4 Commits

Include renames

Author	SHA1	Message	Date
3 people	e77c3b7a63	feat(board): Board Program registry — Phase 1 (engine, LEARN ledger, per-project scoping, panel) (#689) ... * feat(board): Board Program registry — generic trigger/dedup/originate/LEARN engine One registry (foundation/policy/board_programs.py) + one BoardProgramEngine + one orchestrator loop replace the bespoke roadmap/spotlight loops, behavior- preserved: same sources, dispatch routing, one-open-cycle dedup (ledger rows auto-close when their exploration task goes terminal, so x_feature's complete-at-propose flow can't wedge), and live per-program interval overrides with the tick capped at 1h. program_armed() is the single arming chokepoint: the settings-store board_program.<key>.enabled override when present, else the legacy flag — routed through BoardProgramEngine, RoadmapEngine.run_cycle, and XEngine's spotlight gate, so the panel toggle can never be a silent no-op against a legacy boot flag. LEARN: board_program_cycles (migration 087) accrues per-item CEO decisions (exact attribution by exploration_task_id where the caller holds it) and feeds the last closed cycles back into both exploration prompts. The strategy engine's idle signal now opens a roadmap cycle (enabled+dedup respected) instead of only nudging. Per-project scoping (migration 088, projects.board_programs, dual polarity): plain keys opt a project INTO project-scoped programs; "!key" opts it OUT of an org-scoped program's outputs (default eligible — parity). Enforced at propose_roadmap (names the excluded project) and defensively at materialize; validation rejects unknown keys and meaningless polarity both directions. API: GET /api/board-programs + POST /api/board-programs/{key}/run-now (CEO-gated); settings keys for both migrated programs. * feat(panel): Board Programs card + per-project program controls Business page gains a Programs tab: per-program rows (role, trigger, scope, open-cycle badge), enabled switch on the settings-store key, Run now (disabled while a cycle is open). The edit-project dialog gains the program controls next to the CI-watch/video toggles: participates-in checkboxes for project-scoped programs, excluded-from checkboxes for org-scoped outputs. * test(board): full-gate hermeticity — mypy casts + shared-DB purge fixtures make quality runs one pytest process over all suites against the shared persistent DB: integration collects before unit, so the board-programs API test's committed run-now state (settings-store overrides, an open cycle row, its board_roadmap task) poisoned 13 downstream unit tests that pass in isolation. The polluter now purges its own committed state in fixture teardown, and the four consumer files get an autouse per-test purge (board_program.% settings keys, ledger rows, open exploration tasks) so they are hermetic regardless of collection order. Also the four cast("UUID", ...) sites the tests-scope mypy run requires. * feat(panel): re-home per-project program controls onto the settings page Wave C deleted the edit-project dialog these controls originally landed in; they now live on the project settings page's budget/ops card next to the CI-watch/video toggles — participates-in switches for project-scoped programs, excluded-from switches for org-scoped outputs, dual-polarity tooltips, order-independent dirty tracking. Nine makeProject test fixtures gain the required board_programs field the rebase left behind. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-25 05:39:44 +02:00
3 people	ff78618b76	feat: Telegram messages get real formatting + push DMs at draft origination (#568) ... * feat(telegram): HTML-styled bot messages + push DMs at held-draft origination * fix(telegram): attr-context escaping, balance-aware truncation, send observability; docs --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-18 15:54:49 +02:00
3 people	7901ea419e	Retire channels/sessions/messages; A2A becomes primary agent comms (#306) ... * feat(a2a): deliver latest incoming message preview into the claim briefing list_unread_a2a now carries last_message_preview (the latest message from the OTHER agent, never the agent's own reply), fetched via a correlated subquery in the same query — no N+1 on the per-verb briefing path. * feat(a2a): read_a2a verb delivers unread message bodies to the agent A2AService.get_unread_messages returns the caller's unread INCOMING messages (never its own sends), marking exactly those rows read atomically so a message arriving mid-call is preserved. Wired as the read_a2a content verb (route + do_server tool + granted to every delivery role) — the content-bearing read the A2A inbox lacked (read_messages only zeroed the counter). * docs(rag): document read_a2a as the A2A content-read path * fix(task): backlog activation no longer requires a discussion session Removes the SessionTaskTable gate in activate() (and its dangling log field), deletes _inherit_parent_session + its create() call, and drops the now-unused SessionTaskTable import. Coordination rides task state; the session subsystem is being retired. Tests updated to the new (no-session) behavior. * fix(orchestrator): drop session sweep from _run_sweep Removes the messaging import + sweep_timed_out_sessions call. That import sat outside the try/except, so once messaging.py is deleted it would have killed the entire sweep cascade (budget kill-switch, token rollups, retention, image prune, superseded-PR reconcile). Notification sweep + all maintenance sweeps unchanged. * release-manager --no-tags read-clone fix * test: update evidence_repo unit test for a2a last_message_preview * refactor(gateway): drop session propagation on delegate Removes propagate_sessions_to_subtask from delegate(), the ChoreographerDeps messaging field + property, and the ChoreographerDeps messaging arg in deps.py (ContentActions messaging + import stay until the verbs are removed). Deletes the propagation test; strips the now-invalid messaging kwarg from ChoreographerDeps test builders. * refactor(gateway): remove say/open_session/link_session/channels verbs Removes the four channel/session verbs across content_actions (impls + ContentActionsDeps.messaging), do_server (tools + registry), role_config (grants + _CHANNEL_DISCOVERY), do.py (routes), schemas/v1/do.py (request models), and deps.py (MessagingService import + construction). Regenerates the prompt verb tables. dm/notify/read_messages/read_a2a stay. Tests deleted/updated accordingly. * uv.lock Upgrade * refactor: remove conversation RAG indexing; Secretary announces via notification Drops the CONVERSATIONS index (index_conversation, ConversationsIndexPlugin, IndexType.CONVERSATIONS enum, IndexConversationParams, mentor.py type-label, the messaging index hook) and its chunk-table manifest entries. The Secretary's ANNOUNCE/RELAY_MESSAGE now fan out a BROADCAST notification to every agent's inbox (NotificationService.broadcast) instead of posting to a dead channel. * fix(panel): label RAG health error lines by subsystem A red llm_error (e.g. the glm-5.2:cloud weekly-limit 429) rendered under the 'Embedding: ok' header with no label, reading as an embedding failure. Prefix each error line with LLM / Embedding / Vector store. * refactor: remove channel/message reads from metrics, dashboard, git, events MetricsService drops get_communication_volume + the MessageTable message-count in get_agent_metrics (and the now-dead messages_sent_week field). DashboardService drops get_channel_feeds/_compute_channel_status and the message read in get_recent_activity (task activity kept); get_auditor_metrics no longer reports communication_volume. GitService's two primary-session-id helpers always return None now (callers already treat None as "no primary session"). events/handlers.py drops the SESSION_CLOSED/SESSION_TIMEOUT subscriptions + the handle_session_boundary handler. Forced follow-on: api/routes/dashboard.py + api/schemas/dashboard.py dropped the now-dangling live_feeds/ChannelFeed surface and the /metrics/communication route, which wrapped the removed service calls directly (mypy would otherwise fail on the missing attributes). * refactor: delete MessagingService + channel seeding Edited db/__init__.py and services/__init__.py first (drop the unconditional Channel/Group/Message/Session table + MessagingService re-exports), then deleted services/messaging.py, then trimmed db/seed.py to only create_agents (create_channels/create_channel_memberships/create_initial_messages gone). Forced expansion: api/routes/{channels,groups,sessions,messages}.py import roboco.services.messaging directly (not through the package __init__), as does api/routes/tasks.py (the session-links embed on GET /tasks/{id} and the GET /{id}/sessions route). Deleting messaging.py without addressing these breaks `import roboco.api.app` immediately, since app.py eagerly imports all route modules at startup. Since the 4 CRUD route files are 100% MessagingService-backed with zero independent logic (and are wholesale deletes in the plan's later API-routes task anyway), deleted them now + unmounted from app.py/routes/__init__.py; tasks.py got the same surgical trim its later task already specified (drop session-links embed + TaskSessionLinkResponse/TaskResponse.sessions). This pulls a slice of that later work forward — the routes/schemas for channels/groups/sessions/messages still need their own pass, but their messaging-coupled parts are gone. Verified with a full-suite collection sweep (12010 tests collected, zero import errors) beyond the directly touched test dirs, given the expanded blast radius. * refactor: remove channel/session/message models, tables, and channel policy Models: deleted channel.py/group.py/session.py/messaging.py wholesale (zero external consumers besides the models/__init__.py re-export). message.py surgically trimmed: removed MessageCreate (dead) and MessageEdit (never instantiated; ExtractedMessage.edit_history retyped to list[dict[str, Any]] to match how it's actually persisted — confirmed ExtractedMessage was never written to any DB table, so MessageTable's removal carries no functional risk to the kept extraction pipeline). base.py: removed SessionStatus + ChannelType, kept MessageType. Also removed the confirmed-dead channels_read/channels_write fields from models/agent.py:AgentPermissions and models/dashboard.py:ChannelFeedData. db/tables.py: deleted ChannelTable/GroupTable/SessionTable/SessionTaskTable/ MessageTable, TaskTable.session_links, and JournalEntryTable.session_id — cascaded through models/journal.py, services/journal.py, and api/schemas+routes/journals.py (22 plumbing sites). foundation/policy/communications.py: removed the ChannelSpec/CHANNELS catalog + TEAM_SCOPED_ROLES/_CELL_*/_AUDITOR_ONLY helpers, kept the notification policy (Priority/parse_priority/NOTIFY_SENDER_ROLES/ ACK_REQUIRED_BY_TYPE). enforcement/channel_access.py deleted (confirmed fully dead in production). agents_config.py: removed CHANNEL_ACCESS (kept A2A_ALLOWED_PAIRS). seeds/initial_data.py: removed DEFAULT_CHANNELS/CHANNEL_MEMBERSHIPS/AUDITOR_SILENT_ACCESS + the never-consumed INITIAL_MESSAGES. config.py: removed session_idle_timeout_seconds (zero consumers). exceptions.py: removed dead ChannelError/ChannelAccessDeniedError/SessionClosedError. Forced expansion beyond the original file list — ChannelType cascaded into a live, mounted surface the plan didn't trace: agents_config. CHANNEL_ACCESS -> services/permissions.py's channel-RBAC methods (not models/permissions.py, which turned out to have no channel code at all) -> two real endpoints in api/routes/stream.py (GET /permissions, GET /permissions/channel/{name}) and two dependency factories in api/deps.py. Removed the channel methods + fields, deleted the channel-specific stream.py endpoint, deleted require_channel_read/write. Also deleted api/schemas/{channels,sessions}.py (hard dependency on the removed enums; already fully dead after the Task 10 route deletions) and api/schemas/messages.py (a TYPE_CHECKING-only import of the deleted MessageTable; likewise already fully dead) + its dedicated test file. Test updates: test_permissions.py -14 channel tests (matches the planned count exactly), test_communications.py / test_communications_consumers.py split to keep only notification-policy coverage, test_exceptions.py -9, test_deps.py -4, plus the journal/stream/foundation-smoke fallout. Also fixed a pre-existing (Task 7) broken assertion in test_foundation_phase3_smoke.py that inspected a `say()` method already removed from ContentActions. Verified: full-suite collection (11961 tests, zero import errors) and a complete test run (11567 passed, 394 skipped, 0 failed) in addition to the targeted suites. * migration: drop channels/groups/sessions/session_tasks/messages + enum types alembic/versions/060_drop_messaging.py: drop_column journal_entries. session_id (sidesteps hardcoding the FK constraint name — verified empirically against a live migrated DB that it's actually fk_journal_entries_session_id_sessions, but drop_column doesn't care either way); drop_table in FK order (messages -> session_tasks -> sessions -> groups -> channels); DROP TABLE IF EXISTS chunks_conversations (runtime-provisioned, not alembic-managed, would otherwise orphan); DROP TYPE IF EXISTS for messagetype/sessionstatus/sessionscope/channeltype (messagetype's Python enum stays for ExtractedMessage, but the DB type had zero live columns left once MessageTable was dropped in the prior commit). downgrade() raises NotImplementedError — one-way removal. Pruned scripts/reset_runtime_state.sql + .sh: removed the DELETE/COUNT lines for messages/session_tasks/sessions/groups/channels and the groups.active_session_id reset block. Verified end-to-end against a scratch Postgres DB: full migration chain 001->060 applies cleanly, alembic heads shows a single head, all 6 dropped tables + 4 enum types + the journal_entries.session_id column are confirmed gone, journal_entries keeps only its journal_id/task_id FKs, downgrade correctly raises NotImplementedError without corrupting DB state, and the pruned reset_runtime_state.sql runs clean (no errors) against a fully-migrated DB. * refactor(api): remove channel/session/message routes + WS streams Most of this task's file list was already forced through in earlier commits (routes/{channels,groups,sessions,messages}.py + app.py/__init__.py unmounting in the MessagingService-deletion commit; tasks.py's session-links embed + GET /{id}/sessions + schemas/tasks.py's TaskResponse.sessions in that same commit; deps.py's require_channel_read/ write + schemas/{channels,sessions}.py in the models/tables commit). This closes out what was left: - api/websocket.py: deleted the channel_stream + session_stream routes, ConnectionManager's channel_connections/session_connections dicts, connect_channel/connect_session, broadcast_to_channel/broadcast_to_session, get_channel_subscriber_count, and their cleanup lines in disconnect(). Agent streams, notification streams, and the operator system stream are untouched. - api/websocket_bridge.py: deleted _handle_session_event + _handle_message_event and their SESSION_CREATED/SESSION_CLOSED/ SESSION_TIMEOUT/MESSAGE_SENT subscriptions. The A2A live-view, rate-limit, usage, agent-lifecycle, and notification bridges are untouched. - api/schemas/websocket.py: removed NewMessageBroadcast, WSMessageNew, WSMessageEdit, WSMessageDelete, WSSessionClosed — kept the WSMessage base class (still subclassed by the kept WSAgentStream/WSNotification) plus those two. - api/schemas/groups.py: deleted (already fully orphaned since routes/ groups.py was removed; its GroupResponse/GroupDetailResponse had zero consumers). Updated the 5 websocket test files accordingly (removed the channel/ session-specific tests + fixed imports); test_websocket_bridge.py's registration-coverage test dropped the SESSION_*/MESSAGE_SENT assertions. Verified: full-suite collection (11943 tests, zero import errors) and a complete test run (11549 passed, 394 skipped, 0 failed). * docs: retire channels/sessions/messages from agent-facing docs + CLAUDE.md Rewrites docs/rag (RAG-indexed) + docs/map + CLAUDE.md to reflect A2A (dm + read_a2a) as primary agent comms; deletes the channel docs, splits messaging-tools + messaging-notification (renamed notification.md), swaps the WS worked example to A2A_MESSAGE_SENT. _complete_map.md still needs regeneration (generated file). * refactor(panel): remove Communications surface (channels/sessions) Deletes the /communications routes, message components, task-detail Sessions tab, use-channels + channel/session WS hooks, and the channels/sessions/messages/groups api clients; prunes the Channel/Session/Message/Group types + mock data. (Auditor live-feeds + dashboard.ts dead-route cleanup is a follow-up.) * refactor(panel): drop auditor channel-feed + dead communication-metric route * docs(map): regenerate _complete_map from updated slices * fix(a2a): reduce get_unread_messages complexity below xenon C + stale comments Extract the per-conversation unread-counter recompute into _reset_unread_counter (the CI quality gate flagged get_unread_messages as rank C). Also drop the deleted open_session from a content_actions comment and reword an evidence_repo docstring that cited the removed messaging._notify_mentions. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-04 03:10:33 +02:00
3 people	3ccc723cd4	v0.17.0 — Wave 3: sandbox DB, DB isolation, mobile UI, cloud auth, X account, roadmap engine (#303) ... * feat(sandbox): throwaway per-agent Postgres/Redis sandbox containers Orchestrator-provisioned sibling containers per agent spawn (SandboxProvisioner, roboco/runtime/sandbox.py). Per-project opt-in via projects.sandbox_services (migration 057); master switch ROBOCO_SANDBOX_DB_ENABLED, default-off, armed in the NAS compose only. When active, ROBOCO_TEST_DB_* / ROBOCO_TEST_REDIS_* point at the sandbox and the prod-creds gate-env injection is suppressed (sandbox replaces, never coexists). Sandbox lifetime tracks the agent container: teardown at every removal path, orphan janitor at startup + each reaper tick with a grace window for mid-flight spawns. The pre-spawn stale-clear spares the just-provisioned sandbox; provision pre-clears stale same-named containers from a crash-missed teardown. Panel: per-project sandbox-service switches in the edit dialog + feature flag card entry. * docs: CLAUDE.md entry for the sandboxed dev DB/Redis subsystem * feat(security): isolate prod Postgres/Redis from agent containers (roboco_data network) Second user-defined bridge roboco_data carries postgres+redis only; the orchestrator is multi-homed (default + data). Spawned agents and their sandbox sidecars stay on roboco_default and can no longer resolve or reach roboco-postgres:5432 / roboco-redis:6379 (redis has no auth — membership is its only containment). Normal bridge, so host-published ports (15432/16379) keep working. Applied to both build composes and the registry compose; docker-compose.yml re-synced byte-identical with docker-compose.yaml (it had drifted by the sandbox flag block). ROBOCO_DB_NETWORK_ISOLATED (config default false, armed alongside the topology) suppresses the legacy _append_gate_env prod-creds injection: under isolation those creds dead-end, and unreachable creds are worse than none. DB-needing projects opt into sandbox_services instead. The flag is deliberately not a panel feature flag - it must travel with the compose networks: stanzas. Preserved by construction: agent<->agent A2A and orchestrator->agent SDK polls on :9000, MCP->orchestrator on :8000, ollama reachability, docker exec/inspect (daemon socket), host port publishing. * feat(panel): full mobile responsiveness pass Shared primitives: useIsMobile (useSyncExternalStore, hydration-safe, memoized matchMedia subscribe), ResponsiveTable table->card switch below md (single subtree mounted, no duplicated interactive rows), scrollable snap TabsList in the base primitive (justify-center-safe so the first tab stays reachable on overflow), persistent md:hidden bottom tab bar (Overview/Tasks/Kanban/Chat, safe-area padded). Applied: card lists for tasks/projects/products/work-sessions/sessions + the three raw metrics tables; CEO approval queue / release proposal / playbook review action rows stack on narrow; command-center reorders approvals above the fold on mobile; task-header metadata wraps; Communications + A2A become URL-driven single-pane drill-downs below lg (fixes the unconstrained-height ScrollArea bug) with dvh heights; recharts label density/radius adapts via useIsMobile; git diff viewer gets mobile font + wrap toggle; vh->dvh sweep; chat composers get safe-area-inset padding; dashboard main p-4 md:p-6 + pb-20 for the bar. Verified at 375px on the built app: bottom bar, drawer, approval-first overview, swipeable kanban tab strip. All gates green (eslint, tsc, vitest 249, next build 24/24 routes). * feat(auth): cloud auth via FastAPI Users (default-off, single-user cookie session) ROBOCO_CLOUD_AUTH_ENABLED (default off) lets the panel/API be exposed beyond localhost without changing the CEO's local no-login flow while off — get_agent_context and the WS gate are byte-for-byte unchanged in off-mode. On: header-trust dies for humans — any agent-role claim (ceo or a privileged PM/board role) with no valid HMAC token or session cookie is 401, closing the header-spoof hole on the host-published :8000 port for every role. The agent-fleet HMAC path and the system self-PATCH keep working unmodified in both modes. Single seeded CEO user (migration 058 users table, UserTable), no registration router — idempotent env-driven upsert at startup by PK. Cookie transport (httponly/secure/samesite=lax) + a JWTStrategy bound to a fingerprint of the current password hash (rotating the password invalidates every prior session). Sliding 30-day session: every authenticated request re-mints the cookie, so an active session never expires — no unexpected logouts. Panel: (auth)/login page + proxy.ts (Next 16 rename of middleware; probes /auth/status over the docker-internal URL, fails open to off) gate the dashboard; client.ts gets withCredentials + 401->/login. nginx unchanged. Review hardening: broadened the on-mode rejection from ceo-only to every non-CEO role without a valid token (was only closed when ROBOCO_AGENT_AUTH_REQUIRED was also armed); Next-16 proxy.ts rename to clear the middleware deprecation warning. * feat(x): RoboCo X account engine — HoM drafts, per-post CEO approval (default-off) ROBOCO_X_ENGINE_ENABLED (default off, inert without creds). Mirrors the ReleaseManagerEngine held-artifact shape: XEngine drafts a post when a release publishes (via a draft_release_post seam on ReleaseProposalService .approve) and drafts replies to meaningful mentions (dedicated poll loop, x_seen_mentions dedup ledger, per-cycle/open caps). Drafting is local-model-only, clamped to 280 chars. Nothing auto-posts — every tweet is a held task (source x_post/x_reply, confirmed_by_human=False, Secretary-owned, dispatcher-skipped) the CEO edits/approves/rejects in a panel queue. The four OAuth 1.0a secrets live Fernet-encrypted in a singleton x_credentials row (migration 059, all-or-nothing, API returns only has_credentials); decryption is server-side, agents never hold creds or egress. Hand-rolled OAuth 1.0a HMAC-SHA1 signer, no new dependency; NullXClient makes the unconfigured path a graceful no-op. XPostService.approve (CEO-only) is the sole caller of post_tweet. Review hardening: closed a double-post race — the approve path now re-reads committed task state inside the Redis lock and commits COMPLETED before releasing, so a concurrent approve that acquires the lock after the winner released can't re-post (SET-NX is non-waiting, and the route-level commit landed after the lock dropped). Added a regression test. * feat(roadmap): board roadmap engine — PO proposes themed cycles, CEO approves per-item (default-off) ROBOCO_ROADMAP_ENGINE_ENABLED (default off). Weekly, RoadmapEngine opens ONE held exploration task (source=board_roadmap, confirmed_by_human=False, Product-Owner-assigned), deduped to one open cycle. A dedicated one-shot _dispatch_roadmap_exploration spawns the PO solo (not the two-reviewer board path, which would also spawn HoM + fire Approve-&-Start). The PO explores read-only (git/KB/metrics/releases/charter/web) and makes one propose_roadmap call (PO-only content verb) authoring a themed cycle — goal + 3-7 item drafts — persisted as a roadmap_cycle marker (no table, no migration; head stays 059). The CEO acts per-item in the panel roadmap queue: approve materializes a BACKLOG task (source=roadmap, no assignee — never auto-starts), reject records a reason; all-items-terminal completes the exploration task. RoadmapService is idempotent per item. Dispatchers skip board_roadmap. Includes a real SQLAlchemy dirty-check fix (deep-copy the JSON marker before mutating, or the in-place edit + reassign compares equal to its own baseline and the UPDATE is skipped). Review hardening: create_task_from_draft now honors a draft-declared source only from a {prompter, roadmap} whitelist — drafts are LLM-authored, so an unbounded source could impersonate a privileged origin (release_manager would even wedge that engine's dedup). * chore(release): 0.17.0 Wave 3 — six default-off subsystems: sandboxed dev DB/Redis, prod Postgres/Redis network isolation, full mobile UI pass, cloud auth (FastAPI Users), the RoboCo X account engine, and the board roadmap engine. Plus the waves 1+2 work already on master since 0.16.0. Version bumped across the canonical set (config.py, __init__.py, pyproject.toml, panel/package.json, uv.lock); CHANGELOG [Unreleased] cut to [0.17.0]; docs/map delta added. Compose: every optional feature armed :-true in the NAS composes, OFF in the user-facing registry compose. Two opt-in exceptions default off (CLOUD_AUTH — needs email/password/secret + TLS, would otherwise fail startup; ROUTING_STRICT — fail-closed spawning). DB_NETWORK_ISOLATED stays on in both (coupled to the roboco_data topology). * chore(compose): arm cloud_auth + routing_strict ON in the NAS composes Every feature defaults ON in the NAS composes per policy — these two were wrongly left off. Both keep the ${VAR:-true} form so the operator controls the real runtime via .env: cloud auth needs ROBOCO_CLOUD_AUTH_EMAIL/_PASSWORD/_SECRET + TLS set there before a boot (else startup fails loud), and routing_strict is fail-closed. Registry compose keeps both off. * fix(ci): reflow board.md prose (quality gate) + document v0.17.0 env creds The roadmap section added hard-wrapped prose that failed the markdown prose gate; reflowed (token-invariant). Also brought .env.example current: cloud auth (now armed — needs SECRET or startup fails), routing strict, the X engine (panel-entered OAuth), and web research. * fix(ci): reduce cyclomatic complexity of five wave-3 blocks (xenon gate) The wave-3 subagents introduced C-rank functions the CI xenon gate rejects (my per-item reviews ran ruff/mypy/pytest but not xenon): - sandbox.janitor_sweep -> extract _list_labeled_sandboxes / _list_live_agent_containers / _prune_grace - x_client.fetch_mentions -> extract _parse_mention_items - x_engine.run_cycle -> extract _process_mentions - orchestrator._dispatch_pm_work -> extract the source-skip into a MODULE-level _is_held_ceo_source (module, not method, so the wholesale-mocked dispatcher unit tests exercise the real logic) - auth/seed.ensure_seed_user -> extract _apply_seed_updates (module avg -> A) Behavior-preserving; full suite green (11902), xenon clean. * fix(ci): declare pyjwt + fastapi-users-db-sqlalchemy as direct deps (deptry) The cloud-auth code imports jwt and fastapi_users_db_sqlalchemy directly but they were only transitive deps (via fastapi-users), which deptry (quality gate, DEP003) rejects. Declared explicitly; deptry roboco/ clean. Missed originally because local make quality stopped at earlier gates before reaching deptry. * feat(x): gate mention replies behind ROBOCO_X_REPLIES_ENABLED (default off) Per CEO decision: the X engine should only post about releases by default. Reading mentions needs a paid X API tier, so the mention-reply half is now a deliberate opt-in on top of release posting. New default-off flag x_replies_enabled gates the mentions poll loop (_x_mentions_poll_loop) and XEngine.run_cycle; release-post drafting (the release-proposal approve hook) is unaffected and still runs when x_engine_enabled + credentials are set. Added to FEATURE_FLAGS + the panel card. Tests: release posting works with replies off; run_cycle + the poll loop are no-ops with replies off. * fix: 401 only redirects to /login when cloud auth is on; panel-token strips .env quotes Two bugs that together dead-ended login in secure mode: - client.ts redirected to /login on ANY 401, so a mismatched panel token (header-trust/secure mode, cloud auth off) bounced the user to a login page whose backend route isn't mounted -> 404. Now it probes /auth/status (bare fetch, no interceptor re-entry) and only redirects when cloud_auth_enabled. - make panel-token read the .env secret with grep|cut without stripping surrounding quotes, so a quoted ROBOCO_AGENT_AUTH_SECRET produced a token signed with the quotes included — which never verifies against the orchestrator (docker-compose/pydantic unquote the secret). Now strips surrounding single/double quotes. * fix: git-log 500 on '|' in commit message; X queue shows an empty state - GET /api/git/log 500'd (ValueError: Invalid isoformat) when a commit SUBJECT contained a '|' (e.g. the 'curl|sh' lockdown commit): the fixed '|' field delimiter let the subject's pipe shift the split so author+date collapsed into one field. Switched to \x1f (Unit Separator), which can't appear in commit content. Regression test with a piped subject. - The X Post Queue returned null when empty, so there was no visible place for the X drafts. It now renders a discoverable empty state pointing at Settings -> X credentials. * docs: bring docs/rag + docs/map current for v0.17.0 (waves 1-3) Agent-facing RAG corpus and codebase map updated for every feature in the 0.17.0 span, code-verified: - wave 3: sandbox DB, DB network isolation, cloud auth, X engine (+ x_replies_enabled sub-flag), board roadmap engine — new RAG architecture pages + role/tool/config-reference updates; new symbols, migrations 057-059, panel surfaces, and the get_agent_context dual-path across the map slices. - waves 1-2: A2A live view + switchboard, prompter memory (search_past_tasks), Secretary edit access + PM-lighter scope, the PR-gate auto-submit turn cut (ROBOCO_PR_GATE_AUTO_SUBMIT_ENABLED). - correctness fix: api-routes-schemas.md no longer claims the A2A admin routes are reachable by any authenticated agent — they carry a _require_ceo gate (wave 2c). docs/internal, _front.md deltas, and the frozen _complete_map.md snapshot untouched. * fix(rag): atomic upsert for indexed-doc tracking (kills e2e segfault) The indexed-document tracking write used check-then-insert in two paths (IndexedDocumentRepository.upsert_batch and the file-source _upsert_doc_record). Under concurrent indexing both callers saw no row and both inserted, so the second violated uq_indexed_doc_source and poisoned its transaction — surfacing in CI as the intermittent _checkin_failed SIGSEGV on the failed connection's pool checkin. Both paths now use INSERT ... ON CONFLICT DO UPDATE against the constraint: coalesce keeps an existing title/preview when the new value is empty (matching the old guards) and metadata is jsonb-merged. The batch dedupes within itself first (ON CONFLICT can't touch a row twice in one statement). expire_all after the Core upsert keeps same-session ORM reads consistent with the merged DB row. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-03 19:24:00 +02:00