Origination created the task with team=main_pm but no assignee, so after
the CEO's Approve-&-Start it fell to the unassigned-team routing, which
the orchestrator picks up slowly or never. Assign the Main PM agent up
front (the seeded foundation uuid) so the dispatcher routes it straight
to that agent via the assigned-PM path once confirmed. The
confirmed_by_human hold is unaffected — the dispatcher's self-heal skip
sits before the assigned/unassigned split, so the task stays inert until
the CEO approves it (now covered by a test).
The self-heal origination tests blind-inserted the fixed-uuid foundation
system agent (and a main-pm agent). In the full CI suite the app lifespan
seeds + commits those agents first, so the insert hit a duplicate-key on
pk_agents — green in isolation, red in CI. Get-or-create both (by id / by
slug) so the tests pass whether or not the agents already exist. Verified
against the real ordering (an app-lifespan integration test before this
file): 187 passed.
Adversarial review found the load-bearing invariant broken at the dispatch
layer: _dispatch_pm_work skipped only PR_REVIEW_SOURCES, so a PENDING
team=main_pm self_heal task (assigned_to=None, confirmed_by_human=False) was
routed to Main PM and spawned BEFORE the CEO approved it — the "never start
until you approve" promise didn't hold.
Fix: the PM dispatcher now also skips source='self_heal' while
confirmed_by_human is False (before the assigned/unassigned split, so it holds
either way); the task still shows in the panel so the CEO can see and approve
it. approve_and_start flips confirmed_by_human=True (the CEO's start IS the
human confirmation), so it dispatches normally afterward. Other sources are
unaffected.
Tests: a unit test that the dispatcher holds an unconfirmed self_heal task but
routes a confirmed one and ordinary tasks, plus a DB test that approve_and_start
flips the gate. (The readiness gate was deliberately not used — a blocker there
marks the task `blocked`; the dispatch skip leaves it cleanly PENDING.)
Behind the second opt-in (self_heal_originate_enabled), a detected regression
also opens a fix task into RoboCo's own delivery lifecycle and STOPS: PENDING,
unassigned, confirmed_by_human=False, team=main_pm, source=self_heal, with
synthesized acceptance criteria and a self_heal_fp= dedupe marker. It rides the
normal dispatchers only once the CEO Approve-&-Starts it; the loop itself never
calls start / approve / merge / deploy.
- TaskService: SELF_HEAL_SOURCE, extract_self_heal_fingerprint, and
list_open_self_heal_tasks (the dedupe + open-cap basis)
- SelfHealEngine._originate: per-signal fingerprint dedupe, per-cycle and
rolling open-task caps, repo resolved to RoboCo's own project (notify-only
when it can't be resolved)
- 7 DB-backed tests including the never-start / never-approve invariant
Renn F