416 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
5 people	98e618c243	[aaac85d2] Rate limit guardrails for Anthropic and Ollama providers (#104) ... * [25aa5b24] Implement rate-limit Zustand store, Axios interceptor, WebSocket hook, banner component, and page-load sync (#99) (#101) * [25aa5b24] feat(rate-limits): add types, Zustand store, Axios 429 interceptor, WS hook, sync hook, and banner component - panel/src/types/rate-limits.ts: RateLimitEntry, RateLimitHitEvent, RateLimitLiftedEvent, RateLimitApiResponse - panel/src/store/rate-limit-store.ts: useRateLimitStore with Map state, hitRateLimit/liftRateLimit/syncFromApi - panel/src/lib/api/rate-limits.ts: GET /api/system/rate-limits with isMockMode guard - panel/src/lib/api/client.ts: 429 interceptor dispatches to store first, Sonner toast on retry exhaustion - panel/src/hooks/use-rate-limit-websocket.ts: RATE_LIMIT_HIT/LIFTED events + onReconnect callback - panel/src/hooks/use-rate-limit-sync.ts: mount sync + no-op with console.warn when endpoint unavailable - panel/src/components/rate-limit/rate-limit-banner.tsx: amber rows with countdown, no dismiss button - panel/src/app/(dashboard)/layout.tsx: RateLimitBanner mounted below Header - store/index.ts, hooks/index.ts: export new store and hooks * [25aa5b24] fix(rate-limit-banner): use lint-clean countdown pattern (computeSecondsLeft outside render) * [25aa5b24] fix(client): add real retry loop to 429 interceptor so Sonner toast fires on exhaustion - Increment error.config._retryCount and return api(error.config) when retryCount < RATE_LIMIT_MAX_RETRIES, actually retrying the request. - Toast fires only when retryCount >= RATE_LIMIT_MAX_RETRIES (3 attempts). - Fixes AC4: toast was dead code because without return api(error.config) every 429 saw retryCount=1, permanently below the threshold of 3. --------- Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> * [4112cd34] feat(rate-limit): add RateLimitError with 5-retry exponential backoff at all LLM call sites (#102) (#103) - Create roboco/services/exceptions.py with RateLimitError(provider, retry_after), HTTP_TOO_MANY_REQUESTS, MAX_RATE_LIMIT_RETRIES constants, and parse_retry_after_header() helper - extraction.py: extract _call_anthropic_with_retry() helper; retry Anthropic call 5x on 429 with exponential backoff; re-raise RateLimitError from outer except instead of swallowing it - ollama_embedder.py: 5-retry outer loop (429) wrapping existing 3-retry inner loop (ConnectError/Timeout) for all 4 call sites; two concerns kept isolated - indexes/base.py, mentor.py, validator.py: replace magic 429 literals with HTTP_TOO_MANY_REQUESTS; 5-retry loop on 429 for LLM calls - middleware.py: add rate_limit_exception_handler returning HTTP 429 with Retry-After response header - tests/unit/services/test_rate_limit_retry.py: 28 tests covering exhaustion, Retry-After header sleep, partial retries then success, ConnectError isolation Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> * [18107054] feat(rate-limit): Redis rate-limit state tracker + i_am_blocked rate_limited path (#105) (#106) - Add RateLimitStateTracker in roboco/services/gateway/rate_limit_tracker.py with activate(), clear(), is_rate_limited(), get_state(), increment_probe_failures(), reset_probe_failures() backed by redis.asyncio - Add RATE_LIMIT_HIT = "rate_limit.hit" to EventType StrEnum in events.py - Add _handle_rate_limited_parking() to Choreographer: intercepts i_am_blocked(reason='rate_limited') before block state transition, parks all active agents sharing affected provider via mark_waiting_long, publishes RATE_LIMIT_HIT event to StreamEventBus, task stays in_progress - Add get_provider_for_agent() and get_active_agent_slugs_for_provider() helper methods to AgentOrchestrator - Wire orchestrator and stream_bus into ChoreographerDeps via deps.py - Add test_rate_limit_tracker.py (basic ops, probe failures, cross-reconnection persistence, provider isolation) and test_i_am_blocked_rate_limited.py (AC3/AC4/AC5 coverage: task stays in_progress, mark_waiting_long call count equals active agent count, RATE_LIMIT_HIT event payload structure) Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> * [5501e4b4] Wire RateLimitStateTracker into live orchestrator paths — 4 CEO-identified integration gaps (#109) * [8451ca50] feat(gateway): wire RateLimitStateTracker.activate() into i_am_blocked rate-limited path and add provider-rate-limit gate to decide_spawn() (#107) - Add provider/provider_rate_limited optional fields to TriggerContext (backward-compatible defaults) - Insert rule 2 in decide_spawn(): QUEUE when trigger.provider_rate_limited is True with reason 'provider X rate-limited' - Call RateLimitStateTracker(provider).activate() in _handle_rate_limited_parking() after mark_waiting_long loop (wrapped in contextlib.suppress for Redis fault tolerance) - Extend gateway_pre_spawn_check() with optional provider param; check RateLimitStateTracker.is_rate_limited() when provider is known - Pass provider=self.get_provider_for_agent(agent_id) from orchestrator call site - Add TestProviderRateLimitGate (6 tests) to test_trigger_filter.py - Add TestRateLimitTrackerActivateOnParking (6 tests) to test_i_am_blocked_rate_limited.py - All 38 unit tests pass; ruff and mypy clean on changed files Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> * [e9cef0f0] feat(rate-limits): sweeper probe loop, CEO notification, and GET /api/system/rate-limits endpoint (AC4, AC8, AC9) (#108) - Add RATE_LIMIT_LIFTED event type to EventType enum in models/events.py - Add RateLimitStateTracker.list_rate_limited_providers() classmethod to scan Redis for all currently rate-limited providers (used by the new endpoint) - Add orchestrator._rate_limit_probe_loop(): background task started/stopped in start()/stop(), runs _sweep_rate_limit_probes() every 30s - Add orchestrator._probe_one_provider(): checks estimated_lift_at gate, calls _do_probe(); on success: tracker.clear(), resolve_wait() for all parked agents with waiting_for='rate_limit_lifted' matching the provider, publishes RATE_LIMIT_LIFTED event; on failure: increments probe_failures counter, sends CEO notification at threshold 10 (once per episode via _rate_limit_ceo_notified) - Add orchestrator._make_tracker(): injectable factory for RateLimitStateTracker - Add orchestrator._do_probe(): overridable async bool probe (default: True) - Add orchestrator._notify_rate_limit_ceo(): high-priority notification to CEO containing provider name, duration since activation, and paused agent count - Add roboco/api/routes/system.py with GET /rate-limits endpoint (AC9) - Register system_router in app.py under /api/system prefix - Add 17 unit tests in tests/unit/runtime/test_rate_limit_sweep.py covering all AC4/AC8/AC9 paths: probe success/failure, CEO threshold, endpoint schema Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> --------- Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> --------- Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-11 09:21:26 +02:00
Renn F	cc4ccb7ea3	fix(usage): capture agent token usage from the Claude Code transcript ... The token-usage pipeline was fully built — per-session SDK counters, /usage/status, the orchestrator finalize-fetch that writes token columns and estimated cost to the spawn-session row, the daily rollup, and the dashboard — but nothing ever populated the counters. /usage/report had zero callers, so every session reported zero tokens and the cost dashboard rendered all-zeros. A redeploy could not fix code that was never written. Close the loop with the producer that was missing. Claude Code does not pass token counts to hooks, but it does pass the session transcript path, and each assistant entry records its API call's usage. Add: - POST /usage/sync, which parses the transcript and *sets* the cumulative totals absolutely (idempotent — re-syncing the same or a grown transcript overwrites, never double-counts), with a (size, mtime) short-circuit so an unchanged transcript skips the re-parse. - usage-report-hook.sh, which hands the SDK the transcript path. Registered on PostToolUse (keeps mid-run snapshots and reaped-agent sessions accurate) and Stop (guarantees a final sync at turn end before finalize reads the totals). Field mapping verified against a real Claude Code transcript: message.usage.{input_tokens, output_tokens, cache_read_input_tokens, cache_creation_input_tokens}. Unit tests cover summation, idempotency, growth, a missing transcript, and malformed lines.	2026-06-11 07:46:19 +02:00
Renn F	e0cd305844	docs(cell-pm): require mapping every cell criterion to a subtask before idling ... Decomposition is where scope silently disappears: a cell PM delegates a subtask covering most of its acceptance criteria, idles, and the uncovered criteria have no subtask, no dev, and no branch — the gap surfaces only at submit_up or, worse, at QA/CEO review, forcing a full cell revision loop. Add a Coverage section to the cell-PM prompt that pulls the every-criterion- has-a-home discipline forward from the submit_up checklist to decomposition time. Before idling after a delegate, the PM must account for every cell criterion as one of exactly three outcomes — covered now, covered later in a sequenced follow-on (recorded in the decision note), or out of cell scope (also recorded) — so a dropped criterion costs one extra delegate instead of a whole revision loop. Reinforces that on respawn the anti-re-decompose rules will block recovering dropped scope, so coverage must be mapped up front.	2026-06-11 05:59:43 +02:00
3 people	ff35a646fa	Chore: reduce analytics complexity (#100) ... * refactor(analytics): reduce cyclomatic complexity in usage/pricing/rollup Collapse the three near-identical get_by_* aggregation methods in UsageService into a shared _aggregate_by helper parameterized by group column and key name, and centralize token null-coalescing in a _row_tokens helper. Extract the per-row upsert in _sweep_daily_rollup into _upsert_rollup_row, and the pricing-table lookup into _lookup_prices. All blocks now rank <= B and both modules rank A, so the xenon gate passes; behavior is unchanged and existing tests stay green. * feat(billing): make token pricing provider-aware Distinguish three cases when a model has no per-token rate: a non-Anthropic model (local Ollama, or an Ollama Cloud ":cloud" model billed by flat subscription / GPU-time) legitimately has no per-token cost and returns 0.0 silently; an unpriced Anthropic ("claude"-named) model also returns 0.0 but logs a warning, since that is real spend being undercounted and catches new or renamed Claude models missing from the table. Folds the old ollama/ prefix special-case into the general non-Anthropic path so there is one code path, and replaces the blanket 'no pricing data' warning that fired even for self-hosted models. * fix(tasks): preserve ownership when force-unclaiming to pending The stale-claim reaper and the dependency-blocked release both routed through _force_unclaim_to_pending, which nulled assigned_to and left the task in a pending state owned by nobody — no dispatcher re-spawns an ownerless pending task, so it went dormant. The dispatcher-side claimed_by fallback only masked half the cases. Capture the owner before releasing the claim and keep both assigned_to and claimed_by pointed at it (mirroring the unblock restore), releasing only the live claim (active_claimant_id + heartbeat) and the WorkSession. The same agent now resumes the task once it re-dispatches. Updates the reaper test that asserted the old orphaning behavior and adds owner-preservation coverage for both the reaper and dependency-release paths. * fix(tasks): unblock restores the owner into both ownership fields Audit follow-up to the force-unclaim ownership fix. unblock() only restored assigned_to from blocker_raised_by, which block() stashes solely from assigned_to. A task claimed via give_me_work (claimed_by set, assigned_to null) therefore unblocked into a split-owner state — assigned_to null but claimed_by set — that both the dev dispatcher and the PM pool-router race to pick up. It also left claimed_by pointing at the resolver PM after an escalation. Resolve the owner as blocker_raised_by or assigned_to or claimed_by and write it to both fields, matching the force-unclaim and reassign convention so the original worker resumes cleanly. Adds coverage for the give_me_work-claim case and asserts owner restoration on the existing in_progress-resume test. * test(orchestrator): cover dev owner resolution and the claimed_by fallback _resolve_dev_owner_uuid had no coverage. Add the status-dependent precedence (claimed/blocked prefer the live claimant; other statuses prefer the PM-assigned owner) and the half-reap fallback where a pending task with assigned_to nulled still resolves its owner from claimed_by instead of going dormant. * fix(tasks): wire the pre-block snapshot so unblock(restore=True) works The restore=True path on a PM unblock was a no-op: pre_block_state / pre_block_assignee (migration 006) were read by unblock_with_restore but never written, so it always fell through to legacy unblock() and the restore flag did nothing. Snapshot the resting status + owner at every block entry (dependency block, soft block, escalation) before mutating, capturing only the first block in a chain so a re-block doesn't overwrite the original state. Escalation snapshots the outgoing owner, not the escalation target, so restore returns the original worker. The restore path applies the same branchless guard legacy unblock() relies on — a snapshotted in_progress with no branch diverts to pending instead of looping the dispatcher — and is extracted into _apply_pre_block_restore to keep complexity under the gate. Adds coverage for snapshot capture, restore, the branchless divert, and escalation owner restoration. * test(tasks): update orphan-reconciler and dependency-release tests for owner preservation Both the startup orphan reconciler and the dependency-blocked claim release route through unclaim_for_reaper / _force_unclaim_to_pending, which now preserve the owner instead of nulling assigned_to. Update the two tests that asserted the old orphaning behavior to assert the owner is kept (so the same agent resumes) while the live claim is released. * chore(tests): scrub internal work-item labels from test names, docstrings, comments Rename four test files that carried audit work-item IDs in their filenames (test_p0_7_branch_atomicity, test_p2_8_orphan_reconciler, test_p2_9_autogen_prompt_layer, test_p2_7_attempt_id) to describe what they test, and strip the matching P-/D-/S- cluster labels from docstrings, comments, and assertion messages across the test suite and two orchestrator comments. These are internal references with no meaning in the codebase; behavior is unchanged. * style: reformat assertion line shortened by the internal-ref scrub * build: waive unreachable torch CVE-2025-3000 in pip-audit gate torch is a transitive CPU-pinned dep (piragi / sentence-transformers) never loaded at runtime — the stack uses Ollama over HTTP for all embeddings/LLM, so the vulnerable torch.jit.script path is unreachable. CVE-2025-3000 is MEDIUM, local-only, with no published fix. Documented --ignore-vuln waiver; revisit when a fixed torch ships. * fix(orchestrator): route unplaceable pending tasks to main-pm instead of dropping them _get_routing_target returned None when a 'dev'-classified task had no cell agent (no team, or a non-cell team like fullstack/system) or when the routing classification was unrecognized. _route_unassigned_pm_task logged 'no routing target found' and returned, leaving the task ownerless and pending — and no dispatcher re-spawns an unrouted pending task, so it went dormant for 10+ min until the stuck-task detector caught it. Fall back to main-pm (the same default cell_pm routing and escalation already use) so the task is always owned and triaged, never stranded. Logs the fallback so unplaceable tasks stay visible. Adds a test asserting no (routing, team) combination ever resolves to None. * fix(panel): make intake chat markdown inherit the bubble's text color MarkdownBody is shared by the assistant (text-foreground) and user (text-primary-foreground) bubbles. [&_*]:!text-inherit only colored the prose div's descendants, so the prose div itself kept the prose typography body color (gray) and children inherited that — unreadable on the muted assistant bubble. Add !text-inherit on the prose div itself so it inherits the bubble's color too; descendants then inherit the correct foreground. Fixes both bubbles without hardcoding a color. * fix(prompter): keep a board-reviewed product on the board team so Approve & Start shows A product coordination root confirmed via 'Board review & Start' is assigned to a board reviewer (product-owner) for review, but create_task_from_draft set team=main_pm for every product unconditionally. The CEO's Approve & Start gate keys on team=board, so the button never appeared — and because the owner stayed a board agent while the team said main_pm, the dispatcher routed it to the board path (nothing left to do after review) and the task stranded at pending, with the board agent fruitlessly trying to escalate it up. Route a product by its assignee: a board reviewer keeps it team=board (so the gate appears and approve_and_start later hands it to Main PM), while a main-pm assignee — the 'Approve & Start' straight-through path — is team=main_pm. Adds _assignee_is_board mirroring TaskService's board-role check, and a test. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-11 04:36:17 +02:00
5 people	b3057628b0	[499f9eb1] Token Usage & Cost Analytics — Full-Stack Instrumentation, Persistence, and Visualization (#90) ... * [cd2bf666] feat(usage): add token usage types, API client, hooks, and UI components (#87) (#88) - Append 5 TypeScript interfaces to src/types/index.ts: TokenUsageSnapshot, AgentUsageRow, UsageSession, UsageTimePoint, ModelUsageSlice - Create src/lib/api/usage.ts: Axios singleton + isMockMode guards for getUsageSnapshot, getUsageTimeSeries, getAgentUsage, getUsageSessions, getModelUsage - Create src/hooks/use-usage.ts: usageKeys factory + useUsageSnapshot, useUsageTimeSeries, useAgentUsage, useUsageSessions, useModelUsage hooks - Create UsageOverviewPanel (dashboard/usage-overview-panel.tsx): 6 metric rows with Skeleton loading state; week-over-week trend arrow for cost - Update CommandCenter: Metrics+Alerts row expanded from 2-col to 3-col grid adding UsageOverviewPanel - Create src/components/metrics/ folder: UsageTimeSeriesChart (recharts stacked AreaChart with var(--chart-1/2/3)), ModelUsageDonut (PieChart), AgentUsageChart and TeamUsageChart (BarChart), SessionsTable (sortable columns + 10-row Prev/Next pagination) - Update Metrics page: Token Usage & Costs section with 5 rows (summary cards, time series+donut, agent+team bar charts, projection+cache efficiency, sessions table) - Add usage mini-bar to AgentCard: token count + cost + progress bar; AgentGrid and Agents page pass agentUsageMap through - Install recharts 3.8.1 - Export all new symbols through their barrel index.ts files Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> * [10372f0f] Implement full token usage instrumentation: DB migration, SDK endpoints, orchestrator hooks, analytics API, WebSocket events, dashboard integration (#86) (#89) * [10372f0f] feat(token-usage): add Alembic migration 026 for token usage tables Create agent_spawn_sessions, token_usage_snapshots, and daily_usage_rollups tables with correct BIGINT columns, indexes, and unique constraint. Chain: 025_agentrole_prompter → 026_token_usage_tables. * [10372f0f] feat(token-usage): add ORM table classes for token usage instrumentation Add AgentSpawnSessionTable, TokenUsageSnapshotTable, DailyUsageRollupTable to db/tables.py. Import BigInteger and Date from SQLAlchemy. All columns match the migration schema with BIGINT token counts and proper indexes. * [10372f0f] feat(billing): add pricing module with calculate_cost() function Create roboco/billing/__init__.py and roboco/billing/pricing.py with calculate_cost() supporting Claude opus/sonnet/haiku models with input/output/cache pricing. Unknown models return 0.0 without raising. * [10372f0f] feat(sdk): add POST /usage/report and GET /usage/status endpoints to agent SDK Extend _SessionState with token counters. Add TokenReportRequest and TokenUsageStatus models. POST /usage/report additively accumulates token counts; GET /usage/status returns current session totals for sweeper polling. * [10372f0f] feat(orchestrator): add token usage instrumentation hooks - _launch_spawn() calls _record_spawn_session() after successful container spawn - stop_agent() calls _finalize_spawn_session() before container removal - _run_sweep() calls _sweep_token_snapshots() and _sweep_daily_rollup() each tick - New methods: _record_spawn_session, _finalize_spawn_session, _sweep_token_snapshots, _sweep_daily_rollup in TOKEN USAGE section * [10372f0f] feat(api): add token usage analytics API with 7 endpoints Create roboco/services/usage.py (UsageService) and roboco/api/routes/usage.py. Endpoints: GET /api/usage/summary, /time-series, /by-agent, /by-team, /by-model, /projection, /cache-efficiency. Register in app.py. * [10372f0f] feat(dashboard): add usage_summary field to CEO dashboard Add UsageSummary schema (tokens_today, cost_today_usd) to dashboard schemas. Add usage_summary: UsageSummary | None to CEOOverview. Update get_ceo_overview() to populate usage_summary from daily_usage_rollups. * [10372f0f] fix(billing/tests): remove dead except block in _sweep_daily_rollup, add unit tests for pricing.py and services/usage.py - Remove unreachable `except Exception as e` block in orchestrator.py _sweep_daily_rollup() (lines 3376-3381) which referenced undefined `agent_id` and was copy-pasted from _sweep_token_snapshots by mistake - Add tests/unit/billing/test_pricing.py: 31 tests covering opus/sonnet/ haiku tiers with all 4 token types, unknown model → 0.0, empty string → 0.0, and substring-match priority (longer fragment wins) - Add tests/unit/services/test_usage.py: 25 tests covering get_summary trend_pct edge cases (prev=0, both=0, prev>0), get_by_agent/team/model pct_of_total summing to 100%, get_projection formula (avg_daily×30), and get_cache_efficiency hit-rate and cost_saved arithmetic - pricing.py: 100% coverage; services/usage.py: 83% coverage (>80% target) * [10372f0f] fix(usage): include cache tokens in time-series total_tokens to fix AC9 consistency violation get_time_series() previously computed total_tokens as tokens_input + tokens_output only. get_summary() includes all 4 token types (input + output + cache_read + cache_write). AC9 requires both endpoints to agree on their totals for the same period. Fix: add tokens_cache_read and tokens_cache_write to the SELECT query in get_time_series() and include them in the total_tokens calculation. Also adds 4 new unit tests in TestGetTimeSeries covering: - total_tokens includes cache_read and cache_write (the AC9 guard) - zero cache tokens still produces correct total - empty result returns empty list - required fields are present in each point * [10372f0f] fix(usage): remove unused imports and include cache tokens in breakdown totals (AC10) - Remove import math (F401 — never used) - Remove text from sqlalchemy import (F401 — never used) - Remove unused local calculate_cost import inside get_cache_efficiency (F401) - Add tokens_cache_read and tokens_cache_write to SELECT in get_by_agent, get_by_team, and get_by_model; update grand_total and per-item total to include all 4 token types so totals match get_summary() (AC10 fix) - Update test mock rows to include explicit tokens_cache_read=0 and tokens_cache_write=0 so they work with the fixed code - Add new test cases: test_cache_tokens_included_in_total_tokens and test_pct_of_total_sums_to_100_with_cache_tokens for each breakdown class --------- Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> * [44b9eb1f] feat(usage): align frontend API client, TS types, and chart components to real backend contract (#92) (#94) Update all usage-related frontend code to match the actual FastAPI backend response shapes and endpoint paths: - panel/src/lib/api/usage.ts: rewrite all 7 API functions to use correct endpoint paths (/usage/summary, /usage/by-agent, /usage/by-model, /usage/by-team, /usage/time-series, /usage/projection, /usage/cache-efficiency); send period query param (24h/7d/30d not hours); mock generators produce data matching real backend shapes exactly; getUsageSessions returns [] in prod (no /usage/sessions endpoint exists) - panel/src/types/index.ts: replace TokenUsageSnapshot with UsageSummary (tokens_input/tokens_output/total_cost_usd/trend_pct); update AgentUsageRow to use agent_slug/total_tokens/cost_usd/pct_of_total; add TeamUsageRow, UsageProjection, CacheEfficiencyResponse; update UsageTimePoint to use bucket field; update UsageSession to use agent_slug - panel/src/hooks/use-usage.ts: rewrite all hooks to match new API and types; add useTeamUsage, useUsageProjection, useCacheEfficiency hooks - panel/src/components/metrics/usage-time-series-chart.tsx: use bucket field (not timestamp) for axis labels - panel/src/components/metrics/agent-usage-chart.tsx: use agent_slug and total_tokens (not agent_name/tokens_today) - panel/src/components/metrics/team-usage-chart.tsx: rewrite to accept TeamUsageRow[] from API directly - panel/src/components/metrics/model-usage-donut.tsx: use total_tokens, cost_usd, pct_of_total (not tokens/cost/percentage) - panel/src/components/metrics/sessions-table.tsx: use agent_slug, sort keys updated - panel/src/components/dashboard/usage-overview-panel.tsx: use useUsageSummary with tokens_input/tokens_output/total_cost_usd/trend_pct - panel/src/app/(dashboard)/metrics/page.tsx: wire all new hooks, add TeamUsageChart, ProjectionCard, CacheEfficiencyCard with correct types - panel/src/app/(dashboard)/agents/page.tsx: key agentUsageMap by agent_slug - panel/src/components/agents/agent-card.tsx: use total_tokens and cost_usd Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> * [2161b832] fix: SDK_PORT constant, stop_agent lock refactor, usage_session_id binding, rollup 7-day window (#93) (#95) - Add SDK_PORT = 9000 module-level constant to orchestrator.py; replace hardcoded 9000 in _sweep_budget_exceeded URL with SDK_PORT - Add UUID to TYPE_CHECKING imports to satisfy ruff F821 - Refactor stop_agent: call _finalize_spawn_session BEFORE acquiring self._lock so the SDK HTTP round-trip does not hold the lock - Add usage_session_id: UUID | None field to AgentInstance dataclass - Change _record_spawn_session to return UUID | None; wire return value back to instance.usage_session_id in _launch_spawn - Update _finalize_spawn_session to use WHERE id=usage_session_id for direct session row lookup when usage_session_id is not None - Add started_at >= (now_utc - 7 days) filter to _sweep_daily_rollup aggregate query to avoid re-aggregating all-time history each sweep Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> * [2e0759e1] fix: pricing accuracy, import ordering, session-id binding, rollup cleanup, write-hook tests (#97) (#98) - pricing.py: correct claude-opus-4 prices (5/25/0.50/6.25 not 15/75/1.5/3.75) and haiku family prices (1/5/0.10/1.25 not 0.8/4/0.08/0.20); add Ollama zero-cost early-return; add structlog warning for unmatched model names - app.py: move usage_router import before routes.v1 block (ruff isort fix) - orchestrator.py _sweep_daily_rollup: remove unused calculate_cost import; add blank line between stdlib (uuid4) and third-party (sqlalchemy) imports - orchestrator.py _sweep_token_snapshots: prefer direct lookup by instance.usage_session_id; fall back to agent_slug heuristic only when None - tests: add test_sweep_daily_rollup_inserts_new_row and test_stop_agent_finalizes_before_lock to test_orchestrator_write_hooks.py - usage.py, routes/usage.py, stream_bus.py, test files: ruff format/lint fixes Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> * Mypy compliance * fix(migrations,tests): linearize forked migration chain + correct ceo_reject coordination-root expectation The master merge brought in 026_completed_dependency_ids alongside the rework's 026_token_usage_tables — both off 025, forking the alembic head and breaking the enum-parity test. Rebase token-usage onto 026_completed_dependency_ids (linear chain, single head). Also: test_ceo_reject_routes_coordination_task_to_main_pm asserted the old NEEDS_REVISION behavior; the lifecycle fix correctly routes a coordination root to PENDING (Main PM's claim source). Update the assertion. --------- Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-10 14:38:44 +02:00
Renn F	93c6ef8a57	chore(compose): raise stale-claim reaper timeouts to 30m so long agent tasks aren't reaped mid-work	2026-06-10 13:43:55 +02:00
Renn F	06b0802f32	fix(orchestrator): dispatch pending tasks to claimed_by when assigned_to was cleared ... A stale-claim reap can leave a task pending with assigned_to nulled but claimed_by still set. _resolve_dev_owner_uuid only fell back to claimed_by for claimed/blocked, so for pending it saw no owner and the dispatcher never respawned anyone — the task went dormant. Fall back to claimed_by for pending too, so the orchestrator still knows who to call after a half-reap.	2026-06-10 13:36:57 +02:00
Renn F	04dd132009	fix(tasks): CEO-reject of a coordination root routes to pending, not needs_revision ... A CEO reject sent the root to NEEDS_REVISION, but that status is developer-claim-only — a coordination/integration root (project_id NULL + product_id set) has no developer, so the Main PM that owns it could not re-claim, escalated to the Board, and the task deadlocked in blocked with no forward state. ceo_reject now detects the coordination root and routes it to PENDING (the Main PM's claim source) with the claim cleared, via the audited admin_set_status override (awaiting_ceo_approval->pending has no in-band transition). Non-coordination tasks keep the normal needs_revision->developer path. Test pending (test DB was down mid-incident).	2026-06-10 13:23:27 +02:00
Renn F	f3e4f8aeb7	fix(permissions): give the CEO full authority over every task action ... The panel operates as the CEO, but most task-action routes gated to (assignee | cell_pm/main_pm) and omitted the CEO — so the CEO could approve (CEO-only routes) yet got 403 ACCESS_DENIED on unblock, block, reassign, update, delete, cancel. The whole UI write-path was unusable. can_perform_task_action() now short-circuits true for the CEO (fixes update/reassign, delete, cancel and anything routed through it), and the inline block/unblock checks add AgentRole.CEO. The override is a CEO-only early return, so it cannot affect any other role.	2026-06-10 13:02:53 +02:00
3 people	b9082a5c70	Fix: agent idle deadlock and lifecycle hardening (#96) ... * fix(panel): cap dialog height and pin footer so actions stay reachable Shared DialogContent now caps at max-h-[85vh] with overflow-y-auto, and the footer is sticky to the bottom. Long content (e.g. a pasted change-request note) no longer pushes the submit/cancel buttons past the viewport — the body scrolls while the actions stay visible. No-op on dialogs that already fit. * feat(notifications): suppress duplicate same-purpose notifications at send A notification is not created when an unacknowledged one with the same purpose — same sender, same type, same task, overlapping recipients — already exists. Body text is not compared, so rewording cannot defeat it; a different type, task, sender, or an already-acked recipient all still send through. Stops agents that loop re-issuing the same signal from piling up unread that soft-blocks the recipient's idle path. * fix(gateway): stop board/PM lifecycle verbs from 500-crashing Two unguarded crashes that wedged the org in respawn/escalate loops: - escalate_to_ceo dereferenced None.status when the verb runner declined the escalation (task not in awaiting_pm_review — e.g. a board agent escalating a blocked task). It now returns a clean invalid_state. The message/remediate build moved to a helper so the function stays within the complexity gate. - The coordination-root git ops (pr_target, pr_merge, PR update, branch-token resolve) called UUID(str(task.project_id)) directly, which raised on a coordination/integration task (project_id is None — 'badly formed hexadecimal UUID string'). They now resolve through _project_for_task, which falls back to the product's repo for project-less roots. * refactor(intake): split out _block_to_chunk per-block classifier Extract the per-block classification from _blocks_to_chunks so each function stays within the xenon cyclomatic-complexity gate (was rank C). Behaviour is unchanged — verified by the existing intake_driver tests. * feat(gateway): make the i_am_idle unread soft-block satisfiable The soft-block on unread A2A / @mentions had no clearing path, so once those briefing fields populated an agent could never idle — a whole-org deadlock. Keep the guard (it is correct) and add the missing clear paths: - New read_messages content verb (schema -> route -> handler -> a2a.mark_all_read -> MCP tool -> role do_tools): bulk-zeroes the caller's unread A2A and stamps read_at. The idle hint now points to it. - list_unread_mentions returns UNACKED MENTION-type notifications (each @mention already raises one via messaging._notify_mentions) instead of raw, unconditional mentions, so they clear via the existing notify_ack. No schema migration needed. The soft-block is now satisfiable: A2A via read_messages, mentions and notifications via notify_ack. * fix(tests): repair notification-dedup db.scalar mocks + prompter agent seeding The notification send-dedup added a db.scalar() purpose-lookup to _create_notification; the two hand-rolled _FakeDb test stubs (test_notification, test_a2a_priority_tristate) had no scalar() method → AttributeError. Add scalar() returning None (no duplicate) so creation proceeds. Separately, the prompter '& Start' route tests assign the draft to a fixed product-owner / main-pm AGENT_UUID but only seeded system + CEO, so the assigned_to FK failed in isolation (and main-pm flaked in the full suite). Seed both via idempotent merge() in _seed_project_and_ceo. * fix(git): gitignore .pnpm-store + flag GH001 push rejection as permanent A dev once committed the ~115 MB pnpm store → GitHub GH001 (>100 MB) pre-receive reject → open_pr retry-loop. Two root fixes: - Add .pnpm-store/ to .gitignore — an ignored dir can't be staged by any git add. - push() restates a GH001 / file-size rejection as an unmistakable PERMANENT error pointing at i_am_blocked, so the agent stops blind-retrying a push that can never succeed (it otherwise mis-reads the raw output as a transient timeout). The per-verb retry cap (open_pr: 5) already bounded the burn; this ends it. * fix(gateway): accept a PM decision note as satisfying the complete/submit_up reflect gate A cell/main PM that wrote a fresh decision but no separate reflect note bounced on the reflect tracing-gate indefinitely (re-confirmed live: cell PMs looped on cell_pm_complete -> journal:reflect until reaped, burning tokens — worse because each respawn resets the per-verb retry cap). For a PM closing/submitting a task the decision note already documents the close; the separate reflect is the redundant artifact weak-model PMs forget. Accept a fresh decision as satisfying reflect for complete + submit_up — the gate still requires a decision + substantive notes, so the close stays documented. NOTE (enforcement tradeoff, flagged for CEO review): this intentionally relaxes the PM complete/submit_up gate. It does NOT touch the developer i_am_done gate. * feat(gateway): refuse i_am_idle when a PM still owns a task awaiting its review A cell/main PM once tried to 'send work back' by DMing the developer and going idle — but a DM changes no task state, so the task stayed awaiting_pm_review and the orchestrator just re-dispatched the PM in a loop. i_am_idle now refuses (like the pending-assignment guard) when a PM owns an awaiting_pm_review task, with a clear remediation: complete() to finish, or reassign()/delegate() to route it back. PM-only; devs/QA/doc unaffected. Pairs with the reflect-gate relaxation so the PM can actually complete instead of looping. * feat(gateway): push a prior-work handoff digest into task-scoped briefings A freshly spawned or respawned agent previously started cold on every lifecycle hand-off: the prior worker's PR, commits, acceptance status and journal highlights lived in task evidence but were pull-on-demand, so each new role agent re-explored the codebase from scratch — wasted tokens and fragile context loss across respawns. build_task_handoff() composes a compact, DB-only digest (no git diff) and _briefing_for() now attaches it to context_briefing whenever the caller already holds the task row. The digest is built only from a passed-in task, so there are zero extra fetches: every resumption entry point (give_me_work and pm_give_me_work, i_will_work_on, i_will_plan, triage/triage_all, i_am_done, submit_up, escalate_up, complete) threads the loaded task, while id-only correction/rejection paths cleanly omit it. Every field is type-guarded so a partial row never leaks a non-serialisable value into the envelope. * docs(prompts): tell agents to resume from the briefing handoff before re-exploring The base prompt described the success envelope but never told agents to act on context_briefing, so a respawned or hand-off agent would re-scan the whole repo and re-derive the plan even when the briefing already carried the prior worker's PR, commits, acceptance status and journal highlights. Adds a 'Resume from your briefing' section that walks each task_handoff field and instructs the agent to continue from it — and to read the unread A2A / mention / notification lists, which are messages addressed to them. Pairs with the gateway change that now pushes task_handoff into every task-scoped briefing. * feat(tasks): remember cleared dependencies so the unblock briefing can surface them When an upstream dependency completed, _unblock_dependents removed its id from the dependent's dependency_ids to let it be claimed — destroying the only record of which upstream task had just landed. The revived dependent then re-discovered that work from cold. Adds tasks.completed_dependency_ids (Alembic 026, uuid[] default '{}'): _unblock_dependents now appends the cleared id there instead of only dropping it, and the briefing handoff digest surfaces it so the agent picking the task back up knows its blocker cleared because that upstream work shipped. The base prompt documents the field. Migration round-trip verified against postgres (upgrade adds the column, downgrade drops it). * docs(prompts): instruct PMs to split oversized tasks into per-concern subtasks A subtask carrying a long acceptance list or spanning multiple layers/files drove repeated QA failures and a PM revision loop — QA can't pass a partial, and the dev keeps re-touching unrelated parts. Nothing in the PM prompts told them to decompose by size/concern. cell_pm gets a 'Sizing' rule: one subtask = one focused concern with ~2-4 criteria and its own dev->QA pass; decompose anything larger before delegating, sequencing with dependencies. main_pm gets a matching reminder to scope each cell's slice to that cell's layer rather than handing a cell a cross-layer monolith that just pushes the problem down a level. * fix(gateway): mirror the task= kwarg on ChoreographerHelpers helper signatures The handoff-digest change added a keyword-only task= parameter to _briefing_for and _build_tracing_gap in _impl, but the ChoreographerHelpers base that the role mixins inherit still declared the old signatures, so the composed Choreographer had two incompatible base definitions (mypy [misc]). Sync the base declarations to match. * fix(tasks): keep the owner on a substitute-out so the task isn't orphaned build_substitute_update unconditionally nulled assigned_to, so any substitute that routes to PENDING (max_retries, low_context, out_of_scope_*) — the path a verb hitting repeated 500s or its retry limit takes — left the task pending AND unassigned. The dispatcher only respawns a pending task when it has an owner, so the task went dormant: no agent ever picked it back up. Keep the task with its current owner instead. A substitute-out is almost always a transient stall, so the task re-dispatches to the SAME agent, which resumes from the briefing handoff. Only the task_complete -> PM-review handoff changes owner (unchanged). * feat(a2a): suppress duplicate unread A2A messages at send A respawned or retrying agent could re-emit the same DM, stacking identical copies on the recipient's inbox and re-bumping the unread count — noise that the recipient then has to clear. The notification path already dedups; A2A did not. send_chat_message now suppresses a send when an identical message from the same sender is still unread in the conversation, keyed on (conversation, sender, message_kind, content). Genuinely different messages are never collapsed (verified: distinct content still produces distinct rows), so this avoids the earlier per-pair over-suppression. No migration. * fix(panel): default the notifications view to Unread, not All Landing on the All tab buried new notifications under everything already seen — the most-reported annoyance. The Unread tab is the actionable view, so make it the default; the All/Pending tabs are one click away. * fix(panel): show clone progress during intake prep instead of a frozen pill The first clone of a repo can take a few minutes, during which the intake form showed only a static 'Preparing the agent…' button — indistinguishable from a hang. Add a progress region while preparing: an elapsed timer, a saturating progress bar (approaches but never reaches 100% until the agent actually answers), and staged copy (spinning up → cloning → first-clone-takes- a-while → reading the codebase) so the wait reads as work, not a freeze. * feat(docs): index workspace-authored docs that never reached the RAG store Docs written through roboco_docs_write land at /app/docs on the orchestrator and index fine. But a documenter can also write docs with Edit/Write directly in its own clone (README, CHANGELOG, workspace markdown); those resolve to a /app/docs path that doesn't exist on the orchestrator, so the indexer reads nothing and the docs never become searchable — a cross-container miss with no shared mount to bridge it. On docs completion, capture each listed doc's committed content out of the branch (new GitService.read_file_at_branch, via git show) and write it server-side under /app/docs before indexing, so workspace-authored docs reach RAG too. Docs already present server-side are skipped; absolute paths and unreadable/uncommitted files are passed over best-effort. * feat(prompter): survive a browser reload by reconnecting to the live intake chat The intake chat lived entirely in React state, so a page reload wiped it and dropped the human back to the scope form — even though the agent container outlives the page. Now the chat persists a small TTL'd slice (session id, messages, scope, draft) to localStorage and, on mount, reconnects: it asks the new GET /live/{id}/status whether the session is still running and, if so, restores the history and reopens the SSE stream; if dead or expired it clears and shows the form. A full reload doesn't run React effect cleanup, so the navigate-away reap never fires on refresh and the session stays up. Backend adds the status endpoint + PrompterLiveRegistry.is_alive; localStorage is cleared on confirm, start-another, and SPA navigate-away. * chore: remove internal session-bookkeeping refs from code comments (part 1) Strip leaked task/finding numbers, Wave/Phase/cluster/audit labels from docstrings and comments across services, foundation policy, runtime, mcp, api schemas, and agent_sdk — they mean nothing to a repo reader and expose process internals. Wording preserved; only the labels dropped. Done by hand, one comment at a time (no scripted rewrite). _impl.py follows separately. * chore: remove internal session-bookkeeping refs from code comments (part 2) Finishes the manual scrub: the choreographer _impl.py docstrings/comments plus the remaining dogfood-run ('smoke-N') labels across runtime, mcp, foundation, api schemas, services, and agent factories. Reworded to describe the bug or behaviour in plain words; every label dropped. The repo source is now free of task/finding numbers, Wave/Phase/cluster/audit/smoke labels. By hand, one comment at a time. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-10 12:04:24 +02:00
3 people	48556a032b	Fix: CEO reject conduit and main pm routing (#91) ... * fix(tasks): deliver CEO change-requests to the reworker and route integration rejects to the Main PM ceo_reject previously appended the CEO's required-changes only to quick_context (never surfaced to an agent) and always reassigned to the original developer, so the feedback never reached whoever reworked the task and a coordination/integration root went to a developer instead of the Main PM. Now ceo_reject records the reason as a DECISION_LOG handoff journal entry — the channel evidence/journal_highlights already serves to the task's assignee — and routes a coordination task (no project, has product) to team=main_pm + the Main PM so it can delegate the rework. Leaf dev tasks still return to the original developer. The journal write is best-effort (author-exists guard) and never blocks a reject. Adds tests for the routing and the handoff-journal write. * feat(gateway): wire the agent context_briefing receive-path EvidenceRepo's agent-scoped methods were stubbed to return empty lists, so agents never received notifications, A2A DMs, @mentions, recent team activity, or in-lane blockers through their briefing — the system was effectively send-only. This implements all five as single capped queries over the live tables (plus a light task-metadata-gap check), mirroring the existing journal_highlights query. Each runs on the per-verb briefing path, so each stays a single LIMIT-10 indexed lookup. Unit tests cover the row mapping + empty paths; an integration suite exercises the real SQL (array contains, the a2a slug filter, team+status) against Postgres. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-10 02:26:45 +02:00
Renn F	4dc2ce2867	docs(changelog): align 0.1.0 entry — 20 agents + the Task Assistant ... The 0.1.0 entry said "18 AI agents" (reconciled to 20 today, matching the README, CLAUDE.md, and the how-to) and omitted the Task Assistant / intake Prompter — the headline feature of the release. Fix the count, add Intake to the hierarchy, and add the Task Assistant bullet. v0.1.0	2026-06-09 17:34:41 +02:00
3 people	9f8834155a	Feature: prompter gold upgrade (#84) ... * feat(prompter): make the assistant a RoboCo insider and fully wire launch The Prompter's intelligence lived in two thin static prompts, so it asked generic checklist questions and produced a flat task. The launch path was also only half-wired: the panel called the generic task-create endpoint with no project, bypassing the Prompter's own confirm flow. Interview brain - Rewrite the chat system prompt with RoboCo's org model, the task-spec standard, a dimensions playbook, and a reflect-back, 1-2-questions-per-turn, auto-stop discipline. - Inject the live projects/products list each turn so the assistant grounds questions in real surfaces and resolves the target itself. - Replace the brittle phrase-match readiness with a parsed roboco-meta control block (parse_readiness); the block is stripped from the visible reply and the turn now returns draft_ready + scale. Structured GOLD draft - Add first-class draft fields (objective, what_this_builds, the_work, notes) carried in the existing draft_data JSONB — no migration. - Compose the GOLD markdown description deterministically from those fields (compose_description); the model never hand-formats the body. Adaptive routing + wired launch - Confirm now runs through the Prompter confirm endpoint with the human's project/product choice and edited structured draft. - Single-cell targets a project and the cell team; a multi-cell feature targets a product and becomes a Main-PM coordination root that fans out. Frontend - Turn-envelope draft_ready (drop the duplicated phrase-match), structured draft card, confirm dialog with a project/product picker and a per-cell The Work editor, and the corrected priority labels (0 highest .. 3 lowest). * fix(prompter): commit session writes so they survive across requests Session create returned 201 but the row was never durably committed, so the immediately-following /messages call could not find it and 404'd. The prompter routes were the only write surface that never called db.commit() — every other write route (tasks, a2a, groups, docs, product) commits explicitly rather than rely on the request-teardown auto-commit, which is sensitive to middleware and teardown ordering under the production server. - Commit explicitly in all four prompter write routes (create session, send message, get/generate draft, confirm). - Fix _get_session's NotFoundError: it passed a full sentence as resource_type, producing the doubled "... not found not found" message; now uses the (resource_type, resource_id) signature. - Panel: when a message hits a session the server no longer has, start a fresh session and retry once instead of dead-ending on a stale id. Add a regression test that gives each request its own non-committing session — the real cross-request boundary the shared-session integration tests never crossed. It reproduces the production 404 without the route commit and passes with it. * refactor(prompter): drop the "GOLD" jargon for plain wording "GOLD" was informal shorthand for "a good/well-formed spec" that should never have been baked into the LLM prompts, comments, and docstrings as if it were a defined term. Replace it everywhere with plain language ("a well-formed task", "a complete task spec", "the markdown description", "structured spec fields"). No behaviour change. * feat(intake): add the intake interviewer agent role (static definition) Phase 1 of the intake-agent feature: a new first-class `prompter` role — the intake interviewer the CEO chats with to draft a task. This commit defines the role across every foundation layer (no runtime yet); spawning + the live session come next. - identity: Role.PROMPTER, RoleLevel.INTAKE (lowest authority), an AGENTS row (intake-1) on the board team, ROLE_LEVEL entry. Deliberately NOT in BOARD_ROLES — it interviews, it does not review. - lifecycle: gets i_am_idle like every agent (its only verb); no delivery-lifecycle intents. - journaling: ReadTier.OWN — isolated, reads only its own journal. - role_config: human-only manifest — note + evidence only, no say/dm/notify/ channels; allows_subagent=True (research), allows_write=False. - agents_config derives it automatically and correctly excludes it from TASK_CREATOR_ROLES (it drafts, it never creates tasks). - seed presentation ("Intake"); regenerated lifecycle artifacts. - role system prompt: read the code first, single-CEO awareness, propose rather than interrogate — written against the failures we saw. - docs: roster count 19 -> 20, org charts, verb-surface table, usage roster. All foundation drift checks pass; role/manifest/permission tests green. * feat(intake): migrate agentrole enum to add 'prompter' ALTER TYPE agentrole ADD VALUE IF NOT EXISTS 'prompter' so the intake agent row seeds/spawns against a migrated production DB. Forward-only (postgres can't drop enum values), guarded for offline mode — matches migration 012. * style(intake): ruff format the role additions * fix(intake): unguard the agentrole migration so it renders offline The enum-migration-parity test renders 'alembic upgrade head --sql' (offline) and greps for ALTER TYPE ... ADD VALUE. The is_offline_mode() guard skipped emitting it, so the parity check couldn't see 'prompter'. Drop the guard — PG16 permits ADD VALUE in a transaction, same as migration 020's backfill. * feat(intake): the live-session driver (Claude Agent SDK loop) Phase 2 begins. The intake agent isn't a one-shot `claude -p`; it's a live Claude Code session the human chats with. This driver is the container's loop: open one long-lived claude-agent-sdk ClaudeSDKClient, then per human message run a turn (query + receive_response) and stream its events out, keeping conversation context in-process — verified against the real SDK (v0.2.94). - StreamChunk + normalize(): map SDK messages (StreamEvent text deltas, AssistantMessage text/thinking/tool_use blocks, ResultMessage→session_id) to panel-facing chunks. Duck-typed, so it works on real SDK objects and on test fakes alike — SDK-free, fully unit-tested. - IntakeDriver.run(): the loop, with injected session/source/sink seams; a turn failure surfaces as an error chunk without killing the session. - SdkIntakeSession + build_intake_options: the only SDK-coupled code (lazy import; needs the live claude binary, so excluded from coverage). - Add claude-agent-sdk dependency + mypy ignore-missing-stubs. Relay, panel SSE, and the persistent on-demand spawn are the next steps. * Updated uv.lock * feat(intake): the panel<->agent live bridge (registry, routes, entrypoint, image) Wires the live intake chat end to end (Phase 2 integration layer): - prompter_live.py: the orchestrator-side per-session registry — open/close, push (agent->panel), stream (SSE drain), deliver (panel->container). In-process (the orchestrator is single-process). 7 unit tests. - routes/prompter_live.py: GET /live/{id}/stream (SSE), POST /live/{id}/messages (deliver), POST /live/{id}/events (relay in); registered under /api/prompter. 5 integration tests. - agent_sdk/intake_main.py: the container entrypoint — a POST /turn receiver (the driver's MessageSource) + a relay-poster EventSink + the ClaudeSDKClient session, run concurrently. 4 unit tests on the wiring helpers. - docker/agent-prompter.Dockerfile: FROM base, ENTRYPOINT = the driver (not the one-shot `claude` the other agents use). Remaining for Phase 2: the orchestrator persistent-spawn path (scope->workspace clone, CMD = driver, registry.open on spawn, reap-on-confirm) — the deploy-side piece, best finalized against a buildable image. * feat(intake): orchestrator persistent spawn + start/stop for the live chat Add the task-free spawn path for the intake (prompter) agent: one fixed intake-1 container running the Agent-SDK driver (image ENTRYPOINT, not claude -p), one live session at a time. - spawn_intake_session clones the scope's repo(s) via WorkspaceService (project -> one; product -> each distinct project, primary first), composes the intake-1 prompt, resolves the model, and builds docker run via _build_intake_run_cmd: no settings/hook mount (driver owns 9000), no MCP config, no -w; registers the live relay and best-effort delivers the opening message once the receiver is up. - reap_intake_session closes the relay and stops the container. - Routes: POST /live/start (project XOR product) and POST /live/{id}/stop. - ROLE_MODEL_MAP[prompter]=opus; intake-1 -> roboco-agent-prompter image map. - Replace the budget-sweep try/except/continue with _fetch_budget_status, which logs the swallow at debug instead of silently dropping it. 25 new tests; docker + the clone are mocked. End-to-end container spawn is pending a built image and the stack. * feat(intake): wire /prompter to the live agent — scope form + SSE chat Replace the Ollama chat loop on /prompter with the spawned-agent flow. - IntakeForm: pick scope (project XOR product) + opening message + Start before the chat; the agent clones that scope and reads the real code. - use-prompter rewritten as the live brain (lib/api/prompter-live.ts): Start spawns via POST /live/start, then an EventSource on /live/{id}/stream streams the agent working — token deltas fill the assistant bubble, tool_use/thinking drive a live activity line, a draft event renders the existing DraftProposalCard. Messages go via POST /live/{id}/messages. - Chat UX unchanged (Keep Chatting / Review & Confirm / ConfirmDialog reused); reap-on-confirm and reap-on-leave call POST /live/{id}/stop. - Drop the dead Ollama prompterApi client; trim prompter.ts to shared types. Frontend gate green (tsc --noEmit, lint, build). The draft event + the /live/{id}/confirm endpoint are the Phase 4 backend seam. * feat(intake): confirm draft -> backlog task + agent draft emission Complete the live intake vertical: the agent proposes a structured draft and Review & Confirm turns it into a task. - Draft emission: the prompter prompt instructs the agent to emit a fenced roboco-draft JSON block when the spec is ready; the driver parses it into a 'draft' event over the existing relay -> the panel's DraftProposalCard. The panel strips the raw block from the chat bubble. - Fix a double-text bug: with include_partial_messages the reply arrives as both StreamEvent deltas and the final AssistantMessage; the driver now takes text from deltas only and the AssistantMessage for thinking/tool_use/draft. - POST /live/{id}/confirm -> confirm_live_draft, reusing a draft->task core extracted from confirm_draft; reaps the session on success. - Both prompter confirm paths create at BACKLOG, not pending: backlog is the holding area a draft waits in until it's reviewed and promoted to pending (TaskService.activate). The legacy Ollama confirm was creating at pending, skipping that gate — fixed. - Remove the dead 'context' bootstrap param from the Ollama session-create chain (schema + route + method + tests), superseded by the live scope form. - No suppressions: replace every type:ignore/noqa across the intake surface with a real fix (ORM .id -> UUID(str(x)); fakes -> monkeypatch.setattr; lazy imports -> pyproject per-file ignore; union-attr -> recipients[0]). Full make quality green; frontend tsc + lint green. * build(intake): add the agent-prompter image builder to compose The orchestrator references roboco-agent-prompter (AGENT_IMAGES + the _ensure_agent_image dockerfile map) and docker/agent-prompter.Dockerfile exists, but docker-compose.yml built every other agent image up front and left this one out — so the image wasn't pre-built for a stack bring-up. Mirror the other specialized agent-*-image builders: build from docker/agent-prompter.Dockerfile, tag roboco-agent-prompter, depend on agent-base-image. * Created docker-compose.yaml for the NAS * fix(intake): non-blocking /live/start so spawn never times out The start POST awaited the whole spawn — workspace clone + first-time image build + docker run — which blew past the panel's 60s HTTP timeout ('Request timed out. The server may be busy.') and triggered a duplicate send. Found on the 2026-06-09 NAS smoke. - start_intake_session opens the live relay synchronously, then spawns the container in the background (_spawn_intake_container_guarded). The route returns the session id immediately; the panel opens the SSE stream right away. - A background spawn failure is pushed onto the relay as an 'error' event and closes the session, so the panel shows it instead of hanging. - spawn_intake_session stays as the synchronous variant for direct callers/tests. - Panel shows a 'Preparing the agent…' indicator until the first event arrives. 18 intake-spawn tests green; tsc + lint green. E2E re-validates on next smoke. * fix(intake): propose_draft MCP tool + lock the agent down Smoke 2026-06-09 exposed two compounding problems: the agent never reliably emitted the draft (it narrated the spec instead of typing the magic fence), and it had inherited the CEO's entire Claude Code env — Write/Edit/Bash + Gmail/ Notion/Calendar/Drive MCP — because bypassPermissions ignored the allowlist and the mounted ~/.claude leaked the host MCP config. - propose_draft: build_intake_options now registers an in-process SDK MCP tool (create_sdk_mcp_server + @tool). The agent calls it to submit the draft; the driver turns that ToolUseBlock into a 'draft' event (_is_propose_draft / _draft_from_tool_input, tolerant of nested/flat/JSON-string input). The fenced roboco-draft block stays as a fallback. - Lockdown: strict_mcp_config=True + setting_sources=[] (ignore host MCP + settings); permission_mode 'dontAsk' + a can_use_tool gate enforcing a hard allowlist (Read/Grep/Glob/Task + propose_draft) replaces bypassPermissions. - Prompt: call propose_draft (not a fence); the draft's downstream chain is backlog -> Board (PO + HoM) -> CEO approve -> Main PM, and the agent's job ends at the draft (it never routes or hands off). SDK API verified against the installed claude-agent-sdk. Driver detection unit- tested; the SDK-construction is validated on the next NAS smoke (incl. that setting_sources=[] doesn't break the mounted-~/.claude auth). * fix(intake): panel UX cluster from the smoke (#3/#4/#6/#12) - #3 message boundaries: a tool call now ends the current text bubble, so the agent's words before and after a tool render as separate messages instead of one merged wall (the 'two waves merged into one bubble' the CEO saw). - #4 activity indicator: promoted from tiny grey text to a prominent primary- tinted pill so 'watch it work' is actually visible. - #12 End chat: a header button (any chat state) reaps the agent and resets to the form, reusing startAnother (which already stops the session). Backend POST /live/{id}/stop already existed. - #6 log noise: the opening-message delivery retry logs at debug, not error — those failures are expected until the container receiver is up. - Also fix a latent test gap from the #1 commit: the live-route test's fake orchestrator now exposes start_intake_session (the route's non-blocking entry). Frontend tsc + lint green; live-route + prompter_live tests green. * fix(intake): render markdown in the chat bubbles (#8) The agent emits rich markdown (### headers, **bold**, tables, lists) but the bubble rendered raw text, so it was illegible (CEO-flagged on the smoke). Render assistant content with react-markdown + remark-gfm (GFM tables) in a prose container. Adds react-markdown + remark-gfm to the panel. * feat(intake): #14 — two start routes (Board review vs straight to Main PM) Per the CEO spec, the draft confirm now starts the task at PENDING with an explicit assignment instead of parking it at backlog: - route="board" (Board review & Start): assigned to the Product Owner, so the orchestrator dispatches the full Board review (PO + Head of Marketing) before the Main PM picks it up. - route="main_pm" (Approve & Start): assigned straight to the Main PM, who delegates to the cells (Board review skipped). create_task_from_draft gains status + assigned_to params (default BACKLOG, so the legacy confirm_draft is unchanged); confirm_live_draft + the /live/{id}/confirm request carry the route. Service tests cover both routes. * feat(intake): #14 draft-card buttons — Board review vs Approve & Start Three buttons on the draft card now (CEO spec): Keep chatting / Board review & Start / Approve & Start. The two action buttons confirm directly with their route — launchTask(route) sends route to POST /live/{id}/confirm, which starts the task at pending assigned to the Board (PO+HoM) or straight to the Main PM. Supersedes the ConfirmDialog review step (scope is chosen up front in the form), so it's removed from the page flow. The ConfirmDialog component + its sub-editors are now unused — flagged for a follow-up cleanup, left in place to avoid churn. tsc + lint green. * fix(intake): keep the live SSE stream bound to its relay session The orchestrator opened the relay session twice per live chat — once on the request path (before the start call returns) and again inside the background container spawn. The SSE stream binds to the session's queue the moment the panel connects, so the second open swapped in a fresh queue and stranded the stream: the agent replied normally, but its events went to the new queue while the panel kept reading the old one, so the chat looked frozen on "Preparing…". The second open was always redundant (the relay is opened by the caller before the spawn). Remove it, and make open() idempotent so a live session is never replaced out from under a stream that is already connected to it. * fix(intake): draft-card launch buttons silently did nothing The launch path required a `description` field, but the prompter draft schema intentionally has none — it sends `objective` + the structured spec and the backend composes the description (compose_description). `editableDraft.description` was therefore undefined, so `description.trim()` inside launch validation threw a TypeError that propagated out of the button's onClick. Clicking "Board review & Start" / "Approve & Start" did nothing, with no feedback — the wall blocking the whole confirm → task → reap flow. - Map a proposed draft's description from `objective` as a fallback. - Make launch validation null-safe. - Replace the silent early-return with a toast that names what's missing, so a blocked launch is never a dead, feedback-less button again. * fix(intake): steer the agent to ask inline, not via AskUserQuestion The intake's job is to ask clarifying questions, so it reached for the AskUserQuestion tool — which isn't wired to the live chat panel and isn't in its allowlist. The bare deny left it to stumble ("let me clarify… — no worries, let me just lay it out") and waste a visible turn. - Prompt: spell out that it asks by writing in the chat (the human reads every message live) and that no question/prompt tool is available to it. - Gate: give AskUserQuestion a specific deny message that nudges it to ask inline, so even a reflex attempt degrades gracefully. Also refresh the now-stale "what happens after propose_draft" section: the draft card has three choices (Keep chatting / Board review & Start / Approve & Start) and produces a pending task — not the old two-button "backlog" description. * feat(intake): copy buttons on agent messages and the draft card The CEO asked for a way to save the agent's plan/spec elsewhere "just in case" — a cheap manual backstop until refresh-durability lands. - New CopyButton: async Clipboard API when available, plus a legacy textarea+execCommand fallback. The fallback is load-bearing — the panel is served over plain http on a LAN IP, where navigator.clipboard is absent (clipboard needs a secure context), so the modern API alone would never copy. - Copy button under each assistant message (copies its text). - Copy button on the draft card (copies the full spec as markdown: title, objective, what-this-builds, the-work per cell, notes, success criteria). * feat(intake): unbuffer logs + log each turn so the container isn't a black box Debugging the intake smoke was painful for two reasons: (a) the orchestrator block-buffered stdout, so `docker logs` lagged minutes behind reality, and (b) the intake container logged only "session opened" then went silent for the whole conversation (the chat streams to the relay, not stdout). - Set PYTHONUNBUFFERED=1 on the orchestrator and agent-base images so structured logs reach `docker logs` in real time instead of in large delayed chunks. - Log each intake turn: "turn received" (with char count) and "turn streamed" (chunk count + whether a draft was emitted), so the container logs show the conversation's shape at a glance. * chore(intake): remove the dead ConfirmDialog draft editor The three-button draft card (Keep chatting / Board review & Start / Approve & Start) replaced the old review-modal confirm flow, leaving ConfirmDialog and its sub-editors (StringListEditor, TheWorkEditor) referenced by nothing but the barrel export. Remove the three files and the export — typecheck + lint confirm no remaining references. * fix(intake): coerce bad draft enums on confirm instead of hard-failing The intake agent is an LLM and will emit off-enum values — e.g. task_type="feature", which is not a valid TaskType (code/documentation/research/planning/design/ administrative). `_coerce_draft_enums` called `TaskType(value)` directly, which raised, and the confirm 400'd with "Draft has invalid or missing required fields: 'feature' is not a valid TaskType". That forced the agent to discover the valid values and self-correct in-chat — unacceptable: clicking "Approve & Start" must never blow up on a cosmetic enum guess. Coerce each enum to a sane default on invalid/missing (task_type→code, nature→technical, complexity→medium); team falls back to the first valid cell in the_work, then backend. `_lead_cell_team` now skips invalid cell names too. The confirm/launch action no longer hard-fails on an enum the model got wrong. * fix(intake): draft card no longer renders above the user's latest message attachDraft fell back to "the last assistant message anywhere" when the current turn had no streamed text yet (propose_draft called first). That last message was often the PREVIOUS turn's — sitting above the user's "Yes, propose it" — so the draft card rendered above the user's message. Attach only to the current turn's streaming message; otherwise append a fresh assistant message so the card always lands at the bottom of the thread. * test(intake): guard draft enum coercion + invalid-cell skipping Regression tests for the confirm-time enum coercion: an off-enum task_type ("feature") / nature / complexity coerce to code/technical/medium instead of raising, and _lead_cell_team skips invalid cell names. Locks in that a bad enum guess from the agent can never 400 the launch again. * fix(intake): stop the agent fumbling through Claude Code meta-tools In smoke it reflexively probed CC built-ins before reaching propose_draft — plan mode + ExitPlanMode (it announced a written plan and waited instead of emitting the draft), ToolSearch, Write — each correctly denied by the lockdown but stumbly, and it only proposed after explicit CEO nudges. - Gate: ExitPlanMode now gets a specific deny nudge ("you don't use plan mode; call propose_draft"), and the generic deny names the actual toolset instead of a bare "not available", so any probe degrades into guidance. - Prompt: forbid plan mode/ExitPlanMode/ToolSearch explicitly and spell out "you do not plan and wait — call propose_draft directly when the spec is ready," plus an anti-pattern bullet. * feat(intake): make the container logs transparent mid-turn `docker logs` on the intake container was a black box: only turn start/end, while the agent read the codebase and spawned 20+ subagents invisibly (the conversation streams to the relay, not stdout), and the benign 3x ~/.claude.json warning was the only thing visible. - Driver logs each tool call mid-turn ("Intake tool use" with the tool name) and the draft emission, plus a tools count in the turn-streamed summary. Text deltas stay unlogged (they'd spam). Now the logs show the turn's real shape. - Pre-create ~/.claude.json ({}) at container boot so the CLI's "config not found" warning (printed 3x, self-healed anyway) stops drowning the real logs. * fix(intake): render markdown in user messages + scope copy to code blocks Two display fixes from the smoke: - User messages collapsed newlines (plain {content} in a div) and rendered no markdown — a "1.\n2.\n3." answer showed as one run-on line. Render user AND assistant bubbles through a shared GFM markdown body that inherits the bubble's text color, so lists / newlines / styling render correctly on both. - Copy was blanketed on every assistant message; scope it to KEY parts — a copy button on fenced code blocks (the draft card keeps its own). Removed the per-message button. * fix(intake): prevent duplicate tasks from a double-click on launch Clicking a draft launch button twice fired two confirms and created duplicate tasks. Add a synchronous re-entry guard (a ref — no stale-closure window) at the top of launchTask so a second click returns immediately, and disable + spin the draft-card buttons while a launch is in flight so it's visually clear it's working. * docs(how-to): lead task creation with the Task Assistant flow Rewrite "1 · It starts with you" to walk the Prompter/Task Assistant path — scope form, the agent reading the codebase, its grounded analysis, the draft card, and the created task — then flow into the Board review. Replaces the old manual task-definition form shots. Image placeholder: images/prompter_draft_card.png (the 3-button card) is referenced but not yet captured — TODO comment marks it for the next smoke run. A second comment flags an optional re-capture of prompter_run_2 after the markdown-rendering fix. * fix(intake): restore assistant message text contrast The markdown refactor dropped `dark:prose-invert` and made text inherit the bubble's color, but the assistant bubble had no explicit text color — so its text rendered near-invisible (dark-on-dark on bg-muted). Give the assistant bubble an explicit text-foreground; the user bubble already carries text-primary-foreground, and [&_*]:!text-inherit now resolves to a readable color on both. * fix(intake): coerce draft priority too — confirm 500'd on priority="high" The enum-coercion fix covered task_type/nature/complexity/team, but priority is a non-enum int field handled by `int(draft_data.get("priority", 2))`, and the agent guesses a word ("high") as readily as a number — so int("high") raised ValueError and the confirm 500'd. Same class of bug, one field missed. Add _coerce_priority: map words (urgent/high/medium/low → 0/1/2/3), clamp numbers to 0-3, default to 2 (medium) on anything else. The launch can no longer crash on any field the LLM guessed. + regression test. * fix(intake): draft card shows distinct cells, not one badge per work item the_work has one entry per work item, so a cell with several items rendered its badge repeatedly ("Board-led across Backend Backend Backend Frontend Frontend …"). De-dupe to distinct teams so the card reads "Board-led across Backend Frontend" — and the "Cell:" vs "Board-led across" label keys off distinct count. * docs(how-to): hero the teaser gif + resolve the Prompter/Task Assistant thread - Move the 12s teaser gif to the top as the hero — it was buried between the "prefer video" link and the first screenshot. - Name the connection: the Task Assistant IS the Prompter, so section 1 (using the tool) and the rest (RoboCo building it) read as one story — you use the tool the company built for itself, then watch the build. - Re-anchor the section 1 → Board transition to follow the Prompter's own journey, instead of implying section 1's example task is the one reviewed next. * Included images for how-to.md * docs(how-to): align agent count to 20 (matches README + CLAUDE.md) The how-to said "18 agents" with UX/UI at one dev and no Intake — stale against the authoritative count. Bump 18→20 (prose + spelled-out eighteen→twenty), give UX/UI 2 devs, and add the Intake line to the org tree (Intake leads section 1, so it belongs in the tree). README + CLAUDE.md already say 20. * ci(release): publish all RoboCo images to GHCR + Docker Hub The release published only the orchestrator to GHCR. Build and push the full set the stack needs — agent-base, the 8 agent images, orchestrator, and panel — to BOTH ghcr.io/rennf93/* and docker.io/renzof93/*, at :<version> and :latest, so consumers can pull instead of compose-building. - agent-base builds first (the agent images build FROM roboco-agent-base, a local tag), then the rest; push only after every build succeeds. - Image names mirror the docker-compose `image:` values 1:1. - Free disk on the runner first (11 images is space-heavy). - Needs a DOCKERHUB_TOKEN repo secret for the Docker Hub login. - SECURITY.md updated to reference both registries. * ci(release): use short SHA as the image tag on manual dispatch A workflow_dispatch runs against a branch, and the branch name (e.g. feature/prompter-gold-upgrade) was used verbatim as the image tag — but "/" is illegal in a Docker tag, so the first build failed instantly with "invalid reference format". Releases still tag from the release tag; manual dispatch now always uses the short SHA, which is a valid tag. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-09 17:08:34 +02:00
Renn F	ae65bff883	fix(prompter): use the local Ollama LLM instead of the Anthropic cloud API ... The Prompter service called AsyncAnthropic, which needs an ANTHROPIC_API_KEY and 500'd in production ("Anthropic API key not configured"). Align it with the rest of the system (RAG / HyDE): call the local LLM over the OpenAI-compatible /chat/completions endpoint (settings.local_llm_*) via httpx — no external key. - Replace the Anthropic client and _extract_text with a single _create_message seam that POSTs to the local LLM and returns the reply text. - Move the system prompt into an OpenAI-style system message; drop the hard-coded Claude model and the per-call model parameter. - Strip a wrapping markdown code fence before parsing the draft JSON (local models often wrap it). - Repoint the prompter unit and route tests at the new seam (return strings).	2026-06-08 17:04:35 +02:00
Renn F	f2df7fc30b	fix(prompter): align frontend API client with the backend session contract ... The Prompter frontend and backend were built against mismatched contracts: - createSession POSTed no body (the endpoint requires one) and read a `session_id` field the response doesn't have (it is `id`), so every session create returned 422. - sendMessage hit `/sessions/{id}/chat` with `{message}` and expected a `{reply, draft}` object, but the session endpoint is `/sessions/{id}/messages` with `{content}` and returns the full message list. - API errors rendered as "[object Object]" because getErrorMessage String()'d a FastAPI validation array. Point createSession/sendMessage at the real endpoints, adapt the message-list response (latest assistant message is the reply; fetch the structured draft when the reply signals readiness), and make getErrorMessage format string / validation-array / structured-object details into a readable line.	2026-06-08 16:17:41 +02:00
Renn F	b42c13da89	fix(alembic): shorten 023 revision id to fit version_num varchar(32) ... The 023 prompter migration's revision id `023_add_prompter_tracking_columns` was 33 characters — one over the `alembic_version.version_num` varchar(32) limit — so `alembic upgrade` aborted while recording it (transactional DDL rolled the whole step back) and a fresh deploy stalled at 022. Rename the revision to `023_prompter_tracking_columns` (29 chars), update the 024 migration's down_revision, and rename the file to match. No schema change; the upgrade body is untouched.	2026-06-08 15:06:15 +02:00
Renzo FandGitHub	b0b29b578f	Merge pull request #83 from rennf93/fix/lifecycle-residual-hardening ... Lifecycle residual hardening, how-to reframe, and Prompter test integration	2026-06-08 06:48:41 +02:00
Renn F	e863880883	Fix the Prompter tests against the current schema and SDK ... The Prompter feature's integration tests were never executed by CI — the PR checks run CodeQL and secret-scanning, not the pytest suite — so they carried bugs that only surfaced once the feature was integrated and the full quality gate ran against it: - The project fixture set a `git_branch` field the model doesn't have (it is `default_branch`) and omitted the required `assigned_cell` / `created_by` columns, so every confirm-flow test errored at setup. - The tests patched the Anthropic client's `messages.create` at the class level, but the SDK exposes `messages` as a cached_property, so that target can't be resolved. Route the call through a single `_create_message` seam on PrompterService (behavior-identical) and patch that instead. Also drop `confirm_draft` below the cyclomatic-complexity threshold by extracting the override-merge, UUID-field, and enum-coercion helpers (behavior-preserving; the prompter test suite passes unchanged).	2026-06-08 06:44:14 +02:00
Renn F	5a41ef5c90	Merge master (Prompter #80) into lifecycle-residual-hardening	2026-06-08 05:45:07 +02:00
Renzo FandGitHub	b4bd7e9ff2	Merge pull request #80 from rennf93/feature/main_pm/4e095d62 ... [4e095d62] Prompter — conversational task-authoring page for RoboCo	2026-06-08 05:44:18 +02:00
Renzo FandGitHub	29a301a07d	Merge branch 'master' into feature/main_pm/4e095d62	2026-06-08 05:43:39 +02:00
Renn F	17d3d37432	docs(how-to): reframe the walkthrough around RoboCo building itself ... Recast the how-to as a single thesis: RoboCo is an organization — not a swarm and not a framework — and because it is a real organization (roles, a chain of command, a gated lifecycle, reviews and sign-offs) it can build real software, shown by it building one of its own features. The walkthrough now follows that real feature end to end with screenshots from the actual run: the Board scoping it (Product Owner + Head of Marketing review), the Approve & Start decision, a genuine QA failure and re-run, the three cells' verified, agent-co-authored commits converging, and the integrated pull request — its description, its diff, and the Approve & Merge decision — coming back for the CEO's sign-off, with the final task tree at the end. The human acts at only the two ends; the organization fills in everything between. Adds the new walkthrough screenshots and places them across the lifecycle.	2026-06-08 05:36:57 +02:00
Renn F	718a16c4f7	Close residual gaps: CEO escalation from blocked, ref repair, reset-script state ... Three independent residual hardenings surfaced by the smoke run: - escalate_to_ceo is now reachable from a blocked task (source widened to {awaiting_pm_review, blocked} with a matching status-transition row), so a main_pm or board agent has a clean verb to surface a task it cannot resolve to the CEO — who can then approve, reject, or cancel it. Regenerated the lifecycle artifacts (status-transitions doc + panel JSON) to match. - WorkspaceService now prunes broken loose refs (.bak debris and any ref whose contents are neither an object id nor a symref) before the refresh fetch, so a ref left corrupt by an interrupted recovery no longer produces per-operation "broken ref" warnings or wedges ref enumeration. Best-effort, file-reads-only. - The reset script's full-reset Claude-state clear now defaults to the replay-state subdirs (projects/, todos/) of the mounted Claude home and refuses to clear the home root, so a full reset actually clears conversation replay state by default without wiping the host's stored credentials.	2026-06-08 05:17:15 +02:00
Renn F	69da8de4b5	Panel: de-dupe live notifications and expose recovery states on the board ... Notification bell: the websocket stream was rendered with a plain filter, so a stream replay after a reconnect surfaced — and counted — the same notification twice, inflating the unread badge. De-duplicate by notification_id (newest copy wins, arrival order preserved) and key the list on the id instead of array index. PM kanban: the board had no columns for the recovery states (paused, needs-revision, awaiting-CEO-approval, cancelled), so a human had no way to drive a wedged task into them from the UI. Add those columns; dragging a card issues an admin status override, giving the CEO direct recovery from the board.	2026-06-08 04:47:35 +02:00
Renn F	9bbbd6627f	Alert an overseer when the respawn circuit-breaker pauses a wedged agent ... The dispatcher's respawn guard already detects an agent repeatedly spawned on the same task without advancing it, logs a warning, and skips further spawns. But nothing surfaced that to a human, so a wedged agent could sit silently with its task stalled. When the guard trips, send a one-shot high-priority notification to the CEO (tracked per (agent, task) so it fires once, not on every subsequent skipped spawn, and resets if the agent later makes progress). Delivery is best-effort so a notification failure never wedges dispatch. Adds send_stuck_agent_notification to NotificationService and a coverage test asserting the alert fires exactly once across multiple over-threshold spawns.	2026-06-08 04:42:15 +02:00
Renn F	5f32417a63	Harden cell-ownership invariant at reassign and dependency revival ... A board/advisory role (product owner, head of marketing, auditor) has no verb to build, document, or complete a cell task. The escalate path already diverts such a hand-off to the pool; extend the same backstop to the two remaining write-sites: - reassign / reassign_active_claim: a refused board/advisory target is diverted to the pool for a role-matched claim instead of being planted as a non-workable owner. Normal handoff targets (qa, documenter, cell PM) are unaffected. - dependency revival: when a blocked task's last dependency clears, resume in place only under a workable owner; re-home a board/advisory-or-absent owner on a cell task to the pool so it does not immediately re-deadlock. All three sites share one audited pool-divert primitive so no direct status set skips the transition audit. Also reduce cyclomatic complexity below the project threshold for unclaim_for_agent, the dependency-revival path, and the docs index source expansion by extracting helpers (behavior-preserving), and add coverage for the doc source-expansion paths.	2026-06-08 04:23:52 +02:00
3 people	306de1e656	Merge 'master' into 'dogfood feature branch' (smoke test run) (#82) ... * Fix: human surface lifecycle hardening (#81) * fix: harden agent-idle, redis loop, git errors, escalation audit - i_am_idle no longer 500s when auto-pausing a task whose commits are stored as dicts: tolerate dict-or-object commit refs and run the synthetic-checkpoint computation inside the swallowing try block. - The stream event loop no longer logs an idle redis read-timeout as an ERROR every cycle; the blocking-read timeout is treated as a normal idle. - Git command failures surface git's own (secret-scrubbed) stderr in the error message instead of a bare 'Command failed', so push/fetch rejections are diagnosable; the injected PAT is redacted. - The escalate-to-pool redirect emits the task.pending audit event, closing a status mutation that previously skipped the audit log. * fix: let privileged operators set task status via an audited override The task update route silently dropped a 'status' field in the request body, so a CEO/admin could not transition a task wedged in a state with no valid in-band move (e.g. a blocked task whose work merged out-of-band) — the panel returned 200 while nothing changed. Add 'status' to the update schema and apply it through a new audited 'admin_set_status' that bypasses the strict transition validator but always records the audit event. The override requires elevated permissions; ordinary field updates are unchanged. * fix: stop human chat sessions from expiring between messages Messaging sessions fell back to a hardcoded 300s idle timeout, shorter than a normal pause in a human conversation: the sweeper closed the session and the next message opened a new one, so a person could not hold a continuous chat. Make the idle timeout configurable (session_idle_timeout_seconds, default 3600) and resolve an unset timeout to it at every session-creation path instead of the 300s column fallback. * fix: resolve doubled doc paths and stop the indexer warning flood The doc-path resolver returned absolute paths verbatim, so a documenter path that doubled the base segment (/app/docs/docs/...) never resolved on disk and the docs never indexed into RAG. Reduce an absolute path under the docs base to a relative one before normalizing, leaving truly-external absolute paths for the indexer to skip. The indexer now skips non-markdown source files and logs a missing/non-doc source at debug instead of warning on every pass. * fix: reject project repo URLs that point at a protected repository Add a configurable denylist (protected_git_urls) enforced in the project create and update paths, so a project cannot be registered against a repository that must not receive agent commits or merges (e.g. the roboco source repo during a smoke run). Empty by default (no behavior change); operators set it to sandbox smoke-test projects. * fix: let an agent release a blocked task back to the pool A developer (or QA/doc) trapped on a 'blocked' task had no legal forward move — every verb rejected from that state — so the dispatcher kept respawning it with nothing to do. Allow 'unclaim' to release a blocked task the agent owns back to pending (assignment cleared, work session abandoned, audited), so the cell PM can re-delegate it instead of the agent churning. * fix: keep blocked-dev churn out and cell tasks out of board hands - The dispatcher no longer respawns the owner of a blocked task: from blocked the owner has no legal move, so respawning only churns; it is revived on unblock or released via unclaim. - Escalation no longer hands a cell (backend/frontend/ux_ui) coordination task to a board/advisory role — such an escalation is diverted to the cell pool, matching the existing executable-task guard. main_pm targets are unaffected. * chore: add an opt-in full clean-slate to the reset script FULL_RESET=1 wipes everything under the roboco data root except the persistent service stores (ollama/postgres/redis) and clears the persisted agent Claude session dirs (ROBOCO_CLAUDE_STATE_DIRS), which otherwise replay across runs. Default off — the existing DB/Redis wipe + workspace git-reset is unchanged. * ++ --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com> * fix: read the real commit key (hash) and audit the restore-unblock path - The auto-pause checkpoint and _extract_first_commit_sha read commit dicts by key 'sha', but persisted commits are keyed 'hash' (CommitRef.hash) — the prior change stopped the crash but silently dropped every ref. Read 'hash' (sha fallback) at both sites; the test now uses the production dict shape so the regression can't hide. - unblock_with_restore set status directly and skipped the audit log; emit the status-transition audit there too, like the other direct-set paths. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-08 03:27:45 +02:00
Renn F	3c02dc7f03	fix: read the real commit key (hash) and audit the restore-unblock path ... - The auto-pause checkpoint and _extract_first_commit_sha read commit dicts by key 'sha', but persisted commits are keyed 'hash' (CommitRef.hash) — the prior change stopped the crash but silently dropped every ref. Read 'hash' (sha fallback) at both sites; the test now uses the production dict shape so the regression can't hide. - unblock_with_restore set status directly and skipped the audit log; emit the status-transition audit there too, like the other direct-set paths.	2026-06-08 02:45:03 +02:00
3 people	f58fd4530e	Fix: human surface lifecycle hardening (#81) ... * fix: harden agent-idle, redis loop, git errors, escalation audit - i_am_idle no longer 500s when auto-pausing a task whose commits are stored as dicts: tolerate dict-or-object commit refs and run the synthetic-checkpoint computation inside the swallowing try block. - The stream event loop no longer logs an idle redis read-timeout as an ERROR every cycle; the blocking-read timeout is treated as a normal idle. - Git command failures surface git's own (secret-scrubbed) stderr in the error message instead of a bare 'Command failed', so push/fetch rejections are diagnosable; the injected PAT is redacted. - The escalate-to-pool redirect emits the task.pending audit event, closing a status mutation that previously skipped the audit log. * fix: let privileged operators set task status via an audited override The task update route silently dropped a 'status' field in the request body, so a CEO/admin could not transition a task wedged in a state with no valid in-band move (e.g. a blocked task whose work merged out-of-band) — the panel returned 200 while nothing changed. Add 'status' to the update schema and apply it through a new audited 'admin_set_status' that bypasses the strict transition validator but always records the audit event. The override requires elevated permissions; ordinary field updates are unchanged. * fix: stop human chat sessions from expiring between messages Messaging sessions fell back to a hardcoded 300s idle timeout, shorter than a normal pause in a human conversation: the sweeper closed the session and the next message opened a new one, so a person could not hold a continuous chat. Make the idle timeout configurable (session_idle_timeout_seconds, default 3600) and resolve an unset timeout to it at every session-creation path instead of the 300s column fallback. * fix: resolve doubled doc paths and stop the indexer warning flood The doc-path resolver returned absolute paths verbatim, so a documenter path that doubled the base segment (/app/docs/docs/...) never resolved on disk and the docs never indexed into RAG. Reduce an absolute path under the docs base to a relative one before normalizing, leaving truly-external absolute paths for the indexer to skip. The indexer now skips non-markdown source files and logs a missing/non-doc source at debug instead of warning on every pass. * fix: reject project repo URLs that point at a protected repository Add a configurable denylist (protected_git_urls) enforced in the project create and update paths, so a project cannot be registered against a repository that must not receive agent commits or merges (e.g. the roboco source repo during a smoke run). Empty by default (no behavior change); operators set it to sandbox smoke-test projects. * fix: let an agent release a blocked task back to the pool A developer (or QA/doc) trapped on a 'blocked' task had no legal forward move — every verb rejected from that state — so the dispatcher kept respawning it with nothing to do. Allow 'unclaim' to release a blocked task the agent owns back to pending (assignment cleared, work session abandoned, audited), so the cell PM can re-delegate it instead of the agent churning. * fix: keep blocked-dev churn out and cell tasks out of board hands - The dispatcher no longer respawns the owner of a blocked task: from blocked the owner has no legal move, so respawning only churns; it is revived on unblock or released via unclaim. - Escalation no longer hands a cell (backend/frontend/ux_ui) coordination task to a board/advisory role — such an escalation is diverted to the cell pool, matching the existing executable-task guard. main_pm targets are unaffected. * chore: add an opt-in full clean-slate to the reset script FULL_RESET=1 wipes everything under the roboco data root except the persistent service stores (ollama/postgres/redis) and clears the persisted agent Claude session dirs (ROBOCO_CLAUDE_STATE_DIRS), which otherwise replay across runs. Default off — the existing DB/Redis wipe + workspace git-reset is unchanged. * ++ --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-08 01:59:51 +02:00
3 people	5a99140a55	[9ef46be7] feat(prompter): implement Prompter page, nav entry, chat UI, and task creation wiring (#78) (#79) ... - Add Task Assistant nav entry (Sparkles icon) to sidebar between Kanban and Projects - Create lib/api/prompter.ts with createSession, sendMessage, getDraft API functions - Create hooks/use-prompter.ts with 6-state machine (empty→chatting→draft_preview→review_modal→launching→success) - Create ChatMessages with auto-scroll, user/assistant/error rendering, inline DraftProposalCard - Create ChatComposer with Enter-to-send and Shift+Enter for newline - Create DraftProposalCard with title, description, acceptance criteria, metadata badges, Keep Chatting/Review & Confirm actions - Create ConfirmDialog (Radix Dialog, no form element) with MarkdownEditor, AcceptanceCriteriaEditor, metadata selects, warning banner, disabled Confirm & Launch until valid - Create SuccessCard with task title, team, View Task link, Start Another button - Create /prompter route page composing all components via usePrompter hook - TypeScript and ESLint pass with zero errors Co-authored-by: Frontend Developer 2 <fe-dev-2@agents.roboco.dev>	2026-06-07 22:38:36 +02:00
3 people	85ffec86b4	[529f579a] Implement Prompter chat endpoint and structured task drafting (#76) (#77) ... * [529f579a] feat(prompter): add PrompterService with chat and draft generation endpoints * [529f579a] feat(prompter): add PrompterService, schemas, routes, and integration tests * [529f579a] feat(prompter): implement session-based prompter chat endpoints with DB persistence Add full session-based Prompter chat system with: - Alembic migration 024 creating prompter_sessions, prompter_messages, and task_drafts tables with proper foreign keys, indexes, and enum columns - Three new SQLAlchemy ORM table classes in roboco/db/tables.py - Pydantic schemas: PrompterSessionCreateRequest, PrompterMessageRequest, PrompterSessionResponse, PrompterMessageResponse, TaskDraftResponse, TaskConfirmRequest - Four new session-based FastAPI routes: POST /sessions, POST /sessions/{id}/messages, GET /sessions/{id}/draft, POST /sessions/{id}/confirm - PrompterService with DB-backed session, message, and draft persistence; LLM-driven draft generation; ConfirmOverrides dataclass to stay under PLR0913 - Legacy stateless /chat and /draft endpoints retained for backward compatibility - Unit tests for schemas (test_schemas_prompter.py), service pure functions and DB logic (test_prompter.py) with mocked LLM calls - Integration tests for full happy path and legacy endpoints (test_prompter_routes.py) - All ruff format, ruff check, mypy (changed files), and pytest checks passing * [529f579a] fix(prompter): correct test assertion for confirmed_at field nesting The test test_get_draft_generates_from_conversation incorrectly accessed body['draft']['confirmed_at'] but confirmed_at is a field on the outer TaskDraftResponse, not on the nested PrompterDraftTask. Fixed to body['confirmed_at']. --------- Co-authored-by: Backend Developer 2 <be-dev-2@agents.roboco.dev>	2026-06-07 22:16:56 +02:00
3 people	d5cbbf49ee	[50e80c55] Prompter interaction design and confirmation flow spec (#74) (#75) ... * [50e80c55] docs(design): create Prompter interaction design directory and main spec * [50e80c55] docs(design): add confirmation interstitial spec with un-bypassable guardrails * [50e80c55] docs(design): add model-selector drawer UX with Recommended default and complexity mapping * [50e80c55] docs(design): add naming and navigation spec with sidebar placement and Task Assistant recommendation --------- Co-authored-by: UX/UI Developer 1 <ux-dev-1@agents.roboco.dev>	2026-06-07 04:50:38 +02:00
Renn F	199169ef0e	Added short gif	2026-06-07 02:53:51 +02:00
Renn F	913591ed27	Convert walkthrough .mov to .mp4	2026-06-07 01:01:56 +02:00
Renn F	85a069a37d	Updated README.md	2026-06-07 00:43:22 +02:00
Renn F	8b7b8f96f7	Adding screenrecording full-feature-walkthrough	2026-06-07 00:39:06 +02:00
Renn F	067b5e17ef	Fixed how-to.md	2026-06-06 22:25:44 +02:00
Renn F	12e297da23	Updated how-to.md	2026-06-06 22:20:55 +02:00
3 people	3205443119	Fix: dependency spawn gate and cell ownership (#73) ... * Cleanup + Missing greenlet error * fix(messaging): persist a group's active-session pointer so posts reuse it create_session and create_session_with_access_check set group.active_session_id from session.id BEFORE the flush that materializes it — the id is a flush-time uuid4 default, so the pointer was written as NULL and every post opened a fresh session, fragmenting one conversation across many. Flush first, then link, the same ordering the seed path already uses. Two tests fabricated "two distinct sessions" by calling create_session twice on one group, which only differed because of this bug; switch them to two groups so they keep testing their real intent. Add a regression guard that the pointer is actually persisted and a second create reuses the live session. * fix(orchestrator): gate spawns on dependencies and keep cell tasks in their cell The cross-task dependency check ran only on the dev dispatch path, so cell-PM, Main-PM and board agents were spawned onto dependency-blocked tasks and flailed unblock / escalate / notify against an unfinished upstream — climbing ownership of cell work up to the board, which cannot drive it, and deadlocking the task. - Move the dependency gate into the shared spawn readiness check so it covers every role, and auto-block the task so it leaves the pending pool until the upstream reaches a terminal state (then the existing auto-unblock revives it). - Cell-ownership invariant: a backend/frontend/ux_ui task may only be worked or owned by its own cell. The readiness gate refuses a board or Main-PM spawn onto a cell task; reassign refuses and clears such an owner; and on dependency-clear a mis-owned cell task is re-homed to its cell's pending pool instead of reviving under an owner that cannot progress it. - A dependency block is never a CEO signal: notify(target=ceo) is refused while the task is waiting on an unfinished upstream, with a remediate to idle and wait — the block clears on its own. * Uploading images + Fixing pyproject.toml * ++ * revert(orchestrator): drop the cell-ownership block pending a tooling audit The cell-ownership invariant added earlier — a board / Main-PM role may never be spawned onto or reassigned to a cell task, plus re-homing a mis-owned cell task on dependency-clear — was too absolute. It forbids a higher role from stepping in when something genuinely deeper is going on, and contradicts the existing rule that main_pm may hold a task at awaiting_pm_review. The dependency spawn gate already prevents the cascade that handed the board cell tasks; the deadlock it guarded against will be addressed with a return-path approach after auditing what tools the cell PMs actually need. Keeps the dependency gate and the CEO dependency-block notify guard. * docs(prompts): a dependency wait is wait-and-idle, not escalate The cell-PM and Main-PM prompts told agents to escalate_up / retry unblock on a blocked task without distinguishing a dependency wait (which auto-clears the moment the upstream completes) from a real wedge — the source of the escalate/unblock flail and the CEO-notification spam. Split the blocked-state guidance: a cross-cell dependency wait = note + i_am_idle (do not escalate, unblock, or notify the CEO); escalate only a genuinely broken upstream. Fix two stale references to i_am_blocked, a developer-only verb the PMs do not have, to escalate_up. Correct the CLAUDE.md verb-surface table, which understated every role: it listed 4 cell_pm verbs while the flow manifest derives the full set (11, including unclaim and i_am_idle) from lifecycle.spec.intents_for_role. * feat(gateway): cell_pm reassign verb — intra-cell developer hand-off A cell PM can now hand a claimed/in_progress task to another developer in its own cell without unclaim (which drops the work back to the pool and loses the assignee). The branch is keyed to the task, so the work-in-progress is preserved; the new dev is respawned to continue. Intra-cell only: the task must be in the caller's cell and new_assignee must be a developer of that same cell. Wired through every layer: the reassign IntentSpec (composes=(), cell_pm-only), the choreographer verb + intra-cell guard, a reaper-safe TaskService.reassign_active_claim (reseeds the claim heartbeat so the new dev is not immediately reaped), the ReassignRequest schema, the cell_pm flow route, and the MCP flow-server tool. Tracing-waived like unclaim (mechanical hand-off). Regenerated lifecycle/verb artifacts; prompt + CLAUDE.md updated. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-06 22:10:48 +02:00
Renn F	8596c72d9b	docs: rewrite usage.md to the current gateway model ... usage.md described a pre-gateway operating model — a roboco_task_scan tool, /api/v1/<group> endpoints, an awaiting_docs status, and an 18-agent roster. Update it to the real surface: give_me_work, /api/<group> routes, awaiting_documentation, the estimated_complexity/task_type/nature task fields, and 19 agents.	2026-06-05 17:20:37 +02:00
Renn F	ecea593a51	docs(rag): rewrite the KB docs to the real gateway verb surface ... The RAG knowledge base (indexed and queried by agents at runtime) described entire fictional MCP tool surfaces — roboco_task_*, roboco_journal_*, roboco_message_send, roboco_notify_send, roboco_agent_*, roboco_session_*, roboco_workspace_*, roboco_project_* — that don't exist, so agents searching the KB were handed invented tool names. Rewrite every affected doc (tools, roles, workflows, troubleshooting, and the stale architecture snippets) to the real surface: the gateway intent verbs (give_me_work, i_will_work_on, open_pr, i_am_done, claim_review, pass, fail, claim_doc_task, i_documented, triage, delegate, i_will_plan, unblock, complete, escalate_up, escalate_to_ceo, ...) and content tools (commit, note(scope=...), say, dm, evidence, notify*, open_session, channels). Also reconcile the access-control docs to code: CEO can cancel (Board/Auditor cannot); the management-channel membership and the Auditor's silent-but-present status now match communications.py.	2026-06-05 17:20:36 +02:00
Renn F	416356899d	docs(rag): fix the KB security env-var reference ... config-reference.md (indexed into the KB agents trust at runtime) documented a non-existent ROBOCO_SECRET_KEY/JWT and token-expiry setting and omitted the real one. Replace the Security table with the actual env vars — ROBOCO_ENCRYPTION_KEY (Fernet), ROBOCO_AGENT_AUTH_SECRET, ROBOCO_AGENT_AUTH_REQUIRED, ROBOCO_PANEL_AGENT_TOKEN — and drop the phantom Logging/Sessions sections (no backing config fields).	2026-06-05 17:08:08 +02:00
Renn F	073c2ec8b5	fix(prompts): repair the verb-table generator and regenerate ... regenerate_verb_tables.py imported roboco.api.schemas.v2, which no longer exists (schemas moved to v1), so it raised on import and the generated verb/tool tables could never be refreshed — leaving _generated/verbs.md and the per-role prompts stale (e.g. listing submit_for_qa, omitting the notify_*/channels/progress/pr_update content tools). Repoint the imports to v1, fix the renamed schema (OpenPrRequest), and regenerate.	2026-06-05 17:05:45 +02:00
Renn F	fd4df51572	docs: correct doc-vs-code drift across the canonical docs ... A documentation audit against the code surfaced several stale claims: - Agent count: the roster is 19 AI agents (the UX/UI cell has two devs, ux-dev-1 + ux-dev-2), not 18 / a single UX dev. Fixed in README, CLAUDE.md, base.md, and docs/ux_ui. - API: domain routes are mounted under /api, not /api/v1 (the /api/v1 prefix is the agent gateway only); dropped the non-existent /api/v1/test group; fixed the orchestrator-status path in deployment.md. - Quick Start uvicorn target is roboco.api.app:app (the api package deliberately does not export app). - Verb table: the developer PR verb is open_pr (renamed from submit_for_qa); the lifecycle's canonical module is foundation/policy/lifecycle.py (enforcement/task_lifecycle.py is a shim). - Backend team stack: vector store is PostgreSQL + pgvector (via piragi), not Qdrant; mypy targets roboco/, not src/. - .env.example: replaced the phantom Qdrant/OpenAI blocks with the real Ollama/RAG settings.	2026-06-05 17:05:33 +02:00
Renn F	cd6927401c	docs: add an illustrated how-to walkthrough ... A step-by-step guide to the workflow — give the Board a task, approve, the cells build/review/document, the Main PM opens the final PR — each step illustrated with a panel screenshot. The screenshots live under the tracked docs/images/ (the source logos/ tree is gitignored, so embedding from there would render broken on the public repo).	2026-06-05 17:05:14 +02:00
Renn F	7cb05ca988	chore(docs): untrack internal-only strategy and reference docs ... docs/internal/ held internal scratch and business-strategy material (architecture dumps under old/, plus drafts) that should not live on the public repo. Remove the whole tree from tracking — local copies are kept — and gitignore docs/internal/ so it can't be re-added by accident. Also gitignore the internal smoke-findings tracker. (History scrub of the already-pushed copies is a separate follow-up.)	2026-06-05 17:05:00 +02:00
3 people	06682f33c6	Fix: agent workflow hardening (#70) ... * fix(gateway): push the branch before QA handoff so reviewers see the latest commits The commit content tool commits locally without pushing; only open_pr pushed the branch. On the first submission that was fine, but a fix committed while addressing needs_revision never reached origin (open_pr is skipped once the PR exists), so QA — which reviews the remote PR branch — re-reviewed the stale remote and re-failed the task on every cycle, a loop that never converged. i_am_done now pushes the task branch (idempotent; a no-op when nothing is unpushed) as part of the shared submit gate, covering both the normal and resume-from-verifying paths. A push failure blocks the handoff with a clear remediation rather than parking the task in awaiting_qa with commits that exist only in the developer's local workspace. * fix(orchestrator): don't reap a stale claim while the agent's container is alive The stale-claim reaper released any claimed/in_progress task whose last_heartbeat_at exceeded the TTL. The heartbeat only updates on certain gateway calls, so a developer deep in a long edit/test cycle outran the TTL and had its claim reaped mid-work — churning the task and risking a double spawn against the still-running container. The reaper now skips a task whose assignee still holds a live (ACTIVE) agent instance, trusting container liveness — the ground truth — over the heartbeat proxy. The check is defensive on missing fields so a heartbeat-only caller (and the reaper's existing unit tests) behave exactly as before. * fix(gateway): refuse to unblock a task while a dependency is unfinished A PM unblock on a dependency-gated task moved it straight to in_progress, overriding the dependency — letting a dependent proceed without its upstream's work (e.g. a frontend task built before its UX design lands). A dependency block is meant to clear on its own via _unblock_dependents the moment the upstream reaches a terminal state. unblock now refuses while any dependency is still non-terminal, returning a clear remediation that the block resolves automatically. Manual unblock remains available for genuine, non-dependency blockers. * fix(gateway): release a dependency-blocked claim to pending instead of looping A task that reached claimed/in_progress with an unfinished dependency was left in that state when the claim guard rejected, so the orchestrator's respawn loop kept reviving its assignee — which could make no progress — burning work for nothing. The claim guard now releases such a task back to pending. claimed -> blocked is not a legal transition, so pending — held by the dispatch dependency filter — is the lifecycle-correct resting state: the respawn loop ignores pending tasks, and _unblock_dependents re-dispatches it once the upstream reaches a terminal state. release_dependency_blocked_claim shares a _force_unclaim_to_pending core with unclaim_for_reaper so both record a truthful work-session abandon reason. * feat(security): warn at startup in header-trust mode + document the auth posture When ROBOCO_AGENT_AUTH_REQUIRED is not enabled the API accepts the X-Agent-Id / X-Agent-Role headers without a signed token, so any client that can reach it may act as any role (including 'ceo'). The API now logs a clear warning at startup in this mode, and the README gains a Security section documenting the auth posture and how to harden it. Acceptable only on a trusted private network — do not expose the API to untrusted networks. * fix(workspace): scope the refresh fetch to current + default branch ensure_workspace's healthy short-circuit ran an all-refs 'git fetch origin' to keep every origin/<branch> ref current. On a monorepo with many accumulated feature/* branches that exceeds the refresh timeout, the fetch silently fails, and the workspace keeps a stale base — so an agent builds on an out-of-date branch. The refresh now fetches only the workspace's current branch and the repo's default branch (resolved via origin/HEAD), with --no-tags --prune: it transfers near-nothing and can't time out. Readers need their own branch and the default; the integration branch is refreshed at branch-creation time. * fix(git): refresh a dependency-blocked task's branch off the current integration tip A cross-cell dependent (e.g. a frontend task waiting on the UX design) was branched off a base captured before its upstream merged into the integration branch, and the branch was never re-synced — so the agent built on a stale snapshot with none of the upstream's work. Two changes close the gap: - release_dependency_blocked_claim now clears branch_name, so the re-claim (after the dependency clears) re-runs branch creation. - create_branch, when the branch is already on disk with no commits of its own, resets it onto the freshly-pulled base — the dependent now builds on the current integration tip. A branch carrying real commits is left untouched, so no work is discarded; the cell->leaf cascade carries the upstream down to the dev branch automatically. * refactor(gateway): drop the sibling-sequence claim guard Sibling sequence no longer gates a claim. Cross-cell ordering is enforced by task dependencies — a cell task that depends on another is held until its upstream reaches a terminal state, a stronger, status-aware gate than the sequence-number check. That check was dormant in practice anyway: every fan-out child carries sequence 0, on which the guard short-circuited. `sequence` stays a sibling-ordering / dispatch-priority field (list_pending ordering and the panel). Removes sibling_sequence_guard and its _earlier_blocking_sibling helper, the now-unused skip_sequence parameter threaded through the claim verbs, and the sibling fetch that fed it. * feat(gateway): sort a cross-cell dependent after its upstream When the frontend cell task is wired to depend on its UX/UI sibling, set its sequence to the upstream's sequence + 1 so it sorts after the design it waits on — list_pending ordering and the panel now show UX ahead of the implementation it gates, in either delegation order. Adds TaskService.set_sequence (the sibling-ordering field is a service write; it carries no claim-gating semantics — dependencies gate claims). * feat(gateway): make the backend cell depend on UX too UX/UI design defines the screens and API contracts both implementation cells build against, so the backend cell — not just the frontend — waits on the UX/UI cell task in a product fan-out and sorts after it. Wires in either delegation order: a backend task delegated after UX gets the dependency directly; a UX task delegated after a still-pending backend sibling retro-wires it. Mirrors the existing frontend wiring (_depend_backend_on_ux and _depend_pending_backends_on_ux). Backend is held by the same dependency gate, so it costs no extra dispatch churn. * fix(websocket): forward notification acks instead of logging them incomplete The bridge handler serves both notification.sent and notification.acked, but acked events carry `agent_id` (the acking agent) rather than `recipient_id`, so every acknowledgement tripped the missing-field guard and logged "Incomplete notification event" instead of reaching the panel. Accept either field as the recipient. * feat(api): hint the full UUID when a truncated task id fails validation Agents copy the 8-character task prefix the system shows them (the commit prefix, task summaries) and send it as task_id, which fails UUID validation with an opaque "invalid length" 422 and wastes a call. The request-validation handler now detects a task_id UUID error and attaches a `remediate` hint telling the agent to retry with the full 36-character UUID from its task envelope. * fix(audit): record the blocked transition when a task is escalated Escalation sets a task to blocked by writing task.status directly, which bypassed the validated transition helper and so never emitted a task.blocked audit row — the lifecycle moved but the Auditor saw nothing. Extract the audit emit from the central transition helper into _emit_status_transition_audit and call it from the escalate path, capturing the prior status and outgoing owner before reassignment so the row is attributed correctly. * fix(docs): stop doubling the docs path so design specs index into RAG The documenter sometimes hands a doc path already rooted at docs/, and joining it onto DOCS_BASE_PATH (/app/docs) produced /app/docs/docs/..., so the file was never found and the spec never indexed — the frontend cell could not retrieve the UX design over RAG. Normalize the path before joining: trust an absolute path, otherwise strip a single redundant leading docs/ segment. * feat(security): let the control panel authenticate in secure mode With ROBOCO_AGENT_AUTH_REQUIRED=true every request must carry a valid HMAC token, which locked the human control panel out — it sends role headers but no token. nginx, the only trusted hop between the browser and the API, now injects the CEO token on /api and /ws, so the browser never holds the signing secret. The injected value is just the existing per-agent token issued for the CEO identity (issue_panel_token), so the token-verification path is unchanged. An empty value (dev/header-trust mode) renders to no header. `make panel-token` prints the value; set it as ROBOCO_PANEL_AGENT_TOKEN in .env before enabling secure mode. .env.example and the README Security section document the flow. * chore(compose): consolidate the two compose files into one docker-compose.yml and docker-compose.yaml had diverged: .yml — the file Docker actually uses — carried ROBOCO_PUBLIC_BASE_URL but was missing the /app/manifests bind-mount, while .yaml had the manifests mount but not the base URL. Merge the union into docker-compose.yml and delete the duplicate so there is one source of truth and no "multiple config files" warning. This activates the manifests mount in the deployed file: without it the orchestrator writes per-agent tool manifests to its ephemeral container fs, they never reach the host for the daemon to bind-mount, and agents fall back to all-verbs registration. Drop the stale .yaml reference from the config.py docstring, the labeler, and the CI path filters. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-05 16:35:22 +02:00
3 people	97533f769b	chore(deps): bump actions/setup-python from 5 to 6 (#69) ... Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5 to 6. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v5...v6) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-05 03:35:58 +02:00
3 people	f8a1f83a3b	chore(deps): bump docker/setup-buildx-action from 3 to 4 (#68) ... Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3 to 4. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-05 03:35:43 +02:00
3 people	b2c1323bd7	chore(deps): bump actions/checkout from 4 to 6 (#67) ... Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-05 03:35:29 +02:00