The standard was architectural LINTING (placement + hygiene) — things ruff/eslint already do — and it forced backend rules onto frontend projects. This makes it enforce MODULARIZATION, the separation-of-concerns a senior demands that linters are blind to:
- modular_cohesion: a file that mixes architectural concerns (a model defined in a router, a schema in a component) is a monolith — split it. One concern per file.
- thin_routes (Python): a route handler that runs its own DB access instead of delegating to a service.
- thin_components (TypeScript/React): a component that fetches data in its body instead of using a hook.
- god_class: a class past a method-count threshold (single responsibility).
The checks inspect a definition's BODY and a file's COMPOSITION via tree-sitter, precision-over-recall (fire only on a confident structural signal). Rules are now scan-derived and language-aware: hygiene seeds universally, placement only for modules that exist, and modularity per stack — so a frontend project carries no_models_in_components + thin_components, never a backend no_models_in_routers. BUILTIN_RULES is reduced to language-agnostic hygiene.
* feat(conventions): standard schema models + effective-map merge
* feat(conventions): tree-sitter Python classifier + placement checks
* feat(conventions): TS classifier, hygiene/custom checks, runner + CLI
* feat(conventions): ROBOCO_CONVENTIONS_ENABLED flag + cache table + migration
* feat(conventions): repo auto-scan + scaffold draft renderer
* feat(conventions): ConventionsService (cache/baseline/ambient/scaffold/restore)
* feat(conventions): auto-scaffold on project registration (flag-gated)
* feat(conventions): TaskDescription.constraints + auto-baseline attach
* feat(conventions): ambient architecture-map injection at spawn
* test(conventions): subprocess CLI smoke for the agent-image entrypoint
* feat(conventions): block i_am_done on block-level convention violations
* feat(conventions): block pr_pass on unresolved convention violations
* feat(conventions): surface convention findings into QA evidence
* docs(prompts): convention awareness for PO/Intake/Dev/QA/PR-reviewer
* feat(conventions): panel Conventions tab + flag toggle + parity
* test(conventions): end-to-end block, fix, and waiver through the gate
* refactor(conventions): extract pr_pass guards to keep pr_gate under the gate
* style(conventions): format the baseline-constraints attach in task.create
* test(conventions): type-annotate test helpers for the full mypy gate
* build(conventions): ignore types-PyYAML in deptry (mypy-only type stub)
* docs(conventions): document the standard in CLAUDE.md + PM prompt awareness
* fix(conventions): baseline constraints are non-suppressible (dedup-append)
* feat(conventions): scaffold on first workspace clone (threaded workspace)
* feat(conventions): multi-project ambient map for PO/Intake (per-product)
* feat(conventions): persist findings + violations-feed route (migration 044)
* feat(conventions): panel violations feed in the Conventions tab
* test(conventions): intake-spawn mock accepts the ambient layer kwarg
* fix(docker): ollama-init best-effort pull, gate startup on cached models present
A degraded/slow ollama registry made the model manifest re-check fail under
set -e, so ollama-init exited 1 and blocked the orchestrator's
service_completed_successfully gate — taking the whole stack down even though
both models were already cached. Pulls are now best-effort; success is gated on
the models being present, so a flaky registry can't down a cached deployment.
* refactor(content): drop dead TaskDescription.with_baseline_constraints
The structured baseline-merge helper had zero production callers. Project-task baseline constraints are attached by the wired string backstop (TaskService._attach_baseline_constraints), and a real task is free-form prose that cannot form a valid TaskDescription (requires a non-trivial objective + non-empty the_work), so the helper was unreachable from any live path — a leftover from the structured-merge -> string-append design pivot. Removing it leaves a single enforcement path. The constraints field itself stays: it is a member of the well-formed-spec schema (Objective / What This Builds / The Work / Notes / Constraints / Acceptance Criteria), rendered by render_markdown and unit-tested.
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
* feat(conventions): standard schema models + effective-map merge
* feat(orchestrator): park provider on persistent server overload (529/500)
A 429 rate limit already parks a provider — queue its spawns, probe until it
recovers — but a persistent 529/500/503 overload had no such break: the run
died and the orchestrator crash-retried straight back into the overload,
burning tokens in a respawn loop.
Generalize the park to provider-unavailability. On a non-graceful Anthropic
agent exit, match the API's overload markers (overloaded_error /
internal_server_error / "API Error: 5xx") against the dead container's own
output and park the provider with kind="overloaded"; the existing spawn gate
already queues any parked provider, and the probe-resume loop revives the task
when it recovers. Grok keeps its exit-75 path; both now route through one
_park_provider_unavailable helper. Markers are kept specific so an agent that
merely writes about HTTP 500/529 can't trip the break.
Fix the recovery probe to require a 2xx: it treated any non-429 as recovered,
so a probe that itself got a 529 would have resumed agents straight back into
the overload — wrong for the new path and for a 429 that lifts into a 5xx.
Gated by ROBOCO_OVERLOAD_BREAK_ENABLED (default on; off => crash-retry).
---------
Co-authored-by: Renn F <rennf93@users.noreply.github.com>
The structure-everything sweep found four more writers packing key:value soup
into quick_context (the human ResumptionNote field), same anti-pattern as the
already-fixed approve_and_start_notes:
- _record_completion_notes -> completion_notes:<text>
- escalate_to_ceo -> escalation_notes:<text>
- ceo_approve -> ceo_approval_notes:<text>
- ceo_reject -> ceo_rejection:<reason>
Route them through a unified orchestration_markers['transition_notes'] dict
(keyed by event) via markers.set_transition_note, so quick_context carries only
the structured ResumptionNote and the panel never shows raw <event>:<text> soup.
Adds the typed accessor + a roundtrip test.
Two agent-authored fields were leaking non-developer content into the
human note columns the panel renders:
- apply_escalation appended '[ESCALATED] From X to Y\nReason: ...' to
dev_notes (the developer's space). On a re-escalation loop a stuck cell
PM grew one task's dev_notes to ~8KB across 5 escalations. It now writes
a structured orchestration_markers['escalation'] record; the target
still learns the reason from the escalate notification.
- approve_and_start string-packed 'approve_and_start_notes:<text>' into
quick_context (raw key:value soup). It now writes
orchestration_markers['approve_and_start_notes'], leaving quick_context
for the human ResumptionNote only.
Adds typed marker accessors (get/set_escalation, get/set_approve_and_start_notes)
and refactors _record_pr_review under the complexity bound by extracting
_compose_review_body. Documents update_task_with_message as the legacy
A2A-protocol log (dev_notes is intentional there, not pollution).
The single non-empty/non-placeholder gate caught a lone banned token
(wip) and below-floor strings, but multi-token soup made entirely of
placeholders (wip wip, tbd / na, todo todo todo) slipped through both
checks. Add an all-tokens-filler test that strips edge punctuation per
token and rejects when every meaningful token is banned — without
flagging real prose that merely contains a filler word (none of the
tests failed). Strengthens every content model + gateway anti-soup
guard that composes reject_trivial.
Renn F