Item B+C of the video/X per-project targeting spec, plus the
company_goals.company_name field they depend on (migration 075).
- CompanyGoalsService.resolve_product_name is the single fallback chain
(project name -> charter company_name -> RoboCo); XEngine and
VideoEngine both call it and their prompt builders are pure functions
taking product_name — release posts/videos stop hardcoding RoboCo.
- The X and video queue responses carry project_slug/project_name via one
shared unloaded-guard helper (api/schemas/project_fields.py); both
panel queues render a shared ProjectBadge so multi-project drafts are
tellable apart.
- Business -> Goals editor gains the company-name input.
- Fixes a pre-existing test-isolation leak: the company-goals routes test
commits the charter singleton into the session-scoped test DB and
polluted later suites; it now deletes the row on teardown.
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* feat(forge): Phase 0 — git_provider column + registration-time forge validation
Pointing a project at a GitLab/Gitea git_url used to fail silently, several
steps deep, at first PR. New pure policy module (foundation/policy/forge.py)
detects the provider from the git_url host and validates at the
ProjectService create/update chokepoint: github auto-detects and
auto-stamps, explicit git_provider=github is the GitHub Enterprise escape
hatch, gitlab/gitea are recognized-but-not-yet-supported, unknown hosts get
a loud rejection with guidance. An update changing git_url does NOT inherit
a stored auto-stamped provider (restating the override is required), so a
host swap can't smuggle the escape hatch past validation. Migration 075
adds the nullable projects.git_provider column; the panel project dialogs
show the detected forge. Phase 0 of the forge-providers spec.
* fix(panel): mock-mode forge detection extracts the real host
CodeQL js/incomplete-url-substring-sanitization: the substring check
matched github.com anywhere in the URL. Extract the hostname (URL parse
or scp-form regex, mirroring forge.py) and require an exact match.
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
GHSA-4f7g-w95g-5q2c (CVSS 9.8) — the default registry deploy ran in
header-trust mode: with ROBOCO_AGENT_AUTH_REQUIRED unset and cloud auth
off, require_panel_token / _check_agent_auth_token returned without
verifying a credential, so any client reaching the API could write
settings and claim X-Agent-Role: ceo with no token. Binding :8000 to
loopback (c4053d5f) closed the direct path but not nginx :3000, which
proxies /api/ to the orchestrator and passes client X-Agent-* through.
Root cause: header-trust is the default even in production. _auth_required
now fails closed when settings.environment == production (the registry
compose already declares it) — an explicit false still opts out for a
trusted private network. The registry compose arms auth by default and
requires ROBOCO_PANEL_AGENT_TOKEN so nginx injects a valid CEO token and
the panel keeps working. The CEO's NAS deploy is unaffected: it runs
cloud auth, which already enforced tokens on every role.
The env-ladder change makes a parentless root consult the project head
rung before string derivation; on a bare AsyncMock the resolver probe
auto-materializes and returns a truthy mock. Stub it to None so the test
exercises the no-project string-derivation fallback its name promises,
matching test_merge_chain's pattern.
draft_release_post / draft_release_video accept a project_id and the
release-proposal approve hooks pass the proposal task's own project;
the spotlight companion video forwards the spotlight draft's project
into open_video_task — previously it always authored against the
deployment-anchor project's motion/ tree regardless of which project
the spotlight was about. Omitted project_id keeps the anchor-project
fallback, so single-project deployments are unchanged.
_pyproject_version read pyproject.toml with no error handling, so a
non-Python project failed the release-manager cycle every interval
forever. _project_version now probes pyproject.toml, package.json,
Cargo.toml, then a bare VERSION file; missing or unparseable manifests
are skipped and no manifest degrades to an empty version.
A parentless root's PR base / merge target now resolves through
resolve_parent_branch to the project's panel-configured head rung —
submit_root passed a hardcoded 'master', which on a main-default repo made
_ensure_base_on_remote silently create a spurious master branch and land
the assembled root PR there. Literal master survives only as the
no-project string-derivation fallback.
The #568 tests unpacked AsyncMock.await_args without narrowing its
Optional type and passed a SimpleNamespace where _format_task_detail
is annotated TaskTable. Narrow with the repo-standard 'assert
await_args is not None' and cast the fake task at the call sites.
* [e530aa5e] Diagnose and fix roboco-api CI failure (run 29629255153) (#561) (#562)
* [e530aa5e] fix(tests): narrow None before indexing validate_init_data() result in telegram_initdata self-check
CI run 29629255153 failed on mypy, not the historical pydantic-settings
issue (uv.lock already pins 2.14.2). The __main__ self-check block in
test_telegram_initdata.py indexed the dict[str, object] | None return
of validate_init_data() without narrowing away None first.
* [e530aa5e] docs(qa): document CI fix for mypy type narrowing in telegram_initdata test
Explains the root cause (mypy type error in __main__ block), the solution (None narrowing before indexing), and the safe pattern for future test self-checks that call functions returning optional types.
---------
Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech>
Co-authored-by: Backend Documenter <be-doc@roboco.tech>
* [0884b737] Diagnose and fix Python quality gate + e2e lifecycle smoke CI failures on PR #563 (#564) (#565)
* [0884b737] fix(tests): isolate ROBOCO_SDK_URL for scripted e2e-smoke agents
tests/e2e_smoke/harness.py already isolates ROBOCO_AGENT_TOKEN from the
host environment (the #503/#504 fix) but left ROBOCO_SDK_URL leaking
through. flow_server/do_server both default it to
http://localhost:9000 and forward every rejection there for the
per-verb circuit breaker; inside a real spawned agent container that
port is a live SDK loopback, so the breaker records genuine attempts
for the ephemeral test-agent IDs and trips circuit_open mid-test
(test_sandbox_on_demand.py::test_request_sandbox_guard_chain_over_real_api,
which deliberately causes 3 rejections in a row). Point it at a
guaranteed-refused loopback address so every environment gets the same
fail-open bypass a bare CI runner already gets by having nothing
listening on 9000 at all.
* [0884b737] docs(changelog): document e2e-smoke harness ROBOCO_SDK_URL isolation fix
Document the fix that isolates ROBOCO_SDK_URL in the ScriptedAgent harness to prevent the per-verb circuit breaker from leaking state into ephemeral test-agent identities when the e2e-smoke suite runs inside a live agent container. This ensures the suite passes consistently regardless of whether it runs on bare CI or inside a spawned agent.
---------
Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech>
Co-authored-by: Backend Documenter <be-doc@roboco.tech>
* [3b9a1771] Diagnose and fix ALL make quality + e2e-smoke stage failures on PR #563; confirm real CI green (round 3) (#566) (#567)
* [3b9a1771] fix(e2e-smoke): match real embedding dimension when seeding fake journal chunk
test_c3_deleted_journal_unindexed inserted a 4-dim placeholder vector
into chunks_journals, but the e2e stack's app lifespan eagerly creates
that table with the real settings.embedding_dimensions (1024) before
the test runs, so the insert failed with "expected 1024 dimensions,
not 4". Derive _SMOKE_DIM from settings.embedding_dimensions instead
of a hardcoded constant so the seeded vector always matches the
table's actual column width.
* [3b9a1771] docs(qa): document e2e-smoke embedding dimension fix in round 3 CI diagnosis
Recorded the root cause, solution, and pattern for the final e2e-smoke test failure found in comprehensive sandbox testing: the test seeded a 4-dim placeholder vector but the app's eager lifespan init created chunks_journals with the real 1024-dim embedding column. Updated _SMOKE_DIM to derive from settings.embedding_dimensions instead of a hardcoded constant.
---------
Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech>
Co-authored-by: Backend Documenter <be-doc@roboco.tech>
---------
Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech>
Co-authored-by: Backend Documenter <be-doc@roboco.tech>
_classify_check_runs counted any completed cancelled check-run as failing.
The push + pull_request double-trigger leaves cancelled same-name
check-runs on the same head SHA next to the surviving run's green, so the
pr_pass gate saw permanent red on a genuinely green PR. Keep only the
newest (highest-id) run per check name before classifying.
Two layers: generated agent settings now set includeCoAuthoredBy: false
(never set anywhere before, so the CLI nudged models into appending
'Co-Authored-By: Claude ...' to commit messages), and the commit verb
strips AI-attribution lines deterministically at the chokepoint every
provider routes through.
_SWITCHBOARD_SLUGS reused is_human_only_role (spawn semantics) and dropped
the CEO before can_a2a_direct — which allows CEO -> anyone — ever ran, so
the static pair matrix had no CEO pairs and a Renzo filter emptied the
switchboard. Only prompter/secretary/system are excluded now; CEO pairs
get their own 'CEO Direct' section (matrix 70 -> 93). Every switchboard
section header is now a collapse toggle (Radix Collapsible, default open).
* feat(panel): Journals joins the Agents hub as its third tab
* docs(map): Journals tab on the Agents hub; registry retargets
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
Both deploy composes published the orchestrator API on 0.0.0.0:8000, so any
host that could reach the machine hit the control plane directly — past nginx
and, in the default header-trust posture, with no credential: read/write
runtime settings and X-Agent-Role: ceo spawn/stop. nginx reaches the API over
the internal Docker network, so a routable host publish is never needed; bind
it to 127.0.0.1. On-host debugging and normal panel operation are unchanged;
off-host access must go through nginx + cloud auth.
* feat(panel): Agents hub — Fleet and Conversations tabs, /a2a redirect, DM quick-action
* fix(panel): validate deep-linked DM targets against roster and exclusions; re-arm the dm latch
* docs(map): panel entries for this wave
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* feat(panel): customizable Quick Actions on Overview — registry, defaults, persisted picker
* fix(panel): legacy bar actions join the quick-action defaults; empty state; persist-contract test
* docs(map): panel entries for this wave
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* feat(panel): Workstation card grids with persisted view toggle and sorting
* fix(panel): stable multiplier sort with cell-label fallback after adversarial review
* docs(map): panel entries for this wave
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* feat(motion): demo-register visual design bar, vendored craft references, catalog vocabulary index
* fix(motion): correct design-bar composition claims after adversarial fact-check
* docs(map,rag): design-bar, vendored references, and catalog index on the video-engine surfaces
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* feat(panel): Workstation page — Products and Projects as tabs behind one sidebar entry
* docs(map): workstation page, extracted views, and the local-filter scroll trade-off
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* feat(panel): session-start, 7d overview spend, and 30d business spend charts
* feat(panel): surface work sessions as a Git page tab (route was orphaned)
* feat(git): reap spent task branches and render previews at lifecycle chokepoints; guarded stale-branch sweep
* feat(panel): stale-branch cleanup button on the Git page
* fix(git,panel): cursor-resumable sweep, force-delete spent refs, local filter state
* docs(map,rag): branch/preview reaping, cleanup sweep, git-tab work sessions, wave-2 charts
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
A draft targeting a platform with no credentials could never complete:
the X leg posted and committed its id, the TikTok leg failed as
'transient', and the card sat pending in the CEO queue with retry
semantics that structurally cannot succeed. Unconfigured platforms are
now an explicit skip: the draft COMPLETES when every configured
platform has posted (detail names what was skipped), an approve whose
targets are all unconfigured refuses loudly instead of silently
completing, and genuine post failures keep their partial/retry
semantics. Re-approving a parked card clears it without re-posting
(the already-posted guard is covered by a dedicated test).
Verified: 32/32 test_video_post_service (3 new: skip-and-complete,
all-unconfigured refusal, re-approve recovery), ruff/mypy/xenon clean.
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
The 0.7.36 exact-pin landed via an npm install, which wrote a stray
package-lock.json and left pnpm-lock.yaml stale — the image build's
pnpm install --frozen-lockfile then correctly refused the spec
mismatch, blocking deploys. Lockfile regenerated with the Dockerfile's
own pinned pnpm@11.10.0 (resolves @hyperframes/producer@0.7.36 exactly,
frozen-lockfile install and the sidecar's node --test 15/15 verified
locally); the npm lockfile is removed — this package is pnpm-managed.
Playwright, the taste-skill design bar, and hyperframes were all
implemented — and each stopped one hop short of the hands doing video
work: playwright reached only fe-qa/ux-qa, the design bar's web-UI dials
actively pointed a video task at 'dense product UI -> motion 2-3', and
hyperframes' agent-facing doctrine never reached any agent. Three wires:
- vendor the official HyperFrames agent skills (hyperframes-core,
-keyframes, -creative) under motion/skills/ at a pinned upstream
commit (Apache-2.0, attribution headers; prose reflowed to house
style, re-vendor note in each header); README and the dev video
prompt block point at them
- register the playwright MCP for a ux-dev spawned onto a source=video
task (_is_video_authoring_spawn: fail-closed role/team/task-source
probe) so the composition author can watch their HTML live in a real
browser between renders — gating-only, agent-ux already bakes the
browser; QA gating unchanged, be-qa/ordinary ux-dev still excluded
- design bar video-mode override in the ux_ui team prompt: video tasks
are films, the web dials do not apply — use the cinematography bar
and the vendored doctrine instead
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
The vendor publishes seek-safe authoring doctrine as installable agent
skills (hyperframes-keyframes / hyperframes-creative / hyperframes-core);
its primary seek-safe primitive is GSAP tweens on window.__timelines —
the kit's CSS register is a house pattern and the clip-window rule is
its empirically-derived companion.
The release cuts read as static screen recordings: one 6s cursor glide
that then vanished, a locked-off camera, metronomic flat card fades. And
two renderer defects were silently wrecking every cut:
- @hyperframes/producer floated (^0.7.36, no lockfile — image builds get
whatever is latest): 0.7.60 fails EVERY render with "Cannot access 'rt'
before initialization". Pinned 0.7.36 exact and committed
package-lock.json so sidecar builds are reproducible.
- the producer's per-clip visibility scheduler runs on a clock that lags
~50% behind the encoded timeline on a 40s cut — the final frame showed
the authored ~18s state, so the tail scenes (bell card, toast, outro)
were silently missing from the MP4. This, not authoring, is why
rendered cuts kept losing their late scenes. Fix: clip windows are for
structural layers only (hero, panel frame, status); every beat rides
base-hidden styles + delayed CSS animations, which run on the true
clock. Verified frame-by-frame: all four cards, stats, toast, and
outro now land exactly on schedule in both cuts.
Craft, made reusable in the kit instead of per-composition heroics:
- kit.js choreographCursor: data-waypoints="t x y [click]; ..." generates
a multi-leg eased path with fade in/out, an idle-hand sway, and click
rings + glyph press dips — the cursor behaves like a hand, never pops
in, freezes, or blinks out
- kit.js choreographCamera: data-shots="t x y scale; ..." — push-ins
toward each beat's focal point, pull-backs for reveals, settle to end
- release-0.25.0 both cuts re-choreographed: the cursor is the CEO's
hand (settle on the intake while it types, ONE submit click, witness
each card completing, acknowledge the toast, exit off-frame); the
camera lives on every beat; springy card entrances replace flat fades
- motion/README.md gains 'Cinematography & rhythm' (shot-list-first, no
locked-off camera, verify motion with frame PAIRS) + the clip-window
rule; kit/README.md documents both engines; the dev video prompt block
carries the craft bar
Verified end to end through the real sidecar: both cuts render green,
32-frame strips read visually — cursor travels and clicks on schedule,
camera moves, every scene present. motion pnpm test 15/15.
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* feat(gateway): delegation detail-fidelity — details survive hand-off, both directions
Details thinned out at every delegation hop: a PM child task mapped to no
parent criterion was legal (coverage only surfaced at submit_up, after the
whole wave ran — a 12-subtask docs tree grew through 8 review rounds that
way, one child titled 'docs page and route wrapper' shipping only the
page), and QA could pass work on a gestalt read (a 4-scene video brief
shipped 3 scenes past every gate because the features existed only in
prose). Three chokepoint gates:
- delegate (down): every child must declare covers_parent_criteria
resolving against the parent's real acceptance criteria — no mapping or
an unresolvable ref rejects naming every offending child and the valid
criteria; the success envelope carries parent_ac_coverage
{covered, uncovered} so a wave-planning PM sees remaining gaps in the
same turn. Full coverage stays enforced at submit_up (waves stay legal).
- pass_review (up): mandatory criteria_verified — one {criterion,
evidence} entry per task AC, matched by the findings ledger's
id-or-exact-text matcher, evidence soup-checked and capped; rejects
naming the unverified criteria; entries render deterministically into
qa_notes as '[AC] <criterion> — verified: <evidence>' lines. The old
count-only ac_verdicts gate is superseded (arg kept for back-compat).
- video briefs (structured detail at origination): an enumerable feature
list (release highlights, or input_props.highlights carried onto a
reject re-author) becomes its own scene acceptance criterion, bounded to
the AC caps; a re-author without highlights carries the
feedback-addressed criterion instead.
Extracted findings.py's criterion matcher into shared unmatched_criteria /
uncovered_acceptance_criteria instead of duplicating it; criteria_verified
joins the WAF free-text exclusion set like findings/issues.
* fix(gateway): break the block/unblock wedge — four hardening fixes from the live PM loop
A cell task looped fe-pm/main-pm block/unblock for hours (10 cycles, 43
spawns): a transient GitHub API error resolving CI became an unwaivable
blocker finding whose own fix text said no code change was required, the
submit freshness guard then demanded a commit no finding called for,
escalate_up auto-blocked, and main-pm's correct recovery plan 422'd on
the approach length cap, degrading it to a bare unblock. Four fixes:
- pr_pass CI-unresolvable refusal is now explicitly transient-worded:
retry pr_pass shortly, do NOT pr_fail over a CI-status lookup error —
a platform blip is not a code finding
- submit freshness guard grants ONE unchanged-head resubmission per
head sha when the findings ledger has zero open rows (all addressed
without code changes) — stamped via the resubmit_unchanged_head
marker so the same head can never loop a second time
- unblock carries a flip breaker: block_flip_count marker, and at the
third flip a one-shot CEO notification flags the task as structurally
wedged (unblock itself still succeeds — the breaker signals, it does
not wedge recovery)
- i_will_plan's approach cap truncates at 800 chars instead of
rejecting — an over-detailed plan must never cost the PM its turn
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* fix(release): CI wait polls the prod rung; escape the header tooltip apostrophe
get_latest_ci_conclusion defaults to the ladder's head rung, so
wait_for_ci searched slave for a release commit that lives on master
and timed out after 40 minutes with the run already green. The wait
now passes the prod branch explicitly. Also fixes the
react/no-unescaped-entities error that turned master's Panel CI red.
* fix(panel,video): dead dialog triggers behind tooltips; dotted composition ids render
HelpTip nested inside a Dialog/AlertDialog trigger puts the trigger's
click handler on the Tooltip root, which renders no DOM — the agents
Spawn item and the KB Reindex-All / Delete-index confirms were dead.
Tooltips now wrap the triggers. The video renderer accepts interior
single dots in composition ids (release-0.25.0) with '..' still
unrepresentable, and propose_video refuses an unrenderable id at
authoring time.
* fix(dispatch): restart-safe PM review turns
A leaf task in awaiting_pm_review had no periodic pickup: the closure
dispatcher bailed on childless tasks and skipped PR-bearing review
tasks as already-promoted, assuming the submit-time PM session was
still alive — an assumption every restart breaks. Proven live on the
docs-sync leaf after the 0.25.0 redeploy, which also dependency-blocked
its sibling dev task. Childless awaiting_pm_review tasks now flow to
the PM's review turn, and the merge turn respawns its PM when none is
active.
* feat(video): verify the rendered artifact, not the source
The 14s release-0.25.0 cut shipped with only one of four scenes visibly
registering: the dev authored DOM, the smoke asserted DOM, QA read code —
nobody consumed the rendered MP4 before the CEO did. Close that loop, and
the reject loop behind it:
- sidecar frames mode: POST /render with frames=1..32 renders the cut,
ffprobes the REAL duration, extracts midpoint-sampled keyframe PNGs
(timestamps in filenames), streams a tar.gz back with X-Video-Duration
- request_render do-verb (developer/QA, request_sandbox's shape): renders
the caller's ACTUAL composition — dev's own worktree (head_sha/dirty
provenance), QA a read-only git-archive export of the assembled branch —
extracts frames to the container-shared .previews/ path, stamps the
render_preview marker, returns the paths as envelope evidence
- gate: i_am_done on a source=video task refuses without a stamped
render_preview (Requirement.RENDER_VERIFIED; canonical source string
moved to foundation as markers.VIDEO_TASK_SOURCE; mirrored in the
possibilities-matrix fast path so it cannot bypass the check)
- QA claim_review evidence carries video_context (composition id, the
dev's preview, a re-render instruction) so review checks output
- dev spawn prompt block + a 4th authoring AC order Read-every-frame
verification before submitting
- reject -> re-author: a CEO reject with a reason opens a fresh authoring
task carrying the verbatim feedback + a revise-in-place pointer at the
existing composition (best-effort, never fails the reject) — rejection
feedback no longer dies on the cancelled draft
E2E: rendered the committed release-0.25.0 composition through the new
frames mode locally — the returned keyframes show exactly the reported
failure (blank frame at 5.8s, only 'Env ladder' by 12.8s), the check the
fleet was missing.
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
