", so any probe degrades into guidance. - Prompt: forbid plan mode/ExitPlanMode/ToolSearch explicitly and spell out "you do not plan and wait — call propose_draft directly when the spec is ready," plus an anti-pattern bullet. * feat(intake): make the container logs transparent mid-turn `docker logs` on the intake container was a black box: only turn start/end, while the agent read the codebase and spawned 20+ subagents invisibly (the conversation streams to the relay, not stdout), and the benign 3x ~/.claude.json warning was the only thing visible. - Driver logs each tool call mid-turn ("Intake tool use" with the tool name) and the draft emission, plus a tools count in the turn-streamed summary. Text deltas stay unlogged (they'd spam). Now the logs show the turn's real shape. - Pre-create ~/.claude.json ({}) at container boot so the CLI's "config not found" warning (printed 3x, self-healed anyway) stops drowning the real logs. * fix(intake): render markdown in user messages + scope copy to code blocks Two display fixes from the smoke: - User messages collapsed newlines (plain {content} in a div) and rendered no markdown — a "1.\n2.\n3." answer showed as one run-on line. Render user AND assistant bubbles through a shared GFM markdown body that inherits the bubble's text color, so lists / newlines / styling render correctly on both. - Copy was blanketed on every assistant message; scope it to KEY parts — a copy button on fenced code blocks (the draft card keeps its own). Removed the per-message button. * fix(intake): prevent duplicate tasks from a double-click on launch Clicking a draft launch button twice fired two confirms and created duplicate tasks. Add a synchronous re-entry guard (a ref — no stale-closure window) at the top of launchTask so a second click returns immediately, and disable + spin the draft-card buttons while a launch is in flight so it's visually clear it's working. * docs(how-to): lead task creation with the Task Assistant flow Rewrite "1 · It starts with you" to walk the Prompter/Task Assistant path — scope form, the agent reading the codebase, its grounded analysis, the draft card, and the created task — then flow into the Board review. Replaces the old manual task-definition form shots. Image placeholder: images/prompter_draft_card.png (the 3-button card) is referenced but not yet captured — TODO comment marks it for the next smoke run. A second comment flags an optional re-capture of prompter_run_2 after the markdown-rendering fix. * fix(intake): restore assistant message text contrast The markdown refactor dropped `dark:prose-invert` and made text inherit the bubble's color, but the assistant bubble had no explicit text color — so its text rendered near-invisible (dark-on-dark on bg-muted). Give the assistant bubble an explicit text-foreground; the user bubble already carries text-primary-foreground, and [&_*]:!text-inherit now resolves to a readable color on both. * fix(intake): coerce draft priority too — confirm 500'd on priority="high" The enum-coercion fix covered task_type/nature/complexity/team, but priority is a non-enum int field handled by `int(draft_data.get("priority", 2))`, and the agent guesses a word ("high") as readily as a number — so int("high") raised ValueError and the confirm 500'd. Same class of bug, one field missed. Add _coerce_priority: map words (urgent/high/medium/low → 0/1/2/3), clamp numbers to 0-3, default to 2 (medium) on anything else. The launch can no longer crash on any field the LLM guessed. + regression test. * fix(intake): draft card shows distinct cells, not one badge per work item the_work has one entry per work item, so a cell with several items rendered its badge repeatedly ("Board-led across Backend Backend Backend Frontend Frontend …"). De-dupe to distinct teams so the card reads "Board-led across Backend Frontend" — and the "Cell:" vs "Board-led across" label keys off distinct count. * docs(how-to): hero the teaser gif + resolve the Prompter/Task Assistant thread - Move the 12s teaser gif to the top as the hero — it was buried between the "prefer video" link and the first screenshot. - Name the connection: the Task Assistant IS the Prompter, so section 1 (using the tool) and the rest (RoboCo building it) read as one story — you use the tool the company built for itself, then watch the build. - Re-anchor the section 1 → Board transition to follow the Prompter's own journey, instead of implying section 1's example task is the one reviewed next. * Included images for how-to.md * docs(how-to): align agent count to 20 (matches README + CLAUDE.md) The how-to said "18 agents" with UX/UI at one dev and no Intake — stale against the authoritative count. Bump 18→20 (prose + spelled-out eighteen→twenty), give UX/UI 2 devs, and add the Intake line to the org tree (Intake leads section 1, so it belongs in the tree). README + CLAUDE.md already say 20. * ci(release): publish all RoboCo images to GHCR + Docker Hub The release published only the orchestrator to GHCR. Build and push the full set the stack needs — agent-base, the 8 agent images, orchestrator, and panel — to BOTH ghcr.io/rennf93/* and docker.io/renzof93/*, at :<version> and :latest, so consumers can pull instead of compose-building. - agent-base builds first (the agent images build FROM roboco-agent-base, a local tag), then the rest; push only after every build succeeds. - Image names mirror the docker-compose `image:` values 1:1. - Free disk on the runner first (11 images is space-heavy). - Needs a DOCKERHUB_TOKEN repo secret for the Docker Hub login. - SECURITY.md updated to reference both registries. * ci(release): use short SHA as the image tag on manual dispatch A workflow_dispatch runs against a branch, and the branch name (e.g. feature/prompter-gold-upgrade) was used verbatim as the image tag — but "/" is illegal in a Docker tag, so the first build failed instantly with "invalid reference format". Releases still tag from the release tag; manual dispatch now always uses the short SHA, which is a valid tag. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-09 17:08:34 +02:00
3 people	110aaa7a77	Chore: v1 removal gateway canonical (#46) ... * chore(agent_sdk): remove dead /traceability/remind endpoint and reminder map The TRACEABILITY_REMINDERS dict and its /traceability/remind endpoint were keyed entirely on pre-gateway tool names (roboco_task_*, roboco_journal_*, roboco_message_send, roboco_session_create_for_tasks) deleted in the gateway cutover. The endpoint had zero callers; v2 enforces traceability server-side in the Choreographer. * fix(bootstrap,seeds): onboarding prompts call give_me_work(), not deleted roboco_task_scan() The startup prompt and the seeded cell/all-hands channel onboarding messages instructed agents to call roboco_task_scan() — a tool removed in the gateway cutover. Point them at the live give_me_work() flow verb. * fix: replace remaining deleted v1 tool names with gateway verbs Spawn prompts, onboarding strings, remediation messages, and comments still referenced pre-gateway tools deleted in the cutover (roboco_task_*, roboco_agent_idle, roboco_notify_*, roboco_message_send, roboco_session_create_for_tasks, roboco_journal_*, roboco_escalate). Rewrote each to the correct role-scoped gateway verb (give_me_work/i_will_work_on for workers, triage for PMs, i_am_done vs complete, notify/notify_ack, escalate_up, unclaim, i_documented, open_session, note). Updated one enforcement-message test that matched the old tool name by coincidence. * test: guard against deleted v1 tool names reappearing in roboco/ Scans roboco/ for the deleted pre-gateway tool names; excludes the orphaned roboco/agents/ subtree (removed in a later phase). * chore(exceptions): drop 8 unused pre-gateway exception classes + their tests LLMError, RAGError, AlreadyExistsError, TaskBlockedError, TaskClaimError, AgentNotAvailableError, AgentBusyError, NotificationPermissionError were never raised in production. SessionClosedError/DatabaseError are kept (live + tested). * chore(models): drop unused pre-gateway notification/channel/handoff factories Removes create_task_assignment/_blocker_escalation/_review_request/ _documentation_request/_priority_change/_alert/_broadcast, create_cell_channel/ _cross_cell_channel/_announcements_channel, create_handoff (+ HandoffParams), ProactiveContext, and A2APartType. The gateway choreographer builds these server-side now. Drops the matching dead-code tests. * chore(services): drop unused pre-gateway permission/messaging/audit/optimal/remediation methods These pre-gateway helpers (channel-permission checks, channel-membership ops, permission-denial audit hooks, doc ingestion, two remediation hints) have no production caller — the gateway role_config + enforcement layer replaced them. Drops the matching dead-code tests; live methods (send_message, the SESSION_* flow, log_task_action_denial, etc.) are untouched. * chore(orchestrator,ws,events,config): drop unused pre-gateway lifecycle/broadcast/roster symbols orchestrator: get_running_agents, is_agent_busy, queue_priority_work, get_all_instances (+ their OrchestratorAccessProtocol declarations in events.py). websocket: broadcast_new_message, broadcast_session_closed (no event type emits them). agents_config: ALL_PMS/ALL_DEVS/ALL_QA/CELL_PMS roster constants (ALL_DOCS stays — it gates docs-write workspace perms). * refactor(agents): delete orphaned pre-gateway agent subtree + dead organization model The Gateway/full cutover replaced the Python agent-class implementations with the server-side Choreographer; the classes survived only as a self-referential island. Removes roboco/agents/{base,mixins,factory,board,developer,documenter, pm,qa,orchestrator}.py and roboco/agents/factories/{board,cells,developers, documenters,pms,qa}.py, plus roboco/models/organization.py (Cell/Board/ Organization — used only by those factories). Keeps factories/_base.py (compose_prompt — the live prompt-layer composer the orchestrator calls at spawn) behind minimal package __init__ files. * chore(db): drop dead tasks.execution_log + outputs columns (migration 015) Both JSON columns had zero readers/writers in code, tests, and migrations — execution progress is tracked via progress_updates and artifacts via commits/documents. Removes the ORM columns, the Pydantic Task.execution_log/ outputs fields, the ExecutionLog/FileRef models (+ their __init__ exports), and the now-invalid kwargs from test fixtures. Migration 015 (down_revision 014_drop_pm_approvals) verified live: upgrade drops, downgrade re-adds. Apply on the NAS with 'alembic upgrade head' at next deploy. * chore(config): drop 16 unread Settings fields Verified unused (no settings.X, no self.X property use, no getattr-by-name): app_name, reload, workers, openai_api_key, secret_key, access_token_expire_minutes, algorithm, log_level, log_format, the four session_* limits, message_max_length, commit_subject_min_chars, commit_banned_words, agent_budget_sweep_interval_seconds. Removes the empty Logging + Sessions&Messages sections and orphaned .env.example vars. Kept: redis_db/redis_password (redis_url property), agent_sla_* (read via getattr in task_lifecycle), encryption_key, and all live thresholds. NOTE: commit_banned_words/commit_subject_min_chars and agent_budget_sweep_interval_seconds were feature-config never wired to their consumer (commit validator / budget sweep) — removed as dead, but flagged in case the intent was to wire them. * test(lifecycle): give i_will_work_on calls a substantive plan (#171 contract) The real-DB lifecycle tests called i_will_work_on with a 13-char plan and no risks/technical_considerations, so the substantive-plan gate (#171) rejected them with incomplete_input — failing on master. Supply a >=150-char plan plus technical_considerations and risks (mirroring tests/unit/gateway/ test_choreographer_dev.py). All 6 now pass; gate runs with no deselect. * feat(gateway): wire commit-validator thresholds to settings commit_subject_min_chars and commit_banned_words were config defined but never read — the gateway commit() gate used the validator's hardcoded module defaults. Re-add the two Settings fields and pass them through validate_commit_message in content_actions.commit(), so config is the source of truth (validator defaults remain the standalone/CI fallback). Adds wiring tests that monkeypatch settings and assert the gate honors them. * refactor(orchestrator): retire gateway_enabled flag; trigger_filter is unconditional The gateway_enabled Settings field gated only the trigger_filter spawn-cooldown (never the agent tool surface). Prod ran it on; the Phase-0 'legacy dispatch path' it guarded no longer exists. Remove the field + the early-return branch in gateway_pre_spawn_check so the cooldown runs for every spawn, drop the now-dead ROBOCO_GATEWAY_ENABLED from docker-compose.yml, and update the stale Phase-0 comments + cooldown test. The per-container ROBOCO_GATEWAY_ENABLED env (set by _append_manifest_args, read by agent_sdk to load the manifest) is unaffected. * refactor(api): relabel /api/v2 -> /api/v1 as the canonical gateway surface The gateway is the only agent API now, so the 'v2' label (with no v1) was misleading. Renames roboco/api/routes/v2 -> routes/v1, schemas/v2 -> schemas/v1 (+ the matching test dirs and test_v2_role_dep/test_schemas_v2_flow files), rewrites every /api/v2 path, routes.v2/schemas.v2 import, and v2-* router tag to v1, and refreshes the stale 'v2' comments/docstrings. The panel is untouched (it uses the unversioned /api/* REST routes). flow_server/do_server now POST to /api/v1/*. * docs(scripts): reset_runtime_state header matches actual SQL behavior The header claimed it preserves groups + journals, but the .sql wipes both (verified live: groups 6->0, journals 5->0; only agents/projects/channels survive). Correct the wiped/preserved lists to match. * refactor(gateway): extract _build_rich_plan to drop i_will_work_on under the complexity gate i_will_work_on was cyclomatic rank C (11) — one over the xenon --max-absolute B threshold — because of the five `x or default` fallbacks in the rich_plan dict. Move that dict into a small _build_rich_plan helper (behaviour identical); both methods are now rank B. make quality is fully green (xenon was its last failure; bandit already passed — its 34 findings are all LOW severity, filtered by -ll). * feat(foundation): add canonical CELL_TEAMS set; dedupe cell-subset literals * feat(db): add ProductTable + ProductProjectTable ORM (per-cell project map) * feat(task): add additive nullable product_id (ORM + model + DTO + create threading) * feat(task): thread product_id through create_subtask/route/response * feat(db): migration 016 — products, product_projects, tasks.product_id * fix(db): document migration 016 plan deviations (revision len, FK name) Two values in migration 016 intentionally diverge from the Task 2.4 plan literals; this strengthens the in-file justification so the deviations are self-documenting and verifiable. - revision id (plan line 623): the plan's 36-char "016_add_products_and_task_product_id" overflows alembic_version.version_num (VARCHAR(32)) — alembic upgrade head raises asyncpg StringDataRightTruncationError. Kept at 27 chars ("016_add_products_product_id") so Step 4's live round-trip stays green. - downgrade FK name (plan line 683): roboco/db/base.py sets a metadata naming_convention, so the FK upgrade() creates is "fk_tasks_product_id_products", not the Postgres default "tasks_product_id_fkey". The plan literal does not exist in the DB and would fail the downgrade with "constraint does not exist". Both verified via the live upgrade/downgrade round-trip on a throwaway DB. Issue 3 note: the prior commit (b896cac) also touched tests/unit/api/test_schemas_tasks.py (added product_id=None to the task_to_response stub). That line is load-bearing — task_to_response reads task.product_id (added in Task 2.3, commit 67afa6b) — and belongs to Task 2.3's scope; it is left in place because removing it breaks 4 tests and history is not rewritten. * refactor(db): trim migration 016 deviation notes to plan-faithful form Reverts the out-of-scope documentation expansion (commit 1a4f296), which was a second undocumented commit beyond Task 2.4's single plan-specified commit and only bloated the migration docstring/comments. The migration file now matches the plan-specified commit (b896cac) byte for byte: the two necessary deviations from the plan literals stay (revision id shortened to fit alembic_version.version_num VARCHAR(32); downgrade FK name follows db/base.py's metadata naming_convention), each kept to a concise inline note in the plan's header style. The Task 2.3-scoped test stub line (tests/unit/api/test_schemas_tasks.py product_id=None) is load-bearing — task_to_response reads task.product_id — and is left in place; history is not rewritten. Verified: live alembic upgrade head + downgrade to 015 round-trip on a throwaway DB drops products/product_projects/tasks.product_id cleanly, and make quality is green. * refactor(test): annotate db_session and drop type: ignore in migration 016 test Annotate the test_products_tables_and_task_fk_exist param as db_session: AsyncSession (imported under TYPE_CHECKING) and remove the # type: ignore[no-untyped-def] suppression, matching the typed db_session pattern used across tests/integration/. * feat(models): Product + ProductCreate/Update + ProductCellMapping (cell-validated) * refactor(models): minimize ProductCellMapping config override to use_enum_values The previous override re-declared validate_assignment, populate_by_name, and extra=forbid, which RobocoBase already supplies. Pydantic merges model_config across inheritance, so overriding only use_enum_values=False is sufficient to keep team as a real Team enum (required so team in CELL_TEAMS and enum identity hold for callers) while inheriting the rest of the base config. * fix(models): document ProductCellMapping use_enum_values override as plan-mandated Resolves SPEC-COMPLIANCE review notes for Task 3.1 (Product domain models). 1. The ProductCellMapping use_enum_values=False override is a deviation from a bare project.py mirror, but it is mandated by the plan's own Task 3.1 code: RobocoBase sets use_enum_values=True, which coerces team to the plain string "backend". The plan's Step 1 test asserts m.team is Team.BACKEND (enum identity) and the Step 3 validator formats its error with v.value, both of which require team to remain a real Team enum. The override is therefore necessary; this commit relabels the comment to cite the specific spec lines that force it instead of leaving it as an unexplained departure. Downstream Task 3.2 (_replace_cells / project_for) already tolerates either form and the ORM stores the same value regardless, so the override has no behavioral reach beyond the in-memory enum identity the plan's test checks. 2. test_product_model.py hoists 'from uuid import uuid4' to module level rather than inline (as the plan's verbatim Step 1 code shows) because the global Pylint PLC0415 rule (import-outside-top-level) forbids inline imports and there is no per-file-ignore for tests/unit/models/. The hoisted form is the only ruff-clean rendering of the plan's test; left unchanged here. 3. Task 3.1 landed across two commits (c616d95 create, 6ebad255 refactor) rather than the plan's single Step 5 commit. Earlier history is intentionally not rewritten; this single follow-up commit brings the model to its final spec-faithful, fully-documented state. * feat(service): ProductService CRUD + project_for per-cell resolver * feat(api): Product CRUD routes + schemas, wired into the app * fix(api): roll back and map cell-replacement IntegrityError on product update update_product replaced cells via ProductService._replace_cells without any try/except, so a duplicate-team cell (uq_product_projects_product_team) or a non-existent project_id (product_projects.project_id FK) raised an IntegrityError at flush, poisoning the AsyncSession and surfacing an unhandled 500 with no rollback. Wrap the update + commit in a try/except that rolls back and maps the UNIQUE violation to 409 and the FK violation to 422, mirroring create_product's rollback discipline. Add integration tests covering both client-error paths. * fix(api): map create_product cell-mapping IntegrityError to 409/422 create_product only caught the slug conflict ('already exists' in str(e)) and bare-raised everything else, so a cells entry whose project_id does not reference any project let the product_projects.project_id FK IntegrityError propagate out of the route as an unhandled 500. The matching update_product path was already hardened (uq_product_projects_product_team -> 409, FK violation -> 422); apply the same mapping in create_product so a bad project_id (or a duplicate-team cell) is a client error, not a server error. The slug conflict is now caught as ConflictError directly instead of via a broad except + string match. * feat(gateway): add optional project_id to delegate inputs/request/routes * feat(gateway): per-cell project routing (override -> product map -> parent) + product_id inheritance * feat(task): approve_and_start — reassign board task to Main PM (CEO gate #1) * feat(api): POST /tasks/{id}/approve-and-start (CEO gate #1, notes-required) * test(api): cover approve-and-start 404-before-notes-gate for missing task * feat(panel): Product types + Task.product_id * feat(panel): productsApi + hooks + tasksApi.approveAndStart * feat(panel): Products management screen + sidebar nav * feat(panel): Approve & Start button (CEO gate #1) * fix(api): narrow delete_product to IntegrityError + cover 204/409 delete paths * test(task): assert approve_and_start persists + appends the audit note * refactor(db): migration 016 names the tasks.product_id FK explicitly (house style) * fix(db): make migrations authoritative + self-heal orphan product tables init_db() no longer silently falls back to create_all when alembic upgrade fails. That fallback masked migration failures and, since create_all cannot ALTER an existing table, left the schema inconsistent — turning an unapplied migration 016 into a crash loop: 016's CREATE TABLE products failed, the upgrade rolled back, create_all re-created an empty orphan products table, and every later boot failed again on the now-existing table while tasks.product_id never got added. Now a migration failure is raised so the real error surfaces. Migration 016 additionally drops EMPTY orphan products/product_projects tables left by the old fallback before creating them, so an already-polluted DB self-heals on the next deploy with no manual SQL. Skipped in offline (--sql) mode; refuses to drop a table that holds rows. * fix(db): create_all is the schema source of truth; alembic for increments The Alembic chain is incomplete relative to the ORM — columns/tables like notifications.delivered_at and the RAG indexed_documents table have NO migration and have only ever been materialized by create_all. Tests don't catch this because the test DB is also built via create_all, so migrations are never exercised. The prior 'migrations are authoritative' init_db (and before it, the create_all-only-on-failure fallback) therefore left a migrate-only boot with missing columns/tables. init_db now reflects reality: - Fresh DB -> create_all builds the full current ORM schema, then stamp Alembic at head so later incremental migrations apply. - Existing -> run pending migrations (a real failure is raised, not masked), then create_all(checkfirst) to gap-fill any missing ORM tables. create_all cannot add a column to an existing table, so an ORM column added without a migration needs a fresh rebuild of that table to appear. * fix(db): migration 017 reconciles the Alembic chain with the full ORM schema For years the live schema was built by create_all, not migrations, so the chain drifted — tables/columns/indexes in the ORM had no migration (the indexed_documents table, notifications.delivered_at, ~15 indexes, plus timestamptz/server-default metadata). With init_db no longer masking that via a create_all fallback, a migrate-only boot was missing those objects. 017 was produced by 'alembic revision --autogenerate' against Base.metadata, reviewed, and verified: on a fresh DB, 'alembic upgrade head' (001..017) now reproduces the create_all schema EXACTLY — a re-run of autogenerate detects zero changes — and the 017 upgrade/downgrade round-trips cleanly. The migration chain is now complete: migrate-only and create_all converge. Also updates the init_db tests to assert the new behaviour (raise on an existing DB's migration failure; create_all + stamp head on a fresh DB) instead of the removed silent fallback. * feat(panel): Product picker in the New Task form (drives per-cell routing) The Products screen and Approve & Start button shipped, but the task-creation form had no way to attach a Product — so a human couldn't set product_id from the UI, which is exactly what drives per-cell project routing of delegated subtasks. Adds an optional Product dropdown (Advanced -> Git config) populated from useProducts(); 'None' falls back to the single project. * fix(db): seed data is preserved on a fresh DB (run migrations, not bare create_all) The previous fresh-DB path (create_all + stamp head) built the tables but never ran the migration chain, so migration-embedded SEED DATA was skipped — most visibly the AI providers seeded in 004. After a DB reset that left provider_configs empty, so PUT /api/providers/ollama-key 404'd (the handler raises NotFoundError when the Ollama provider row is missing). Since migration 017 made the chain reproduce the full ORM schema, init_db now runs 'alembic upgrade head' from base on a fresh DB — building every table/column/index AND running the seeds. Verified: a fresh upgrade head seeds both provider rows. Existing DBs still get migrations + create_all gap-fill. Updates the init_db fresh-DB test accordingly. * feat(task): project_id optional when a product_id is set (board fan-out tasks) A board task that fans out across cells via a Product has no single repo of its own — backend/frontend/ux_ui are each wrong, because the root coordinates and delegates. Forcing one arbitrary Project was broken design (flagged at design time). project_id is now nullable; a task must have project_id OR product_id: - TaskCreate model validator + a TaskService.create() invariant (covers every create path). - ORM/DTO/schema: project_id nullable; task_to_response uses to_python_uuid. - Gateway: a parent with only a product can delegate (guard now needs BOTH project and product to be None to reject); _resolve_subtask_project resolves each subtask from the product map and raises a clear error if a cell has no mapping and no parent project. - Migration 018 (tasks.project_id nullable), round-trip verified; fresh upgrade head still seeds providers. - Panel: Project no longer required once a Product is selected. - Removed the dead, never-called a2a create_task_from_message (it could only ever create a repo-less task) + its two coverage-only tests. make quality green; panel tsc/lint/build green. * Upgrade to Minimax M3 * fix(db): seed providers on existing DBs + correct enum casing Migration 004 created the modelprovider/assignmentscope enums and seeded provider rows in UPPERCASE, but the ORM (_str_enum) reads/writes the lowercase StrEnum .value — so a fresh migrate-from-base DB built an enum the ORM cannot read. Lowercase the enum labels and seed values in 004. Add idempotent migration 019 to (re)seed the Anthropic + Ollama Cloud providers with ON CONFLICT (name) DO NOTHING, so an existing DB whose provider_configs table was created by create_all (and never ran 004's seed) gets the rows on the next `alembic upgrade head` — fixing the /api/providers/ollama-key 404 without a volume wipe. * fix(tasks): let board/fan-out coordination tasks flow without a repo A coordination task (project_id NULL, product_id set) targets no repo of its own — it fans out to cell subtasks that each resolve a real project from the product's cell->project map. Several paths still assumed every task does git work and blocked it: - orchestrator: add _is_coordination_task() and exempt these tasks from the project/branch/git-token gates in _readiness_check_task, _readiness_gate, _check_stuck_conditions, _validate_task_for_spawn. - services/task.py: _ensure_branch_for_task returns "" (no branch) for a coordination task instead of raising; activate requires project OR product. This unblocks Main PM's i_will_plan claim, which otherwise raised before it could delegate the fan-out. - gateway: _pending_assignment_guard exempts advisory roles (product_owner/head_marketing/auditor) from the "assigned but never claimed" idle gate — they review without claiming, so they could not satisfy a claim-or-unclaim remediation. Adds focused unit tests for each. * fix(tasks): coordination tasks reach in_progress + team reflects Main PM The board->cells fan-out deadlocked: a coordination/fan-out task (product set, no project of its own) could be created and claimed, but start()'s claimed->in_progress transition hit validate_git_requirements, which still demanded a branch_name and raised GitRequirementError. So Main PM's i_will_plan never completed — it looped and never delegated. c961282 exempted _ensure_branch_for_task (branch creation) but missed this parallel git gate in the enforcement layer. - task_lifecycle.py: add GitContext.is_coordination; skip the claimed->in_progress branch_name gate when it is set. - task.py: populate is_coordination=(project_id is None and product_id is not None) in _validate_and_set_status; a branchless code task is still gated. - approve_and_start: set team=Team.MAIN_PM on hand-off so the task isn't left labelled team=board after it leaves the board (now assigned to main-pm). Adds a lifecycle-gate unit test and an end-to-end integration test that claims, plans, and starts a project-less coordination task. * fix(hooks): remove dead traceability hook + stale deleted-verb references The v1-removal cleanup (2cfbf39) deleted the /traceability/remind SDK endpoint but left the PostToolUse hook that curls it, so every gateway tool call 404'd and agents silently lost their traceability reminders. Remove the dangling hook (registration + TRACEABILITY_TRIGGER_TOOLS + Dockerfile COPY + the script); v2 carries per-verb guidance on the Envelope. Also correct two stale pre-gateway tool names in hook text: the budget loop-detector nudged agents toward the deleted roboco_task_escalate() (now unclaim()/i_am_idle(), which every looping role has), and an sdk-startup comment referenced roboco_task_scan/get. Extends the deleted-tool-name guard to scan docker/scripts/*.sh and to assert every $SDK_URL/<path> a hook curls is a route still served by the SDK — the check that would have caught this class (it lives in shell, invisible to mypy and the Python import graph). * fix(db): backfill ORM enum values the migration chain never added Several StrEnum values were added to the ORM over time without a matching `ALTER TYPE ... ADD VALUE` migration; 017 was autogenerate-derived and autogenerate does not detect added enum labels, so the drift survived. On a DB whose enum type predates the value, binding it raises at runtime — e.g. `invalid input value for enum notificationtype: "a2a_request"` on GET /api/notifications (list_system_notifications), and the same class for blockerresolvertype/handoffstatus/team. Migration 020 adds every drifted value idempotently (ADD VALUE IF NOT EXISTS — no-op when 009 already reconciled it). Runs on the next `alembic upgrade head`. Detected by comparing each ORM enum's values to the labels the migration chain produces; adds tests/unit/test_enum_migration_parity.py which renders the chain offline and fails on any future drift — the check that would have caught both this and the provider-enum bug. * fix(orchestrator): stop branch auto-block, board reassign, unblock livelock, agentless claims Cluster C1 — four coupled orchestrator/task-invariant defects: #18: a branch is created only at claim, so a pending, never-claimed code task legitimately has no branch_name. The stuck-detection sweep (pending-only) and readiness gate flagged that as "Task missing branch_name" and auto-blocked the task every tick, so it never dispatched. Centralize the gate in _branch_is_expected (status in claimed/in_progress/verifying, never a coordination task) and apply it in both _check_stuck_conditions and _readiness_check_task. #14: the main_pm -> product_owner escalation rung handed an in_progress descendant code task to the Product Owner (a board role) and marked it BLOCKED; the board has no verb to own code work, so the dev's finished work deadlocked. TaskService.apply_escalation (the single write primitive — covers both the gateway escalate verb and the HTTP escalate route) now diverts a descendant code task targeting a board/advisory role: it releases the task to PENDING for a role-matched cell claim instead of stranding it. #17: a blocked task reassigned to Main PM kept respawning the ex-assignee cell PM to unblock it, but the assignee-only pre-unblock note returned not_authorized — a livelock. _dispatch_blocker_work now dispatches the task's CURRENT PM/board assignee (the unblock authority), falling back to the cell PM only when no PM/board holds it. Also: a branchless coordination parent yields no valid merge target — resolve_parent_branch now falls back to the child's own project default branch (e.g. master) via TaskService.project_default_branch_for_task, and _check_parent_branch_ready no longer blocks a child on a coordination parent's non-existent branch. #19: a task left claimed/in_progress with an assignee but no running container was invisibly stuck (only PENDING tasks get fresh dispatch; the heartbeat reaper can't see a freshly-seeded claim). New _dispatch_claimed_without_agent net: after a short grace window it respawns the assignee, or releases the claim to pending (lifecycle-safe via unclaim_for_reaper) when the assignee is unknown. New config ROBOCO_CLAIMED_NO_AGENT_GRACE_SECONDS (default 120). * fix(gateway): tolerant note verb + lock evidence do-tool invariant #15: the note verb no longer hard-rejects thin decision/reflect payloads. List-typed fields (options, consequences, next_steps) coerce a lone scalar into a one-element list at both the NoteRequest schema (mode=before validator) and the service layer; missing narrative fields default to a visible placeholder instead of returning incomplete_input. The note is always recorded, preserving audit value, and a well-intentioned note can no longer trip the do-server 3-strikes circuit breaker. Widen the agent-facing do_server.note hints to accept list-or-scalar and refresh the docstrings. #8: add regression coverage locking the invariant that every role's do_tools carries evidence (role_config + developer spawn manifest). The current source already registers mcp__roboco-do__evidence for developers end-to-end; the report stemmed from a stale deployed build, and the tests prevent silent regression. * fix(gateway): allow UX devs to receive design tasks; surface delegation rules to cell PM The UX/UI cell's developers (ux-dev-1/ux-dev-2, Role.DEVELOPER on Team.UX_UI) ARE its designers, but _validate_assignee_task_type rejected task_type='design' for every DEVELOPER, blocking the UX cell's normal design delegation. Allow 'design' for UX-team devs only; backend/frontend devs stay rejected (design routing belongs to the UX cell). The orchestrator already dispatches a developer for a design task (_dev_dispatch_role_matches returns True), so this creates no orphan like the documentation case. Replace the static Cell-PM 'pass planning' remediate with a per-assignee hint so a dev/design mis-type gets a developer-class next-step instead of an off-topic planning hint. Surface the three delegation guardrails in the cell-PM prompt so PMs stop probing them by trial and error: valid task_type per assignee (incl. design for UX devs), documentation auto-creation (non-delegatable), and the sequential single-active code-spine. Fix the delegate-row task_type list (documentation is NOT delegatable) and update the lifecycle spec description; regenerate the lifecycle artifacts. * fix(orchestrator): improve agent briefings for handoff consumption, product/project model, and workspace/secret hygiene Main PM (roles/main_pm.md): - Require reading the upstream Product Owner / Head of Marketing handoff (their decision/reflect journal entries + task description) BEFORE doing any own research or calling i_will_plan, so the Main PM builds on the Board's analysis instead of duplicating it. Added a dedicated section, hardened workflow step 1, and added an anti-pattern. - Add a 'Products vs Projects' section: a Product fans out to one Project per cell; those Projects may be the SAME repo (monorepo subtrees) or DIFFERENT repos (multi-repo). The Main PM coordinates across them and must not assume one repo or call a monorepo subtree 'a separate repo'. Names the Prompter monorepo case (github.com/rennf93/roboco). Developer (roles/developer.md): - State the exact workspace path convention /data/workspaces/<project-slug>/<team>/<agent-slug>/, that the cwd is already set there, to stay inside the own cell workspace, and to not probe/guess the path (ls /, find /). - Sanctioned secret handling: env/printenv is bash-guard denied and reveals nothing; needed secrets arrive via the task description, else i_am_blocked so the PM supplies them. Added matching anti-patterns. Tests: add tests/unit/agents/test_briefing_cluster_c4.py asserting the composed system prompt (the text mounted into agent containers) carries each of the above. * fix(orchestrator): board review involves PO+HoM and notifies CEO Cluster C5 (#2, #4): a board/coordination task was reviewed by the Product Owner alone, and the CEO got no formal signal when the review finished — only buried channel chatter — so the Approve & Start handoff was invisible. #4 — Board review is now a two-reviewer gate. _handle_board_assigned_task dispatches BOTH the Product Owner and the Head of Marketing (one-shot each), regardless of which one holds assigned_to, and the unassigned board-routing path delegates here instead of claiming + spawning the PO alone. Board tasks stay pending/unassigned for the CEO's Approve & Start. The board prompt now makes the PO+HoM pair-review model explicit (HoM owns the UX/positioning dimension). #2 — Once BOTH reviewers have finished (dispatched and no longer active), the orchestrator emits exactly one formal CEO notification via NotificationService.send_board_review_complete_notification (APPROVAL type, ack-required, carrying related_task_id) so the handoff is an actionable signal. One-shot per task; a notification failure clears the guard so a later tick can retry. To let the non-assignee board member record its review note on a task held by the other board member, content-action ownership now exempts a board role posting to a board/coordination task (project_id is None, product_id set). The exemption is narrow: it does not widen ownership for any other role or any project-backed task. Unit tests cover both reviewers dispatched, one-shot dispatch, the CEO notification fired exactly once when both are done (and not before), the retry-on-failure path, the notification builder, and the board co-review ownership exemption (allowed for board+coordination, blocked otherwise). * fix(workspace): install dev deps post-clone + raise git commit timeout for large changesets Cluster C6 (#10, #13, #12-investigate). #10: per-agent workspace clones never had the project's dev dependencies installed, so the make-quality gate (ruff/mypy/pytest for Python, the TS toolchain for the panel) was missing and devs re-downloaded tooling per task. WorkspaceService now runs the project's install after cloning (`uv sync` for Python, `pnpm install`/`npm ci`/`npm install` for Node/TS, detected by manifest/lockfile). Idempotent via a lockfile-digest marker under .git/ so a re-entry with unchanged lockfiles is a no-op; also runs on the healthy short-circuit so pre-existing clones get backfilled. Gated by workspace_install_dev_deps (default on) with workspace_dep_install_timeout_seconds. #13: the gateway commit verb timed out on the large panel changeset because every git op used the hardcoded 30s _GIT_TIMEOUT and each call also re-walks the tree to chown. _run_git now takes a per-call timeout override sourced from settings (git_command_timeout_seconds default); the staging + commit ops in commit() and create_commit() use the longer git_commit_timeout_seconds (default 180s). httpx REST timeouts unchanged in value. #12 (investigate only — no push, no history change): the clone base ref is NOT hardcoded; it already comes from project.default_branch threaded through git.get_workspace -> ensure_workspace -> _clone_repo (git clone --branch). The stale-base problem is a deploy/process issue (GitHub master is behind the deployed migration chain), resolvable only by pushing the chain to master. The default_branch column is the existing configurable lever. * fix(panel): gate Approve & Start to board coordination tasks; stop 404 storm on closed sessions CEO gate #1 button only renders for a PENDING board coordination/fan-out task (no project_id, has product_id) — the board-reviewed handoff that approve_and_start accepts — instead of every PENDING board-team task. approve_and_start requires PENDING (it re-targets to Main PM without a status change), so the gate stays on PENDING rather than the unrelated end-of-work awaiting_ceo_approval state. Session/message reads now treat a 404 as terminal and never retry it: a reaped session is gone for good, and retrying every dead session-id is what produced the growing 404 storm on GET /api/messages. The transcript loads once (staleTime Infinity, no focus/reconnect refetch) so closed sessions stay viewable without re-polling. * fix(orchestrator): role-correct respawn prompt, throttle agentless dispatch, broaden #14 guard #19 wrong-role prompt on respawn: _get_prompt_for_agent fell through to the developer prompt for every non-dev/doc/qa role, so a respawned PM or board agent was told to write code and call verbs it does not own. Route by the agent's actual role through the existing per-role prompt builders (developer/qa/documenter/cell_pm/main_pm/product_owner/head_marketing/auditor). Both callers benefit; _spawn_pending_dev only ever passes developer/documenter/ unknown, so its behavior is unchanged. #19 spawn-burst: _dispatch_claimed_without_agent looped over every agentless claimed/in_progress task and could spawn many containers in one tick. Break after the first respawn so a restart can't trigger a burst, matching every sibling dispatcher. The release-to-pending path spawns nothing and keeps draining stale unknown claims. #14 guard scope: _is_descendant_code_task only matched CODE, so a descendant DOCUMENTATION or DESIGN task escalated to a board/advisory role was still stranded on a role with no verb to own it. Rename to _is_descendant_executable_task and broaden to CODE/DOCUMENTATION/DESIGN — the cell-executed types a board role cannot own. PLANNING/RESEARCH/ADMINISTRATIVE route to a PM, not a cell agent, and are left unchanged; root tasks are still reviewed up the chain. * fix(docker): add node+pnpm to orchestrator so it pre-installs frontend cell deps * Added .github workflows * refactor(services): extract helpers to keep install_dev_deps + developer task-type check under the xenon complexity gate * chore(github): add launch kit — CI, GHCR release, labels, templates, funding, dependabot npm, community docs * chore(github): bump_version — drop unused noqa, fix datetime UTC import --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-03 06:35:03 +02:00