9 Commits

Include renames

Author	SHA1	Message	Date
3 people	7901ea419e	Retire channels/sessions/messages; A2A becomes primary agent comms (#306) ... * feat(a2a): deliver latest incoming message preview into the claim briefing list_unread_a2a now carries last_message_preview (the latest message from the OTHER agent, never the agent's own reply), fetched via a correlated subquery in the same query — no N+1 on the per-verb briefing path. * feat(a2a): read_a2a verb delivers unread message bodies to the agent A2AService.get_unread_messages returns the caller's unread INCOMING messages (never its own sends), marking exactly those rows read atomically so a message arriving mid-call is preserved. Wired as the read_a2a content verb (route + do_server tool + granted to every delivery role) — the content-bearing read the A2A inbox lacked (read_messages only zeroed the counter). * docs(rag): document read_a2a as the A2A content-read path * fix(task): backlog activation no longer requires a discussion session Removes the SessionTaskTable gate in activate() (and its dangling log field), deletes _inherit_parent_session + its create() call, and drops the now-unused SessionTaskTable import. Coordination rides task state; the session subsystem is being retired. Tests updated to the new (no-session) behavior. * fix(orchestrator): drop session sweep from _run_sweep Removes the messaging import + sweep_timed_out_sessions call. That import sat outside the try/except, so once messaging.py is deleted it would have killed the entire sweep cascade (budget kill-switch, token rollups, retention, image prune, superseded-PR reconcile). Notification sweep + all maintenance sweeps unchanged. * release-manager --no-tags read-clone fix * test: update evidence_repo unit test for a2a last_message_preview * refactor(gateway): drop session propagation on delegate Removes propagate_sessions_to_subtask from delegate(), the ChoreographerDeps messaging field + property, and the ChoreographerDeps messaging arg in deps.py (ContentActions messaging + import stay until the verbs are removed). Deletes the propagation test; strips the now-invalid messaging kwarg from ChoreographerDeps test builders. * refactor(gateway): remove say/open_session/link_session/channels verbs Removes the four channel/session verbs across content_actions (impls + ContentActionsDeps.messaging), do_server (tools + registry), role_config (grants + _CHANNEL_DISCOVERY), do.py (routes), schemas/v1/do.py (request models), and deps.py (MessagingService import + construction). Regenerates the prompt verb tables. dm/notify/read_messages/read_a2a stay. Tests deleted/updated accordingly. * uv.lock Upgrade * refactor: remove conversation RAG indexing; Secretary announces via notification Drops the CONVERSATIONS index (index_conversation, ConversationsIndexPlugin, IndexType.CONVERSATIONS enum, IndexConversationParams, mentor.py type-label, the messaging index hook) and its chunk-table manifest entries. The Secretary's ANNOUNCE/RELAY_MESSAGE now fan out a BROADCAST notification to every agent's inbox (NotificationService.broadcast) instead of posting to a dead channel. * fix(panel): label RAG health error lines by subsystem A red llm_error (e.g. the glm-5.2:cloud weekly-limit 429) rendered under the 'Embedding: ok' header with no label, reading as an embedding failure. Prefix each error line with LLM / Embedding / Vector store. * refactor: remove channel/message reads from metrics, dashboard, git, events MetricsService drops get_communication_volume + the MessageTable message-count in get_agent_metrics (and the now-dead messages_sent_week field). DashboardService drops get_channel_feeds/_compute_channel_status and the message read in get_recent_activity (task activity kept); get_auditor_metrics no longer reports communication_volume. GitService's two primary-session-id helpers always return None now (callers already treat None as "no primary session"). events/handlers.py drops the SESSION_CLOSED/SESSION_TIMEOUT subscriptions + the handle_session_boundary handler. Forced follow-on: api/routes/dashboard.py + api/schemas/dashboard.py dropped the now-dangling live_feeds/ChannelFeed surface and the /metrics/communication route, which wrapped the removed service calls directly (mypy would otherwise fail on the missing attributes). * refactor: delete MessagingService + channel seeding Edited db/__init__.py and services/__init__.py first (drop the unconditional Channel/Group/Message/Session table + MessagingService re-exports), then deleted services/messaging.py, then trimmed db/seed.py to only create_agents (create_channels/create_channel_memberships/create_initial_messages gone). Forced expansion: api/routes/{channels,groups,sessions,messages}.py import roboco.services.messaging directly (not through the package __init__), as does api/routes/tasks.py (the session-links embed on GET /tasks/{id} and the GET /{id}/sessions route). Deleting messaging.py without addressing these breaks `import roboco.api.app` immediately, since app.py eagerly imports all route modules at startup. Since the 4 CRUD route files are 100% MessagingService-backed with zero independent logic (and are wholesale deletes in the plan's later API-routes task anyway), deleted them now + unmounted from app.py/routes/__init__.py; tasks.py got the same surgical trim its later task already specified (drop session-links embed + TaskSessionLinkResponse/TaskResponse.sessions). This pulls a slice of that later work forward — the routes/schemas for channels/groups/sessions/messages still need their own pass, but their messaging-coupled parts are gone. Verified with a full-suite collection sweep (12010 tests collected, zero import errors) beyond the directly touched test dirs, given the expanded blast radius. * refactor: remove channel/session/message models, tables, and channel policy Models: deleted channel.py/group.py/session.py/messaging.py wholesale (zero external consumers besides the models/__init__.py re-export). message.py surgically trimmed: removed MessageCreate (dead) and MessageEdit (never instantiated; ExtractedMessage.edit_history retyped to list[dict[str, Any]] to match how it's actually persisted — confirmed ExtractedMessage was never written to any DB table, so MessageTable's removal carries no functional risk to the kept extraction pipeline). base.py: removed SessionStatus + ChannelType, kept MessageType. Also removed the confirmed-dead channels_read/channels_write fields from models/agent.py:AgentPermissions and models/dashboard.py:ChannelFeedData. db/tables.py: deleted ChannelTable/GroupTable/SessionTable/SessionTaskTable/ MessageTable, TaskTable.session_links, and JournalEntryTable.session_id — cascaded through models/journal.py, services/journal.py, and api/schemas+routes/journals.py (22 plumbing sites). foundation/policy/communications.py: removed the ChannelSpec/CHANNELS catalog + TEAM_SCOPED_ROLES/_CELL_*/_AUDITOR_ONLY helpers, kept the notification policy (Priority/parse_priority/NOTIFY_SENDER_ROLES/ ACK_REQUIRED_BY_TYPE). enforcement/channel_access.py deleted (confirmed fully dead in production). agents_config.py: removed CHANNEL_ACCESS (kept A2A_ALLOWED_PAIRS). seeds/initial_data.py: removed DEFAULT_CHANNELS/CHANNEL_MEMBERSHIPS/AUDITOR_SILENT_ACCESS + the never-consumed INITIAL_MESSAGES. config.py: removed session_idle_timeout_seconds (zero consumers). exceptions.py: removed dead ChannelError/ChannelAccessDeniedError/SessionClosedError. Forced expansion beyond the original file list — ChannelType cascaded into a live, mounted surface the plan didn't trace: agents_config. CHANNEL_ACCESS -> services/permissions.py's channel-RBAC methods (not models/permissions.py, which turned out to have no channel code at all) -> two real endpoints in api/routes/stream.py (GET /permissions, GET /permissions/channel/{name}) and two dependency factories in api/deps.py. Removed the channel methods + fields, deleted the channel-specific stream.py endpoint, deleted require_channel_read/write. Also deleted api/schemas/{channels,sessions}.py (hard dependency on the removed enums; already fully dead after the Task 10 route deletions) and api/schemas/messages.py (a TYPE_CHECKING-only import of the deleted MessageTable; likewise already fully dead) + its dedicated test file. Test updates: test_permissions.py -14 channel tests (matches the planned count exactly), test_communications.py / test_communications_consumers.py split to keep only notification-policy coverage, test_exceptions.py -9, test_deps.py -4, plus the journal/stream/foundation-smoke fallout. Also fixed a pre-existing (Task 7) broken assertion in test_foundation_phase3_smoke.py that inspected a `say()` method already removed from ContentActions. Verified: full-suite collection (11961 tests, zero import errors) and a complete test run (11567 passed, 394 skipped, 0 failed) in addition to the targeted suites. * migration: drop channels/groups/sessions/session_tasks/messages + enum types alembic/versions/060_drop_messaging.py: drop_column journal_entries. session_id (sidesteps hardcoding the FK constraint name — verified empirically against a live migrated DB that it's actually fk_journal_entries_session_id_sessions, but drop_column doesn't care either way); drop_table in FK order (messages -> session_tasks -> sessions -> groups -> channels); DROP TABLE IF EXISTS chunks_conversations (runtime-provisioned, not alembic-managed, would otherwise orphan); DROP TYPE IF EXISTS for messagetype/sessionstatus/sessionscope/channeltype (messagetype's Python enum stays for ExtractedMessage, but the DB type had zero live columns left once MessageTable was dropped in the prior commit). downgrade() raises NotImplementedError — one-way removal. Pruned scripts/reset_runtime_state.sql + .sh: removed the DELETE/COUNT lines for messages/session_tasks/sessions/groups/channels and the groups.active_session_id reset block. Verified end-to-end against a scratch Postgres DB: full migration chain 001->060 applies cleanly, alembic heads shows a single head, all 6 dropped tables + 4 enum types + the journal_entries.session_id column are confirmed gone, journal_entries keeps only its journal_id/task_id FKs, downgrade correctly raises NotImplementedError without corrupting DB state, and the pruned reset_runtime_state.sql runs clean (no errors) against a fully-migrated DB. * refactor(api): remove channel/session/message routes + WS streams Most of this task's file list was already forced through in earlier commits (routes/{channels,groups,sessions,messages}.py + app.py/__init__.py unmounting in the MessagingService-deletion commit; tasks.py's session-links embed + GET /{id}/sessions + schemas/tasks.py's TaskResponse.sessions in that same commit; deps.py's require_channel_read/ write + schemas/{channels,sessions}.py in the models/tables commit). This closes out what was left: - api/websocket.py: deleted the channel_stream + session_stream routes, ConnectionManager's channel_connections/session_connections dicts, connect_channel/connect_session, broadcast_to_channel/broadcast_to_session, get_channel_subscriber_count, and their cleanup lines in disconnect(). Agent streams, notification streams, and the operator system stream are untouched. - api/websocket_bridge.py: deleted _handle_session_event + _handle_message_event and their SESSION_CREATED/SESSION_CLOSED/ SESSION_TIMEOUT/MESSAGE_SENT subscriptions. The A2A live-view, rate-limit, usage, agent-lifecycle, and notification bridges are untouched. - api/schemas/websocket.py: removed NewMessageBroadcast, WSMessageNew, WSMessageEdit, WSMessageDelete, WSSessionClosed — kept the WSMessage base class (still subclassed by the kept WSAgentStream/WSNotification) plus those two. - api/schemas/groups.py: deleted (already fully orphaned since routes/ groups.py was removed; its GroupResponse/GroupDetailResponse had zero consumers). Updated the 5 websocket test files accordingly (removed the channel/ session-specific tests + fixed imports); test_websocket_bridge.py's registration-coverage test dropped the SESSION_*/MESSAGE_SENT assertions. Verified: full-suite collection (11943 tests, zero import errors) and a complete test run (11549 passed, 394 skipped, 0 failed). * docs: retire channels/sessions/messages from agent-facing docs + CLAUDE.md Rewrites docs/rag (RAG-indexed) + docs/map + CLAUDE.md to reflect A2A (dm + read_a2a) as primary agent comms; deletes the channel docs, splits messaging-tools + messaging-notification (renamed notification.md), swaps the WS worked example to A2A_MESSAGE_SENT. _complete_map.md still needs regeneration (generated file). * refactor(panel): remove Communications surface (channels/sessions) Deletes the /communications routes, message components, task-detail Sessions tab, use-channels + channel/session WS hooks, and the channels/sessions/messages/groups api clients; prunes the Channel/Session/Message/Group types + mock data. (Auditor live-feeds + dashboard.ts dead-route cleanup is a follow-up.) * refactor(panel): drop auditor channel-feed + dead communication-metric route * docs(map): regenerate _complete_map from updated slices * fix(a2a): reduce get_unread_messages complexity below xenon C + stale comments Extract the per-conversation unread-counter recompute into _reset_unread_counter (the CI quality gate flagged get_unread_messages as rank C). Also drop the deleted open_session from a content_actions comment and reword an evidence_repo docstring that cited the removed messaging._notify_mentions. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-04 03:10:33 +02:00
3 people	da563487b8	Wave 2 features: A2A live view (CEO chime-in + reply budget) and prompter memory (#297) ... * feat(a2a): live view — watch fleet conversations, CEO chime-in, reply budget A2A_MESSAGE_SENT published from A2AService.send (excerpt-capped) and fanned through the existing /ws/system bridge; CEO-only admin REST for conversations/messages + a reply route on the publish-bearing send path; panel /a2a page with live transcript and a composer gated on task-linked conversations. The matrix gains its one asymmetric rule: CEO may message anyone, nobody may target the CEO — and agent replies inside a CEO-opened conversation are hard-budgeted to one per CEO message (per conversation, per agent), rejected with wait-don't-retry guidance. Built subagent-driven (Sonnet 5), reviewed; v1 seams documented in the map delta. * feat(prompter): intake remembers the task history Intake spawns now carry a per-project chronological digest of recent tasks (capped: 15 lines/project, 4000 chars total — ~300-1000 tokens) merged into the ambient layer, and the interviewer gets a bounded search_past_tasks tool (one shared implementation behind the grok MCP tool and the Claude SDK in-process tool) to check precedent mid-conversation. Informational memory only — the sequencing analyzer keeps ownership of ordering. Built subagent-driven (Sonnet 5), reviewed; pre-existing conventions-ambient MegaTask-scope gap flagged, untouched. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-03 00:07:55 +02:00
3 people	df87fcf059	Chore/logical gaps element sweep fixes (#287) ... * [sweep] lifecycle: 6 confirmed gaps fixed (cancel-ceo-gate, claim_pr_review gate, needs_team_match, valid_next_verbs narrowing, pr_reviewer unclaim, complete side_effect ordering) * [chore] logical-gaps: route-layer force gate + privileged-field gate + pre-task audit attribution tasks.py (5 gaps): - _HATCH_OVERRIDE_STATES expanded to 7: a privileged PATCH INTO a gate state (completed/cancelled/awaiting_{qa,documentation,pr_review, pm_review,ceo_approval}) now requires explicit force — the panel hatch is no longer a quiet click that drops a task into/out of a human gate. - _RESURRECT_SOURCE_STATES: a privileged PATCH OUT of a terminal status (completed/cancelled) resurrects finished work and likewise requires force, audited as an override. - _PRIVILEGED_UPDATE_FIELDS gate: a bare task owner (UPDATE_OWN, no ASSIGN) cannot self-reassign / re-team / re-parent / re-depend / re-block / rewrite-plan / re-project its task — those structural fields are PM-gated; the REST surface must not bypass the verb-layer's reassign/delegate/triage gate. A 403 names the touched fields + the verb to use instead. - pre-task create denial: a role that cannot create tasks is now logged via log_task_creation_denial (distinct task_creation target_type + attempted payload) instead of a 'N/A' task_id that coerced to NULL and left the role-escalation attempt unattributable. audit.py: - split log_task_action_denial (5-param, under PLR0913) from log_task_creation_denial (4-param) — the create path has no task_id; the non-UUID sentinel (N/A) is preserved in details[target_id_raw] rather than dropped to a NULL target_id indistinguishable from any other NULL-target denial. tests: - test_tasks_routes.py: parametrized admin-override gate (force required for gate + terminal states, force succeeds). - test_tasks_route_privileged_fields.py: dev owner 403 on assigned_to/team/parent_task_id, 200 on dev-facing description. - test_audit.py: pre-task attribution via log_task_creation_denial + non-UUID sentinel preservation. * [chore] logical-gaps: kanban board column coverage + status-class fixes (6 gaps) models/kanban.py: - DEV_COLUMNS: cover all 15 lifecycle statuses (was 7; dropped BACKLOG, PAUSED, VERIFYING, NEEDS_REVISION, AWAITING_PR_REVIEW, AWAITING_PM_REVIEW, AWAITING_CEO_APPROVAL, CANCELLED). A dev whose task bounced to needs_revision or sits in a gate used to see their own task vanish. - PM_COLUMNS: add the gate/revision/paused/cancelled/backlog columns so the cell PM sees the QA->docs->PR-review->PM-review->CEO chain on its board. - QA_COLUMNS: drop the 'In Review'->VERIFYING mapping. VERIFYING is the dev's self-verification (task still with the dev, not with QA); it misrepresented dev mid-verification as active QA work. services/kanban.py: - _build_flat_board: add an 'Other' fallback column for any task whose status matches no configured column, so total_cards == sum(card_count) and no card is built-then-silently-dropped (the vanished-card leak). - get_qa_board: drop VERIFYING from qa_statuses (consistent with the column change). - get_documenter_board: scope to task_type=documentation so a dev IN_PROGRESS code task sharing the cell team no longer appears under 'Gathering'. - get_main_pm_board_flat: widen the status filter to include PENDING/CLAIMED/ COMPLETED and route those to the incoming/distributed/done columns, which were structurally always empty under the in-flight-only filter. tests/integration/test_kanban_service.py: parametrized coverage of every dropped dev status, PM gate/revision states, QA excludes VERIFYING, documenter excludes dev code tasks, flat Main PM incoming/distributed/done populated, and the 'Other' fallback invariant. * [chore] logical-gaps: lifecycle-enforcement validators + status-class fixes (5 gaps) enforcement/task_lifecycle.py: - drop the spurious VERIFYING->awaiting_documentation legacy edge. The canonical exit is submit_qa -> awaiting_qa -> (qa_pass) -> awaiting_documentation; the direct edge bypassed the entire QA review hop (ungated — no role gate existed for it). - is_waiting_state: add awaiting_pr_review. The PR-review gate parks the PM on the reviewer; it is a waiting state. The hard-coded set was never updated when AWAITING_PR_REVIEW was added to the enum, so the gate status was miscategorized as active. foundation/_validate_lifecycle.py: - _check_status_enum_coverage: replace the tautology (STATUS_GRAPH keys every Status by construction) with a real bidirectional check — every non-terminal Status is the source of a transition (catches orphan states), and every source/target referenced is a real Status member (catches stray-string targets). - _check_terminal_exits: split the {COMPLETED, CANCELLED} reachability into a COMPLETED-path requirement + a cancel-exit requirement. The cancel fan-out made the old check structurally trivial — a status whose sole exit was cancel passed with no real forward completion path. - _check_status_enum_parity (new, registered): cross-check spec.Status against models.base.TaskStatus at import so the ORM column type and the lifecycle map cannot drift (TaskType had this guard; Status did not). tests: verifying->awaiting_documentation rejected, self-fail preserved, awaiting_pr_review is waiting, mutually-disjoint classification invariant, status enum parity, stray-string-target / orphan-source / cancel-only-exit validator rejections. * [chore] logical-gaps: stream-bus poison-pill ACK + dead-letter, periodic reclaim, cancelled-handler marker cleanup (3 gaps) stream_bus.py: - _handle_message isolates Event.from_json in its own try/except; an undecodable payload (unknown EventType, bad UUID/timestamp, malformed JSON) is dead-lettered then ACKed instead of falling through to the broad except that only logged — a poison pill stayed pending forever and re-failed on every reclaim. (gap: stream-bus-malformed-event-poison-pill) - _reclaim_loop spawned alongside _listen_loop in start_listening (cancelled in disconnect). XREADGROUP '>' delivers only NEW messages, so a runtime handler failure left its message pending and unretried until a restart; the loop re-runs recover_pending every 60s so the idempotency-guarded replay actually fires. (gap: stream-bus-no-runtime-reclaim-loop) - _run_handler_guarded marker cleanup catches BaseException so a handler cancelled mid-flight (asyncio.CancelledError is BaseException-derived since 3.8) clears its SET-NX marker; otherwise the guard suppressed the very redelivery that would complete the work. (gap: stream-bus-cancelled- handler-keeps-idempotency-marker) TDD: 4 red->green tests in tests/unit/events/test_bus.py. * [chore] logical-gaps: verb_runner trailing-None side-effect guard + actor_agent_id threading (3 gaps) _verb_runner.py: - run_intent skips the side_effects loop when a TRAILING composed action returned None (its source-status check failed under a concurrent transition). Previously the loop ran unconditionally on the None task and _do_push_branch(None)/_do_pr_merge(None) crashed with a NoneType AttributeError, turning the clean INVALID_STATE the entry/intermediate guards give into a 500/respawn loop. The trailing None now flows to the caller's `if task is None` handler. Latent today (no shipped intent has both a None-capable compose and trailing side_effects) but the runner is generic. (gap: runner-side-effects-fire- on-trailing-none-task) - _do_push_branch / _do_create_pr / _do_create_root_pr forward actor_agent_id=agent.id into git_service (push_branch / create_pr), matching _do_pr_merge. Without it, a verb on a task whose assigned_to was cleared before the side effect falls through to created_by and pushes from / opens a PR against the wrong workspace. (gap: side-effect-handlers-drop-actor-agent-id) - _do_escalate_to_ceo forwards actor_agent_id=agent.id so the awaiting_ceo_approval audit row attributes to the specific PM/Board agent. (gap: do-escalate-to-ceo-drops-actor-agent-id) task.py: escalate_to_ceo gains actor_agent_id param, passed as audit_agent_id to _validate_and_set_status and recorded as escalated_by_agent_id in the event payload + log. escalate_to_ceo_for_agent forwards agent.agent_id. _impl.py: the main_pm complete->escalate path forwards actor_agent_id=main_pm_agent_id. TDD: 5 red->green tests (synthetic trailing-None intent, actor forwarding for push_branch/create_pr/create_root_pr/escalate_to_ceo) + real-DB audit test asserting the awaiting_ceo_approval row carries the actor UUID. Updated 3 board escalate_to_ceo tests to assert the forwarded actor. * [B-REL] release executor: idempotent half-landed retry + commit-scoped CI + decoupled workflow Three confirmed gaps in the release fail-closed pipeline (#87/#318/#402): #87 publish_failed retry duplicates changelog: execute() only short-circuits on an existing tag. A publish_failed outcome (commit pushed + CI green, no tag) left no tag, so a retry re-ran apply_version_bumps + write_changelog_entry (re-inserting the entry above the already-present heading -> duplicate) and commit_and_push (a second chore(release) commit). Add ReleaseOps .release_commit_sha(version) detecting a prior release commit on the branch (clone already at the target version); when present, skip the bump/changelog/ gate/commit pipeline and rejoin the shared CI -> publish tail on the existing commit. No second commit, no duplicate entry. #318 wait_for_ci polls branch-latest, not the release commit: a later push to master during the ~40min wait made the latest run's head_sha != the release sha forever, exhausting _CI_MAX_POLLS -> false ci_failed on a release whose own CI was green. Thread head_sha through get_latest_ci_conclusion / _fetch_latest_ci_run (GitHub actions/runs?head_sha=) so the gate polls the release commit's own run; a concurrent push can no longer mask it. #402 release CI gate reuses self_heal_ci_workflow: that setting documents an empty-string mode for single-workflow repos which, inherited here, degraded the fail-closed gate to the all-workflows mode git.py itself flags as unreliable. Add release_ci_workflow (default ci.yml) and _resolve_release_ ci_workflow(); the release gate always resolves a NAMED workflow, never None. Refactor: bundle the CI-fetch per-project inputs into a _CiRunQuery dataclass so _fetch_latest_ci_run stays under the arg-count gate; unify the half-landed path into execute's shared tail (drops a separate _publish_existing, one return path). TDD red->green; ruff/mypy clean. * [chore] logical-gaps: a2a service hierarchy gate (typed, unconditional) + persist skill on message row (3 gaps) create_a2a_notification gated A2A hierarchy only when both ends resolved (`if from_agent and target_agent:`), so an unattributed (from_agent falsy) or unresolvable-target request slipped past the hierarchy matrix and dispatched with from_agent='unknown' / to_agent='' — and a denial came back as a bare ValueError indistinguishable from the missing-task_id ValueError. Require both ends present, then validate via the shared typed validate_a2a_access path (A2AAccessDeniedError + route_hint) so the legacy notification surface enforces the same who-may-talk-to-whom invariant as the conversation path. send() accepts skill= and the gateway callers (qa/doc/pr_gate) pass it expecting the receiver to learn which capability the message is about, but send_chat_message never read it from options — silently dropped. Persist a nullable skill column (migration 054) on a2a_messages, wire it through send_chat_message + _msg_to_model + the A2AChatMessage model, and fix the send() docstring (it claimed 'recorded in message metadata'). TDD: 4 red→green (skill recorded on message + surfaces in inbox; permission denied raises typed A2AAccessDeniedError with route_hint; self-A2A raises typed; missing from_agent raises instead of silent dispatch). 103 a2a integration tests green; ruff/mypy clean; migration 054 verified upgrade/downgrade on throwaway PG. * [chore] logical-gaps: release-proposal already_published closes proposal + heartbeat-lock-loss cancels execute (2 gaps) approve() closed the proposal only on status=='published'. A retry that finds the tag already shipped returns 'already_published' (is_already_published), so if a prior publish's route commit failed / HTTP 504'd, the proposal stayed non-terminal forever — every retry returned already_published and never closed it; only a manual cancel unstuck it. Close on both published and already_published: the release shipped either way. _heartbeat_loop returned silently when the lock was no longer owned (a >TTL Redis outage let the mutex expire mid-execute), leaving executor.execute running UNGUARDED — a concurrent approve (once Redis returns) could then acquire the lock and _prepare_release_clone rm -rf the in-flight shared release clone while the first execute was still mid-run_gate, re-opening the very rm -rf-clone race the mutex+heartbeat exist to prevent. Run execute as a task; on lock-loss the heartbeat sets a flag and cancels it, and approve() turns the CancelledError into a structured 'lock_lost' result (an external cancellation of approve itself still propagates — distinguished by the flag). TDD: 2 red→green (already_published → COMPLETED not wedged; heartbeat lock-loss → lock_lost + execute cancelled, proposal not completed). 8 concurrency tests green; ruff/mypy clean. * [chore] logical-gaps: release approve async dispatch (202) — kill the 40min synchronous HTTP 504 The approve route ran the whole fail-closed execute inline: clone(600s) + gate(1800s) + CI poll(2400s) + publish(300s) ≈ up to 85min worst case. nginx (the single :3000 entry point, ~60s read timeout) 504'd long before it finished, so the CEO's approve always appeared to fail even when the release succeeded server-side — the structured ReleaseResult was unreachable over the wire. dispatch_approve spawns the execute in a background task with a fresh session (built from the request session's engine) and the route returns 202 'accepted' immediately; _INFLIGHT_APPROVES tracks the dispatched task for observability (self-cleans via done-callback; the Redis mutex still refuses a double-execute on a second click). The panel already polls GET /proposal every 30s, so it observes the final status (COMPLETED on published/already_published, else the proposal stays open for retry); the card's approve toast now treats 'accepted' as an info 'dispatched, running in the background' instead of the old 'Release halted' warning. TDD: 2 route tests red→green (approve returns 202 'accepted' + the proposal transitions to COMPLETED / stays PENDING once the background faked execute completes; the dispatched task is awaited while the executor patch is live). 83 release tests green; ruff/mypy clean; panel typecheck+lint+format+test green. * [chore] mcp-servers: normalize exception bodies to Envelope + lift task_id/correlation_id on circuit_open (#232 #359 #57) flow_server/do_server: the non-404 JSON path returned exception-handler bodies raw (dict `error` from roboco/generic/http exception handlers, or a 422 `detail` list) — neither is the Envelope wire format the agent is prompted to trust (string error kind + message + remediate + missing), so on any service/validation failure the agent got no remediate and flailed until the breaker tripped. _normalize_exception_envelope lifts the body into a real Envelope (code -> counted string kind via _classify_dict_error_code, NOT_FOUND -> not_found, message lifted, remediate synthesized, missing=[]; 422 -> incomplete_input with the validation detail preserved). The synthesized envelope still flows through the breaker so a 500/422 storm trips it. _record_and_check_circuit: the circuit_open substitution dropped task_id / correlation_id from the top level (the SDK's envelope omits them); lift them from the original rejection so the agent's envelope contract and ops audit-join of the trip event still work, not just nested in inner. intake_server._post_event: capture the relay response body under `detail` on non-success so the grok intake agent gets the real reason (e.g. 'session not in MegaTask scope' on a 422) instead of an opaque http_422 token with no remediation. TDD red->green; ruff + mypy clean; 157 mcp/SDK-breaker tests pass. * [chore] a2a-routes: authenticate send_message responder + gate cancel task (PM-only) (#116 #423) send_message took the responder identity from a client-supplied metadata.from_agent, so any caller could spoof anyone (e.g. from_agent='ceo') in the task's notes and in the spawn/notification routed back to the original requester. Stamp the authenticated caller's slug as the responder instead (CurrentAgentContext). cancel_task was ungated: no auth dependency and no role check, so any agent (or any caller) could cancel a task the lifecycle rule reserves to PM roles (Any -> cancelled: PM roles only) — and the cascade-cancel of all non-terminal descendants ran with a hardcoded cell_pm role and no recorded actor. Add require_any_authenticated_agent + a PM-or-above gate, and thread the authenticated role (into the cascade role gate) and slug (into the cancellation note) into A2AService.cancel_task. Tests: send_message ignores a spoofed from_agent and records the authenticated slug; cancel rejects a developer (403) and a missing auth header; a PM cancel threads role + slug into the service; the pre-existing cancel success/already-terminal/not-found tests now run under a PM context (the success test's body was missing the A2A 'name' field and false-passed on a 422 — now genuine). * [chore] work-session-routes: ownership check on mutating routes + stamp merge_pr merged_by from auth (#158 #271) Every mutating work-session route keyed off session_id alone after the role gate, so any developer could commit into / abandon / complete a peer's active session (breaking the single-active-WorkSession invariant and stranding that task) and any PM could merge any cell's PR — the REST surface bypassed the verb layer's active-claimant gate entirely. Add a shared _assert_ownership guard: dev ops require session.agent_id to be the caller; PM merge_pr requires a cell PM to own the session's task cell (main PM / CEO / board coordinate every cell), 404 for a missing session. merge_pr took merged_by from the request body, so any PM could record a PR merge under another agent's id, corrupting the merge audit trail the completion/CEO-approval chain and metrics rely on. Drop the body param and stamp the authenticated caller's agent_id as merged_by (the MergePRRequest schema is gone with it). Tests: a second dev's token hitting a peer's /commits and /abandon -> 403 (session left active); a foreign-cell PM -> 403, same-cell PM -> 200; a spoofed body merged_by is ignored and the persisted row records the PM. * [chore] ci-watch/dep-update dedupe: normalize git_url + treat empty-string workflow as default (#148 #1267) The per-repo open-task dedupe filtered ProjectTable.git_url == git_url (exact), while the orchestrator collapses its poll set by repo_key (lower / strip trailing '/' / drop '.git'). Two projects whose git_url differs only by those accidentals (a monorepo's cell-projects, or a re-registered canonical project) defeated the one-open-task-per-repo invariant and opened duplicate fix / dep-update tasks. Extract roboco.utils.converters.repo_key as the single source and match the dedupe query on its SQL mirror (regexp_replace(rtrim(lower(...)))). The ci_watch (git_url, workflow) dedupe used func.coalesce(ci_watch_workflow, default), but SQL COALESCE only substitutes for NULL — a project saved with ci_watch_workflow='' (reachable via panel/API) yielded coalesce('', default) = '' != default, so the DB diverged from the engine/orchestrator (which collapse '' to the default via Python truthiness) and opened a duplicate fix task every red cycle. Wrap with func.nullif(..., '') so an empty string collapses to the default too. Tests: a ''-workflow + NULL-workflow project on one repo dedupe to one task; git_url accidentals (.git suffix / trailing slash) dedupe across both ci_watch and dep_update. The orchestrator _repo_key now delegates to repo_key. * [chore] admin_set_status: attribute the blocked-restore to the admin actor + emit override row (#2176) admin_set_status taking a BLOCKED task to pending/in_progress with a pre-block snapshot returned early via _apply_pre_block_restore, which emitted its audit row with agent_role=None and audit_agent_id=restored_owner (the pre-block dev) — the admin actor_id/actor_role were dropped entirely. Because this branch runs with force=false (pending/in_progress aren't hatch destinations), the distinguishing task.admin_override row (written only on the non-restore path, gated by force) was never written, so an operator could silently re-own a blocked task with no trace of who triggered it. Thread actor_id/actor_role into _apply_pre_block_restore (admin_set_status passes them with admin_override=True) so the transition audit row attributes the re-owning to the admin, and emit a task.admin_override row (forced=False, restore=True) on this branch independent of the force flag. The in-band unblock(restore=True) path passes no actor and keeps the legacy attribution (restored owner) with no override row. Test: admin PATCH status=pending on a BLOCKED task with a snapshot attributes every audit row to the admin (not the restored dev) and emits the override row. * [chore] converters: typed InvalidIdentifierError from require_uuid + log the orchestrator drop (#25) require_uuid raised a bare ValueError('UUID value cannot be None'), so a malformed/None identifier propagated as an opaque error callers either let 500 or broad-catch-and-silently-swallow — the orchestrator reaper call site wrapped it in a bare except-Exception return with NO log, dropping a bad task_id_str invisibly. Introduce InvalidIdentifierError(ValueError) and raise it from require_uuid for both None and unparseable input; it stays a ValueError subclass so existing except-ValueError / except-Exception callers are unaffected, but typed so a caller can handle a bad identifier distinctly. The reaper now catches the typed error, logs at warning, and no-ops — the drop is visible instead of swallowed. Tests: None and an unparseable string both raise InvalidIdentifierError; it subclasses ValueError (back-comat). * [sweep] notification_delivery: list_system_notifications over-fetch-then-slice for pending_ack_only The SQL limit was applied before the post-fetch 'not fully acked' Python filter. A window of newer fully-acked ack-required rows filled the limit and masked older unacked notifications the operator still needs to act on (the pending-ACK queue silently under-reported; a CEO-approval notification could be hidden by newer already-acked noise). pending_ack_only now drops the SQL limit, filters in Python, then slices to limit; the non-pending branch keeps the SQL limit unchanged. * [sweep] proactive: drop vestigial code-patterns surface from context package Code indexing was removed, so _find_code_patterns always returned [] yet build_context_package still called it, ContextPackage.code_patterns stayed a live field, _build_summary advertised 'Found N code patterns', and _count_items counted it — a permanently-empty slot the system claimed to populate. The dead method, its call, the summary line, and the count reference are removed. The code_patterns field itself is retained (always-empty, serialized in to_dict and the optimal route response) for API/schema back-compat, marked deprecated in its docstring. * [sweep] migration 052: integration-test the task_cell_projects unique constraint The UNIQUE(task_id, team) 'one project per cell per task' invariant was only exercised through SimpleNamespace stubs that never touch a DB session, so the real Postgres constraint was unverified. If it were mis-declared or dropped, two same-team rows could coexist and _resolve_subtask_project would non-deterministically return one, cutting a subtask's branch/PR against the wrong repo. Adds an integration test that inserts two same-(task_id, team) rows and asserts IntegrityError on uq_task_cell_projects_task_team, plus a positive different-teams case. * [sweep] pr_gate: classify MegaTask root-subtask as root so its root->master PR gets COMMENT (#608) _post_gate_review_to_pr identified a root->master PR by absence of a parent_task_id. A MegaTask root-subtask opens its own root->master PR into the project's master (submit_root, parent='master') but carries parent_task_id=umbrella, so is_root was False and the gate posted APPROVE (pr_pass) / REQUEST_CHANGES (pr_fail) instead of COMMENT. The APPROVE could satisfy a single-approval master branch-protection rule and let a non-CEO merge via the GitHub UI before the CEO, against the documented invariant that only the CEO acts on master. is_root now also covers is_batch_root_subtask (batch_id set + parented); a non-batch cell-PM coordination root keeps batch_id=None so it stays a cell->root PR (APPROVE/REQUEST_CHANGES). Extends the _task test helper with a batch_id kwarg. * [sweep] enforcement: complete the status-class partition + coverage invariant (#247) is_waiting_state already covered awaiting_pr_review (the primary fix), but the doc's coverage invariant was missing: backlog and pending fell through ALL three predicates (terminal/active/waiting), so a future enum addition could silently land in no category. is_waiting_state now also covers pending (waiting for a claim) and backlog (waiting on PM activation), so is_terminal_state / is_active_state / is_waiting_state partition the whole Status enum. Adds test_status_classification_covers_every_enum_member asserting every Status member is classified by exactly one predicate, so an enum addition that drifts the partition fails the build. * [chore] test-suite: unblock the quality gate (mypy + 2 behavior fixes) 12 mypy errors across 5 test files: drop banned type:ignore comments (lifecycle_spec monkeypatch uses cast(Any, ...); the ignores were unused), wrap SQLAlchemy-typed ids with cast(UUID, ...) for AgentContext / WorkSession args (AgentTable.id is Mapped[sqla UUID], not uuid.UUID), annotate **kw: Any, and cast(Any, svc) for a method-assignment mock. test_cancel_descendants_cascades_for_authorized_pm: the child was parked in awaiting_ceo_approval, which the spec gates to CEO-only cancel (lifecycle.py:378-389) — a cell_pm cascade correctly refuses it (the #103 refuse path). Use a PM-cancelable in_progress child so the positive-cascade assertion holds; the refuse case is already covered by its sibling test. test_a2a_message_auth: /message/send now resolves the authenticated responder slug via get_agent_context (a DB lookup, #116). This is a DB-free unit test of the token gate + route body, so stub get_agent_context in the fixture — the gate (require_any_authenticated_agent) still runs real and 401s on a missing/forged token before that dependency resolves. * [chore] complexity: split 5 C-rank blocks to <=B for the xenon gate No behavior change; each C-rank function factored into a helper so the complexity gate (xenon --max-absolute B) holds. - lifecycle.can_invoke_action: extract the team-match check into _check_team_match. - a2a.cancel_task: extract _status_value_of + _apply_cancel_note. - task._apply_pre_block_restore: extract _restore_block_ownership (status/ owner restore + snapshot clear) and _emit_admin_override_audit (#2176). - release_proposal.approve: extract _finalize_release_lock (heartbeat/ execute cancel + mutex release) out of the finally. - kanban.get_main_pm_board_flat: dict-dispatch the column routing instead of a 7-branch if/elif ladder (status wins over team; in-flight + no cell team falls through to Coordination, #196). * [chore] lifecycle artifacts: regenerate to match the spec (foundation-check) The rendered artifacts (docs/rag/lifecycle, panel/lib/lifecycle.json, the _generated role-prompt fragments) had drifted from the spec — the prior sweep commits (cancel-CEO gate, claim_pr_review preconditions, pr_reviewer unclaim, complete merge-first ordering) changed spec data without regenerating, and the foundation-check render+diff stage never ran because mypy failed earlier in the gate. make foundation-check now passes. * [fix] chat: wire live message delivery end-to-end (MESSAGE_SENT) send_message persisted messages but never broadcast them, there was no MESSAGE_SENT event type or bridge forwarder, and the panel session view had no websocket subscription — the live chat path was dead end-to-end. - add EventType.MESSAGE_SENT and publish it best-effort on every persisted send (a bus outage logs, never rolls back the durable row) - bridge _handle_message_event forwards to /ws/sessions/{id} and /ws/channels/{id}; subscribe it in register_websocket_bridge_handlers - panel useSessionStream subscribes the session view; the page invalidates the transcript + session-detail queries on each message.new so the held (staleTime Infinity) views refresh live without the manual Refresh * [fix] chat: return session task_links in one read; drop panel N+1 GET /sessions/{id} ran a bare select and session_to_response omitted task_links, so it always returned them empty — the panel worked around it with a triple-fetch (get session, get-tasks-for-session which re-fetched the same endpoint, then a task GET per link), and the links never showed. - add get_session_with_links(_or_raise) that eager-loads task_links -> task - add session_to_response_with_links; GET /sessions/{id} uses both - panel useSession now relies on the single populated response; remove the dead getTasksForSession + per-task fetch and the unused tasksApi import * [fix] chat: validate reply_to against the effective session; guard closed-session composer Posting to a closed session transparently redirects the message to the group's active session (intended for agents holding stale refs), but reply_to was validated against the requested session, not the one the message lands in — letting a cross-session reply slip through — and the panel silently posted there too, so the message vanished from the view. - validate reply_to against session.id (the effective, possibly-redirected session), not req.session_id - panel: render a "session is closed" notice instead of the composer for a non-active session; if a send still lands elsewhere (stale status), toast that it went to the active session rather than letting it appear to vanish * [fix] chat: close session/group/message read IDOR; fix doubled 404s get_session and the messages-list took an agent id but never used it, and get_group took none at all — any authenticated agent could read any private channel's group, session, and message transcripts. Three NotFoundError sites also passed a full sentence as resource_type, yielding "... not found not found". - add require_group_read_access / require_session_read_access (channel member / silent observer / privileged, mirroring list_group_sessions_for_agent) and get_session_with_links_for_agent; enforce on GET /sessions/{id}, GET /sessions/{id}/tasks, GET /messages, GET /groups/{id} (-> 403 on deny) - fix the three doubled-404 sites to the NotFoundError(resource_type, resource_id) form Also folds two gate fixes for the prior chat commits: cast session.id to UUID for the reply_to validation, and ruff import/format touch-ups. Note: POST /messages intentionally still skips the channel write-ACL on the HTTP (human-CEO/panel) path — the CEO is not in writers for 8/11 channels, so enforcing it there would block the panel; the gateway/agent path enforces it. * [fix] secretary: harden live chat — stuck spinner, mid-reply clobber, reload The Secretary live chat had three live-behaviour bugs: a dropped SSE connection left a permanent "thinking…" spinner (openStream set no transport-error handler, so the no-data error Event was swallowed by the JSON-parse guard and streaming never reset); sending mid-reply wiped the accumulation buffer and pushed a user message without guarding the in-flight turn, abandoning/duplicating the reply; and the chat lived only in React state, so a reload wiped it. - route the dual-purpose `error` listener: server-sent JSON → handleEvent, transport error (no data) → reset streaming, surface a notice, close stream - guard send while streaming (streamingRef); disable the composer Send/Enter while a reply is in flight - persist sessionId + messages to localStorage (TTL'd) and, on mount, restore + re-attach the stream once the backend confirms the session is still alive (mirrors the intake/prompter durability) * [chore] groups: extract group-read helper to keep module rank A The get_group IDOR access-check added try/except branches that tipped the module to xenon rank B. Extract the service-error→HTTP mapping into a small helper so get_group stays lean and the module is rank A again (behaviour unchanged; covered by the groups route tests). * [fix] chat: correct panel session-task mutation endpoints linkTask/unlinkTask posted to /add-task and /remove-task (with a body), but the backend exposes POST /sessions/{id}/tasks and DELETE /sessions/{id}/tasks/{task_id} (path param) — so every call 404'd. updateTaskLink targeted /update-task, a route that does not exist at all. Point linkTask and unlinkTask at the real routes and drop the phantom updateTaskLink. All three were unused, so no behaviour changes today — this removes a latent 404 trap. * [docs] chat: document live message delivery (MESSAGE_SENT / message.new) Document the live transcript-update path the chat-subsystem fixes wired: - docs/api/websockets.md: add the message.new event-types row (carried on /ws/sessions + /ws/channels from EventType.MESSAGE_SENT) and note the forwarder sets type:"message.new" - docs/panel/communications-and-journals.md: the session transcript updates live; a closed session is read-only (composer disabled) - CLAUDE.md: name message.new on the per-resource streams and make MESSAGE_SENT the worked example of the add-a-live-event recipe The internal roboco_map slices (gitignored) were updated in place to match. * [docs] reconcile published docs with code since v0.13.0 Drift caught by the doc-reconciliation pass (all verified against HEAD): - CLAUDE.md + rag: pr_reviewer gained the unclaim verb (16b71be8) - rag permissions/task-states/task-tools: awaiting_ceo_approval -> cancelled is CEO-only, not PM+CEO (16b71be8 cancel-ceo-gate; lifecycle.py:373-382) - deploy/env-reference: ROBOCO_APP_VERSION default 0.9.0 -> 0.14.0 (config.py:31); add ROBOCO_RELEASE_CI_WORKFLOW row (2759edf7, config.py:454) - deploy/data-and-migrations: 44->54 revisions, head 054_a2a_message_skill - optional/autonomous-maintenance: CI-watch dedupe is per (repo, workflow) (d34bc1a7) --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-01 01:11:34 +02:00
4 people	6cf99a1b0a	[beb8cae1] Type-gate tests/ under mypy — fix all errors and flip quality gate (#156) (#157) ... * [420e5e68] Fix mypy errors in tests/unit/ and create tests/__init__.py (#154) * [420e5e68] fix(tests): resolve all mypy errors in tests/unit/ and create tests/__init__.py - Create tests/__init__.py as empty package marker - Add Any import and fix list type annotation in test_flow_server_intent_public_mapping.py - Move AsyncIterator to TYPE_CHECKING block and fix m.cls.__name__ attr error in test_app.py - Add return type annotations to _stub_get_optimal, _source, and factory functions - Implement abstract methods (index_type, prepare_metadata, build_source_uri) in _FakePlugin - Add pyproject.toml per-file-ignore for ARG002 on test_optimal_grounding.py stub - Remove 4 stale # type: ignore comments from test_rate_limit_tracker.py - Fix method-assignment patterns in test_rate_limit_sweep.py via patch.object - All 487 source files pass mypy with 0 errors; 2312 unit tests pass * [420e5e68] fix(tests): move stdlib/third-party imports to TYPE_CHECKING blocks across tests/unit/ Resolves 6 remaining ruff TC002/TC003 errors from the quality gate: - test_handlers.py: Iterator → TYPE_CHECKING - test_quality_gate.py: pathlib → TYPE_CHECKING - test_board_dispatch.py: AsyncIterator + httpx → TYPE_CHECKING - test_streaming.py: Iterator → TYPE_CHECKING - test_notification.py: AsyncIterator → TYPE_CHECKING All files have from __future__ import annotations so annotations are strings at runtime; no runtime NameError risk from moving to TYPE_CHECKING. * [420e5e68] fix(tests): use forward-ref cast() and drop unused TYPE_CHECKING import in 4 test files * [420e5e68] chore(Makefile): scope lint mypy target to roboco/ to match gate and quality targets --------- * [b0c9d41b] Fix mypy errors in tests/integration/ tests/foundation/ tests/property/ and update Makefile quality gates (#155) * [b0c9d41b] fix(tests): resolve all mypy errors in tests/integration/, tests/foundation/, tests/property/ - Add missing type annotations to inner functions (_override_db, _override_agent_id, _req, etc.) - Use cast("UUID", ...) to fix SQLAlchemy UUID vs uuid.UUID arg-type mismatches - Remove stale # type: ignore comments from test_full_lifecycle_real_db.py and test_task_service_lifecycle_misc.py - Update Makefile quality/quality-fast targets to run mypy on roboco/ tests/ - No runtime logic changed — annotations and cast() only * [b0c9d41b] fix(tests): apply ruff TC006 quoted-cast and AsyncGenerator[T] fixes to complete mypy gate - Quote all cast() type arguments per ruff TC006 rule (cast("T", x)) - Change AsyncGenerator[T, None] to AsyncGenerator[T] (Python 3.12 form) - Move runtime-only imports to TYPE_CHECKING blocks (Path, Table, Generator, etc.) - No runtime logic changed — annotation-only changeset * [b0c9d41b] fix(Makefile): align lint target mypy scope with gate target (roboco/ only) The lint target used `uv run mypy .` (all files) while gate uses `uv run mypy roboco/`. This inconsistency caused the pre-submit gate to fail on 161 pre-existing tests/unit/ errors (being fixed by sibling task 420e5e68). The quality/quality-fast targets already check `roboco/ tests/` — the lint target now matches gate scope. --------- --------- Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> Co-authored-by: Backend Developer 2 <be-dev-2@agents.roboco.dev>	2026-06-14 13:43:46 +02:00
3 people	718d7dd83e	Fix: open findings cleanup (#122) ... * refactor(usage): remove the unconsumed per-agent USAGE_UPDATE event USAGE_UPDATE was published per active agent each sweep, bridged, and broadcast to /ws/system, but no panel client ever consumed it — the dashboard reads only the aggregate USAGE_SNAPSHOT. Every emission was wasted event-bus and WebSocket traffic. Drop the UsageUpdate payload, publish_usage_update and its throttle, the EventType member, and the bridge subscription. Keep USAGE_SNAPSHOT, which already carries the per-agent breakdown, so no live data is lost. * refactor(prompter): remove the legacy local-LLM HTTP endpoints The panel uses only the live SDK-intake path (/prompter/live/*); the legacy /prompter/chat, /draft and /sessions/* endpoints — backed by the local Ollama LLM with hardcoded prompts — had no remaining caller. Remove the router, its mount in app.py, and its integration test. The live router and the shared draft-confirmation service are untouched. * refactor(prompter): drop the dead legacy local-LLM service + schemas With the legacy HTTP endpoints gone, the local-LLM chat/draft/session methods, their prompt constants, the ConfirmOverrides/TurnResult dataclasses, and the entire prompter schema module had no production caller (only their own tests). Remove them, keeping the live-intake path: create_task_from_draft / confirm_live_draft, the enum/priority/team coercion, and the pure description/readiness helpers. * refactor(agents): stop granting the Task sub-agent tool to roles Every agent role was granted the built-in Task tool, but no role prompt or workflow uses it and there are no custom sub-agent definitions — so a Task call only spawns a context-blind generic sub-agent that burns budget (ToolSearch, the comment's stated use, is MCP-only and not callable in agent containers). Drop Task from all three grant points in lockstep: the --tools spawn flag and both _ROLE_BUILTIN_TOOLS maps (system-prompt + briefing layers), with a regression guard added to each layer's test. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-12 23:10:21 +02:00
5 people	547fe444f2	[4865ff8b] Add WebSocket support to the usage dashboard (#115) ... * [e7349d84] feat(dashboard): WS usage store, hook extension, status badge, and smooth animations (#111) (#113) - Add src/store/usage-store.ts with typed UsageData interface, useUsageStore Zustand store, setUsageData, clearUsageData, and setWsState actions - Export useUsageStore and UsageData from store/index.ts - Extend use-rate-limit-websocket.ts: rename msg type to SystemWsMessage, add key_metrics field; add useEffect syncing wsState into useUsageStore; add USAGE_UPDATE/USAGE_SNAPSHOT handler dispatching to useUsageStore (RATE_LIMIT_HIT/LIFTED handling and onReconnect unchanged) - Update CommandCenter to read key_metrics from useUsageStore when wsState === 'connected' and usageData non-null; falls back to useCeoOverview() (refetchInterval: 60000) when WS disconnected - Update KeyMetricsPanel: add wsState prop, render connection status Badge matching AgentStreamViewer pattern (bg-green-500+Wifi / bg-yellow-500+ Loader2 spin / bg-gray-500+WifiOff); add transition-all duration-300 ease-in-out to metric value spans for smooth animated updates Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> * [c9745ee8] feat(events): add USAGE_UPDATE/SNAPSHOT event types, throttled publisher, /ws/system usage bridge (#112) (#114) - Add EventType.USAGE_UPDATE='usage.update' and EventType.USAGE_SNAPSHOT='usage.snapshot' to the EventType StrEnum in roboco/models/events.py - Create roboco/services/usage_events.py with _UsageThrottle class (5-second per-agent window using time.monotonic()) and publish_usage_update() / publish_usage_snapshot() helpers; lazy imports prevent circular dependency with roboco.events - Extend orchestrator._sweep_token_snapshots() to publish USAGE_UPDATE per active agent (throttled) and a USAGE_SNAPSHOT aggregate after each sweep cycle; wrapped in contextlib.suppress so event errors never abort DB snapshot operations - Add _handle_usage_event() to websocket_bridge.py following _handle_rate_limit_event pattern; register USAGE_UPDATE and USAGE_SNAPSHOT subscriptions in register_websocket_bridge_handlers() forwarding both to /ws/system via broadcast_system() - Add unit tests: test_usage_events.py (throttle suppression, publish helpers) and test_websocket_bridge.py extended with _handle_usage_event coverage and updated registration assertion to include USAGE_UPDATE/USAGE_SNAPSHOT Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> * fix(usage-ws): reconcile the realtime token/cost contract end-to-end The backend and frontend halves shipped mismatched contracts, so the usage dashboard never received live data: - The bridge forwarded the dotted event value ("usage.update") while the panel switched on "USAGE_UPDATE"; map both to the UPPER_SNAKE type string the same way the rate-limit handler does. - The backend emitted token/cost telemetry but the frontend read a key_metrics field and fed the org-metrics panel. Rewire the frontend to consume the USAGE_SNAPSHOT token/cost payload into the "Token Usage & Cost" panel — WS-first with polling fallback and a connection-status badge — and revert the unrelated KeyMetricsPanel / CommandCenter wiring. Backend cleanups in the same path: - Replace the multi-argument publish helpers with typed UsageUpdate / UsageSnapshot payloads, removing the too-many-arguments lint suppressions. - Extract _fetch_agent_tokens and _persist_token_snapshot from the token sweep, removing the too-many-statements suppression; label the live snapshot "live". Hardening uncovered while fixing the above: - _finalize_spawn_session pulled the full RAG stack into the session-finalization path through a transcript-parse import; move the pure parser into a dependency-light roboco.agent_sdk.transcript_usage module so finalization never imports the agent SDK server. - Reduce _finalize_spawn_session complexity by extracting _resolve_final_token_usage, and widen the transcript-fallback guard so a read error can never abort finalization. Also align KeyMetricsPanel with the metrics /dashboard/ceo actually returns: it read velocity_24h / avg_time_to_done / active_agents, none of which get_key_metrics() emits, so four of five rows rendered "—". Render velocity_weekly, completion_rate, documentation_coverage and active_blockers. * docs: note live usage push over /ws/system on the usage dashboard * fix(usage): finalize on self-exit and de-duplicate transcript token counts Two bugs left token capture broken even after the transcript-read fallback landed — surfaced by a live agent run: - Agents that self-exit (the normal i_am_idle -> container shutdown, exit 0) were never finalized. _finalize_spawn_session is only called from stop_agent(), but a graceful self-exit goes through _handle_stopped_container, which set the instance OFFLINE and returned without finalizing — leaving the spawn-session row open with zero tokens. Finalize there for both graceful (exit_reason="completed") and crash (exit_reason="crashed") exits. - sum_transcript_usage double-counted. Claude Code logs one assistant message as several JSONL lines (one per content block — thinking / text / tool_use), each repeating the same message.usage, so summing every line roughly doubled the totals. De-duplicate by message.id. Verified against a live agent transcript: the raw sum (12, 1068, 62502, 115828) vs the de-duped (6, 516, 62502, 63336), which matches the session's authoritative result.usage exactly. * feat(usage): fall back to the transcript in the live token sweep The 60s token sweep read only the agent SDK's /usage/status, which races container teardown and reports zero mid-run — so live usage (and the USAGE_SNAPSHOT pushed to /ws/system) stayed at zero for active agents. Extract _resolve_active_tokens: try the SDK, then fall back to the durable transcript (the same source finalize uses) so running agents report live. * feat(usage): add GET /usage/sessions for the dashboard's Recent Sessions The panel's Recent Sessions table was mock-only — the backend had no sessions endpoint, so production always showed 'No sessions recorded yet'. Add UsageService.get_recent_sessions + a /usage/sessions route returning the most recent spawn-session rows (token totals + cost), and point the panel client at it. --------- Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-11 23:19:50 +02:00
3 people	303c2db289	Fix: rate limit real probe (#110) ... * fix(rate-limit): real provider liveness probe instead of time-based stub The rate-limit recovery sweeper cleared a provider and resumed parked agents purely on elapsed time — _do_probe was a stub that always returned True once the retry_after window passed, so it never confirmed the provider had actually stopped rate-limiting us. Under a sustained limit that resumes agents straight into another 429, re-parking them: avoidable churn. Make the probe real. _do_probe now issues a free, unmetered liveness call — Anthropic GET /v1/models or Ollama GET /api/tags — and treats any non-429 response as the limit having lifted. A 429 keeps the provider parked; a network error keeps it parked too (retry next sweep). When the provider can't be probed (no API key, or an unrecognized provider), it falls back to the prior time-expiry optimism rather than stranding agents. _probe_target keeps URL/header resolution separate and testable, and _do_probe stays a monkeypatchable boundary so the existing sweep tests are unaffected. Also drop two acceptance-criteria-number labels from comments in this file. * chore(rate-limit): clear merged gate debt in rate-limit tests + deps lint The rate-limit PR landed with ruff violations the full gate flags but the authors' runs missed: test_rate_limit_sweep.py was unformatted, and test_rate_limit_tracker.py had unsorted/unused imports and magic-value comparisons. Format the sweep test, drop the dead imports, and bind the magic comparison values to locals. Also strip acceptance-criteria-number labels from comments/docstrings across the three rate-limit test files (leaving genuine acceptance_criteria=[...] test data untouched), and add api/deps.py to the PLC0415 per-file-ignore — it is the DI wiring hub and defers a couple of service imports to call time to avoid import cycles, the same rationale already applied to api/routes, runtime, and services. * fix(rate-limit): resolve redis type errors in RateLimitStateTracker A cold mypy run (the gate's true state — prior passes were warm-cache only) flagged four redis-typing errors in rate_limit_tracker.py that the merge missed: three unused type:ignore[type-arg] on redis.Redis, and an aclose() the bundled redis type stub doesn't expose. Drop the now-unused ignores, and close the scan client via 'async with redis.from_url(...) as r:' instead of a finally-block aclose(). The context manager closes the client on exit using the modern redis.asyncio API — no deprecated close(), no stub-missing aclose(), no suppression. Extend the test's redis mock to model the async context-manager protocol so it returns itself on enter. * test(prompter): pass route='main_pm' in the product main-PM routing test Pre-existing master failure, unrelated to the rate-limit work. The test is named ...product_routes_to_main_pm and asserts team=MAIN_PM, but called confirm_live_draft without a route, so it got the 'board' default — which assigns the Product Owner and yields team=BOARD by design (the board-review path keeps the root at team=board until the CEO approves). The Main-PM path is selected with route='main_pm', exactly as the sibling ...main_pm_route_assigns_main_pm test does. Add the missing kwarg so the test verifies the path it names; behaviour under test is unchanged. * Updated uv.lock * refactor(complexity): bring all rank-C blocks under the xenon B ceiling The full quality gate's xenon step (--max-absolute B --max-modules A --max-average A) failed on eight rank-C blocks plus the extraction module average — debt the rate-limit and token-analytics merges deferred. Reduce each by extracting cohesive helpers, behaviour unchanged: - orchestrator._probe_one_provider: split into _too_early_to_probe, _on_probe_success, _on_probe_failure, _parked_agents_for. - rate_limit_tracker.list_rate_limited_providers: extract _read_rate_limited_entry and a _decode helper. - trigger_filter.decide_spawn: extract _stale_trigger_decision (drops the PLR0911 suppression too). - ollama_embedder (embed_query, _embed_batch_sync, aembed_query, _embed_batch_async): share _rl_backoff / _map_embed_error / _log_429 / _sleep_connect_retry / _asleep_connect_retry; remove a dead post-loop guard in aembed_query. - mentor._synthesize_answer: extract _select_system_prompt and _answer_from_response. - indexes/base.ask: extract the 429-retried LLM call into _ask_llm. - extraction.__init__: extract _compile_patterns so the module average lands at rank A. xenon now exits 0; rate-limit, optimal_brain, extraction, and events suites all green. * chore(deps): drop obsolete types-redis stub; honor redis 8.0 inline types types-redis 4.6 (typed for redis 4.x) shadowed redis 8.0's own inline types, which both masked real annotation mismatches in stream_bus.py and forced awkward workarounds elsewhere. The stale stub is why the mypy gate only ever passed warm-cached: a cold run under the wrong stub disagreed with the code. Remove types-redis (and its orphaned transitive stubs) so mypy uses redis's shipped types. That surfaces that xreadgroup/xclaim return bytes-keyed records while _handle_message is annotated str — the code already decodes bytes defensively, so this is an annotation gap, not a runtime bug. Make the types honest: cast each result to its concrete shape and decode the stream name and message id to str at the dispatch boundary via a _to_str helper. mypy roboco/ is now clean cold (247 files) against redis's real types; events suite green. * Updated uv.lock * fix(workspace): install the dev extra so agents can run make quality Agent workspaces were set up with plain `uv sync`, which installs only the project's default dependency group (pytest) — not the `dev` *extra* where the gate tools live (ruff, mypy, xenon, radon, vulture, bandit, deptry). So an agent's .venv had pytest but no linters, and `make quality` died immediately on `ruff: command not found`. Agents literally could not lint, type-check, or complexity-check their own work, which is how format/mypy/xenon debt merged unseen. Sync the `dev` extra (`uv sync --extra dev`) so the workspace gets the full toolchain the setup's own docstring already promised. * fix(panel): rate-limit endpoint shape + websocket path Two panel-facing breakages from the rate-limit rework: - GET /api/system/rate-limits returned a raw list, but the panel store reads response.entries — so `r.entries is not iterable` crashed the banner sync on page load. Return the panel's contract: a { entries: [...] } envelope whose items are camelCase {provider, affectedAgents, hitAt, resumeAt, retryAfterSeconds}, derived from the raw Redis state (resumeAt = hitAt + retryAfter). - The rate-limit websocket hook passed "/ws/system" while getWebSocketUrl() already supplies the "/ws" base, producing the doubled "/ws/ws/system" URL. Pass "/system" to match the agents/channels/notifications hooks. Note: the backend /ws/system endpoint itself does not yet exist (the rework shipped the panel hook only); the REST fix keeps the banner correct on load and reconnect until that endpoint is built. * test(workspace): assert uv sync installs the dev extra Follow the workspace setup change: the dependency-install command is now `uv sync --extra dev` so the agent workspace gets the lint/type/complexity toolchain. Update the three assertions that pinned the old `uv sync`. * feat(ws): add /ws/system stream and bridge rate-limit events to the panel The rate-limit rework shipped the panel's websocket hook but no backend: there was no /ws/system endpoint and nothing forwarded RATE_LIMIT_HIT/LIFTED to a socket, so the banner got no live updates. Build the missing half: - ConnectionManager grows a system-wide connection set with connect_system / broadcast_system, and disconnect() now clears it. - A /ws/system websocket endpoint (operator stream, no per-agent keying) with the same connected + ping/pong lifecycle as the other streams. - websocket_bridge subscribes RATE_LIMIT_HIT/LIFTED and forwards each to broadcast_system tagged with the type the panel switches on. Both events ride the same StreamEventBus singleton, and the subscriptions register before start_listening(), so the consumer reads their streams. Pairs with the panel hook now passing '/system' (getWebSocketUrl supplies the '/ws' base). Covered by handler, manager, and endpoint-lifecycle tests. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-11 18:16:20 +02:00
3 people	06682f33c6	Fix: agent workflow hardening (#70) ... * fix(gateway): push the branch before QA handoff so reviewers see the latest commits The commit content tool commits locally without pushing; only open_pr pushed the branch. On the first submission that was fine, but a fix committed while addressing needs_revision never reached origin (open_pr is skipped once the PR exists), so QA — which reviews the remote PR branch — re-reviewed the stale remote and re-failed the task on every cycle, a loop that never converged. i_am_done now pushes the task branch (idempotent; a no-op when nothing is unpushed) as part of the shared submit gate, covering both the normal and resume-from-verifying paths. A push failure blocks the handoff with a clear remediation rather than parking the task in awaiting_qa with commits that exist only in the developer's local workspace. * fix(orchestrator): don't reap a stale claim while the agent's container is alive The stale-claim reaper released any claimed/in_progress task whose last_heartbeat_at exceeded the TTL. The heartbeat only updates on certain gateway calls, so a developer deep in a long edit/test cycle outran the TTL and had its claim reaped mid-work — churning the task and risking a double spawn against the still-running container. The reaper now skips a task whose assignee still holds a live (ACTIVE) agent instance, trusting container liveness — the ground truth — over the heartbeat proxy. The check is defensive on missing fields so a heartbeat-only caller (and the reaper's existing unit tests) behave exactly as before. * fix(gateway): refuse to unblock a task while a dependency is unfinished A PM unblock on a dependency-gated task moved it straight to in_progress, overriding the dependency — letting a dependent proceed without its upstream's work (e.g. a frontend task built before its UX design lands). A dependency block is meant to clear on its own via _unblock_dependents the moment the upstream reaches a terminal state. unblock now refuses while any dependency is still non-terminal, returning a clear remediation that the block resolves automatically. Manual unblock remains available for genuine, non-dependency blockers. * fix(gateway): release a dependency-blocked claim to pending instead of looping A task that reached claimed/in_progress with an unfinished dependency was left in that state when the claim guard rejected, so the orchestrator's respawn loop kept reviving its assignee — which could make no progress — burning work for nothing. The claim guard now releases such a task back to pending. claimed -> blocked is not a legal transition, so pending — held by the dispatch dependency filter — is the lifecycle-correct resting state: the respawn loop ignores pending tasks, and _unblock_dependents re-dispatches it once the upstream reaches a terminal state. release_dependency_blocked_claim shares a _force_unclaim_to_pending core with unclaim_for_reaper so both record a truthful work-session abandon reason. * feat(security): warn at startup in header-trust mode + document the auth posture When ROBOCO_AGENT_AUTH_REQUIRED is not enabled the API accepts the X-Agent-Id / X-Agent-Role headers without a signed token, so any client that can reach it may act as any role (including 'ceo'). The API now logs a clear warning at startup in this mode, and the README gains a Security section documenting the auth posture and how to harden it. Acceptable only on a trusted private network — do not expose the API to untrusted networks. * fix(workspace): scope the refresh fetch to current + default branch ensure_workspace's healthy short-circuit ran an all-refs 'git fetch origin' to keep every origin/<branch> ref current. On a monorepo with many accumulated feature/* branches that exceeds the refresh timeout, the fetch silently fails, and the workspace keeps a stale base — so an agent builds on an out-of-date branch. The refresh now fetches only the workspace's current branch and the repo's default branch (resolved via origin/HEAD), with --no-tags --prune: it transfers near-nothing and can't time out. Readers need their own branch and the default; the integration branch is refreshed at branch-creation time. * fix(git): refresh a dependency-blocked task's branch off the current integration tip A cross-cell dependent (e.g. a frontend task waiting on the UX design) was branched off a base captured before its upstream merged into the integration branch, and the branch was never re-synced — so the agent built on a stale snapshot with none of the upstream's work. Two changes close the gap: - release_dependency_blocked_claim now clears branch_name, so the re-claim (after the dependency clears) re-runs branch creation. - create_branch, when the branch is already on disk with no commits of its own, resets it onto the freshly-pulled base — the dependent now builds on the current integration tip. A branch carrying real commits is left untouched, so no work is discarded; the cell->leaf cascade carries the upstream down to the dev branch automatically. * refactor(gateway): drop the sibling-sequence claim guard Sibling sequence no longer gates a claim. Cross-cell ordering is enforced by task dependencies — a cell task that depends on another is held until its upstream reaches a terminal state, a stronger, status-aware gate than the sequence-number check. That check was dormant in practice anyway: every fan-out child carries sequence 0, on which the guard short-circuited. `sequence` stays a sibling-ordering / dispatch-priority field (list_pending ordering and the panel). Removes sibling_sequence_guard and its _earlier_blocking_sibling helper, the now-unused skip_sequence parameter threaded through the claim verbs, and the sibling fetch that fed it. * feat(gateway): sort a cross-cell dependent after its upstream When the frontend cell task is wired to depend on its UX/UI sibling, set its sequence to the upstream's sequence + 1 so it sorts after the design it waits on — list_pending ordering and the panel now show UX ahead of the implementation it gates, in either delegation order. Adds TaskService.set_sequence (the sibling-ordering field is a service write; it carries no claim-gating semantics — dependencies gate claims). * feat(gateway): make the backend cell depend on UX too UX/UI design defines the screens and API contracts both implementation cells build against, so the backend cell — not just the frontend — waits on the UX/UI cell task in a product fan-out and sorts after it. Wires in either delegation order: a backend task delegated after UX gets the dependency directly; a UX task delegated after a still-pending backend sibling retro-wires it. Mirrors the existing frontend wiring (_depend_backend_on_ux and _depend_pending_backends_on_ux). Backend is held by the same dependency gate, so it costs no extra dispatch churn. * fix(websocket): forward notification acks instead of logging them incomplete The bridge handler serves both notification.sent and notification.acked, but acked events carry `agent_id` (the acking agent) rather than `recipient_id`, so every acknowledgement tripped the missing-field guard and logged "Incomplete notification event" instead of reaching the panel. Accept either field as the recipient. * feat(api): hint the full UUID when a truncated task id fails validation Agents copy the 8-character task prefix the system shows them (the commit prefix, task summaries) and send it as task_id, which fails UUID validation with an opaque "invalid length" 422 and wastes a call. The request-validation handler now detects a task_id UUID error and attaches a `remediate` hint telling the agent to retry with the full 36-character UUID from its task envelope. * fix(audit): record the blocked transition when a task is escalated Escalation sets a task to blocked by writing task.status directly, which bypassed the validated transition helper and so never emitted a task.blocked audit row — the lifecycle moved but the Auditor saw nothing. Extract the audit emit from the central transition helper into _emit_status_transition_audit and call it from the escalate path, capturing the prior status and outgoing owner before reassignment so the row is attributed correctly. * fix(docs): stop doubling the docs path so design specs index into RAG The documenter sometimes hands a doc path already rooted at docs/, and joining it onto DOCS_BASE_PATH (/app/docs) produced /app/docs/docs/..., so the file was never found and the spec never indexed — the frontend cell could not retrieve the UX design over RAG. Normalize the path before joining: trust an absolute path, otherwise strip a single redundant leading docs/ segment. * feat(security): let the control panel authenticate in secure mode With ROBOCO_AGENT_AUTH_REQUIRED=true every request must carry a valid HMAC token, which locked the human control panel out — it sends role headers but no token. nginx, the only trusted hop between the browser and the API, now injects the CEO token on /api and /ws, so the browser never holds the signing secret. The injected value is just the existing per-agent token issued for the CEO identity (issue_panel_token), so the token-verification path is unchanged. An empty value (dev/header-trust mode) renders to no header. `make panel-token` prints the value; set it as ROBOCO_PANEL_AGENT_TOKEN in .env before enabling secure mode. .env.example and the README Security section document the flow. * chore(compose): consolidate the two compose files into one docker-compose.yml and docker-compose.yaml had diverged: .yml — the file Docker actually uses — carried ROBOCO_PUBLIC_BASE_URL but was missing the /app/manifests bind-mount, while .yaml had the manifests mount but not the base URL. Merge the union into docker-compose.yml and delete the duplicate so there is one source of truth and no "multiple config files" warning. This activates the manifests mount in the deployed file: without it the orchestrator writes per-agent tool manifests to its ephemeral container fs, they never reach the host for the daemon to bind-mount, and agents fall back to all-verbs registration. Drop the stale .yaml reference from the config.py docstring, the labeler, and the CI path filters. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-05 16:35:22 +02:00
Renn F	9aa30fb945	100% Coverage	2026-05-06 21:02:31 +02:00