4 Commits

Include renames

Author	SHA1	Message	Date
3 people	cea3e56628	feat(lifecycle): revision findings ledger — structured failure feedback, persisted and delivered down the chain (#486) ... * feat(lifecycle): revision findings ledger — structured QA/PR/PM/CEO failure feedback, persisted and delivered down the chain Every bounce used to survive only as flattened prose: rounds overwrote each other in notes_structured, request_changes persisted nothing, two raw dev_notes appends were silently destroyed by the next handoff note, and the dev prompt pointed at fields (qa_notes via evidence(), pm_notes) the API never delivered. Agents re-interpreted and re-discovered every failure before they could start fixing it. - task_review_findings (migration 071, append-only): file/line/severity/ criterion(AC-id-validated)/expected/actual/fix/evidence per finding, with origin (qa|pr_gate|pm|ceo), round, and an open->addressed->verified lifecycle (waived reserved); new tasks.pm_notes + PmReviewContent give request_changes a structured home - producers: fail_review/pr_fail/request_changes take findings=[...] (prose issues shimmed+merged for one release, deprecation-logged); ceo_reject validates its reason (no 500), lands an origin=ceo finding, and bumps round+audit on branchless coordination roots; guardrails at the verb chokepoint (nudge >5, hard reject >10, field caps, traversal-safe file); the dev_notes data-loss appends are removed; new task.request_changes + task.ceo_reject audit events close rework attribution - delivery: qa_notes/pr_reviewer_notes/pm_notes carry the deterministic [F-id8] rendering; claim briefings, evidence(), the REVISION_REQUIRED spawn prompt, PM triage bounced-blocks, and A2A bodies deliver open findings; round-N+1 QA and gate reviewers get the full prior ledger; panel Findings tab + bounced-xN chip; metrics pm_rejects/ceo_rejects + findings counts; vault task notes render a Findings section (fail-open) - resolution closes for every origin: i_am_done and submit_up/submit_root take resolved_findings gated by FINDINGS_ADDRESSED (owner-gated so a stale non-owner PM can never mutate the ledger); pass_review/pr_pass/ complete verify-stamp same-transaction; ceo_approve stamps best-effort - 24 real-DB integration tests drive the full loop through the real choreographer; full suite 12856 green * docs: revision findings ledger sweep — CLAUDE.md, map, RAG corpus - CLAUDE.md: new ledger section + corrected request_changes row - docs/map/review-findings.md (new subsystem map) + surgical updates to task-service/pr-gate-review/metrics-observability/vault/panel maps - docs/rag: producers' findings contract across qa/pr-reviewer/developer/ cell-pm/main-pm/ceo role docs (the PM docs were missing request_changes entirely), verb references, and a new architecture/review-findings.md disambiguating ledger findings from convention findings * test(e2e): resubmit resolves the pr_fail finding per the ledger contract The scripted pr_fail revision loop resubmitted submit_up without resolved_findings — correctly rejected now that FINDINGS_ADDRESSED gates the PM resubmit verbs (green locally, red only in CI since the e2e suite skips without ROBOCO_E2E_SMOKE=1). The scripted PM now reads the open ledger row pr_fail persisted (new open_finding_ids arc helper) and resolves it on resubmit, asserting the open set drains — exercising the coordinator half of the new contract end to end. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-11 22:54:42 +02:00
3 people	8f3f4236c0	feat(tasks): sequence is the bar — strict sibling ordering at the claim chokepoint (#452) ... * feat(tasks): enforce sibling sequence order at the claim chokepoint A task with a parent and effective sequence N (COALESCE(sequence, 0)) can no longer be claimed while any sibling with a strictly lower effective sequence is non-terminal — assignee-blind, independent of and stricter than dependency_ids, enforced in _validate_claim_preconditions so both claim paths (gateway verbs and the dispatcher's raw REST claim) cross it. Ties run parallel; cancelled siblings never block; sequence 0 and parentless tasks are unaffected. Live failure this guards: a PM delegated revision subtasks sequenced 0..3 with no dependency edges and seq 2 started alongside seq 0 — sequence was advisory-only. set_sequence's contract updated accordingly. New e2e smoke case drives the refusal and the post-completion claim through the real gateway. * chore(scripts): skip .uv-cache and .claude in the prose scanner Repo-local tool dirs (private uv cache, agent worktrees) carry vendored and generated markdown that tripped make reflow-check. * fix(tasks): wave-derived delegation sequences + claim-gate hardening Three fixes from the adversarial review of the sequence claim gate: Delegation no longer stamps a raw per-sibling ordinal (deterministic merge-order bookkeeping) as sequence — under the strict gate that serialized ALL delegated work, including fully independent cross-dev and cross-cell siblings. Sequences are now wave-derived post-wiring (stamp_wave_sequence: 1 + max same-parent dependency sequence, 0 when independent), so independent siblings tie and run parallel while colliding/ordered work ascends. The cross-cell UX wiring restamps instead of writing relative ux+1 values (a relative write could invert a collision-derived stamp), and the dispatch merge/lane barriers gain a created_at tiebreak for wave-tied siblings so shared-branch merge order stays deterministic. PM-authored sequences are never rewritten. The guard now also fires on reclaims from needs_revision (a lower- sequence sibling delegated after the first claim was invisible), and tasks.parent_task_id gains an index (migration 069) — the guard's sibling probe ran as a Seq Scan on the hottest verb. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-10 22:55:00 +02:00
3 people	cfde4369b1	Token optimization levers — claim-scoped briefing, payload caps, role-scoped optimal, notification-spawn cooldown (#292) ... * feat(gateway): claim-scoped context briefing — heavy sections only on context-acquisition verbs * feat(gateway): cap unbounded LLM-facing payloads — embedded diffs, notification bodies, handoff journal content, north star * feat(mcp): role-scope the optimal server's tool groups; index management becomes dev/test-only * feat(mcp): cap per-result content on kb/error/learning search, mentor sources, rag citations * refactor(gateway): extract heavy-briefing sections + clip helper to keep xenon ranks * feat(orchestrator): cross-tick cooldown for notification-triggered spawns * feat(usage,orchestrator): scope spawn-waste to anthropic sessions; cap agent Bash output via settings env * docs: claim-scoped briefing, payload caps, optimal role-scoping, notification-spawn cooldown * test(mcp): type the mixed-item cap fixture explicitly * fix(orchestrator): lazy-init the notification-spawn cooldown store * fix(lifecycle): admin-override claim reconciliation + PM request_changes verb (S6 postmortem B3+B4) B3 — admin_set_status now reconciles claim ownership when leaving BLOCKED: review/queue targets clear claimed_by/claimed_at/active_claimant_id and consume the pre-block snapshot (a stale escalation claim was stranding the next claimant: give_me_work handed the task out while note() bounced not_authorized — the live b8fe0494 wedge). The pending/in_progress restore path also syncs active_claimant_id, and a REST PATCH unassign releases the claim with it. B4 — new PM verb request_changes: awaiting_pm_review -> needs_revision with concrete issues. The PM previously had no reject at merge review (only complete/escalate), so an AC/scope violation looped i_am_blocked->escalate 4x live. Full vertical: lifecycle transition + ActionSpec + IntentSpec, TaskService.request_changes (routes like a QA fail — original dev for a leaf, revision PM for assembled; issues appended to dev_notes), verb-runner compose, choreographer verb (spec gate + non-empty issues + soup check + a2a delivery of the reject reason), HTTP routes on both PM flows, MCP tool, journal:decision tracing, PM prompts, regenerated lifecycle artifacts. * fix(panel): stop scorecard fetches for fallback-roster placeholder ids useAgents() serves the static AGENT_ROSTER (ids "1".."22") while agent definitions load; the Scorecards tab fetched a member scorecard per row immediately, firing 22 guaranteed-422 requests per refetch cycle. Through the browser's per-origin connection limit those queued every metrics-page query behind them (~10s of skeletons on every tab). Gate the fetch on a real member id (agent UUID or the "ceo" alias). * Upgraded uv.lock * fix(sequencing): declared deps become real edges + full loop-breaker coverage + assembled-branch freshness (S6 postmortem B1/B2/B6 + breaker) B1a — code delegations REQUIRE a collision surface: new TASK_AT_DELEGATE completeness spec (conditional FieldRequirement, when=('task_type','code')) enforced at the gateway delegate gate. A no-surface code sibling is 'parallel to everything' by analyzer design, which is how two devs ran the CEO's explicitly-ordered work out of order (f3e1afc5: seq#1 started before seq#0, zero dependency edges). PM prompts updated; REST/manual creation (TASK_AT_CREATE) unchanged. B1b — the CEO's declared 'Depends on' lists become real edges: DraftSurface gains declared_depends_on; SequencingService.analyze unions declared edges (validated: self/out-of-range rejected) with the derived collision rules, cycle-checked by the existing toposort. confirm_live_batch/preview_batch map each draft's depends_on through (string indices coerced); intake tool doc + prompter role prompt instruct verbatim copying. The live S6 root got 1 of its 3 declared in-batch edges and started alongside still-running R3. Breaker coverage — the progress-aware respawn circuit breaker (_pm_respawn_should_gate: strike counting, status-advance reset, tracing-gap budget, DB durability, one-shot CEO notification) was consulted by only 3 spawn paths; the doc/QA/dev/PR-review/PR-gate/revision/board paths spawned unguarded at fixed cadence (the 26-respawn fe-doc loop, ~$7.20). Now consulted at every task-keyed spawn site (14 total). B2 — assembled-branch freshness: submit_up/submit_root auto-sync the assembled branch when it has fallen behind its base (children are terminal at submit time, so the rebase is safe; master is never written). A rebase conflict is a hard reject naming the files instead of a blind re-review — kills the needs_revision↔awaiting_pr_review ping-pong of re-submitting a stale head. Leaf i_am_done already had the behind-base gate; claim-time fetch-fresh cut already existed. B6 — documenter revision-pass loop: the awaiting_documentation bail rejections (i_am_blocked/unclaim) now name the actual exit (i_documented re-affirm) and the documenter prompt gets an explicit revision-pass rule. * fix(orchestration): assembly-integrity gate + dispatcher heartbeat (incidents #11, #1) Assembly integrity — submit_up/submit_root refuse when a completed child's commits are not patch-present in the assembled branch (git cherry — rebase-safe; branch pruned after merge or any git error fails open). Live incident #11: a completed revert subtask's merge was lost from the cell branch and the review gate re-flagged the exact violation the revert fixed, spawning another revision cycle. Dispatcher heartbeat — a dispatcher.alive audit row every 5 minutes from the dispatch loop. The 2026-07-01 outage was 4h25m of fleet-wide silence with no way to distinguish 'loop dead' from 'no work'; the loop's stdout died with the container while audit_log survives. CHANGELOG for tonight's full sweep included. * style: ruff format for the orchestration sweep * refactor(gateway): fold the assembled-submit guards + trim complexity under the xenon gate _assembled_submit_guards combines the #11 integrity check and B2 freshen for submit_up/submit_root; lifecycle's invalid-source remediate and git's per-child cherry probe extracted into helpers. Test harnesses built via __new__ stub the respawn tracker (the breaker now runs on their paths). --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-02 05:46:01 +02:00
Renn F	e209e285b8	feat(dispatch): per-dev sequenced queues for code subtasks (guardrails spec 3) ... True two-dev parallelism: a cell PM delegates the FULL set of code units up front — each dev gets its own queue, both build at the same time, each works its queue one task at a time in order. Replaces the old ceiling (≤2 code subtasks per parent, one per dev) which structurally forced under-decomposition. - Cap: `code` removed from `_SPINE_TYPE_CAPS` — no per-parent code cap (total fan-out still bounded by `_SUBTASK_HARD_CAP=12`); `planning`/`documentation` stay sequential at 1. `_same_assignee_rejection` exempts `code` so a dev may own a queue, but still rejects an exact same-title duplicate (the accidental re-delegation bug). `_spine_type_dup_envelope` simplified to the sequential spine it now only serves. - Dispatch barrier: `_blocked_by_earlier_lane_sibling` holds a dev's higher-sequence pending code leaf while it still has an earlier non-terminal code sibling under the same parent (keyed on assignee, gates only code) — the dev works its queue in order. Wired into `_spawn_pending_dev`. Loop-free (skip the tick, no reject/respawn) and best-effort (lookup failure → dispatch), mirroring the existing merge barrier. The merge barrier is unchanged: leaf PRs still merge serially in sequence order into the shared cell branch, so the independent build lanes never wedge it. - Prompt: cell_pm role guidance rewritten from the two-subtask-cap model to the per-dev-queue model (delegate all units now; dependent units go in one dev's queue, upstream first). Independent per-dev queues (each lane advances at its own pace) rather than strict cross-dev wave-sync, by design — more parallel and leaves the wedge-prone merge barrier untouched. Pairs with the spec-2 idle coverage gate: removing the code cap lets a PM claim every criterion up front, so that gate is always satisfiable.	2026-06-16 04:10:05 +02:00