GitLab's create_org_repo (services/forge/gitlab.py) replaces the Phase-3
synthetic 501 with a real implementation: resolves org (a group's full
path, subgroups included) to a numeric namespace id via GET
/groups/{path}, falling back to the token's own namespace on a 404
(personal-namespace projects); POSTs /projects with the
name/path/description/visibility/initialize_with_readme payload
(visibility mapped private->"private"/"internal"); reshapes the 201
onto the GitHub fields callers read (full_name/clone_url/html_url) and
GitLab's duplicate-path 400 "has already been taken" onto GitHub's 422
shape, text preserved. Gitea's create_org_repo was already real but
untested — added transport-level coverage.
GitHubProvisioningService (services/github_provisioning.py) is now
provider-aware: ROBOCO_PROVISIONING_PROVIDER (github default / gitlab /
gitea) and ROBOCO_PROVISIONING_HOST (self-hosted instance, required for
gitlab/gitea or the service stays disabled exactly like a missing
token/org) pick the target forge; the class/factory names stay
GitHub-flavored for backward compatibility (pitch.py and existing
imports untouched). A shared _is_already_exists() helper recognizes
GitHub's "already exists" (422), Gitea's (409/422 "already exists"),
and GitLab's reshaped "has already been taken" (422). The existing-repo
re-fetch now builds a provider-aware RepoRef (GitLab packs org/name
into the owner field; GitHub/Gitea keep the owner,repo pair). Default
behavior (no new env set) is byte-for-byte the Phase-1 GitHub path,
pinned by a regression test.
Gates: ruff format/check clean, mypy roboco/+tests/ clean (1235 files),
xenon A/A/B clean, targeted suite (forge + provisioning + pitch) 79/79
green.
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
Opening /tg in a plain browser loads telegram.org's script, which
defines window.Telegram.WebApp with EMPTY initData (no real launch
behind it). Production posted that empty string to webapp-auth → 422 →
"Couldn't sign in". The dev path already guarded this (cb55f2b9); the
prod path didn't. Now a bridge with no initData that isn't the dev mock
shows the "Open from Telegram" wall instead of erroring — the cockpit is
a phone-from-Telegram surface, and a desktop browser gets the wall, not
a failed auth.
Caught live on the NAS: every cloud-auth login failed with
422 {"loc": ["query", "db"]} regardless of credentials. Root cause:
auth/manager.py used postponed annotations with a TYPE_CHECKING-only
AsyncSession import, so FastAPI could not resolve get_user_db's
Annotated[AsyncSession, Depends(get_db)] at runtime and silently
demoted `db` to a required query parameter.
The module now evaluates annotations eagerly (no future-annotations,
runtime imports) so an unresolvable annotation is loud instead of a
silent contract change. Regression test mounts the REAL login router —
no dependency overrides, which is exactly why the existing suite never
caught this — and asserts wrong credentials yield 400
LOGIN_BAD_CREDENTIALS, never a 422.
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* test(forge): live-GitLab contract suite — verified against gitlab.com
Mirror of the Gitea live suite for GitLabProvider (forge Phase 3):
env-gated (ROBOCO_GITLAB_E2E_URL/_TOKEN + ROBOCO_E2E_SMOKE=1),
self-seeding — creates a throwaway private project under the token's
namespace, pushes real commits, and drives the provider end to end: MR
open → duplicate 409→422 reshape → native source/target filter →
GitHub-shape adaptation (iid→number, head/base, merged) → per-file diff
reassembly → note review → commit-status→check_runs reshape → squash
merge with a mergeability-settle retry (GitLab computes merge status
asynchronously) → branch delete → release (shaped html_url) → the
oauth2 Basic-auth git-CLI claim. Project deleted afterwards.
Green against gitlab.com on first full run — no adapter fixes needed
(the settle-retry is the one live-behavior accommodation). Requires a
token with Project: Create (classic `api` scope, or fine-grained with
project create + API read/write).
* fix(tests): split None-guarded assert so its message can't dereference None
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* feat(forge): Phase 2 — Gitea provider, per-call routing, host registry
Gitea support lands behind the Phase-1 seam:
- GiteaProvider (services/forge/gitea.py): Gitea v1 transport addressed
by instance host (api base from the project's git_url). Where Gitea's
wire contract diverges from GitHub's, the provider adapts responses
back into the shapes GitService already classifies (ShapedResponse):
`token` auth scheme, duplicate-PR 409→422 with the "already exists"
text GitService keys on, commit statuses reshaped into check_runs /
workflow_runs envelopes, APPROVE→APPROVED review mapping, Do-keyed
POST merge, merge-method repo keys, label-color '#' prefix,
client-side head/base PR filtering. Deliberate postures per the spec:
zero-workflows fail-open (statuses-free repo → no_ci_configured) and
merge_branch as a shaped 501 (env-sync cascade lands on missing_ref;
the shared local-git fallback is Phase-2.1).
- ForgeRouter (services/forge/router.py): GitService._forge now routes
per call from RepoRef.host — every existing call site unchanged in
shape. RepoRef gains an optional host; _parse_git_url returns the
host-stamped ref and it is threaded through GitService/release
executor instead of being rebuilt from strings (helpers re-signatured
to take RepoRef).
- Host registry (services/forge/registry.py): in-memory host→provider
map, self-healing — ProjectService.get/get_by_slug re-register on
every read; provider_for resolves gitea projects by git_url host.
- Registration validation now accepts git_provider="gitea"; GitLab
remains recognized-but-rejected. Panel: the read-only Forge badge
becomes a real picker (Auto-detect / GitHub-GHE / Gitea / GitLab
disabled).
Plain git (clone/fetch/push) needs no changes — the Basic-auth
extraheader works on Gitea unchanged. Gates: mypy 392 files, xenon A,
full unit suite 6356 green, integration suite 2257 green.
* feat(forge): live-Gitea contract suite + scheme support + slash-safe refs
Hardening from running the provider against a real dockerized Gitea
1.22.6 (the spec's Phase-2 contract suite, now committed as the
env-gated tests/e2e_smoke/test_gitea_live.py — self-seeding: creates its
own repo, pushes real commits, and drives PR open → duplicate reshape →
list/filter → diff → review → labels → commit-status CI reshapes →
squash merge → branch delete → release, plus a live verification of the
x-access-token Basic-auth git-CLI claim).
Two real findings fixed:
- Branch refs weren't URL-encoded — every RoboCo branch carries slashes
(feature/backend/...), and Gitea's router 404s on the extra path
segments. list_ci_runs + delete_branch_ref now quote the ref
(regression-pinned in the unit suite).
- The API base hardcoded https; a LAN instance serving plain http is a
real deployment shape. GiteaProvider gains a scheme (recorded per host
by the registry from the project's git_url).
ShapedResponse moves to forge/shaping.py (shared by the upcoming GitLab
transport, which needs its text override for diff reassembly).
* feat(forge): Phase 3 GitLab provider + Phase 2.1 local-merge fallback
GitLabProvider (services/forge/gitlab.py): GitLab v4 transport addressed
by host+scheme, subgroup-safe (the MR project path packs into
RepoRef.owner, URL-encoded per call). Adapters translate MR semantics
into the GitHub shapes GitService classifies: iid→number,
source/target_branch→head/base with a merged bool, per-file diffs
reassembled into unified-diff text (ShapedResponse text override,
3-page cap), approve-vs-note review routing (GitLab has no
request-changes verb), pipelines/statuses reshaped into
workflow_runs/check_runs, merge-method repo-key mapping, duplicate-MR
409→422. Reviewer mirroring is skipped (needs numeric ids RoboCo
doesn't store); provisioning stays Phase 4. gitlab.com now auto-detects
at registration like github.com; self-hosted GitLab sets the provider
explicitly (panel picker enabled).
Phase 2.1: neither Gitea nor GitLab has GitHub's server-side merges
API — their merge_branch returns a shaped 501 and
GitService.sync_env_branch now runs the shared local-git fallback
(_local_merge_branch: throwaway clone → ancestor check → merge → push;
a conflict aborts with the remote untouched; same status vocabulary as
the merges-API path).
Also aligns the whole tree with the full gate's tests/-scoped mypy
(provider-test responder typing, e2e_smoke's stale owner/repo shapes).
Gates: mypy 1229 files clean, xenon A, unit suite 6393 green, forge
suites 85 green, panel typecheck/lint clean.
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
The full-suite CI run executes every test tree in one process against one
database, so other suites' committed rows are visible to the Today-brief
queries and the "empty company" / absolute-count assertions failed
(assert 4 == 0). The suite now snapshots a pre-seed baseline and asserts
deltas, seeds at priority 0 so its rows stay inside the brief's item
caps, and uses a unique agent slug (the fixed be-dev-1 could collide
with leaked rows). Verified by co-running with the known-polluting
integration suites in one process.
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
CI runs `mypy roboco/ tests/`; the bridge/cockpit suites were only gated
against `mypy roboco/` locally. Real credentials dataclass instead of
SimpleNamespace, AsyncMock casts where mocks sit behind typed fields, a
return annotation on the fake stream, a None-guard on the consumer task,
and a fresh registry lookup where mypy's literal narrowing read an
assert as always-false.
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* feat(tg): P0 — dev mock bridge + Telegram-native foundations
Mini App V4 phase 0. The (tg) shell gains the groundwork every later
phase builds on:
- Dev mock bridge: outside Telegram, a development build falls back to a
no-op WebApp object and skips the webapp-auth POST (the regular panel
session cookie authorizes API calls), so the cockpit is workable in a
plain browser. Production keeps the "Open from Telegram" wall.
- Telegram theme adoption: themeParams map onto the shadcn CSS variables
scoped to #tg-shell (desktop dashboard untouched), colorScheme drives
the dark class, themeChanged re-applies live. Non-hex values are
dropped at the trust boundary.
- Viewport/swipe correctness: shell height rides Telegram's own
--tg-viewport-stable-height (100dvh fallback), vertical swipe-to-close
disabled so list scrolling can't dismiss the app.
- Native chrome bindings: TgWebAppProvider context plus useMainButton /
useBackButton declarative hooks and a null-safe haptics helper —
consumers never touch window.Telegram directly.
* feat(tg): P1 — Today home tab + one-round-trip /telegram/today brief
Mini App V4 phase 1: the cockpit now opens on a "Today" brief answering
"does anything need me?" in one glance.
Backend: GET /api/telegram/today (CEO-gated, rate-limited) returns the
whole brief in one round trip via the new TgCockpitService — needs-you
items (awaiting-CEO + blocked tasks capped for a phone screen, held-draft
counts across release/X/video/roadmap queues), a fleet snapshot with
per-agent current-task titles, today's spend from the day rollup
(degrading to zeros on a usage hiccup, mirroring the CEO overview), and
ship state. Deliberately DB-only: no live GitHub calls, no readiness
snapshot (that path clones), no orchestrator singleton — the CI
red/green proxy is the set of open ci_watch fix tasks.
Panel: TgTodayTab is the new default tab (Gauge icon) — needs-you rows
and draft chips deep-link into the tab that acts on them (with a haptic
tap), fleet/spend/ship render as dense cards, 45s refetch until the P3
WebSocket wiring lands.
* fix(tg): dev mock engages when the CDN bridge loads outside Telegram
Live browser smoke caught it: a bare tab still loads telegram-web-app.js,
so window.Telegram.WebApp EXISTS outside Telegram — just with empty
initData. The dev fallback keyed on a null bridge only, so a dev browser
went down the real-auth path and posted empty initData instead of
mounting the mock. The fallback now treats bridge-with-no-initData the
same as no bridge (a real Telegram launch always carries initData);
production behavior is unchanged.
* feat(tg): P2 — native approvals card stack
Mini App V4 phase 2: the Approvals tab stops stacking the four desktop
queue cards and becomes a phone-native flow — one normalized list across
release proposal / X drafts / video drafts / proposed roadmap items, and
a full-context detail per item:
- Release: version/bump/gate badges, changelog draft, gaps, migration
notes, in-flight + failed-execute banners; approve runs the fail-closed
executor, reject requires a substantive change request (10 chars).
- X: editable body with the live 280 counter, replied-to mention quoted;
approve sends the edited body only when actually edited.
- Video: cut-toggled player (blob-fetched through the authed client — a
bare <video src> would 401), per-platform caption edits with 280/2200
counters; approve sends only checked-in edits.
- Roadmap: the PO's full pitch (description, rationale, ACs); approve
materializes into the backlog per item.
The detail's primary action rides Telegram's native MainButton and back
navigation rides the BackButton, with visible fallbacks outside Telegram
(dev mock, old clients). Haptics fire on outcomes. An acted-on item
vanishes from the refetched queue, popping back to the list by
construction. A failed queue source is surfaced ("list may be
incomplete" / "couldn't load") instead of masquerading as an empty
queue — caught live in the browser smoke.
* feat(tg): dev demo mode — /tg?demo=1 renders canned cockpit data
Development-only: with the flag param present, the Today brief and the
four approval queues resolve typed fixtures (dynamically imported, so
production bundles never carry them) instead of hitting the backend —
the cockpit is fully browsable with zero stack running. Mutations still
go to the real API and fail loudly; it's a showroom, not a simulator.
* feat(tg): P3 — cockpit rides /ws/system live
Chat adopts the desktop A2A invalidate-on-frame idiom over the shared
ref-counted /ws/system socket: every a2a.message frame refreshes the
conversation list and the affected thread, missed-frame gaps are healed
by a reconnect refetch, and the 10s thread poll turns off entirely while
the socket is up (it remains the fallback). The Today brief refreshes on
each USAGE_SNAPSHOT push so the spend line tracks the sweeper live, with
the 45s poll as the socket-down fallback. No new sockets, no backend
changes — the WS gate already accepts the cloud-auth session cookie.
* feat(tg): P4 — deterministic bot command tier + self-syncing menu
Mini App V4 phase 4 (deterministic half): three new bot commands beside
/status /queue /task —
- /agents: who's mid-task right now, from the same TgCockpitService
fleet snapshot the Today brief renders (now public `fleet()`).
- /usage: today's spend from the day rollup.
- /blocked: awaiting-you + blocked tasks, deep-linked into the panel,
capped per section, titles HTML-escaped.
BOT_COMMANDS is the single registry driving /help AND a once-per-process
Bot API setMyCommands sync on the first poll cycle (new client method,
best-effort), so the Telegram command menu can never drift from what the
code implements. The interactive tier (/secretary, /newtask riding a
live Intake interview in-thread) is specced but not in this commit.
* feat(tg): direction-C styling pass — Telegram palette, RoboCo voice
The cockpit stops wearing default-shadcn and gets its own visual
language on top of the P0 themeParams bridge (colors stay CSS-variable
driven, so inside Telegram everything still adopts the user's theme):
- Shared primitives (components/tg/ui.tsx): TgSection grouped cards with
tracked micro-label headers, TgRow list rows (44px targets, press
feedback, 1/2-line clamp), TgRowIcon glyph tiles, TgStat tabular-nums
figures. Every tab composes the same three, so density and rhythm are
identical across the surface.
- Shell renders a centered 430px column (sm:border-x) — the phone UI no
longer stretches across a desktop dev browser.
- Tab bar: tighter type, active stroke-weight shift, backdrop blur.
- Today: needs-you count badge, divided task rows with inline blocked
marker, fleet as mono-named rows, spend/ship as stat tiles.
- Approvals rows as icon-tile cards; detail header gains the kind glyph.
- Inbox/Chat rows aligned to the same card language.
* feat(tg): P5 — /secretary and /newtask live-chat bridges
The bot's interactive tier: both commands bridge the CEO's Telegram chat
into the same in-process runtimes the panel drives — the persistent
Secretary container and the scoped Intake interview.
There is no synchronous send→reply seam (replies land on the session's
single-consumer relay queue), so each bridged session runs one long-lived
consumer task (roboco/services/telegram_bridge.py) that drains
PrompterLiveRegistry.stream and pushes one Telegram message per completed
turn. While a session is live, plain chat text IS the conversation;
/end closes it.
/newtask resolves the intake scope (single project auto-picked, multiple
offered as a tap-to-pick keyboard holding the initial text), and the
interview happens in-thread. A draft proposal renders as a card with
Send-to-Board / Discard buttons: confirm routes through the normal
board-review path (PrompterService.confirm_live_draft, route=board) and
PARKS the session — board feedback later streams straight back into the
same thread, closing the redraft loop from the phone. MegaTask batches
still confirm in the panel only.
The consumer's open stream arms the registry's 60s keepalive, so the
bridge runs its own idle TTL (same setting, parked sessions exempt).
State is per-process in-memory by design (the _PENDING_REPLIES posture);
intake/secretary containers are process-wide singletons, so a bridged
session preempts a live panel session of the same kind by construction.
* feat(tg): cockpit skin — RoboCo dark deck with a constant amber accent
The cockpit no longer inherits the dashboard's white default outside
Telegram: #tg-shell carries its own standing skin (deep slate surfaces,
amber primary) so the Mini App looks like RoboCo everywhere. Inside
Telegram the themeParams bridge now overrides SURFACE tokens only —
background/card/text/hint/border repaint to the user's Telegram theme
while --primary/--ring stay RoboCo amber: Telegram's surfaces, RoboCo's
voice. Demo fixtures also rewritten to neutral content (they previously
depicted unbuilt forge work and already-shipped roadmap items as live).
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
_sync_target_branch ran a bare `git pull` after checkout; on a workspace
clone whose local target branch diverged from origin (inevitable once
remote history is rewritten) modern git fatals with "Need to specify how
to reconcile divergent branches". On the CEO approve-and-merge path the
GitHub merge had already landed, so the failure surfaced as a spurious
400 "Merge failed" and every retry re-hit the same wedged clone.
Sync is now fetch + `reset --hard origin/<branch>` — remote-authoritative,
matching the helper's intent and self-healing the divergence for all
call sites (CEO merge, PM 409-retry sync, post-merge best-effort sync).
* [467e263d] fix(ci): restore green Python quality gate on slave (mypy + xenon)
Two independent bugs broke run 29653535468's 'Python quality gate' job,
not the pydantic-settings pin (already correctly 2.14.2 on this branch).
- git.py: _delete_remote_branch_best_effort's success path fell off the
function with no return, failing mypy's missing-return-statement check
and silently returning None instead of the documented True.
- company_goals.py: CompanyGoalsService.upsert's six repetitive
`if key in data` branches pushed the module's average cyclomatic
complexity past xenon's --max-modules A gate; refactored into a loop
over the mutable-field tuple (behaviourally identical).
* [467e263d] docs(changelog): restore green Python quality gate on slave (CI run 29653535468)
Documented two independent code-level bugs fixed in commit 5ed93ca7:
1. git.py: missing return True statement in _delete_remote_branch_best_effort success path (mypy failure)
2. company_goals.py: cyclomatic complexity refactoring for xenon gate pass
Both bugs identified and fixed by dev team; verified via full CI reproduction locally.
---------
Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech>
Co-authored-by: Backend Documenter <be-doc@roboco.tech>
The two parallel spec-item branches each took 075 off head 074 (flagged in
both PRs); merging both left two alembic heads. git_provider now revises
075_company_goals_company_name; verified with a real upgrade chain run.
* feat(forge): Phase 0 — git_provider column + registration-time forge validation
Pointing a project at a GitLab/Gitea git_url used to fail silently, several
steps deep, at first PR. New pure policy module (foundation/policy/forge.py)
detects the provider from the git_url host and validates at the
ProjectService create/update chokepoint: github auto-detects and
auto-stamps, explicit git_provider=github is the GitHub Enterprise escape
hatch, gitlab/gitea are recognized-but-not-yet-supported, unknown hosts get
a loud rejection with guidance. An update changing git_url does NOT inherit
a stored auto-stamped provider (restating the override is required), so a
host swap can't smuggle the escape hatch past validation. Migration 075
adds the nullable projects.git_provider column; the panel project dialogs
show the detected forge. Phase 0 of the forge-providers spec.
* feat(forge): Phase 1 — GitProvider seam, GitHub transport extracted
roboco/services/forge/: base.py holds the pure contracts (RepoRef +
GitProvider ABC, stdlib-only — a later GitLabProvider is implemented by
reading this file alone), github.py the httpx transport (20 endpoint
methods behind one shared request-plumbing helper set), registry.py the
wiring (git_provider column -> provider, failing loud on gitlab/gitea).
GitService keeps its exact public surface and all response
classification; its 26 inline REST call sites route through a lazy
_forge property (several suites build GitService via __new__, so an
__init__-set attribute breaks them). github_provisioning and
release_executor ride the same provider. Zero behavior change — the
pre-existing suites pass unmodified; per-project provider resolution
lands with the second provider.
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
Item B+C of the video/X per-project targeting spec, plus the
company_goals.company_name field they depend on (migration 075).
- CompanyGoalsService.resolve_product_name is the single fallback chain
(project name -> charter company_name -> RoboCo); XEngine and
VideoEngine both call it and their prompt builders are pure functions
taking product_name — release posts/videos stop hardcoding RoboCo.
- The X and video queue responses carry project_slug/project_name via one
shared unloaded-guard helper (api/schemas/project_fields.py); both
panel queues render a shared ProjectBadge so multi-project drafts are
tellable apart.
- Business -> Goals editor gains the company-name input.
- Fixes a pre-existing test-isolation leak: the company-goals routes test
commits the charter singleton into the session-scoped test DB and
polluted later suites; it now deletes the row on teardown.
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* feat(forge): Phase 0 — git_provider column + registration-time forge validation
Pointing a project at a GitLab/Gitea git_url used to fail silently, several
steps deep, at first PR. New pure policy module (foundation/policy/forge.py)
detects the provider from the git_url host and validates at the
ProjectService create/update chokepoint: github auto-detects and
auto-stamps, explicit git_provider=github is the GitHub Enterprise escape
hatch, gitlab/gitea are recognized-but-not-yet-supported, unknown hosts get
a loud rejection with guidance. An update changing git_url does NOT inherit
a stored auto-stamped provider (restating the override is required), so a
host swap can't smuggle the escape hatch past validation. Migration 075
adds the nullable projects.git_provider column; the panel project dialogs
show the detected forge. Phase 0 of the forge-providers spec.
* fix(panel): mock-mode forge detection extracts the real host
CodeQL js/incomplete-url-substring-sanitization: the substring check
matched github.com anywhere in the URL. Extract the hostname (URL parse
or scp-form regex, mirroring forge.py) and require an exact match.
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
GHSA-4f7g-w95g-5q2c (CVSS 9.8) — the default registry deploy ran in
header-trust mode: with ROBOCO_AGENT_AUTH_REQUIRED unset and cloud auth
off, require_panel_token / _check_agent_auth_token returned without
verifying a credential, so any client reaching the API could write
settings and claim X-Agent-Role: ceo with no token. Binding :8000 to
loopback (c4053d5f) closed the direct path but not nginx :3000, which
proxies /api/ to the orchestrator and passes client X-Agent-* through.
Root cause: header-trust is the default even in production. _auth_required
now fails closed when settings.environment == production (the registry
compose already declares it) — an explicit false still opts out for a
trusted private network. The registry compose arms auth by default and
requires ROBOCO_PANEL_AGENT_TOKEN so nginx injects a valid CEO token and
the panel keeps working. The CEO's NAS deploy is unaffected: it runs
cloud auth, which already enforced tokens on every role.
The env-ladder change makes a parentless root consult the project head
rung before string derivation; on a bare AsyncMock the resolver probe
auto-materializes and returns a truthy mock. Stub it to None so the test
exercises the no-project string-derivation fallback its name promises,
matching test_merge_chain's pattern.
draft_release_post / draft_release_video accept a project_id and the
release-proposal approve hooks pass the proposal task's own project;
the spotlight companion video forwards the spotlight draft's project
into open_video_task — previously it always authored against the
deployment-anchor project's motion/ tree regardless of which project
the spotlight was about. Omitted project_id keeps the anchor-project
fallback, so single-project deployments are unchanged.
_pyproject_version read pyproject.toml with no error handling, so a
non-Python project failed the release-manager cycle every interval
forever. _project_version now probes pyproject.toml, package.json,
Cargo.toml, then a bare VERSION file; missing or unparseable manifests
are skipped and no manifest degrades to an empty version.
A parentless root's PR base / merge target now resolves through
resolve_parent_branch to the project's panel-configured head rung —
submit_root passed a hardcoded 'master', which on a main-default repo made
_ensure_base_on_remote silently create a spurious master branch and land
the assembled root PR there. Literal master survives only as the
no-project string-derivation fallback.
The #568 tests unpacked AsyncMock.await_args without narrowing its
Optional type and passed a SimpleNamespace where _format_task_detail
is annotated TaskTable. Narrow with the repo-standard 'assert
await_args is not None' and cast the fake task at the call sites.
* [e530aa5e] Diagnose and fix roboco-api CI failure (run 29629255153) (#561) (#562)
* [e530aa5e] fix(tests): narrow None before indexing validate_init_data() result in telegram_initdata self-check
CI run 29629255153 failed on mypy, not the historical pydantic-settings
issue (uv.lock already pins 2.14.2). The __main__ self-check block in
test_telegram_initdata.py indexed the dict[str, object] | None return
of validate_init_data() without narrowing away None first.
* [e530aa5e] docs(qa): document CI fix for mypy type narrowing in telegram_initdata test
Explains the root cause (mypy type error in __main__ block), the solution (None narrowing before indexing), and the safe pattern for future test self-checks that call functions returning optional types.
---------
Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech>
Co-authored-by: Backend Documenter <be-doc@roboco.tech>
* [0884b737] Diagnose and fix Python quality gate + e2e lifecycle smoke CI failures on PR #563 (#564) (#565)
* [0884b737] fix(tests): isolate ROBOCO_SDK_URL for scripted e2e-smoke agents
tests/e2e_smoke/harness.py already isolates ROBOCO_AGENT_TOKEN from the
host environment (the #503/#504 fix) but left ROBOCO_SDK_URL leaking
through. flow_server/do_server both default it to
http://localhost:9000 and forward every rejection there for the
per-verb circuit breaker; inside a real spawned agent container that
port is a live SDK loopback, so the breaker records genuine attempts
for the ephemeral test-agent IDs and trips circuit_open mid-test
(test_sandbox_on_demand.py::test_request_sandbox_guard_chain_over_real_api,
which deliberately causes 3 rejections in a row). Point it at a
guaranteed-refused loopback address so every environment gets the same
fail-open bypass a bare CI runner already gets by having nothing
listening on 9000 at all.
* [0884b737] docs(changelog): document e2e-smoke harness ROBOCO_SDK_URL isolation fix
Document the fix that isolates ROBOCO_SDK_URL in the ScriptedAgent harness to prevent the per-verb circuit breaker from leaking state into ephemeral test-agent identities when the e2e-smoke suite runs inside a live agent container. This ensures the suite passes consistently regardless of whether it runs on bare CI or inside a spawned agent.
---------
Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech>
Co-authored-by: Backend Documenter <be-doc@roboco.tech>
* [3b9a1771] Diagnose and fix ALL make quality + e2e-smoke stage failures on PR #563; confirm real CI green (round 3) (#566) (#567)
* [3b9a1771] fix(e2e-smoke): match real embedding dimension when seeding fake journal chunk
test_c3_deleted_journal_unindexed inserted a 4-dim placeholder vector
into chunks_journals, but the e2e stack's app lifespan eagerly creates
that table with the real settings.embedding_dimensions (1024) before
the test runs, so the insert failed with "expected 1024 dimensions,
not 4". Derive _SMOKE_DIM from settings.embedding_dimensions instead
of a hardcoded constant so the seeded vector always matches the
table's actual column width.
* [3b9a1771] docs(qa): document e2e-smoke embedding dimension fix in round 3 CI diagnosis
Recorded the root cause, solution, and pattern for the final e2e-smoke test failure found in comprehensive sandbox testing: the test seeded a 4-dim placeholder vector but the app's eager lifespan init created chunks_journals with the real 1024-dim embedding column. Updated _SMOKE_DIM to derive from settings.embedding_dimensions instead of a hardcoded constant.
---------
Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech>
Co-authored-by: Backend Documenter <be-doc@roboco.tech>
---------
Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech>
Co-authored-by: Backend Documenter <be-doc@roboco.tech>
_classify_check_runs counted any completed cancelled check-run as failing.
The push + pull_request double-trigger leaves cancelled same-name
check-runs on the same head SHA next to the surviving run's green, so the
pr_pass gate saw permanent red on a genuinely green PR. Keep only the
newest (highest-id) run per check name before classifying.
Two layers: generated agent settings now set includeCoAuthoredBy: false
(never set anywhere before, so the CLI nudged models into appending
'Co-Authored-By: Claude ...' to commit messages), and the commit verb
strips AI-attribution lines deterministically at the chokepoint every
provider routes through.
_SWITCHBOARD_SLUGS reused is_human_only_role (spawn semantics) and dropped
the CEO before can_a2a_direct — which allows CEO -> anyone — ever ran, so
the static pair matrix had no CEO pairs and a Renzo filter emptied the
switchboard. Only prompter/secretary/system are excluded now; CEO pairs
get their own 'CEO Direct' section (matrix 70 -> 93). Every switchboard
section header is now a collapse toggle (Radix Collapsible, default open).
* feat(panel): Journals joins the Agents hub as its third tab
* docs(map): Journals tab on the Agents hub; registry retargets
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
Both deploy composes published the orchestrator API on 0.0.0.0:8000, so any
host that could reach the machine hit the control plane directly — past nginx
and, in the default header-trust posture, with no credential: read/write
runtime settings and X-Agent-Role: ceo spawn/stop. nginx reaches the API over
the internal Docker network, so a routable host publish is never needed; bind
it to 127.0.0.1. On-host debugging and normal panel operation are unchanged;
off-host access must go through nginx + cloud auth.
* feat(panel): Agents hub — Fleet and Conversations tabs, /a2a redirect, DM quick-action
* fix(panel): validate deep-linked DM targets against roster and exclusions; re-arm the dm latch
* docs(map): panel entries for this wave
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* feat(panel): customizable Quick Actions on Overview — registry, defaults, persisted picker
* fix(panel): legacy bar actions join the quick-action defaults; empty state; persist-contract test
* docs(map): panel entries for this wave
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* feat(panel): Workstation card grids with persisted view toggle and sorting
* fix(panel): stable multiplier sort with cell-label fallback after adversarial review
* docs(map): panel entries for this wave
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* feat(motion): demo-register visual design bar, vendored craft references, catalog vocabulary index
* fix(motion): correct design-bar composition claims after adversarial fact-check
* docs(map,rag): design-bar, vendored references, and catalog index on the video-engine surfaces
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* feat(panel): Workstation page — Products and Projects as tabs behind one sidebar entry
* docs(map): workstation page, extracted views, and the local-filter scroll trade-off
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* feat(panel): session-start, 7d overview spend, and 30d business spend charts
* feat(panel): surface work sessions as a Git page tab (route was orphaned)
* feat(git): reap spent task branches and render previews at lifecycle chokepoints; guarded stale-branch sweep
* feat(panel): stale-branch cleanup button on the Git page
* fix(git,panel): cursor-resumable sweep, force-delete spent refs, local filter state
* docs(map,rag): branch/preview reaping, cleanup sweep, git-tab work sessions, wave-2 charts
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
A draft targeting a platform with no credentials could never complete:
the X leg posted and committed its id, the TikTok leg failed as
'transient', and the card sat pending in the CEO queue with retry
semantics that structurally cannot succeed. Unconfigured platforms are
now an explicit skip: the draft COMPLETES when every configured
platform has posted (detail names what was skipped), an approve whose
targets are all unconfigured refuses loudly instead of silently
completing, and genuine post failures keep their partial/retry
semantics. Re-approving a parked card clears it without re-posting
(the already-posted guard is covered by a dedicated test).
Verified: 32/32 test_video_post_service (3 new: skip-and-complete,
all-unconfigured refusal, re-approve recovery), ruff/mypy/xenon clean.
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
The 0.7.36 exact-pin landed via an npm install, which wrote a stray
package-lock.json and left pnpm-lock.yaml stale — the image build's
pnpm install --frozen-lockfile then correctly refused the spec
mismatch, blocking deploys. Lockfile regenerated with the Dockerfile's
own pinned pnpm@11.10.0 (resolves @hyperframes/producer@0.7.36 exactly,
frozen-lockfile install and the sidecar's node --test 15/15 verified
locally); the npm lockfile is removed — this package is pnpm-managed.
