4 Commits

Include renames

Author	SHA1	Message	Date
3 people	3849c1737e	feat(video): switch 0.19.0 renderer Remotion → HyperFrames (HTML-native, Apache-2.0) (#314) ... * feat(video): rewrite sidecar render core to HyperFrames (in place) * feat(video): convert motion compositions from Remotion TSX to HyperFrames HTML * refactor(video): rename render client to video_renderer_client (renderer-agnostic) * chore(video): rename remotion-renderer prose in test_video_pipeline docstrings * chore(video): rename sidecar to video-renderer + add system ffmpeg for HyperFrames * chore(video): rename stray remotion-renderer refs in sidecar + py docstrings (controller cleanup) * chore(video): fix stale Remotion API names in Dockerfile comment (controller cleanup) * docs(video): rewrite video-engine prose for HyperFrames + add map entry + folded prose fixes * docs(video): add trailing newline to docs/map/video-engine.md (controller cleanup) * chore(video): drop internal spec refs + minio/test suppressions (folded hygiene) * fix(video): reclaim outDir on createRenderJob throw + hide empty 4th highlight Final whole-branch review (Opus) triaged two FIX items from the SDD nits ledger; the rest ship as-is. - render.js: a synchronous throw from createRenderJob (post-mkdtemp, not awaited) left an empty outDir on disk — the outer catch only reclaimed extractDir. Reclaim outDir too when it exists, and correct the stale comment that claimed the out dir was never created. - {vertical,square}.html: the 4th highlights <li> lived in the DOM hidden only by JS, so a no-JS / failed-script render would show an empty bullet. Start it style="display:none" and reveal on populate, so an unscripted render shows nothing instead. Vitest smoke (release-announcement.test.js) 4/4 green; render.js syntax checked. Python suite untouched by this fix (JS/HTML only). * fix(video): type _override_db yield as AsyncSession | None T7 widened _build_app's db_session param to AsyncSession | None (to drop the 4x # type: ignore[arg-type] on the DB-independent _build_app(None, ...) calls) but left the inner _override_db fixture typed AsyncIterator[AsyncSession] — so 'yield db_session' yielded AsyncSession | None into a declared AsyncSession, and mypy failed at test_video_routes.py:177 ('Incompatible types in yield'). The DB-independent media tests pass db_session=None deliberately: their route uses a monkeypatched task service and never awaits the session, so yielding None is safe at runtime. Type the override's yield as AsyncSession | None to match — no cast, no # type: ignore, no assert, runtime behavior unchanged. The 3 media tests (3 passed) and the 19 db-gated tests (skipped locally) hold. * chore(gate): skip .superpowers scratch in markdown prose gate reflow_md.py walks the filesystem via rglob('*.md') and skips tooling dirs (.venv, .mypy_cache, .pytest_cache, ...) but not .superpowers/ — the superpowers SDD workflow's scratch dir (briefs, reports, progress ledger, all gitignored). A dev running SDD locally would hit a false markdown-prose gate failure on those transient files. Add .superpowers to SKIP_DIRS, consistent with the existing tooling-scratch exclusions. * fix(video): validate composition_id to close path traversal (CodeQL) compositionId flowed unvalidated from the POST body into path.join under extractDir/motion/compositions/, so a '../..'-style value could escape the composition dir (CodeQL: Uncontrolled data used in path expression). Validate at the trust boundary in server.js (/^[A-Za-z0-9_-]+$/) and add a path.resolve + startsWith containment check in render.js so it stays safe regardless of caller. * fix(mcp): send X-Agent-Token + X-Agent-Team from flow/do servers flow_server._build_headers and do_server._build_headers constructed only X-Agent-ID/Role/Correlation-ID, omitting X-Agent-Token and X-Agent-Team (unlike ApiClient._get_agent_headers used by the other MCP servers). Latent since the gateway refactor — surfaced when ROBOCO_AGENT_AUTH_REQUIRED=true was armed on the NAS, 401-ing every flow/do verb with 'Missing X-Agent-Token header'. Add both headers (mirroring ApiClient) so the HMAC gate passes. Tests assert the headers are now injected. * [video-engine] Per-project video_engine_enabled opt-in toggle Mirrors ci_watch_enabled (migration 048): the global ROBOCO_VIDEO_ENGINE_ENABLED flag arms the subsystem; the new projects.video_engine_enabled column (migration 063) opts a repo into authoring against its motion/ dir. VideoEngine._opted_in_project no-ops open_video_task at the single chokepoint covering all three trigger paths (on-release, on-spotlight, CEO on-demand) until the operator flips it in the panel edit-project dialog. Existing projects stay opted out (server_default=false). * fix(auth): send X-Agent-Token + X-Agent-Team from all agent->API call sites The prior fix (6ed4e139) covered the flow/do MCP servers but missed four other agent->orchestrator call sites that built the header dict by hand and omitted X-Agent-Token and/or X-Agent-Team. With ROBOCO_AGENT_AUTH_REQUIRED armed on the NAS, every one 401s: - agent_sdk/server.py: the session-end post-mortem flush (/api/journals/me/entries), A2A persistence + offline fallback (/api/a2a/*), and the stopped-without-transition auto-substitute (/api/tasks/auto-substitute) — all sent only X-Agent-ID/Role, so each 401'd 'Missing X-Agent-Token'. Add a shared _agent_headers() helper (mirroring flow_server._build_headers) and route all four through it. - agent_sdk/secretary_driver.py: _headers() sent the token but not the team, so the HMAC gate 401'd with signature mismatch (secretary is board-team; token signed with team='board', verified with team=''). Add the team header. - mcp/git_readonly.py: the read-only git MCP sent only X-Agent-ID/Role — no token, no team — so /api/git/* 401'd once auth was armed. Convert the static _HEADERS to a _headers() helper with team + token. - runtime/orchestrator.py: the cell-PM auto-submit self-API call acted as a PM with a hand-built {X-Agent-ID, X-Agent-Role} dict — no token, no team — 401ing under auth-required. Add _agent_api_headers(uuid, role) mirroring _system_api_headers, and use it. Tests: _agent_headers round-trip (token + team, team-omitted when None), _agent_api_headers carries a signed PM token + team. * [auth] Omit UNSIGNED self-call token in dev mode + video-engine test mypy fix _agent_api_headers sent the UNSIGNED sentinel when ROBOCO_AGENT_AUTH_SECRET was unset, but the dev-mode middleware rejects a presented-but-unverifiable token with 401 signature mismatch (while accepting a missing one). The cell-PM auto-submit self-call 401'd in every dev run, regressing test_auto_submit_cuts_the_pm_turn. Attach the token only when a secret is set. Also fix the FromClause.update mypy error in the per-project video-engine opt-out test (ORM row load + flush). * [auth] Omit UNSIGNED agent token at every agent->API call site The orchestrator injects ROBOCO_AGENT_TOKEN=UNSIGNED when the HMAC secret is unset at spawn. The API middleware rejects a presented-but-unverifiable token with 401 'signature mismatch' even in dev mode (auth not required), so forwarding UNSIGNED turned every flow/do/SDK/secretary/git verb into a 401 — the live pr_reviewer/i_am_idle signature-mismatch loop. Omit the header when the token is the UNSIGNED sentinel at all five agent-side header builders; dev accepts a missing token, prod 401s with 'Missing X-Agent-Token' (the clear respawn-with-secret signal). Add a structlog diagnostic on the middleware reject path so the next mismatch logs the exact (id, role, team, token_unsigned, auth_required) inputs. * [auth] Self-heal stale agent tokens at orchestrator startup A token is signed once at spawn. If ROBOCO_AGENT_AUTH_SECRET drifts afterwards (a .env change, a compose recreate that reloads the orchestrator's env without recreating agent containers, an image redeploy), the surviving agent keeps sending its old token and the middleware 401s every verb with 'signature mismatch'. The container stays alive heartbeating, so the reaper never reclaims it and no fresh agent spawns: the fleet stalls. _heal_stale_agent_tokens runs at startup (before _readopt_running_agents) and kills each running agent container whose baked-in token no longer verifies against the current secret, so normal dispatch re-spawns it with a freshly signed token. Inert when the secret is unset (dev): verify fails for every token without a secret, so the heal would kill the whole fleet without this gate. Best-effort: a probe failure leaves the container alone (the reaper still covers it). * [auth] Sign agent token over the UUID, not the slug (pr_reviewer 401 root cause) The token was signed over the agent slug (_append_agent_auth_env) while the MCP servers send X-Agent-ID as the agent UUID (_generate_mcp_config, since 453a7ae2 — gateway v1 parses X-Agent-ID as Annotated[UUID]). The middleware verified HMAC(uuid:role:team) against a slug-signed token → 'signature mismatch', token_unsigned=false. Latent for 2 months until 6ed4e139/53391f22 made the MCP servers forward the token. The c0328971 startup heal missed it: docker exec printenv reads the container-level ROBOCO_AGENT_ID (the slug), so the heal verified the slug-signed token against the slug → matched → didn't kill the stale container, which kept 401ing (its MCP server sends the UUID). Fix: sign the token over the UUID, set the container ROBOCO_AGENT_ID to the UUID too (so the SDK server — which inherits container env, not the MCP manifest env — sends UUID consistently), and resolve the container-env id to its UUID in _heal_stale_agent_tokens so pre-fix stale containers are evicted on next restart. Regression test: test_heal_kills_slug_env_container_with_slug_signed_token. * [scan] gate A2A/notification/stream agent-id deps under cloud auth (C1) * [scan] omit UNSIGNED agent token from MCP server headers (H1) * [scan] fail loud when cloud auth and nginx CEO-token are both armed (H2) * [scan] cache last-known-good auth-probe result in panel proxy (C2) * [respawn] Tripped breaker self-heals after a cooldown A DB-durable PM-respawn counter (migration 051 / e2f7097a) wedges forever once tripped: the only reset was a task status change, which can't happen while the breaker blocks the spawn. So a deploy that fixes the underlying loop (auth/prompt/schema) couldn't clear the wedge without manual DELETE surgery on respawn_tracker — the 2026-07-06 pr-reviewer-1 loop, where the auth fix cleared the 401 but count=63 survived restart and kept skipping the dispatcher spawn for an external-PR task. Freeze last_check at the trip tick and, after pm_respawn_trip_cooldown_seconds (default 300), let ONE spawn through. A still-wedged task re-trips after the threshold (bounded re-burn ~3 spawns per window); a fixed one advances and the status-change path fully resets. Restore re-stamps last_check to now, so a freshly restored row still trips immediately — durability preserved, which is why the migration-051 persistence tests still pass. * [scan] fix test_deps callsites for cloud-auth-gate signature change (C1 followup) * [scan] per-IP rate limit on /auth/login under cloud auth (L31) * [scan] Phase 1 auth/security fixes under 0.19.0 CHANGELOG * [scan] secretary token signs over real team (board) not empty — fixes /api/secretary/* 401 (L31-class) * [scan] LoginRateLimiter: key off X-Forwarded-For first hop + redis-down fail-open test nginx is the single entry point; request.client.host is the nginx peer IP, collapsing every external client into one limiter bucket (self-DoS amp). Read the downstream client IP from X-Forwarded-For (first hop) / X-Real-IP, falling back to the peer. Adds coverage for the XFF keying, the redis-down fail-open branch, and drops a redundant asyncio marker on a sync-TestClient test. * [scan] nits: describe login_max_attempts + replace cast with assert in get_current_agent_slug login_max_attempts was the only bare cloud-auth field; add a Field description matching the surrounding idiom. Replace cast('str', ctx.slug) with a runtime assert that fails loud if the cloud-auth ctx invariant breaks, and drop the now-unused cast import. * [scan] secretary token: use get_agent_team resolver + complete spawn-shutdown mock team (0dfd45ca followup) * [scan] require agent HMAC token under cloud_auth (close v1 flow/do header-trust) * [scan] _require_ceo accepts CEO session cookie under cloud_auth * [scan] HTTP require_panel_token accepts session cookie under cloud_auth * [scan] gate /api/settings behind panel token * [scan] gate unauthenticated /api read routes (agents/a2a-tasks/kanban/usage/rate-limits) * [scan] hoist deferred test imports to top-level (clear PLC0415) * [scan] Phase 1b e2e smoke + CHANGELOG * [scan] add_dependency rejects self-reference + cycle (M18) * [scan] WorkSessionService.create translates IntegrityError to ConflictError (H10) * [scan] _qa_or_doc_claim locks the task row FOR UPDATE (M19) * [scan] docs_complete + mark_pr_created lock the task row FOR UPDATE (H4) * [scan] gate complete() IN_PROGRESS on leaf/branchless only (H3) * [scan] _unclaim_from_blocked clears stale pre-block snapshot (H5) * [scan] admin_set_status terminal guard + skip revision bump under force (M20) * [scan] cell_pm_complete idempotent pre-check before merge (H7) * [scan] wrap gateway post-runner side effects in try/except (H6) * [scan] pass_qa/fail_qa accept AWAITING_QA only (L29) * [scan] mark_pr_created passes audit_agent_id (L30) * [scan] phase 2 e2e smoke - one scenario per finding * [scan] phase 2 quality gate ruff format + check: green mypy roboco/: green (357 files) pytest unit+integration: 6905 passed, 10 pre-existing DB-contamination failures (pass in isolation) e2e smoke: 11 passed, 4 cross-scenario workspace-contamination failures (all 6 state-machine scenarios pass individually) Quality-gate fixes: - move function-local imports to module top (PLC0415) - fix M19 regression: submit_for_qa clears active_claimant_id so the competing-claimant guard lets the QA claim through - fix H7 regression: _StubGit gains is_pr_merged_for_task - fix M19 unit tests: mock session.execute for the FOR UPDATE lock - e2e H3: notes >= 20 chars; e2e H5: rich i_will_work_on inputs + PM unclaims (block reassigns to PM) * [scan] move active_claimant_id clear into pass_qa/fail_qa + admin_set_status (M19 follow-on) Phase 2 opus whole-branch review found the M19 follow-on clear lived in the gateway wrappers (qa_pass/qa_fail) not the transition methods (pass_qa/fail_qa) themselves. The direct REST routes POST /pass-qa and POST /fail-qa call the transitions directly, bypassing the wrappers and leaving the QA's stale active_claimant_id set in AWAITING_DOCUMENTATION / NEEDS_REVISION — the competing-claimant guard then rejects the next legitimate documenter/QA claim. admin_set_status had the same gap for a non-blocked override into a review/queue state (IN_PROGRESS->AWAITING_QA left the dev's id, blocking qa_claim). Root-cause fix: move the clear INTO pass_qa and fail_qa (mirroring submit_for_qa), add a clear in admin_set_status when new_status in _REVIEW_QUEUE_STATES and from_status != BLOCKED, and drop the now-redundant clears + flushes from the qa_pass/qa_fail wrappers. Every caller is covered; the wrappers keep their actor-mismatch warnings. Covering tests: test_pass_qa_clears_active_claimant_for_doc_claim (asserts a subsequent doc_claim succeeds), test_fail_qa_clears_active_claimant, test_admin_set_status_into_review_queue_clears_active_claimant, test_admin_set_status_non_review_queue_keeps_active_claimant. Updated the two wrapper unit tests that asserted the wrapper clears (now the transition's job). * [C3] unindex_journal_entry + call from delete_entry JournalService.delete_entry deleted the DB row but never de-indexed the RAG chunks, so deleted/private journal content bled forever into RAG answers and claim-time briefings. Add OptimalService.unindex_journal_entry mirroring unindex_playbook (vector-store delete_by_source + tracking-row delete via get_db_context, both idempotent + best-effort), and call it from delete_entry after the row commit inside a try/except so a de-index failure never errors the delete. * [M25] learning_id hashes full content to avoid collision The memory distiller emits lessons with a fixed 'Problem: …' opening shape, so two distinct lessons whose first 100 chars match collided on learning_id = f"lrn-{md5(content[:100])[:12]}". replace_on_reingest then routed both to the same source URI and the second ingest's replace_chunks DELETE wiped the first lesson's chunks — silent data loss. Hash the full content (widening the hex slice 12→16) so distinct bodies get distinct ids and each retains its chunks. * [H13] reject non-internal local_llm_base_url at config load * [M28] bulk-insert learning broadcast instead of N+1 * [M27] mark_read/mark_all_read stamp only the unread rows seen at call time mark_read and mark_all_read used to zero the unread counter FIRST, then run a bulk UPDATE … WHERE read_at IS NULL that stamped every inbound unread row. A send_chat_message committing between the counter-zero and the UPDATE inserted a new read_at NULL row that the UPDATE then stamped as read — the new message was silently consumed while the counter stayed 0. Mirrors get_unread_messages (same file): SELECT the unread message IDs at call time, UPDATE exactly those IDs, then recompute the unread counter from the DB via the existing _reset_unread_counter helper. A message arriving mid-call is not in the selected ID set, so the UPDATE skips it and the recomputed counter keeps it unread. * [H12] dedup: exact to_agents predicate + purpose discriminator + ack DEL * [M23] playbook indexed_ok/indexed_at + startup reconcile of unindexed approved * [M24] RAG indexing dead-letter + janitor reclaim + failed_index_count health * [L23] institutional_memory_status sentinel distinguishes below-floor/empty/error/disabled * [L26] sweep_expired_notifications re-escalates stale unacked ack-required * [phase3] e2e smoke + CHANGELOG for 0.19.0 * [M24] _reindex_journal_entry honors is_private (C1 review fix) Dead-letter replay mirrors the original journal._schedule_rag_index path: a private entry is never indexed into the shared JOURNALS corpus, and a private learning is still recorded into LEARNINGS as non-shareable. Previously the replay always called index_journal_entry and skipped record_learning for private learnings, leaking private content on replay and dropping the legitimate non-shared learning. Three regression tests. * [H11] clone via git -c http.extraheader, not URL-embedded PAT * [H11] _sync_read_clone fetch via http.extraheader, not URL-embedded PAT Sibling site to the clone fix: the conventions read-clone refresh ran 'git fetch --tags <https://TOKEN@host> <branch>', exposing the PAT in the fetch argv on the orchestrator host. Mirrors the clone site's per-call '-c http.extraheader=Authorization: Basic …' prefix + bare URL. SSH URLs and tokenless public repos unchanged. * [H11] release_executor clone+push via http.extraheader; delete _inject_token_into_url * [H8] rebase_onto_base gates on clean tree like pull * [H9] _link_commit_to_task flushes, doesn't commit out-of-band * [M38] _pr_is_merged returns None on HTTPError; caller assumes merged * [M39] _cherry_unmerged_entry marker grep anchored to commit-prefix * [L1] thread actor_agent_id through update_pr_for_task * [H8] fix rebase test mocks for clean-tree gate H8 inserted a 'git status --porcelain' dirty-tree gate at the top of rebase_onto_base (mirroring pull). The 3 rebase control-flow tests mocked _run_git with a side_effect list matching the OLD call sequence (no leading status call), so every call shifted by one and the assertions missed. Prepend a clean-status result to each list so the gate passes and the fetch/checkout/reset/rebase/diff/abort/push sequence aligns. Verified: 16 passed (was 3 failed/13 passed post-H8, 16 passed pre-H8). * [L2] push --force-with-lease instead of bare --force * [L1] refresh stale workspace-resolution docstrings pr_target and _workspace_for_branch still documented the actor → assigned_to → created_by fallback chain that L1 removed from _resolve_workspace_agent_id. Update both to the post-L1 actor → assigned_to → None resolver (project.workspace_path as the final fallback) so a future reader doesn't rely on a fallback that no longer exists. * [M37] merge_pr locks the work_session row FOR UPDATE * [phase4] e2e smoke + CHANGELOG for 0.19.0 * [phase4] fix M37 test flake + document H8 skip The opus whole-branch review flagged the M37 concurrency tests as ~50% flaky: both asserted caller A wins the FOR UPDATE race, but which caller wins the lock is non-deterministic. When B won, the 'assert a_row.merged_by == a_merger' branch flipped false even though the production code (M37) was correct — exactly one merger recorded, audit trail intact. Assert the invariant instead: both rows COMPLETED, both report the same merged_by, value in {a_merger, b_merger}. Applied to both the unit test and the e2e twin. Also documents the H8 e2e skip in the module docstring (the report claimed it was documented there but it wasn't) and drops the internal 'Phase 4' label from the docstring header in favor of the public '0.19.0' version anchor. * [H24] wait_for_ci polls through the window on non-success * [H25,L34] release mutex orphan-sweep on start + shared redis client * [M1] tiktok _refresh commits rotated tokens in an independent session * [H25] drop new type:ignore in orphan-sweep test (constraint cleanup) * [M2] feature-spotlight re-arms when exploration stale past 2x interval with no live HoM spawn * [M6,M7] mark_seen after meaningful+project; persist since_id cursor in redis * [M3,M5] reject() guards COMPLETED; edited_body deferred into the single-flight lock * [M4] bound list_completed_video_tasks + ix_tasks_source_status_created index (migration 066) * [M8,M9,L9] pass head_sha to CI gate; _run_git 30s timeout; _commits_since split maxsplit 2 * [M10,L35] dedupe dep_update by (git_url, command); fold redundant per-project queries * [L36] gather ci_watch telemetry sweep instead of sequential iteration * [L11] document self_heal fingerprint is stable per-signal by design * [M11] engine-loop liveness watchdog: heartbeat + 2x-interval staleness alert * [M21] video render loop commits per-task, not one trailing commit * [M22] _detect_stuck_tasks skips held-CEO-source tasks * [L6] video_renderer_client._save writes temp + atomic rename * [phase5] e2e smoke + CHANGELOG for 0.19.0 * [M11] instrument x_mentions + roadmap engine loops with liveness heartbeats * [phase5] fix-wave: correct e2e M11 unit-test filename + strengthen failed-cycle heartbeat assertion * [C4] panel WS: shared /ws/system socket + long-tail retry + pong watchdog * [H15] video-post-queue caption derived per render (mirror x-post-queue) * [C4-fix] panel WS: discriminating long-tail tests + drop dead freeze block + evict dead shared conn on manual disconnect Finding 1 (Critical, websocket.test.ts): the two long-tail-retry tests fired onopen between close cycles, which reset reconnectAttempts to 0 each cycle, so they passed under the pre-fix 3-attempt gate. Rewrote both to NEVER fire onopen between closes, so attempts accumulates: test 1 asserts state stays 'reconnecting' past attempt 3 (old gate would flip 'disconnected' terminal); test 2 asserts a new socket is constructed within 30000ms at attempt 7 where uncapped 5000*1.5^7 ~= 85s (old uncapped code would leave the timer unexpired). Verified both FAIL on a reverted old-shape connection.ts and PASS on the fixed code. Finding 2 (Important, connection.ts): the 'if (raw >= cap) this.reconnectAttempts = exp' block was a no-op (exp was just read from the same field) and the unconditional increment afterwards grew the counter regardless. Deleted the dead block; kept the Math.min cap on the delay. Replaced the misleading ponytail comment with an accurate one: delay is capped, counter grows unbounded but delay is bounded. Finding 3 (Important, use-websocket.ts): manual disconnect() tore down the shared conn for all subscribers but left the dead (manualClose=true, never reconnects) entry in _sharedSockets, so a later mount hit the reuse branch, attached a subscriber, replayed 'disconnected', and never called connect(). Added a urlRef and _sharedSockets.delete(url) in the manual disconnect callback so a later mount reopens a fresh conn. * [H16] settings Save wired to settingsApi (persist + read back) * [H17] tasks page passes status/team/limit to useTasks (server-side filter) * [H18] useAgents roster re-derives on live-status change (statusEpoch in queryKey) * [M40] useMetrics reads agent counts from useAgentStatus cache (dedupe poll) * [H18] tighten useAgents statusEpoch comment (drop spec ref) * [M40] drop spec ref + tighten useMetrics comment * [M41] scorecard refetchInterval 60s -> 5min (25 req/min -> 5) * [M42] feature-flag off-transition confirm + pending-keys Set * [M43] X/TikTok credentials clear-behind confirm dialog * [M44] rate-limit syncFromApi merges (keep fresher hitAt) + A2A reconnect invalidation * [phase6] proxy.ts cookie-check comment + CHANGELOG Fixed entries * [phase6] drop stale WS pin-attempts comment + fix tasks-page lead-in * [H21] type DelegateRequest.estimated_complexity as Complexity (reject critical) * [H22] type SoftBlockRequest.resolver_type as BlockerResolverType (no silent AGENT fallback) * [H23] serialize TaskTable.documents into TaskResponse (DocRefResponse) * [L27] delete SubstituteRequest phantom suggested_role/suggested_team fields * [L14] Envelope.not_found defaults remediate (guide re-fetch + re-issue) * [L28] delete unused ListResponse generic (dead code; pagination deferred) * [H19] _delegate_static_guards allow cell_projects roots (cross-cell MegaTask) * [M13] MegaTask confirm-batch idempotency key from session_id (SETNX guard + result sidecar) * [M14] strip assigned_to from MegaTask drafts (no board-owned root-subtask deadlock) * [H20] thin_routes receiver-gate add/add_all/merge (no false block on set/cache.add) * [M16] tighten noqa code-capture to [A-Z0-9, ]+ (no false block on natural prose) * [M45] conventions read-clone force-refetch on read (no 30s stale map window) * [L25] conventions._resolve returns (root, sha); ORM mutated on the event loop * [M15] open_conventions_pr force-pushes disposable scaffold branch (no silent None) * [L24] roadmap cycle completion emits status-transition audit * [Phase7] CHANGELOG: 15 schema/conventions/MegaTask/API fixed (H21-H23,L27,L14,L28,H19,M13,M14,H20,M16,M45,L25,M15,L24) * [Phase7] lint gate hygiene: shorten docstring (E501), sort imports (I001), hoist AuditLogTable import (PLC0415) * [H14] Enable the GROK provider row in _apply_grok so routing reaches the GrokCliProvider * [M31] Route GROK active-token resolution to usage.json so live usage reflects grok agents * [M32] Pass cache read/write tokens to calculate_cost in the usage sweep so live cost reflects Anthropic cache spend * [M33] Park Ollama-Cloud rate limits via a marker map so a glm-5.2:cloud 429 parks instead of crash-respawning * [M34] Sweep orphan agent_spawn_sessions at startup so crashed-run tokens roll into usage/cost summaries * [L12] Persist revisit_resets (migration 067) so the PM-respawn breaker's revisit counter survives a restart * [L18] Date-gate the Sonnet-5 promo revert so billing returns to list rates after 2026-08-31 * [L20] Warn when ROBOCO_GROK_RUN_LOG yields no session id instead of silently falling back to a zero-usage env id * [phase8] CHANGELOG: LLM provider routing, usage capture, billing fixes * [phase8] Trailing ruff format hygiene (orchestrator marker tuples, token-sweep test signatures) * [phase8] Fix mypy: rename GROK-branch tokens var so transcript fallback stays reachable * [M35] Add an expiring agent-token format (iat/exp) with backward-compatible verify * [M35] Wire agent-token TTL at spawn (config + orchestrator + grok) so tokens are bounded * [M36] Add JWT jti claim and re-mint the sliding cookie only near expiry so a stolen cookie's exp is fixed * [M36] Redis jti revocation: read_token rejects revoked jtis and logout revokes the current jti * [phase9] CHANGELOG: bound agent tokens + sliding-cookie re-mint window + jti revocation * [scan-fix] mypy: type-annotate test files for make-quality gate CI's make quality runs mypy roboco/ tests/; the scan-fix program's local gate ran mypy roboco/ only, so test files were never type-checked. Fix all 67 errors across 23 test files with real annotations/casts/asserts/dead-code removal — no # type: ignore / # noqa added. * [e2e] Per-test DB isolation + dispatcher re-claim before PM complete * [scan] Regenerate verb tables for delegate Complexity type * [scan] Reduce 9 xenon C-ranks to B (auth, orchestrator, gateway, services) * [scan] Restore short-circuit time.time() in verify_agent_token (security path) --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-07 10:09:23 +02:00
3 people	60c64c70e8	fix(run-hardening): break PM decision-gate, stale-agent, and empty-diff loops (#255) ... Forensic triage of a 24h run reconstructed the dominant gateway.rejected loops from the audit_log. After earlier deploys fixed the i_will_plan crash and the open_pr push-gap, three real, recurring-capable burn loops remained. This fixes them at the architecture level, not by prompt-nagging. journal:decision write-then-gate (the dominant completion-path blocker): PM decision-point verbs required a separate note(scope='decision') call before the verb, which loaded/weak models forget to chain — so complete and unblock hit a tracing_gap (journal:decision missing) and respawn-looped, stranding finished tasks forever. Each verb now auto-records its OWN rationale as the journal:decision before the gate runs (the proven i_am_blocked -> write_struggle pattern), so the gate passes off real, persisted reasoning. unblock gains a required `reason` (threaded MCP tool -> request schema -> routes -> choreographer); delegate derives the decision from its title + description; complete/submit_up/submit_root/escalate_up/ escalate_to_ceo reuse their existing notes/reason. The gate still runs as defense-in-depth; the auto-record is idempotent within the decision window and best-effort. Adds JournalService.write_decision and Choreographer._ensure_pm_decision. open_pr empty-diff 422: an overlapping-decomposition leaf with zero commits vs its base makes GitHub 422 "No commits between ...". The generic invalid_state "retry" looped the dev 15x on one task. open_pr now steers to a terminal i_am_blocked hand-off so the PM completes or cancels the redundant leaf. owns_task stale-agent loop (41x): a superseded agent (task reassigned away) calling i_am_done/open_pr got a PRECONDITION_OWNERSHIP tracing_gap it read as a fixable precondition and retried forever. Both verbs now short-circuit with the clear not_authorized "no longer yours -> give_me_work" steer that resume/unclaim already use. RAG docs updated for the new unblock(reason) signature; CHANGELOG entries added under 0.11.0 (unreleased). open_pr refactored into _open_pr_preflight_rejection + _open_pr_failure_env to stay within the return-count and complexity budgets. Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-25 01:07:05 +02:00
Renn F	41ef7f6b4e	feat(gateway): C8 PM-decision gate windowed satisfaction ... _check_pm_decision_required now requires the latest journal:decision within pm_decision_window_seconds (default 300). Older decisions no longer satisfy the gate. Adds JournalService.latest_decision_at. Future-tighten (out of scope): per-verb-group consumption tracking would need persistent state — Choreographer is per-request today.	2026-05-12 06:27:33 +02:00
3 people	62bda0c497	Gateway/full (#9) ... * chore(gateway): scaffold gateway package and test layout * feat(config): add gateway feature flags, coordination thresholds, commit-validator settings * feat(gateway): add standardized response envelope with ok/error variants * feat(gateway): add remediation hint catalog for tracing-gap and invalid-state errors * feat(gateway): add per-role flow/do tool catalog with developer, qa, doc, pm, board configs * feat(db): add gateway columns — active_claimant_id, heartbeat, pre_block snapshot, acceptance_criteria_status, qa_evidence_inspected * feat(db): create gateway_triggers table for dispatcher decision logging * feat(db): align canonical skill set; substitute qa_review -> code_review across agent seeds * fix(db/008): make skill alignment in-place + idempotent; preserve column and existing custom skills * feat(gateway): add claimant_lock for single-active-agent invariant with heartbeat staleness * feat(gateway): add trigger_filter with stale-cleanup, claimant-queue, and cooldown rules * feat(gateway): add tracing_gate with plan, progress, journal, acceptance_criteria, qa requirements * refactor(gateway): drop per-file ruff ignores; refactor tracing_gate with dispatch table + GateContext * feat(gateway): add merge_chain to resolve PR target by branch hierarchy depth * feat(gateway): add commit_validator with min-length, banned-words, and conventional-shape hints * feat(gateway): add evidence_builder for verb-response evidence and capped context_briefing * feat(gateway): add Choreographer skeleton with per-phase verb signatures and DI protocols * feat(runtime): add spawn_manifest builder for per-role pre-loaded tool registration Introduces SpawnInputs dataclass + build_for_role(inputs) + write_manifest() in roboco/runtime/spawn_manifest.py; reads role_config for allowed verbs/tools, emits JSON manifest that SDK shim reads at container startup to eliminate ToolSearch. * feat(runtime): wire gateway pre-spawn check (trigger_filter + claimant_lock) into orchestrator behind ROBOCO_GATEWAY_ENABLED flag - Add GatewayTriggerTable SQLAlchemy ORM model to roboco/db/tables.py (matches existing table from migration 007_gateway_triggers_table) - Add module-level gateway_pre_spawn_check() + helpers to orchestrator.py (gated: returns ("spawn", "gateway disabled") immediately when flag is False) - Wire gateway check into _safe_spawn() — the single dispatcher choke-point for all agent spawns; QUEUE or DROP outcome logs and returns None (no spawn) - ROBOCO_GATEWAY_ENABLED defaults to False; legacy behaviour is unchanged * feat(agent_sdk): load tool-manifest.json at startup behind ROBOCO_GATEWAY_ENABLED flag (no agent-visible change yet) Adds load_tool_manifest() to the SDK server that reads env at call-time so gateway-enabled agents can obtain their pre-registered tool list at startup; returns None when the flag is off, leaving the legacy briefing path completely unchanged. * fix(optimal_brain): skip indexing when source ID is None to eliminate roboco://journals/None spam - Add `build_doc_source(kind, id_)` module-level helper in indexes/base.py that returns None when id_ is None instead of producing a "roboco://journals/None" URI - Update abstract `build_source_uri` return type to `str | None` so subclasses can legitimately signal a missing ID - Short-circuit `ingest()` and `_prepare_docs_for_batch()` in BaseIndexPlugin when `build_source_uri` returns None (debug log, no push to vector store) - Fix JournalsIndexPlugin.build_source_uri: `kwargs.get("entry_id")` returns the kwarg value even when it is None, so fall back to doc_id before calling build_doc_source - Fix ConversationsIndexPlugin.build_source_uri: return None when session_id is None rather than producing "roboco://conversations/None-unknown" - Add 9 unit tests with a piragi-free conftest that stubs sys.modules * fix(agent_sdk): inject X-Agent-ID header on notification-poller requests Both `_check_pending_a2a` and `_auto_ack_a2a_notifications` in `roboco/mcp/a2a_server.py` were calling the main API without identity headers, causing orchestrator `Missing X-Agent-ID header` warnings on `GET /api/v1/notifications/pending-a2a` and the ack-a2a POST. Add module-level `AGENT_ROLE` constant (mirrors the existing `AGENT_ID` pattern) and pass `{"X-Agent-ID": AGENT_ID, "X-Agent-Role": AGENT_ROLE}` on both requests. * fix(git): use ROBOCO_PUBLIC_BASE_URL for commit-trailer Links instead of hardcoded localhost * fix(test_runner): call uv run pytest/ruff directly; add make to orchestrator Dockerfile as backstop FileNotFoundError was propagating as a raw 500 when a project had `make test` configured but make was not installed in the orchestrator container. Two fixes: 1. Catch FileNotFoundError in _run_command and re-raise as ValidationError (400) with a clear message telling the operator to reconfigure the project command (e.g. replace 'make test' with 'uv run pytest'). 2. Add `make` to the orchestrator Dockerfile runner-stage apt-get so projects that legitimately use make targets continue to work without reconfiguration. * fix(api/git): resolve project by slug or UUID in git_log endpoint Add _resolve_project_slug() helper to git routes that tries UUID lookup first and falls back to slug, matching the pattern already used in project routes. Apply to all four read-only git endpoints: status, log, branches, diff. * fix(a2a): auto-create conversation when conversation_id absent; reject empty IDs in URL builder * fix(agent_sdk): default subagent model to parent agent's model from spawn manifest, not hardcoded haiku Inject CLAUDE_CODE_SUBAGENT_MODEL env var into every agent container at spawn time. Claude Code ≥2.1.x reads this variable to override the default Task (Agent) subagent model, which otherwise hard-codes claude-haiku-4-5-20251001. When the parent runs on a non-Anthropic provider (e.g. Ollama Cloud / minimax-m2.7:cloud) that Anthropic model is unreachable, so subagent dispatch fails. The value follows the same provider-aware translation already used for the --model CLI flag: Anthropic short names go through MODEL_MAP, and non-Anthropic identifiers are passed verbatim. To avoid calling the class by name inside a @staticmethod, the shared translation logic is extracted to the module-level _resolve_agent_cli_model() helper; _resolve_cli_model() now delegates to it. Verified: CLAUDE_CODE_SUBAGENT_MODEL is present and honoured in the Claude Code 2.1.123 binary (grep confirmed the env-var lookup pattern `if(process.env.CLAUDE_CODE_SUBAGENT_MODEL) return KK(…)`). * chore(makefile): add quality and quality-fast targets composing every PR gate * chore(quality): add import-linter dependency and gateway boundary contract * test(property): scaffold tracing-completeness assertion (filled in Phase 4) * Format test file to pass ruff check * fix(gateway): drop Protocol scaffolding from choreographer skeleton; del-statements on unused stub args; clear vulture whitelist * linting * feat(gateway): Phase 1 dev cutover — ChoreographerDeps + give_me_work Add ChoreographerDeps frozen dataclass (7 deps: task, work_session, git, a2a, journal, audit, evidence_repo), refactor Choreographer.__init__ to accept the bundle, implement give_me_work + _briefing_for via evidence_builder.build_context_briefing, and add property accessors for all deps. All Phase 2-4 stubs gain del-statements and still raise NotImplementedError. 3 tests added and passing; mypy/ruff/vulture clean. * feat(gateway): implement i_will_work_on handling pending, claimed, and needs_revision recovery * feat(gateway): implement i_have_committed with plan-required precondition Replaces the NotImplementedError stub with the real implementation: looks up the agent's active task, enforces plan presence before recording, calls task.add_progress, and returns a structured Envelope. Adds 3 unit tests (records progress, no active task → invalid_state, no plan → tracing_gap). * feat(gateway): implement i_am_done with smart catch-up and skill resolution * feat(gateway): implement i_am_blocked (struggle + escalate) and i_am_idle (with unread soft-block) * feat(gateway): add ContentActions for commit, note, say, dm, evidence with auto-inject and validation * feat(api/v2): add /api/v2/flow/dev/* endpoints delegating to Choreographer Six intent-verb endpoints (give_me_work, i_will_work_on, i_have_committed, i_am_done, i_am_blocked, i_am_idle) under /api/v2/flow/dev/, each a thin handler that delegates to Choreographer. Includes Pydantic request schemas, EvidenceRepo Phase 1 stub (all methods return []), get_choreographer FastAPI dep wired with all 7 service deps, and 8 unit tests (all passing). * feat(api/v2): add /api/v2/do/* endpoints for commit, note, say, dm, evidence * feat(mcp): add roboco-flow MCP server for intent verbs (Phase 1: dev verbs implemented) * feat(mcp): add roboco-do MCP server for smart-wrapped content tools * feat(runtime): mount per-agent tool-manifest.json on developer-container spawn; gateway flag enabled for devs only * docs(prompts): rewrite developer role prompt for gateway-only verbs (~15 lines vs 49) * chore(mcp): confirm dev manifest excludes legacy task/journal/notify/a2a tools (Phase 1 cutover; servers retired in Phase 4) * feat(gateway): implement claim_review with inline evidence (kills #15) and qa_evidence_inspected tracking * feat(gateway): implement pass_review with qa_notes/learning/evidence tracing gates * feat(gateway): implement fail_review with issue list, tracing gates, and dev A2A handoff * feat(api/v2): add /api/v2/flow/qa/* endpoints (claim_review, pass, fail, give_me_work, i_am_idle) * feat(mcp): add QA verbs (claim_review, pass, fail) to roboco-flow MCP server * docs(prompts): rewrite QA role prompt for gateway verbs; explicitly warn against grep-the-commit anti-pattern * feat(runtime): enable gateway flag for QA-role spawns (Phase 2 cutover) * feat(gateway): implement claim_doc_task and i_documented with file-list and notes-min-chars gates * feat(gateway): implement triage (cell PM) and triage_all (main PM) with priority order * feat(gateway): implement unblock with pre_block_state restoration (kills #23) * feat(gateway): implement cell_pm_complete with auto-merge to parent branch (kills #22 for cell scope) * feat(gateway): implement main_pm_complete (open master PR + escalate to CEO) * feat(gateway): add complete() dispatcher routing to cell_pm_complete or main_pm_complete by role * feat(gateway): implement escalate_up routing by role.escalation_target * feat(api/v2): add /api/v2/flow/{documenter,cell_pm,main_pm}/* endpoints * feat(mcp): add Doc + PM verbs to roboco-flow MCP server (claim_doc_task, i_documented, triage, triage_all, unblock, complete, escalate_up) * docs(prompts): rewrite Doc, Cell PM, and Main PM role prompts for gateway verbs * feat(runtime): enable gateway flag for Doc, Cell PM, and Main PM roles (Phase 3 cutover) * test(integration): full pending->awaiting_ceo_approval test through dev/QA/doc/cell-PM/main-PM gateway path * chore(tests): rename unused args to _args in flow_server tests Cleared RUF059 lint blocker for Phase 3 closeout. The destructured args was only consumed in URL-asserting tests; one variant only checks kwargs["json"], so its args is now _args. * chore: untrack docs/superpowers/ + add to .gitignore Plans + spec were inadvertently swept into commits 5d41a4b and de0c5b5 by subagent 'git add -A' calls. Removed from index and gitignored going forward; files remain on disk for ongoing reference. They still exist in history of those two commits — invoke a follow-up filter-repo if a full purge is desired. * feat(gateway): implement Board escalate_to_ceo with role allow-list Allows main_pm, product_owner, and head_marketing to escalate tasks to CEO. Enforces awaiting_pm_review state and journal:decision tracing gate. Closes Phase 4 Task 1. * feat(gateway): implement board_triage prioritizing strategic root tasks Adds Choreographer.board_triage and TaskService.list_strategic_for_board. PO and Head Marketing get curated lists of strategic-nature root tasks in awaiting_pm_review. Closes Phase 4 Task 2. * feat(gateway): implement auditor_triage surfacing long-running blocked-task anomalies Adds Choreographer.auditor_triage and TaskService.list_long_running_blocked. The Auditor surfaces tasks blocked >30min as anomalies for reflect-note observation. Closes Phase 4 Task 3. * chore(tests): add return + arg type annotations to gateway tests All gateway test functions now have -> None and parameter annotations. Cleared 63 mypy [no-untyped-def] errors that pre-existed since Phase 1. Mypy now clean across tests/unit/gateway/. * feat(api/v2): add /api/v2/flow/{board,auditor}/* endpoints Board: triage, escalate_to_ceo, i_am_idle. Auditor: triage, i_am_idle (read-only role). Adds EscalateToCeoRequest schema with reason min_length validation. Closes Phase 4 Task 4. * feat(mcp): add Board + Auditor verbs to roboco-flow MCP server Adds escalate_to_ceo MCP tool used by Board (PO + Head Marketing) and Main PM. Updates the implemented set in _validate_role_compatibility. Auditor uses the existing triage tool with role-routing in URL. Closes Phase 4 Task 5. * docs(prompts): rewrite Board (PO, Head-Marketing, Auditor) prompts for gateway verbs All 3 board identity files + roles/board.md now use the slim, gateway-aware shape (no ToolSearch directive, no state-tool table). Auditor is explicit about its read-only scope. Closes Phase 4 Task 6. * feat(runtime): enable gateway manifest for ALL roles (Phase 4 cutover) Adds product_owner, head_marketing, auditor to GATEWAY_ENABLED_ROLES. Every spawned agent now gets a gateway manifest mounted at /app/tool-manifest.json. The legacy briefing path is dead. Closes Phase 4 Task 8. * test(property): implement tracing-completeness assertion across smoke-test batch Replaces Phase 0 stub. Asserts the 6 tracing-contract requirements on every completed task: audit_log agent_id non-null per state-transition row, DEVELOPER:TASK_REFLECTION journal entry, QA:LEARNING journal entry, CELL_PM/MAIN_PM:DECISION_LOG journal entry, acceptance_criteria_status covering every criterion with a referencing_artifact_id, and qa_evidence_inspected = true. Uses an in-memory ephemeral Postgres test DB (`roboco_test_<pid>_<rand>`) provisioned per pytest session, not SQLite — the production schema relies on Postgres-only types (UUID, ARRAY) the SQLite dialect cannot compile. Tests requesting db_session/smoke_test_batch are auto-skipped when no Postgres is reachable on localhost:5432; ROBOCO_TEST_DB_HOST/PORT/USER override the endpoint. Schema is built via Base.metadata.create_all + manual ALTER for the acceptance_criteria_status / qa_evidence_inspected columns, NOT via `alembic upgrade head`. This sidesteps two pre-existing layer-drift items that block any fresh migration run today: 1. Migration 001 declares the agentrole Postgres enum with lowercase values (qa, developer, ...) but the SQLAlchemy ORM binds Enum(AgentRole) to the StrEnum's uppercase NAMES — production DBs mask this by being bootstrapped via create_all and stamped at 001. 2. Migration 008 runs UPDATE agents SET skills WHERE id over an agents.skills column that no migration in this chain ever creates. Documented in conftest.py so a future migrations cleanup can find them. Also notes that acceptance_criteria_status/qa_evidence_inspected are in the DB schema (per migration 006) but are NOT mapped on the ORM TaskTable nor on the Pydantic Task model — services that read them via `task.qa_evidence_inspected` rely on those values being set on raw rows. The property test uses raw SQL to read the columns directly, matching the DB-level contract. Closes Phase 4 Task 11. Side change: pyproject.toml — adds asyncpg.* to the existing [[tool.mypy.overrides]] ignore_missing_imports list (asyncpg ships no py.typed marker), matching the convention used for redis, anthropic, piragi, etc. Test count: 1; backend: Postgres (localhost test DB). * style(mcp/flow_server): single-line _post call after format pass * fix(db): map 7 gateway columns from migration 006 to TaskTable + Task model active_claimant_id, last_heartbeat_at, pre_block_state, pre_block_assignee, pre_block_metadata, acceptance_criteria_status, qa_evidence_inspected: present in DB since migration 006 but absent from the ORM mapping. Gateway code (tracing_gate, choreographer, claimant_lock) reads these via task.<attr>; without the mapping, runtime would AttributeError. Closes PHASE4-BUG-A. * fix(db): repair alembic chain — neutralize 008, add 009 enum reconcile, ORM uses values_callable Three coordinated changes that close PHASE4-BUG-B: 1. roboco/db/tables.py — introduce _str_enum() helper that wraps Enum() with values_callable=lambda obj: [m.value for m in obj]. Apply to all 23 StrEnum-typed mapped columns. ORM now serializes by .value (lowercase) to match alembic 001's declared enum values; default Enum() was using .name (uppercase) which never matched. 2. alembic/versions/008_align_skills.py — replace with documented no-op. The original migration referenced agents.skills, a column that has never existed in any migration (the agents table has capabilities, not skills). The substitution intent (qa_review -> code_review) was already satisfied statically in roboco/agents_config.py. 3. alembic/versions/009_enum_reconcile.py — new migration that: - Adds missing enum values: agentrole.system, team.fullstack, taskstatus.quarantined. - Detects uppercase drift from a Base.metadata.create_all bootstrap and rebuilds agentrole/team/taskstatus enums with lowercase members + USING lower(col::text)::enum on every column referenced. No-op if already lowercase. Tests stay green: 281 passed. * feat(services): backfill 36 gateway-shaped methods for Choreographer The gateway Choreographer was wired to call methods that the underlying services did not expose. This adds them as thin wrappers + queries (most alias canonical methods; a handful are gateway-specific variants). TaskService — 26 methods: aliases (submit_verification, submit_qa, list_blocked_for_team, list_blocked_all_teams, list_awaiting_pm_review_for_team, list_assigned_for_agent), agent queries (agent_for, qa_agent_for_team, documenter_for_team, cell_pm_for_team, get_active_task_for_agent, list_paused_for_agent), triage queries (list_awaiting_main_pm_all, all_subtasks_terminal), state setters (set_plan, mark_evidence_inspected, mark_agent_idle), QA/Doc claim variants (qa_claim, doc_claim, qa_pass, qa_fail), PM completion (cell_pm_complete with merge_commit), unblock with state restore (unblock_with_restore), and escalation (escalate, escalate_up_to_role). Also adds GatewayAgentView dataclass that unifies DB and config-derived agent attributes. JournalService — 4 methods: existence checks (has_decision_for_task, has_learning_for_task, has_reflect_for_task) + write_struggle. GitService — 4 methods: branch-keyed entry points (create_pr, pr_merge, pr_target, diff) plus push_branch helper. Each derives project + workspace from the task that owns the branch / PR. WorkSessionService — 2 methods: files_changed + has_unpushed_commits. PR existence is the proxy for pushed (no per-commit push column). Choreographer: switched git.push(branch_name) call to push_branch() to dispatch to the new gateway-shaped helper. * test(services): unit tests for 36 gateway-backfill methods Adds happy-path + edge tests for every method added in the prior backfill commit. Total 61 new tests across: - tests/unit/services/test_task.py (36) - tests/unit/services/test_journal.py (8) - tests/unit/services/test_git.py (10) - tests/unit/services/test_work_session.py (7) Each test mocks at the session boundary (no DB) and stubs adjacent service methods via a dynamic _bind helper to avoid mypy [method-assign] noise without resorting to type:ignore comments. * test(gateway): switch dev catch-up assertion to push_branch The Choreographer's catch-up sequence was renamed from git.push(branch) to git.push_branch(branch) when GitService got a gateway-shaped helper in the prior commit. This updates the existing assertion to match. * feat(mcp): add roboco-git-readonly server with status/log/diff/branches Slim FastMCP server exposing the four read-only git tools every role needs (status, log, diff, branch_list) by forwarding to /api/v1/git/* on the orchestrator. Replaces the read-only half of the legacy roboco-git server; write operations now go through gateway verbs in roboco-flow / roboco-do. The endpoint shapes mirror the panel-facing API (project_slug, include_remote, staged/file_path) so the same backend handlers serve both human and agent traffic. * refactor(mcp): delete legacy task/journal/notify/a2a/message/project servers Phase 4 cutover: agents now reach every state-changing surface through the gateway (roboco-flow intent verbs + roboco-do content tools), with roboco-git-readonly + roboco-optimal + roboco-docs covering reads. The seven legacy MCP servers + their handler trees are dead code from the agent side, so they're removed: roboco/mcp/task_server.py (1020 LOC) roboco/mcp/journal_server.py (512 LOC) roboco/mcp/notify_server.py (440 LOC) roboco/mcp/a2a_server.py (790 LOC) roboco/mcp/message_server.py (682 LOC) roboco/mcp/project_server.py (667 LOC) roboco/mcp/tasks/ (handlers+utils) (~4300 LOC) roboco/mcp/test/ (in-container runner; replaced by gateway evidence + manual smoke) roboco/mcp/git/ (full server; read-only half migrates to the new slim roboco-git-readonly module, write half is owned by gateway verbs) Orchestrator updates: - _generate_mcp_config registers only roboco-flow, roboco-do, roboco-git-readonly, roboco-optimal, and (for docs roles) roboco-docs. No more per-role legacy fan-out. - base_allow flips to mcp__roboco-flow__*, mcp__roboco-do__*, mcp__roboco-optimal__*, mcp__roboco-git-readonly__*. Role-specific allow lists are reduced to file IO scoping, since gateway verbs enforce role policy server-side. - TRACEABILITY_TRIGGER_TOOLS rewritten in terms of the gateway servers (mcp__roboco-flow__* / mcp__roboco-do__*) instead of the now-deleted per-tool list. Test fix: tests/unit/services/test_a2a.py imported _handle_send_chat_message from the deleted a2a_server. The four MCP-layer URL-builder tests (empty conversation_id guard) are dropped — the equivalent boundary now lives in /api/v2/do/* which has its own integration coverage. The two service-layer nil-UUID guard tests are kept; they exercise A2AService directly and remain meaningful (the panel still uses the v1 chat surface, where a buggy caller could pass the nil UUID). Net: ~9600 LOC removed from roboco/mcp/. quality-fast green: 338 tests pass, mypy clean, ruff clean. No /api/v1/* router changes — those endpoints stay live for the panel UI which still uses every lifecycle action; agents have no prompts that name them so the path is dead code from the agent side. * docs(claude.md): replace legacy MCP listing with gateway/verb-surface section Phase 4 cutover: agents go through roboco-flow + roboco-do (gateway), not the deleted task/journal/notify/a2a/message/project servers. Document the verb surface per role + the Envelope response shape so future Claude Code sessions land in the correct mental model. Closes Phase 4 Task 13. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-05-02 03:11:49 +02:00