19 Commits

Include renames

Author	SHA1	Message	Date
Renn F	9927d248ea	[feature] wire cell-task wave chain + by-osmosis edge (sequencing S3) ... Kind 2 (cell-task wave chain): a new cell-task under root-subtask UT_n depends on every cell-task under every root-subtask in UT_n.dependency_ids (the kind-1 wave-chain edges), so its branch carries the previous wave's merged cell work. Re-derived from the root-subtask's deps, not the cell-task's own dependency_ids (which also carry UX/product-fanout edges the by-osmosis edge must not pick up). A root may fan to several cell-tasks (different cells), so the previous wave's cell-task is a SET. Kind 4 (by-osmosis): the first dev task (sequence 0) under a cell-task depends on each predecessor cell-task's tail (max-sequence) dev task, so the new wave's first branch carries the previous wave's fully-merged tail. Subsequent dev tasks inherit the tail via kind 3 or the merged base. Both wired from _create_subtask_from_inputs, dispatched on parent.team (MAIN_PM -> kind 2; cell team -> kind 4). Pure helpers (cell_task_wave_chain_depends_on, by_osmosis_tail_dev_tasks) unit-tested in test_sequencing.py; TaskService methods integration-tested. Idempotent + best-effort throughout (add_dependency dedupes; missing predecessors are no-ops). Also fixes a latent mypy-tests gap (estimated_complexity required on direct TaskCreateRequest calls in the S2 tests).	2026-06-28 04:22:27 +02:00
Renn F	12621a3608	[feature] wire dev-task collision DAG at cell-PM delegation (sequencing S2) ... Pure dev_task_collision_edges in sequencing.py turns a parent's surfaced siblings into (depends_on_id, task_id) pairs via SequencingService. TaskService. wire_sibling_collision_dag wires them through add_dependency (idempotent). The choreographer calls it after each dev-task delegate so the sibling collision DAG is built incrementally as the cell PM decomposes — file-overlap serializes, migration chains, shared-last; stable (priority, sequence) ordering keeps edges from flipping into reverse cycles on re-runs.	2026-06-28 04:11:38 +02:00
Renn F	c9fd735a32	[feature] delegate carries dev-task collision surface (sequencing S1) ... The cell/main PM's delegate verb now carries the dev-task collision surface (intends_to_touch / adds_migration / touches_shared) and an explicit depends_on override through DelegateRequest -> DelegateInputs -> _create_subtask_from_inputs -> create_subtask, and create_subtask forwards sequence / dependency_ids / batch_id / surfaces into the prepared TaskCreateRequest instead of dropping them (the base create already persists them at task.py:878-884). This is the plumbing for the multi-level sequencing model edge kind 3 (dev-task collision DAG). Previously a dev task delegated with a collision surface or an explicit dependency lost it before persistence — dependency_ids was always [], so the only dev-task ordering was the weak assignee-keyed spawn barrier (the live 2026-06-27 out-of-order break: 40842957 started before 9b3682b8's PR merged). Phase S2 runs SequencingService over the surfaced siblings and wires the DAG via add_dependency.	2026-06-28 04:05:30 +02:00
Renn F	a2bc2f1b97	[fix] fail_qa routes needs_revision back to the dev, never the pool ... A dev task in needs_revision must go back to the developer, never the pool. The pool path let a cell PM re-claim the revision (PMs can claim needs_revision) — the live 2026-06-27 'needs revision on a dev task sent to the cell PM' bug. fail_qa's original_developer marker is the fast path, but it is unreliable in practice (live observation: never persisted), so the unassign else-branch was the load-bearing path and it dropped the task into the pool. Add a work-session fallback (_resolve_revision_dev) that resolves the developer who actually worked the task — the most recent work session whose agent is a developer, the QA's own session excluded — and reassigns to that dev instead of unassigning. Only unassign when no developer ever touched the task. Self-heals the marker so a subsequent re-fail takes the fast path and the QA-review index attributes the work correctly.	2026-06-28 03:55:24 +02:00
3 people	889f3689e7	MegaTask (#248) ... * feat(batch): batch_id + collision descriptor columns Sequenced batch intake ("Mega task") foundation: tasks.batch_id (indexed) groups a batch of top-level tasks created together; intends_to_touch (text[]), adds_migration and touches_shared (bool, NOT NULL default false) are the per-task collision surface the SequencingService will read to wire dependency waves. Mirrored on the Task model + TaskCreateRequest and wired through TaskService.create. Migration 046 (real upgrade->downgrade->upgrade verified vs a throwaway pgvector PG); a non-batch task declares no surface (defaults). Task 1 of the 0.11.0 sequenced-batch-intake plan. * feat(batch): flag + draft collision descriptors Default-off ROBOCO_BATCH_INTAKE_ENABLED (config + FEATURE_FLAGS + panel card); the propose_draft tool doc + the TS DraftProposal gain the per-task collision surface intends_to_touch / adds_migration / touches_shared. The draft is a loose dict so the descriptors ride it through the relay intact (test asserts the forwarded payload); the analyzer (Task 3) reads them to wire dependency waves. Task 2 of the 0.11.0 sequenced-batch-intake plan. * feat(batch): deterministic collision-sequencing analyzer SequencingService.analyze turns a batch's per-task collision surfaces into a dependency DAG + execution waves — correctness in CODE, not agent judgment. Rules in order: file overlap serializes (more-important first), migrations form a serial chain (no concurrent Alembic heads), touches_shared runs last, cell contention warns (never serializes); then dedupe, existence + cycle check, and Kahn topological layering. Pure (no DB/services); SequencingError on a cycle or out-of-range edge. Golden test reproduces the CEO's hand-sequenced 4 waves of the 11-item guard-core-app batch (the effort that deadlocked the Main PM): S6 alone last, the R1/R3/R4 migration chain, R2/R3/S8 serialized on the shared threat service, S1/S2/S7 in one parallel wave. Task 3 of the 0.11.0 sequenced-batch-intake plan. * chore(batch): brand the user-facing surfaces "MegaTask" The user-facing name is MegaTask: the feature-flag label is "MegaTask intake", the panel flag-card and the config description lead with MegaTask. Internal names stay technical (batch_intake_enabled, batch_id, SequencingService). * chore(batch): drop the feature flag — MegaTask is a core intake scope MegaTask is additive and opt-in by its own nature (the Prompter proposes a batch only when the CEO asks for several tasks; single-task intake is unchanged), so there is no risk surface a flag protects — 'don't create a MegaTask' is the off switch. Remove batch_intake_enabled from config, the FEATURE_FLAGS registry, the panel flag card, and its tests. MegaTask will be a third scope option in the Intake modal (single-cell / multi-project / MegaTask), not a toggle. * feat(batch): MegaTask identity predicate + orchestrator branchless recognition The single source of truth for the umbrella's exemptions: pure is_batch_umbrella / is_batch_root_subtask / is_branchless_coordination (foundation/policy/batch.py) — an umbrella has a batch_id and is top-level; a root-subtask shares the batch_id but is parented. The orchestrator's _is_coordination_task now consults is_branchless_coordination, so a MegaTask umbrella is recognized as doing no git of its own (git-exempt at spawn-readiness / stuck-detection) exactly like a product fan-out root. Non-batch behavior is identical (the predicate reduces to the old no-project+product check; the orchestrator coordination suite stays green), and the umbrella branch is inert until the create path exists. First slice of the MegaTask umbrella enforcement (branchless guard). * feat(batch): branchless umbrella guard across the git-exemption sites A MegaTask umbrella does no git of its own — every git-exemption site in TaskService now consults the shared is_branchless_coordination predicate instead of an inline product-only check, so the umbrella's exemptions cannot drift between sites: - the claimed->in_progress branch gate (GitContext.is_coordination) lets an unbranched umbrella reach in_progress and delegate; - _ensure_branch_for_task short-circuits an umbrella to "" instead of the misconfigured raise (the claim path ignores the return, treating it as branchless); - CEO-reject routing sends a rejected umbrella to the Main PM in PENDING (needs_revision is developer-claim-only and would deadlock it). Covers both shapes via the predicate (product fan-out root OR umbrella); a batch root-subtask keeps its own branch/PR. Adds orchestrator recognition tests for the umbrella plus claim/branch/reject integration tests. * feat(batch): umbrella assembles no PR; completes branchless submit_root now hard-rejects a MegaTask umbrella up front (a preflight that also folds in the unknown-role refusal to stay within the return-count budget): the umbrella spans many projects with no single master, so each root-subtask opens and is reviewed on its own PR — the umbrella never enters the in-path review gate. The Main PM completes it directly once every root-subtask is terminal. Umbrella completion needs no new code: it is branchless (no branch_name), so _main_pm_complete_guard already accepts it from in_progress, checks all_subtasks_terminal, and main_pm_complete walks it to awaiting_pm_review and escalates to the CEO with no PR creation — exactly the product fan-out root path. Adds the submit_root-reject and umbrella-completion gateway tests; pins batch_id=None on the normal-root submit_root test (a MagicMock auto-attr would otherwise read as an umbrella). * feat(batch): MegaTask create path — umbrella + sequenced root-subtasks PrompterService.confirm_live_batch turns N confirmed drafts into a real MegaTask: it builds each draft's collision surface, runs the pure SequencingService to get conflict-free waves, creates the branchless umbrella (batch_id, no project/product), then one root-subtask per draft (own project, parent=umbrella, sequence=wave index, descriptors), and wires the analyzer's edges through add_dependency so the existing dependency-gate runs the waves in order. The route picks the start path like a single confirm: 'board' holds the root-subtasks in BACKLOG for the batch review; 'main_pm' creates them PENDING so wave 0 dispatches at once. create_task_from_draft gains a BatchPlacement (parent/batch/sequence/ team_override) and forwards the collision descriptors; the exactly-one- target rule (here and the TaskService.create invariant) is relaxed for an umbrella, which legitimately targets neither. New route POST /live/{session}/confirm-batch + BatchConfirmRequest mirror the single confirm. Adds the structural-invariant + board-hold + empty-batch tests. * feat(batch): release MegaTask root-subtasks on CEO approval; board awareness The board route holds a MegaTask's root-subtasks in BACKLOG so the work waits for the batch review. approve_and_start (CEO gate #1, board->Main PM) now releases them via _activate_batch_root_subtasks: each held child flips BACKLOG -> PENDING + team=main_pm so the dependency-gate dispatches wave 0. No-op for a non-umbrella; idempotent (children past BACKLOG untouched). The Product Owner and Head of Marketing identity prompts gain a MegaTask section so they review the whole batch + wave plan and adjust scope before sign-off (they review drafts; the umbrella is their unit). Also extracts the create() target invariant into _require_target_or_umbrella to keep the method under the complexity gate after the umbrella exemption. Adds the umbrella-approval activation test. * feat(batch): multi-project intake scope for MegaTask A MegaTask spans several possibly-unrelated repos, so the intake chat can now be scoped to an explicit project list (not just one project or one product). StartLiveRequest gains project_ids; /live/start threads it through start/spawn_intake_session -> _spawn_intake_container -> _clone_intake_scope. The multi-repo clone machinery already existed for products; _intake_scope_slugs now also resolves an explicit project_ids set (split into _slugs_for_project_ids / _slugs_for_product), cloning each repo with the first as the primary cwd and the siblings readable. Scope validation is now 'exactly one of project_slug / product_id / project_ids' via the shared _require_one_intake_scope. Adds scope-resolution, spawn, and route tests for the MegaTask path. * feat(batch): propose_batch intake tool (MegaTask multi-draft hand-off) The intake agent can now hand the panel a whole MegaTask in one tool call. Both intake paths gain propose_batch alongside propose_draft: - Claude (intake_driver): a propose_batch tool registered on the in-SDK MCP server + allowlisted; the driver intercepts the ToolUseBlock and emits ONE StreamChunk(kind="batch") carrying {drafts:[...], title}. - grok (intake_server): a propose_batch tool that POSTs a "batch" relay event via the shared _post_event helper (post_draft/post_batch). A batch carries N drafts, each the propose_draft shape PLUS its own project_id (a MegaTask spans unrelated repos) and collision surface so the analyzer sequences the waves. The prompter prompt documents the MegaTask scope + when to call propose_batch. Adds Claude-normalize and grok-relay tests for the batch path. * feat(batch): MegaTask intake panel — third scope, batch review, waves The panel now drives a MegaTask end to end. The intake modal gains a third scope, 'MegaTask', beside Single cell and Board-led: a multi-project checklist (a MegaTask spans several possibly-unrelated repos), validated to at least two. start() sends project_ids; use-prompter accumulates the agent's single propose_batch hand-off as a 'batch' SSE event into a BatchProposal and lands in a new batch_preview state. A new BatchReviewCard lists every proposed task with its target project + collision-surface badges (migration / shared) and offers one start path for the whole batch — Board review & Start or Approve & Start — wired to confirmBatch → POST /confirm-batch. The success card shows the sequenced result: N tasks in M waves (+ any advisory notes). prompter.ts gains the DraftScale 'megatask' + the BatchConfirm payload/result types; the SSE client allows the 'batch' kind. Panel typecheck + lint + 113 tests green. * docs(batch): MegaTask across changelog, CLAUDE.md, site, and RAG The four documentation obligations for the MegaTask feature: - CHANGELOG: an Unreleased entry covering the umbrella model, sequencing, multi-project intake, propose_batch, and the create/approval path. - CLAUDE.md: a MegaTask section (identity predicate, umbrella/root-subtask hierarchy, sequencing rules, intake + create path, board activation). - Published site: a user-facing company/megatask.md (scopes, waves, the umbrella, the two start buttons) + nav entry; a pointer added to the intake chapter of the Tour. - RAG corpus: workflows/megatask.md so the Main PM (and any agent) can retrieve the umbrella's branchless / no-PR / completion rules at runtime. The runtime concurrent-migration guard is intentionally NOT added: the analyzer already chains migration-adders into dependencies and the dependency-gate serializes them, so a separate guard would be dead code. * feat(batch): batch_id guardrail + wave preview + batch_id on TaskResponse Guardrail (CEO): a batch_id is denied on any task that is not a well-formed MegaTask member. is_valid_batch_shape permits batch_id only on an umbrella (no parent → must target neither project nor product) or a root-subtask (has a parent → exactly one target); TaskService.create enforces it AND verifies a root-subtask's parent is the batch umbrella (same batch_id, top-level). This closes a latent hole: is_batch_umbrella is true for a batch_id + no-parent task even with a project, so a stray batch_id could have spoofed the branchless branch-gate / no-PR exemption. (The public task API never exposed batch_id for write; this guards the service layer.) Wave preview: PrompterService.preview_batch + POST .../preview-batch compute a MegaTask's waves from the proposed drafts WITHOUT creating anything, so the panel can show the sequencing before confirm. Extracted _sequence_drafts as the single source shared by preview and confirm, so the previewed waves are exactly the ones wired. TaskResponse now carries batch_id so the panel can badge the umbrella. * feat(batch): MegaTask review — project editor, wave preview, persistence, badge Closes the panel gaps in the MegaTask review experience: - Per-task project editor: each proposed task gets an inline project Select (updateBatchDraftProject), so a task the agent put in the wrong or no repo can be fixed before launch — not only by re-chatting. Launch stays blocked until every task has a project. - Wave preview: on a batch proposal the panel fetches POST .../preview-batch (no task created) and shows the conflict-free wave plan, so the human reviews the sequencing before confirming. - Refresh durability: the MegaTask review (batch + waves + projectIds) is persisted, so a browser reload mid-review restores it like a single draft. - MegaTask badge: TaskResponse exposes batch_id, the panel Task type carries it, and the task table badges the umbrella row 'MegaTask'. Panel typecheck + lint + 113 tests green. * test(batch): stub task carries batch_id for task_to_response task_to_response now serializes batch_id (TaskResponse field), so the _stub_task SimpleNamespace fixture must provide it — without it the reader hit AttributeError, failing the 8 task-schema serialization/enrichment tests. Test-only; the real TaskTable carries the column (migration 046). * fix(batch): close MegaTask audit gaps — completion crash, analyzer cycle, guardrails An adversarial multi-agent audit of the feature surfaced 20 verified gaps; this closes the backend ones. HIGH: - Umbrella completion crashed. escalate_to_ceo hard-required a pr_number, which a branchless umbrella never has, so main_pm_complete dereferenced None. Both pr_number gates now waive a MegaTask umbrella (escalate_to_ceo + the awaiting_pm_review->awaiting_ceo_approval lifecycle gate via a new GitContext.is_umbrella), and main_pm_complete guards a None return. The completion test had mocked escalate_to_ceo, hiding it — now a real service test covers the waiver. - The collision analyzer could fabricate a cycle (a touches_shared + adds_migration draft overlapping another migration draft) and raise SequencingError — a bare ValueError that escaped as an opaque 500. The migration chain is now shared-last-aware (never contradicts rule 3), and _sequence_drafts translates SequencingError to a clean 400. MEDIUM: - Collisions are now project-scoped: two repos can't collide on a coincidental path or serialize independent migrations (DraftSurface carries project_id; rules 1/2/3 respect it). - The batch_id guardrail ran only at create. update() + the PATCH null-clear path now re-assert is_valid_batch_shape, so a mutation can't break a member's shape and spoof the branchless exemption. - A draft missing title/acceptance_criteria now raises ValidationError (was a bare KeyError -> 500). - confirm_live_batch re-asserts every draft targets a scoped project and the batch spans >=2 distinct projects (project_ids added to the request). - Route-level tests for confirm-batch / preview-batch. LOW: strict multi-repo clone (fail loud on any unresolvable project); malformed/empty propose_batch surfaces an error chunk (Claude) / refuses to POST (grok) instead of silently acking; dropped malformed drafts are counted and surfaced; stale grok intake docstrings updated. * fix(batch): MegaTask panel + doc audit gaps Frontend half of the audit fixes: - The confirm payload now carries project_ids (the schema requires it), and the panel re-checks every task targets one of the scoped repos before launching, naming the offending task. - The Review-MegaTask project picker is filtered to the scoped repos and the per-task validity (border + launch gate) keys off scoped membership, so a task can only be (re)pointed at an in-scope project — also fixing the case where the agent emitted a non-UUID / unknown project. - Dropped malformed drafts are surfaced as a chat error so the human knows the batch shrank instead of silently confirming fewer tasks. - Doc wording: a wave releases on the previous wave's terminal state (normally a merge; a cancellation releases it too), not strictly 'merged'. * test(batch): lock the CEO's EXACT 4-wave hand-sequencing as the golden bar The golden test asserted the constraints (S6 last, the migration chain, the shared-threats serialization, S1/S2/S7 parallel) but not the full wave partition. The bar for MegaTask is 'reproduce my exact waves or it's not done', so assert the exact 4-wave partition the analyzer produces for the guard-core-app batch: wave 1: R1 R2 S1 S2 S3 S5 S7 · wave 2: R3 · wave 3: R4 S8 · wave 4: S6 Confirmed unchanged by the audit's analyzer fixes (no migration is shared; single project). * fix(batch): tolerate a stub task in assert_batch_shape_intact The batch-shape re-validation read task.batch_id directly, but update()'s partial-caller contract is exercised with a SimpleNamespace stub that has no batch_id column → AttributeError. Use getattr(..., None) for batch_id and the shape fields so the guard no-ops on any task lacking the column (a stub, or a non-batch task) while still enforcing on a real batch member. * fix(orchestrator): authenticate internal API self-calls with the system identity The dispatcher httpx clients were built without an agent identity, so the orchestrator's self-PATCHes to /api/tasks/{id} (auto-block, auto-resume, auto-recover, SLA annotation) were rejected 401 "Missing X-Agent-ID" and silently no-op'd. The auto-resume that lifts a PM's paused parent could never write, so paused/blocked parents stayed wedged and stranded their dependents (the fe-pm/be-pm respawn churn seen in prod). Header propagation was inconsistent across the separate AsyncClient call-sites: only the main dispatch client carried the system identity; the readiness and sweep clients did not. Hoist the identity into a shared _SYSTEM_API_HEADERS constant and apply it to every API-facing dispatcher client. The system role holds TaskAction.ASSIGN, so it is authorized for the audited admin_set_status path those write routes use. The external provider-recovery probe client is intentionally left untouched. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-24 01:15:57 +02:00
3 people	c09cf80b40	Feature/observability gateway health (#247) ... * feat(observability): revision_count + audit_log query index (migration 045) Adds tasks.revision_count (the O(1) rework counter — forward-only, existing rows default 0) and the composite index audit_log(target_id, event_type, timestamp) that powers the cycle-time and rework reconstruction queries. Verified the real upgrade/downgrade/upgrade chain on a throwaway pgvector PG. First task of the 0.10.0 observability dashboards. * feat(observability): count reworks + attribute qa_fail/pr_fail to the rejector Every transition into needs_revision increments tasks.revision_count at the single audit chokepoint (exactly once per bounce, across all paths incl. pr_fail and ceo_reject), so the rework rate is an O(1) read. A QA or PR-review bounce also emits a named task.qa_fail / task.pr_fail audit event carrying the rejector's agent_id, so the per-agent rework scorecard charges the rejection to the reviewer who made it, not the developer who owns the task. * feat(observability): cycle-time, bottleneck, rework, and scorecard metrics MetricsService gains four read methods on the audit_log + tasks data: per-stage cycle time reconstructed from the transition journey (excluding the named qa_fail/pr_fail events), bottleneck distribution (cumulative dwell + live parked counts), rework rate (overall/by-team/by-agent with rejector attribution + cost via spawn-session task_id), and a fused per-agent/per-cell scorecard. Dataclass models with to_dict(). Verified against a real Postgres journey. * feat(observability): cycle-time/bottleneck/rework/scorecard read endpoints Thin read-only routes on the dashboard router delegating to MetricsService: /metrics/cycle-time, /metrics/bottlenecks, /metrics/rework, and /metrics/scorecard/{agent,team}. 404 when an agent scorecard target is absent. 5 route tests (200 + shape + the agent-404 case). * feat(panel): Delivery observability tab (cycle-time, bottlenecks, rework, scorecards) A third Metrics tab built on the observability endpoints: a per-stage cycle-time bar chart, a bottleneck panel (worst stage + cumulative dwell + live parked counts), a rework panel (rate + by-team + by-agent attribution + cost), and per-cell scorecards. Reuses Recharts + Card/Badge/Skeleton and the React-Query hook pattern; observabilityApi mirrors usageApi with mock-mode fallbacks. tsc + eslint clean; 113 panel tests pass. * docs(observability): changelog + CLAUDE.md for the delivery dashboards * feat(gateway-health): recover a broken-but-alive agent instead of protecting it The verb-heartbeat cannot tell a quiet-healthy agent from one whose MCP gateway is broken (a corrupted /app/.venv firing no verb) yet whose container is up — the reaper's live-skip would shield it forever. The reaper now probes the gateway out-of-band (docker exec: does the gateway venv import its deps?) and, once it has been broken past gateway_health_grace_seconds (tolerating a transient probe miss), kills + evicts the container so it falls through to release + respawn. Probe-inconclusive or healthy spares the container. Gated by gateway_health_enabled (default-on reliability fix; in the panel Feature Flags). Defers the optional agent-side self-check + full registry re-adoption — the reaper's docker-liveness fallback already recovers a broken-after-restart agent. * docs(gateway-health): changelog + CLAUDE.md for broken-but-alive recovery * docs(observability): user-facing docs for the Delivery dashboards + gateway-health Documents the new Metrics -> Delivery tab (cycle-time, bottlenecks, rework with rejector attribution, cell scorecards) in the panel guide and the operations health-and-metrics guide, and adds the gateway-health env vars + an agent-gateway recovery note. Published MkDocs site only; settings.md's default-off flag table intentionally omits the default-on gateway-health flag (same as overload-break). * chore(release): cut 0.10.0 (changelog section + version refs) * fix(gateway): exempt PM coordinators from single-task claim guards A Main/Cell PM plans and delegates many root tasks in parallel; the work then runs in the delegated cells, not in the PM's own hands. But the claim-time concurrency guards meant for developers — already_active and paused (the latter firing after i_am_idle auto-pauses the PM's own umbrella) — were applied to the PM too, so once it held one root it could never plan a second: it thrashed between its claimed roots and respawned forever, burning tokens for zero progress. _run_claim_guards now skips already_active/paused for the coordinator PM roles (_COORDINATOR_ROLES = {main_pm, cell_pm}); only unmet_dependency — a real upstream sequence constraint, which parks the root back to pending — still gates a PM. paused_tasks_guard also excludes the target task itself, so a PM re-entering its own paused umbrella never self-blocks. Tests: a coordinator plans a second root with one in_progress + one paused sibling (full path + claimed-recovery path), the paused target exclusion, and the developer guards still fire. Repurposed the pre-fix test that asserted the now-removed PM block. * fix(metrics): coerce SQL avg/extract hours aggregates to float (panel toFixed crash) EXTRACT(epoch ...) returns numeric on PostgreSQL 14+, which asyncpg surfaces as a Decimal; a Decimal serializes to a quoted JSON string, so the panel's avg_cycle_hours.toFixed(1) (and the other hours fields) threw 'toFixed is not a function' and blanked the Delivery tab. A single _as_hours helper now rounds every SQL-averaged hours field to a real float — avg_cycle_hours on the new scorecards plus the pre-existing avg_completion_hours / avg_blocked_hours / longest_blocked_hours. Token and cost fields were already float()-cast and are unaffected. Regression test asserts _as_hours coerces Decimal -> float and preserves the None/zero behavior. * feat(panel): edit a task's sequence from the details page A task's sequence (order within siblings, lower runs first) was display-only with no way to change it from the UI, and TaskUpdate didn't carry the field so PATCH couldn't set it either. The details page's Dependencies tab now has an inline sequence editor mirroring the parent / dependency editors, and PATCH /tasks/{id} accepts a sequence field (owner or privileged role) through the existing generic update path. * fix(mypy): green the full make-quality type gate make quality runs 'mypy roboco/ tests/', which the per-module checks on the 0.10.0 branch never exercised. Two issues surfaced: - The coordinator-exemption change added role_str to Choreographer._run_claim_guards but not to the ChoreographerHelpers protocol base, so the composed Choreographer had incompatible base-class signatures. Sync the protocol signature. - The gateway-health / stale-reaper tests stubbed methods by direct assignment (orch._m = AsyncMock()) and typed their duck-typed task doubles as object, tripping method-assign / assignment / attr-defined. Switch to monkeypatch.setattr (keeping a local mock ref for the assertions) and type the doubles as Any — no type: ignore. Full mypy roboco/ tests/ clean (785 files); the 21 runtime tests pass. * fix(metrics): static cycle-time SQL — clear bandit B608 (CI gate) The cycle-time query interpolated an optional team clause into the text() SQL via an f-string, which bandit flags as B608 (hardcoded SQL) and turned the merge gate red. The team value was always a bound parameter, so it was a false positive — but the f-string is the trigger. Rebuilt as one static query with (CAST(:team AS text) IS NULL OR a.details->>'team' = :team) and an always-bound team param (CAST, not ::text — SQLAlchemy's :param parser collides with PostgreSQL's :: cast operator, which broke the query as a stray param). Full make quality green vs a real pgvector PG (all 21 gate steps). --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-23 07:26:41 +02:00
Renn F	2aa00ca124	test(content): assert transition notes via markers, not quick_context ... Three integration tests still asserted the old quick_context soup format for completion_notes / escalation_notes — update them to read the new orchestration_markers transition_note (the source moved in the prior commit).	2026-06-21 08:14:55 +02:00
Renn F	3ff6967b9d	fix(content): keep coordination notes off dev_notes / quick_context ... Two agent-authored fields were leaking non-developer content into the human note columns the panel renders: - apply_escalation appended '[ESCALATED] From X to Y\nReason: ...' to dev_notes (the developer's space). On a re-escalation loop a stuck cell PM grew one task's dev_notes to ~8KB across 5 escalations. It now writes a structured orchestration_markers['escalation'] record; the target still learns the reason from the escalate notification. - approve_and_start string-packed 'approve_and_start_notes:<text>' into quick_context (raw key:value soup). It now writes orchestration_markers['approve_and_start_notes'], leaving quick_context for the human ResumptionNote only. Adds typed marker accessors (get/set_escalation, get/set_approve_and_start_notes) and refactors _record_pr_review under the complexity bound by extracting _compose_review_body. Documents update_task_with_message as the legacy A2A-protocol log (dev_notes is intentional there, not pollution).	2026-06-21 05:36:50 +02:00
Renn F	0fba4eed01	refactor(content): move orchestration markers off quick_context to typed jsonb	2026-06-21 02:48:07 +02:00
4 people	6cf99a1b0a	[beb8cae1] Type-gate tests/ under mypy — fix all errors and flip quality gate (#156) (#157) ... * [420e5e68] Fix mypy errors in tests/unit/ and create tests/__init__.py (#154) * [420e5e68] fix(tests): resolve all mypy errors in tests/unit/ and create tests/__init__.py - Create tests/__init__.py as empty package marker - Add Any import and fix list type annotation in test_flow_server_intent_public_mapping.py - Move AsyncIterator to TYPE_CHECKING block and fix m.cls.__name__ attr error in test_app.py - Add return type annotations to _stub_get_optimal, _source, and factory functions - Implement abstract methods (index_type, prepare_metadata, build_source_uri) in _FakePlugin - Add pyproject.toml per-file-ignore for ARG002 on test_optimal_grounding.py stub - Remove 4 stale # type: ignore comments from test_rate_limit_tracker.py - Fix method-assignment patterns in test_rate_limit_sweep.py via patch.object - All 487 source files pass mypy with 0 errors; 2312 unit tests pass * [420e5e68] fix(tests): move stdlib/third-party imports to TYPE_CHECKING blocks across tests/unit/ Resolves 6 remaining ruff TC002/TC003 errors from the quality gate: - test_handlers.py: Iterator → TYPE_CHECKING - test_quality_gate.py: pathlib → TYPE_CHECKING - test_board_dispatch.py: AsyncIterator + httpx → TYPE_CHECKING - test_streaming.py: Iterator → TYPE_CHECKING - test_notification.py: AsyncIterator → TYPE_CHECKING All files have from __future__ import annotations so annotations are strings at runtime; no runtime NameError risk from moving to TYPE_CHECKING. * [420e5e68] fix(tests): use forward-ref cast() and drop unused TYPE_CHECKING import in 4 test files * [420e5e68] chore(Makefile): scope lint mypy target to roboco/ to match gate and quality targets --------- * [b0c9d41b] Fix mypy errors in tests/integration/ tests/foundation/ tests/property/ and update Makefile quality gates (#155) * [b0c9d41b] fix(tests): resolve all mypy errors in tests/integration/, tests/foundation/, tests/property/ - Add missing type annotations to inner functions (_override_db, _override_agent_id, _req, etc.) - Use cast("UUID", ...) to fix SQLAlchemy UUID vs uuid.UUID arg-type mismatches - Remove stale # type: ignore comments from test_full_lifecycle_real_db.py and test_task_service_lifecycle_misc.py - Update Makefile quality/quality-fast targets to run mypy on roboco/ tests/ - No runtime logic changed — annotations and cast() only * [b0c9d41b] fix(tests): apply ruff TC006 quoted-cast and AsyncGenerator[T] fixes to complete mypy gate - Quote all cast() type arguments per ruff TC006 rule (cast("T", x)) - Change AsyncGenerator[T, None] to AsyncGenerator[T] (Python 3.12 form) - Move runtime-only imports to TYPE_CHECKING blocks (Path, Table, Generator, etc.) - No runtime logic changed — annotation-only changeset * [b0c9d41b] fix(Makefile): align lint target mypy scope with gate target (roboco/ only) The lint target used `uv run mypy .` (all files) while gate uses `uv run mypy roboco/`. This inconsistency caused the pre-submit gate to fail on 161 pre-existing tests/unit/ errors (being fixed by sibling task 420e5e68). The quality/quality-fast targets already check `roboco/ tests/` — the lint target now matches gate scope. --------- --------- Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> Co-authored-by: Backend Developer 2 <be-dev-2@agents.roboco.dev>	2026-06-14 13:43:46 +02:00
3 people	ff35a646fa	Chore: reduce analytics complexity (#100) ... * refactor(analytics): reduce cyclomatic complexity in usage/pricing/rollup Collapse the three near-identical get_by_* aggregation methods in UsageService into a shared _aggregate_by helper parameterized by group column and key name, and centralize token null-coalescing in a _row_tokens helper. Extract the per-row upsert in _sweep_daily_rollup into _upsert_rollup_row, and the pricing-table lookup into _lookup_prices. All blocks now rank <= B and both modules rank A, so the xenon gate passes; behavior is unchanged and existing tests stay green. * feat(billing): make token pricing provider-aware Distinguish three cases when a model has no per-token rate: a non-Anthropic model (local Ollama, or an Ollama Cloud ":cloud" model billed by flat subscription / GPU-time) legitimately has no per-token cost and returns 0.0 silently; an unpriced Anthropic ("claude"-named) model also returns 0.0 but logs a warning, since that is real spend being undercounted and catches new or renamed Claude models missing from the table. Folds the old ollama/ prefix special-case into the general non-Anthropic path so there is one code path, and replaces the blanket 'no pricing data' warning that fired even for self-hosted models. * fix(tasks): preserve ownership when force-unclaiming to pending The stale-claim reaper and the dependency-blocked release both routed through _force_unclaim_to_pending, which nulled assigned_to and left the task in a pending state owned by nobody — no dispatcher re-spawns an ownerless pending task, so it went dormant. The dispatcher-side claimed_by fallback only masked half the cases. Capture the owner before releasing the claim and keep both assigned_to and claimed_by pointed at it (mirroring the unblock restore), releasing only the live claim (active_claimant_id + heartbeat) and the WorkSession. The same agent now resumes the task once it re-dispatches. Updates the reaper test that asserted the old orphaning behavior and adds owner-preservation coverage for both the reaper and dependency-release paths. * fix(tasks): unblock restores the owner into both ownership fields Audit follow-up to the force-unclaim ownership fix. unblock() only restored assigned_to from blocker_raised_by, which block() stashes solely from assigned_to. A task claimed via give_me_work (claimed_by set, assigned_to null) therefore unblocked into a split-owner state — assigned_to null but claimed_by set — that both the dev dispatcher and the PM pool-router race to pick up. It also left claimed_by pointing at the resolver PM after an escalation. Resolve the owner as blocker_raised_by or assigned_to or claimed_by and write it to both fields, matching the force-unclaim and reassign convention so the original worker resumes cleanly. Adds coverage for the give_me_work-claim case and asserts owner restoration on the existing in_progress-resume test. * test(orchestrator): cover dev owner resolution and the claimed_by fallback _resolve_dev_owner_uuid had no coverage. Add the status-dependent precedence (claimed/blocked prefer the live claimant; other statuses prefer the PM-assigned owner) and the half-reap fallback where a pending task with assigned_to nulled still resolves its owner from claimed_by instead of going dormant. * fix(tasks): wire the pre-block snapshot so unblock(restore=True) works The restore=True path on a PM unblock was a no-op: pre_block_state / pre_block_assignee (migration 006) were read by unblock_with_restore but never written, so it always fell through to legacy unblock() and the restore flag did nothing. Snapshot the resting status + owner at every block entry (dependency block, soft block, escalation) before mutating, capturing only the first block in a chain so a re-block doesn't overwrite the original state. Escalation snapshots the outgoing owner, not the escalation target, so restore returns the original worker. The restore path applies the same branchless guard legacy unblock() relies on — a snapshotted in_progress with no branch diverts to pending instead of looping the dispatcher — and is extracted into _apply_pre_block_restore to keep complexity under the gate. Adds coverage for snapshot capture, restore, the branchless divert, and escalation owner restoration. * test(tasks): update orphan-reconciler and dependency-release tests for owner preservation Both the startup orphan reconciler and the dependency-blocked claim release route through unclaim_for_reaper / _force_unclaim_to_pending, which now preserve the owner instead of nulling assigned_to. Update the two tests that asserted the old orphaning behavior to assert the owner is kept (so the same agent resumes) while the live claim is released. * chore(tests): scrub internal work-item labels from test names, docstrings, comments Rename four test files that carried audit work-item IDs in their filenames (test_p0_7_branch_atomicity, test_p2_8_orphan_reconciler, test_p2_9_autogen_prompt_layer, test_p2_7_attempt_id) to describe what they test, and strip the matching P-/D-/S- cluster labels from docstrings, comments, and assertion messages across the test suite and two orchestrator comments. These are internal references with no meaning in the codebase; behavior is unchanged. * style: reformat assertion line shortened by the internal-ref scrub * build: waive unreachable torch CVE-2025-3000 in pip-audit gate torch is a transitive CPU-pinned dep (piragi / sentence-transformers) never loaded at runtime — the stack uses Ollama over HTTP for all embeddings/LLM, so the vulnerable torch.jit.script path is unreachable. CVE-2025-3000 is MEDIUM, local-only, with no published fix. Documented --ignore-vuln waiver; revisit when a fixed torch ships. * fix(orchestrator): route unplaceable pending tasks to main-pm instead of dropping them _get_routing_target returned None when a 'dev'-classified task had no cell agent (no team, or a non-cell team like fullstack/system) or when the routing classification was unrecognized. _route_unassigned_pm_task logged 'no routing target found' and returned, leaving the task ownerless and pending — and no dispatcher re-spawns an unrouted pending task, so it went dormant for 10+ min until the stuck-task detector caught it. Fall back to main-pm (the same default cell_pm routing and escalation already use) so the task is always owned and triaged, never stranded. Logs the fallback so unplaceable tasks stay visible. Adds a test asserting no (routing, team) combination ever resolves to None. * fix(panel): make intake chat markdown inherit the bubble's text color MarkdownBody is shared by the assistant (text-foreground) and user (text-primary-foreground) bubbles. [&_*]:!text-inherit only colored the prose div's descendants, so the prose div itself kept the prose typography body color (gray) and children inherited that — unreadable on the muted assistant bubble. Add !text-inherit on the prose div itself so it inherits the bubble's color too; descendants then inherit the correct foreground. Fixes both bubbles without hardcoding a color. * fix(prompter): keep a board-reviewed product on the board team so Approve & Start shows A product coordination root confirmed via 'Board review & Start' is assigned to a board reviewer (product-owner) for review, but create_task_from_draft set team=main_pm for every product unconditionally. The CEO's Approve & Start gate keys on team=board, so the button never appeared — and because the owner stayed a board agent while the team said main_pm, the dispatcher routed it to the board path (nothing left to do after review) and the task stranded at pending, with the board agent fruitlessly trying to escalate it up. Route a product by its assignee: a board reviewer keeps it team=board (so the gate appears and approve_and_start later hands it to Main PM), while a main-pm assignee — the 'Approve & Start' straight-through path — is team=main_pm. Adds _assignee_is_board mirroring TaskService's board-role check, and a test. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-11 04:36:17 +02:00
5 people	b3057628b0	[499f9eb1] Token Usage & Cost Analytics — Full-Stack Instrumentation, Persistence, and Visualization (#90) ... * [cd2bf666] feat(usage): add token usage types, API client, hooks, and UI components (#87) (#88) - Append 5 TypeScript interfaces to src/types/index.ts: TokenUsageSnapshot, AgentUsageRow, UsageSession, UsageTimePoint, ModelUsageSlice - Create src/lib/api/usage.ts: Axios singleton + isMockMode guards for getUsageSnapshot, getUsageTimeSeries, getAgentUsage, getUsageSessions, getModelUsage - Create src/hooks/use-usage.ts: usageKeys factory + useUsageSnapshot, useUsageTimeSeries, useAgentUsage, useUsageSessions, useModelUsage hooks - Create UsageOverviewPanel (dashboard/usage-overview-panel.tsx): 6 metric rows with Skeleton loading state; week-over-week trend arrow for cost - Update CommandCenter: Metrics+Alerts row expanded from 2-col to 3-col grid adding UsageOverviewPanel - Create src/components/metrics/ folder: UsageTimeSeriesChart (recharts stacked AreaChart with var(--chart-1/2/3)), ModelUsageDonut (PieChart), AgentUsageChart and TeamUsageChart (BarChart), SessionsTable (sortable columns + 10-row Prev/Next pagination) - Update Metrics page: Token Usage & Costs section with 5 rows (summary cards, time series+donut, agent+team bar charts, projection+cache efficiency, sessions table) - Add usage mini-bar to AgentCard: token count + cost + progress bar; AgentGrid and Agents page pass agentUsageMap through - Install recharts 3.8.1 - Export all new symbols through their barrel index.ts files Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> * [10372f0f] Implement full token usage instrumentation: DB migration, SDK endpoints, orchestrator hooks, analytics API, WebSocket events, dashboard integration (#86) (#89) * [10372f0f] feat(token-usage): add Alembic migration 026 for token usage tables Create agent_spawn_sessions, token_usage_snapshots, and daily_usage_rollups tables with correct BIGINT columns, indexes, and unique constraint. Chain: 025_agentrole_prompter → 026_token_usage_tables. * [10372f0f] feat(token-usage): add ORM table classes for token usage instrumentation Add AgentSpawnSessionTable, TokenUsageSnapshotTable, DailyUsageRollupTable to db/tables.py. Import BigInteger and Date from SQLAlchemy. All columns match the migration schema with BIGINT token counts and proper indexes. * [10372f0f] feat(billing): add pricing module with calculate_cost() function Create roboco/billing/__init__.py and roboco/billing/pricing.py with calculate_cost() supporting Claude opus/sonnet/haiku models with input/output/cache pricing. Unknown models return 0.0 without raising. * [10372f0f] feat(sdk): add POST /usage/report and GET /usage/status endpoints to agent SDK Extend _SessionState with token counters. Add TokenReportRequest and TokenUsageStatus models. POST /usage/report additively accumulates token counts; GET /usage/status returns current session totals for sweeper polling. * [10372f0f] feat(orchestrator): add token usage instrumentation hooks - _launch_spawn() calls _record_spawn_session() after successful container spawn - stop_agent() calls _finalize_spawn_session() before container removal - _run_sweep() calls _sweep_token_snapshots() and _sweep_daily_rollup() each tick - New methods: _record_spawn_session, _finalize_spawn_session, _sweep_token_snapshots, _sweep_daily_rollup in TOKEN USAGE section * [10372f0f] feat(api): add token usage analytics API with 7 endpoints Create roboco/services/usage.py (UsageService) and roboco/api/routes/usage.py. Endpoints: GET /api/usage/summary, /time-series, /by-agent, /by-team, /by-model, /projection, /cache-efficiency. Register in app.py. * [10372f0f] feat(dashboard): add usage_summary field to CEO dashboard Add UsageSummary schema (tokens_today, cost_today_usd) to dashboard schemas. Add usage_summary: UsageSummary | None to CEOOverview. Update get_ceo_overview() to populate usage_summary from daily_usage_rollups. * [10372f0f] fix(billing/tests): remove dead except block in _sweep_daily_rollup, add unit tests for pricing.py and services/usage.py - Remove unreachable `except Exception as e` block in orchestrator.py _sweep_daily_rollup() (lines 3376-3381) which referenced undefined `agent_id` and was copy-pasted from _sweep_token_snapshots by mistake - Add tests/unit/billing/test_pricing.py: 31 tests covering opus/sonnet/ haiku tiers with all 4 token types, unknown model → 0.0, empty string → 0.0, and substring-match priority (longer fragment wins) - Add tests/unit/services/test_usage.py: 25 tests covering get_summary trend_pct edge cases (prev=0, both=0, prev>0), get_by_agent/team/model pct_of_total summing to 100%, get_projection formula (avg_daily×30), and get_cache_efficiency hit-rate and cost_saved arithmetic - pricing.py: 100% coverage; services/usage.py: 83% coverage (>80% target) * [10372f0f] fix(usage): include cache tokens in time-series total_tokens to fix AC9 consistency violation get_time_series() previously computed total_tokens as tokens_input + tokens_output only. get_summary() includes all 4 token types (input + output + cache_read + cache_write). AC9 requires both endpoints to agree on their totals for the same period. Fix: add tokens_cache_read and tokens_cache_write to the SELECT query in get_time_series() and include them in the total_tokens calculation. Also adds 4 new unit tests in TestGetTimeSeries covering: - total_tokens includes cache_read and cache_write (the AC9 guard) - zero cache tokens still produces correct total - empty result returns empty list - required fields are present in each point * [10372f0f] fix(usage): remove unused imports and include cache tokens in breakdown totals (AC10) - Remove import math (F401 — never used) - Remove text from sqlalchemy import (F401 — never used) - Remove unused local calculate_cost import inside get_cache_efficiency (F401) - Add tokens_cache_read and tokens_cache_write to SELECT in get_by_agent, get_by_team, and get_by_model; update grand_total and per-item total to include all 4 token types so totals match get_summary() (AC10 fix) - Update test mock rows to include explicit tokens_cache_read=0 and tokens_cache_write=0 so they work with the fixed code - Add new test cases: test_cache_tokens_included_in_total_tokens and test_pct_of_total_sums_to_100_with_cache_tokens for each breakdown class --------- Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> * [44b9eb1f] feat(usage): align frontend API client, TS types, and chart components to real backend contract (#92) (#94) Update all usage-related frontend code to match the actual FastAPI backend response shapes and endpoint paths: - panel/src/lib/api/usage.ts: rewrite all 7 API functions to use correct endpoint paths (/usage/summary, /usage/by-agent, /usage/by-model, /usage/by-team, /usage/time-series, /usage/projection, /usage/cache-efficiency); send period query param (24h/7d/30d not hours); mock generators produce data matching real backend shapes exactly; getUsageSessions returns [] in prod (no /usage/sessions endpoint exists) - panel/src/types/index.ts: replace TokenUsageSnapshot with UsageSummary (tokens_input/tokens_output/total_cost_usd/trend_pct); update AgentUsageRow to use agent_slug/total_tokens/cost_usd/pct_of_total; add TeamUsageRow, UsageProjection, CacheEfficiencyResponse; update UsageTimePoint to use bucket field; update UsageSession to use agent_slug - panel/src/hooks/use-usage.ts: rewrite all hooks to match new API and types; add useTeamUsage, useUsageProjection, useCacheEfficiency hooks - panel/src/components/metrics/usage-time-series-chart.tsx: use bucket field (not timestamp) for axis labels - panel/src/components/metrics/agent-usage-chart.tsx: use agent_slug and total_tokens (not agent_name/tokens_today) - panel/src/components/metrics/team-usage-chart.tsx: rewrite to accept TeamUsageRow[] from API directly - panel/src/components/metrics/model-usage-donut.tsx: use total_tokens, cost_usd, pct_of_total (not tokens/cost/percentage) - panel/src/components/metrics/sessions-table.tsx: use agent_slug, sort keys updated - panel/src/components/dashboard/usage-overview-panel.tsx: use useUsageSummary with tokens_input/tokens_output/total_cost_usd/trend_pct - panel/src/app/(dashboard)/metrics/page.tsx: wire all new hooks, add TeamUsageChart, ProjectionCard, CacheEfficiencyCard with correct types - panel/src/app/(dashboard)/agents/page.tsx: key agentUsageMap by agent_slug - panel/src/components/agents/agent-card.tsx: use total_tokens and cost_usd Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> * [2161b832] fix: SDK_PORT constant, stop_agent lock refactor, usage_session_id binding, rollup 7-day window (#93) (#95) - Add SDK_PORT = 9000 module-level constant to orchestrator.py; replace hardcoded 9000 in _sweep_budget_exceeded URL with SDK_PORT - Add UUID to TYPE_CHECKING imports to satisfy ruff F821 - Refactor stop_agent: call _finalize_spawn_session BEFORE acquiring self._lock so the SDK HTTP round-trip does not hold the lock - Add usage_session_id: UUID | None field to AgentInstance dataclass - Change _record_spawn_session to return UUID | None; wire return value back to instance.usage_session_id in _launch_spawn - Update _finalize_spawn_session to use WHERE id=usage_session_id for direct session row lookup when usage_session_id is not None - Add started_at >= (now_utc - 7 days) filter to _sweep_daily_rollup aggregate query to avoid re-aggregating all-time history each sweep Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> * [2e0759e1] fix: pricing accuracy, import ordering, session-id binding, rollup cleanup, write-hook tests (#97) (#98) - pricing.py: correct claude-opus-4 prices (5/25/0.50/6.25 not 15/75/1.5/3.75) and haiku family prices (1/5/0.10/1.25 not 0.8/4/0.08/0.20); add Ollama zero-cost early-return; add structlog warning for unmatched model names - app.py: move usage_router import before routes.v1 block (ruff isort fix) - orchestrator.py _sweep_daily_rollup: remove unused calculate_cost import; add blank line between stdlib (uuid4) and third-party (sqlalchemy) imports - orchestrator.py _sweep_token_snapshots: prefer direct lookup by instance.usage_session_id; fall back to agent_slug heuristic only when None - tests: add test_sweep_daily_rollup_inserts_new_row and test_stop_agent_finalizes_before_lock to test_orchestrator_write_hooks.py - usage.py, routes/usage.py, stream_bus.py, test files: ruff format/lint fixes Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> * Mypy compliance * fix(migrations,tests): linearize forked migration chain + correct ceo_reject coordination-root expectation The master merge brought in 026_completed_dependency_ids alongside the rework's 026_token_usage_tables — both off 025, forking the alembic head and breaking the enum-parity test. Rebase token-usage onto 026_completed_dependency_ids (linear chain, single head). Also: test_ceo_reject_routes_coordination_task_to_main_pm asserted the old NEEDS_REVISION behavior; the lifecycle fix correctly routes a coordination root to PENDING (Main PM's claim source). Update the assertion. --------- Co-authored-by: Frontend Developer 1 <fe-dev-1@agents.roboco.dev> Co-authored-by: Backend Developer 1 <be-dev-1@agents.roboco.dev> Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-10 14:38:44 +02:00
3 people	b9082a5c70	Fix: agent idle deadlock and lifecycle hardening (#96) ... * fix(panel): cap dialog height and pin footer so actions stay reachable Shared DialogContent now caps at max-h-[85vh] with overflow-y-auto, and the footer is sticky to the bottom. Long content (e.g. a pasted change-request note) no longer pushes the submit/cancel buttons past the viewport — the body scrolls while the actions stay visible. No-op on dialogs that already fit. * feat(notifications): suppress duplicate same-purpose notifications at send A notification is not created when an unacknowledged one with the same purpose — same sender, same type, same task, overlapping recipients — already exists. Body text is not compared, so rewording cannot defeat it; a different type, task, sender, or an already-acked recipient all still send through. Stops agents that loop re-issuing the same signal from piling up unread that soft-blocks the recipient's idle path. * fix(gateway): stop board/PM lifecycle verbs from 500-crashing Two unguarded crashes that wedged the org in respawn/escalate loops: - escalate_to_ceo dereferenced None.status when the verb runner declined the escalation (task not in awaiting_pm_review — e.g. a board agent escalating a blocked task). It now returns a clean invalid_state. The message/remediate build moved to a helper so the function stays within the complexity gate. - The coordination-root git ops (pr_target, pr_merge, PR update, branch-token resolve) called UUID(str(task.project_id)) directly, which raised on a coordination/integration task (project_id is None — 'badly formed hexadecimal UUID string'). They now resolve through _project_for_task, which falls back to the product's repo for project-less roots. * refactor(intake): split out _block_to_chunk per-block classifier Extract the per-block classification from _blocks_to_chunks so each function stays within the xenon cyclomatic-complexity gate (was rank C). Behaviour is unchanged — verified by the existing intake_driver tests. * feat(gateway): make the i_am_idle unread soft-block satisfiable The soft-block on unread A2A / @mentions had no clearing path, so once those briefing fields populated an agent could never idle — a whole-org deadlock. Keep the guard (it is correct) and add the missing clear paths: - New read_messages content verb (schema -> route -> handler -> a2a.mark_all_read -> MCP tool -> role do_tools): bulk-zeroes the caller's unread A2A and stamps read_at. The idle hint now points to it. - list_unread_mentions returns UNACKED MENTION-type notifications (each @mention already raises one via messaging._notify_mentions) instead of raw, unconditional mentions, so they clear via the existing notify_ack. No schema migration needed. The soft-block is now satisfiable: A2A via read_messages, mentions and notifications via notify_ack. * fix(tests): repair notification-dedup db.scalar mocks + prompter agent seeding The notification send-dedup added a db.scalar() purpose-lookup to _create_notification; the two hand-rolled _FakeDb test stubs (test_notification, test_a2a_priority_tristate) had no scalar() method → AttributeError. Add scalar() returning None (no duplicate) so creation proceeds. Separately, the prompter '& Start' route tests assign the draft to a fixed product-owner / main-pm AGENT_UUID but only seeded system + CEO, so the assigned_to FK failed in isolation (and main-pm flaked in the full suite). Seed both via idempotent merge() in _seed_project_and_ceo. * fix(git): gitignore .pnpm-store + flag GH001 push rejection as permanent A dev once committed the ~115 MB pnpm store → GitHub GH001 (>100 MB) pre-receive reject → open_pr retry-loop. Two root fixes: - Add .pnpm-store/ to .gitignore — an ignored dir can't be staged by any git add. - push() restates a GH001 / file-size rejection as an unmistakable PERMANENT error pointing at i_am_blocked, so the agent stops blind-retrying a push that can never succeed (it otherwise mis-reads the raw output as a transient timeout). The per-verb retry cap (open_pr: 5) already bounded the burn; this ends it. * fix(gateway): accept a PM decision note as satisfying the complete/submit_up reflect gate A cell/main PM that wrote a fresh decision but no separate reflect note bounced on the reflect tracing-gate indefinitely (re-confirmed live: cell PMs looped on cell_pm_complete -> journal:reflect until reaped, burning tokens — worse because each respawn resets the per-verb retry cap). For a PM closing/submitting a task the decision note already documents the close; the separate reflect is the redundant artifact weak-model PMs forget. Accept a fresh decision as satisfying reflect for complete + submit_up — the gate still requires a decision + substantive notes, so the close stays documented. NOTE (enforcement tradeoff, flagged for CEO review): this intentionally relaxes the PM complete/submit_up gate. It does NOT touch the developer i_am_done gate. * feat(gateway): refuse i_am_idle when a PM still owns a task awaiting its review A cell/main PM once tried to 'send work back' by DMing the developer and going idle — but a DM changes no task state, so the task stayed awaiting_pm_review and the orchestrator just re-dispatched the PM in a loop. i_am_idle now refuses (like the pending-assignment guard) when a PM owns an awaiting_pm_review task, with a clear remediation: complete() to finish, or reassign()/delegate() to route it back. PM-only; devs/QA/doc unaffected. Pairs with the reflect-gate relaxation so the PM can actually complete instead of looping. * feat(gateway): push a prior-work handoff digest into task-scoped briefings A freshly spawned or respawned agent previously started cold on every lifecycle hand-off: the prior worker's PR, commits, acceptance status and journal highlights lived in task evidence but were pull-on-demand, so each new role agent re-explored the codebase from scratch — wasted tokens and fragile context loss across respawns. build_task_handoff() composes a compact, DB-only digest (no git diff) and _briefing_for() now attaches it to context_briefing whenever the caller already holds the task row. The digest is built only from a passed-in task, so there are zero extra fetches: every resumption entry point (give_me_work and pm_give_me_work, i_will_work_on, i_will_plan, triage/triage_all, i_am_done, submit_up, escalate_up, complete) threads the loaded task, while id-only correction/rejection paths cleanly omit it. Every field is type-guarded so a partial row never leaks a non-serialisable value into the envelope. * docs(prompts): tell agents to resume from the briefing handoff before re-exploring The base prompt described the success envelope but never told agents to act on context_briefing, so a respawned or hand-off agent would re-scan the whole repo and re-derive the plan even when the briefing already carried the prior worker's PR, commits, acceptance status and journal highlights. Adds a 'Resume from your briefing' section that walks each task_handoff field and instructs the agent to continue from it — and to read the unread A2A / mention / notification lists, which are messages addressed to them. Pairs with the gateway change that now pushes task_handoff into every task-scoped briefing. * feat(tasks): remember cleared dependencies so the unblock briefing can surface them When an upstream dependency completed, _unblock_dependents removed its id from the dependent's dependency_ids to let it be claimed — destroying the only record of which upstream task had just landed. The revived dependent then re-discovered that work from cold. Adds tasks.completed_dependency_ids (Alembic 026, uuid[] default '{}'): _unblock_dependents now appends the cleared id there instead of only dropping it, and the briefing handoff digest surfaces it so the agent picking the task back up knows its blocker cleared because that upstream work shipped. The base prompt documents the field. Migration round-trip verified against postgres (upgrade adds the column, downgrade drops it). * docs(prompts): instruct PMs to split oversized tasks into per-concern subtasks A subtask carrying a long acceptance list or spanning multiple layers/files drove repeated QA failures and a PM revision loop — QA can't pass a partial, and the dev keeps re-touching unrelated parts. Nothing in the PM prompts told them to decompose by size/concern. cell_pm gets a 'Sizing' rule: one subtask = one focused concern with ~2-4 criteria and its own dev->QA pass; decompose anything larger before delegating, sequencing with dependencies. main_pm gets a matching reminder to scope each cell's slice to that cell's layer rather than handing a cell a cross-layer monolith that just pushes the problem down a level. * fix(gateway): mirror the task= kwarg on ChoreographerHelpers helper signatures The handoff-digest change added a keyword-only task= parameter to _briefing_for and _build_tracing_gap in _impl, but the ChoreographerHelpers base that the role mixins inherit still declared the old signatures, so the composed Choreographer had two incompatible base definitions (mypy [misc]). Sync the base declarations to match. * fix(tasks): keep the owner on a substitute-out so the task isn't orphaned build_substitute_update unconditionally nulled assigned_to, so any substitute that routes to PENDING (max_retries, low_context, out_of_scope_*) — the path a verb hitting repeated 500s or its retry limit takes — left the task pending AND unassigned. The dispatcher only respawns a pending task when it has an owner, so the task went dormant: no agent ever picked it back up. Keep the task with its current owner instead. A substitute-out is almost always a transient stall, so the task re-dispatches to the SAME agent, which resumes from the briefing handoff. Only the task_complete -> PM-review handoff changes owner (unchanged). * feat(a2a): suppress duplicate unread A2A messages at send A respawned or retrying agent could re-emit the same DM, stacking identical copies on the recipient's inbox and re-bumping the unread count — noise that the recipient then has to clear. The notification path already dedups; A2A did not. send_chat_message now suppresses a send when an identical message from the same sender is still unread in the conversation, keyed on (conversation, sender, message_kind, content). Genuinely different messages are never collapsed (verified: distinct content still produces distinct rows), so this avoids the earlier per-pair over-suppression. No migration. * fix(panel): default the notifications view to Unread, not All Landing on the All tab buried new notifications under everything already seen — the most-reported annoyance. The Unread tab is the actionable view, so make it the default; the All/Pending tabs are one click away. * fix(panel): show clone progress during intake prep instead of a frozen pill The first clone of a repo can take a few minutes, during which the intake form showed only a static 'Preparing the agent…' button — indistinguishable from a hang. Add a progress region while preparing: an elapsed timer, a saturating progress bar (approaches but never reaches 100% until the agent actually answers), and staged copy (spinning up → cloning → first-clone-takes- a-while → reading the codebase) so the wait reads as work, not a freeze. * feat(docs): index workspace-authored docs that never reached the RAG store Docs written through roboco_docs_write land at /app/docs on the orchestrator and index fine. But a documenter can also write docs with Edit/Write directly in its own clone (README, CHANGELOG, workspace markdown); those resolve to a /app/docs path that doesn't exist on the orchestrator, so the indexer reads nothing and the docs never become searchable — a cross-container miss with no shared mount to bridge it. On docs completion, capture each listed doc's committed content out of the branch (new GitService.read_file_at_branch, via git show) and write it server-side under /app/docs before indexing, so workspace-authored docs reach RAG too. Docs already present server-side are skipped; absolute paths and unreadable/uncommitted files are passed over best-effort. * feat(prompter): survive a browser reload by reconnecting to the live intake chat The intake chat lived entirely in React state, so a page reload wiped it and dropped the human back to the scope form — even though the agent container outlives the page. Now the chat persists a small TTL'd slice (session id, messages, scope, draft) to localStorage and, on mount, reconnects: it asks the new GET /live/{id}/status whether the session is still running and, if so, restores the history and reopens the SSE stream; if dead or expired it clears and shows the form. A full reload doesn't run React effect cleanup, so the navigate-away reap never fires on refresh and the session stays up. Backend adds the status endpoint + PrompterLiveRegistry.is_alive; localStorage is cleared on confirm, start-another, and SPA navigate-away. * chore: remove internal session-bookkeeping refs from code comments (part 1) Strip leaked task/finding numbers, Wave/Phase/cluster/audit labels from docstrings and comments across services, foundation policy, runtime, mcp, api schemas, and agent_sdk — they mean nothing to a repo reader and expose process internals. Wording preserved; only the labels dropped. Done by hand, one comment at a time (no scripted rewrite). _impl.py follows separately. * chore: remove internal session-bookkeeping refs from code comments (part 2) Finishes the manual scrub: the choreographer _impl.py docstrings/comments plus the remaining dogfood-run ('smoke-N') labels across runtime, mcp, foundation, api schemas, services, and agent factories. Reworded to describe the bug or behaviour in plain words; every label dropped. The repo source is now free of task/finding numbers, Wave/Phase/cluster/audit/smoke labels. By hand, one comment at a time. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-10 12:04:24 +02:00
3 people	48556a032b	Fix: CEO reject conduit and main pm routing (#91) ... * fix(tasks): deliver CEO change-requests to the reworker and route integration rejects to the Main PM ceo_reject previously appended the CEO's required-changes only to quick_context (never surfaced to an agent) and always reassigned to the original developer, so the feedback never reached whoever reworked the task and a coordination/integration root went to a developer instead of the Main PM. Now ceo_reject records the reason as a DECISION_LOG handoff journal entry — the channel evidence/journal_highlights already serves to the task's assignee — and routes a coordination task (no project, has product) to team=main_pm + the Main PM so it can delegate the rework. Leaf dev tasks still return to the original developer. The journal write is best-effort (author-exists guard) and never blocks a reject. Adds tests for the routing and the handoff-journal write. * feat(gateway): wire the agent context_briefing receive-path EvidenceRepo's agent-scoped methods were stubbed to return empty lists, so agents never received notifications, A2A DMs, @mentions, recent team activity, or in-lane blockers through their briefing — the system was effectively send-only. This implements all five as single capped queries over the live tables (plus a light task-metadata-gap check), mirroring the existing journal_highlights query. Each runs on the per-verb briefing path, so each stays a single LIMIT-10 indexed lookup. Unit tests cover the row mapping + empty paths; an integration suite exercises the real SQL (array contains, the a2a slug filter, team+status) against Postgres. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-06-10 02:26:45 +02:00
Renn F	bbe9ac7c23	test: unblock-resume tests need a claimed task (branch_name) ... The lifecycle fix routes a never-claimed (no-branch) blocked task to pending on unblock; these two tests asserted in_progress on a no-branch task. Give them a branch so they exercise the claimed-task resume path they intend (no-branch -> pending is covered by new unit tests).	2026-06-04 02:41:19 +02:00
Renn F	9e9dd55b5d	fix(task): drop cell_pm→main_pm auto-escalation in complete (#178) ... `service.complete()` ran a two-tier approval chain (`_apply_complete_approval_chain`): when a Cell PM completed an `awaiting_pm_review` task, `_handle_cell_pm_escalation` silently reassigned `task.assigned_to = main_pm.id` (+ `claimed_by`) and kept the task in `awaiting_pm_review` for a second-tier review by Main PM. That model is incompatible with the gateway's `main_pm_complete`, which explicitly rejects any non-root task (`if t.parent_task_id is not None: return invalid_state("main_pm complete only operates on root tasks")` — choreographer/_impl.py:3860). Result: the leaf got handed to main-pm with no verb that could advance it → permanent wedge. Observed end-to-end this session (smoke run 02:25–02:35): - 02:25:56 leaf → awaiting_pm_review (correctly assigned to be-pm via notify_pm_of_docs_complete). - 02:26:42 be-pm cell_pm_complete REJECTED tracing_gap journal:reflect (proves leaf IS assigned to be-pm). - ~02:27 (silent — success-path is INFO, filtered): be-pm wrote the reflect note + retried → choreographer cell_pm_complete → git.pr_merge → service.cell_pm_complete → service.complete(agent=be-pm) → _apply_complete_approval_chain → _handle_cell_pm_escalation → task.assigned_to = main_pm.id (no `task.reassigned` audit because the event goes to `_emit_task_event(EventType.TASK_ESCALATED_TO_MAIN_PM)`, not the gateway audit log). - 02:27:30 _dispatch_pm_review_work (orchestrator) saw leaf with assigned_to=main-pm → spawned main-pm against the leaf (target_id in audit_log confirms it: `target_id=f3bdd585 agent_slug=main-pm`). - 02:28:21+ be-pm cell_pm_complete → not_authorized "not assigned to you". main-pm main_pm_complete → invalid_state "only operates on root tasks". Closure dispatcher cycled both PMs to budget-reap. Fix: remove the cell_pm branch from `_apply_complete_approval_chain`. Cell PM completing a non-root awaiting_pm_review task now transitions it to COMPLETED (the gateway model). Cell→main escalation, when intended, uses the dedicated `submit_up` verb on the cell-level parent, not `complete`. The main_pm → CEO branch for root parents stays. Removed the now-dead `_handle_cell_pm_escalation` helper and the now- unused `agent_id` parameter on `_apply_complete_approval_chain`. Tests inverted: `test_complete_cell_pm_escalates_to_main_pm` → `test_complete_cell_pm_does_not_escalate_to_main_pm` (asserts status=COMPLETED, assigned_to != main_pm.id). The no-Main-PM-fallback test trivially still passes (the path is now the only path). Lifecycle test comment updated. make quality green.	2026-05-20 05:17:54 +02:00
Renn F	caa4fc1969	fix(gateway): unclaim releases a pending-assigned task — escape trap (#176) ... An agent assigned a `pending` task it never claimed was structurally trapped: from pending-assigned, unclaim returned None ("cannot unclaim from status pending"), i_am_idle rejected ("assigned but never claimed"), i_am_blocked rejected ("block requires in_progress"). Any persistent claim-time rejection (a gate the agent cannot satisfy, a transient validation error) therefore looped the agent until budget-reap AND left the task orphaned (pending, assigned, no progress). Observed in smoke-16 and smoke-17. unclaim_for_agent now releases a pending task assigned to the caller: no status change (already pending → no lifecycle transition, no WorkSession to abandon since it was never claimed), just clear assigned_to/active_claimant_id so the dispatcher can reassign. The choreographer spec gate already permits unclaim from pending (composes=() — role-only), so the service branch is the whole fix. Updated the now- stale unclaim remediate string; rewrote the test that encoded the buggy trap and added a paused-status negative case.	2026-05-18 01:30:06 +02:00
3 people	207aaecd72	Feature: lifecycle canonical spec (#14) ... * chore: clean make quality baseline on feature/lifecycle-canonical-spec Three classes of pre-existing issues blocking `make quality`: 1. Alembic migrations 002/009/011 used runtime introspection (op.get_bind() + inspect / bind.execute) without guarding for offline (--sql) mode. `alembic upgrade head --sql` is part of `make quality`; in offline mode `op.get_bind()` returns a MockConnection with no inspection system, so the migrations crashed before emitting their SQL stubs. Each migration now short-circuits or simplifies in `context.is_offline_mode()` — live-DB behavior is unchanged. 2. ruff format drift on three files left over from prior in-flight edits (choreographer/_impl.py, content_actions.py, and one test file). `ruff format` applied. 3. vulture flagged two unused `tb` parameters in async __aexit__ stubs in test_task_service_lifecycle_misc.py. The parameter is protocol-required but unused by the body — renamed to `_tb` (vulture treats underscore-prefixed names as intentionally unused). `make quality` is now green from this branch's HEAD; subsequent lifecycle-spec work can use it as the per-task gate. * feat(lifecycle): canonical spec package + Role/Status/TaskType enums Foundation for the canonical lifecycle/permissions module. Enums mirror docs/internal/old/workflows/STATUS_TRANSITIONS.md + PERMISSIONS.md. Tests pin enum membership against both the predecessor canon and roboco.models.base.TaskType. * feat(lifecycle): Decision dataclass with allow/reject/tracing_gap constructors Single rejection shape every consumer maps to its native format (Envelope, HTTP code, prompt hint). __post_init__ enforces the allowed/rejection_kind invariants so a malformed Decision can't reach a consumer. * fix(lifecycle): tighten Decision invariants per Task 2 review Two reviewer findings on the Task 2 Decision dataclass, addressed in one commit: 1. The docstring promised `allowed=True ⇒ rejection_kind is None AND missing == [] AND remediate is None`, but __post_init__ only checked the rejection_kind half. A caller could construct an allow-shaped Decision with stale missing/remediate fields and sneak it past validation. Tighten __post_init__ to enforce the full invariant. Add a regression test. 2. tracing_gap defensively copies the missing list (`list(missing)`) to isolate the stored list from later caller-side mutation, but no test pinned this. Add a regression test that mutates the source list after construction and asserts the stored list is unchanged. Issue 2 from the same review (mutable list vs tuple for `missing`) is a broader design call deferred until consumers exist; the defensive copy is sufficient until then. * feat(lifecycle): Precondition/ActionSpec/IntentSpec/StatusTransition dataclasses The four dataclasses that hold the canonical tables. ActionSpec and StatusTransition are direct ports of pre-gateway PERMISSIONS.md + STATUS_TRANSITIONS.md rows. IntentSpec is the gateway-only addition: each gateway intent verb declares which atomic actions it composes. * feat(lifecycle): _STATUS_TRANSITIONS table + STATUS_GRAPH view Direct port of STATUS_TRANSITIONS.md. Every transition records its trigger action and (optionally) a role constraint. STATUS_GRAPH is the precomputed source→{targets} view callers use for reachability checks. * fix(lifecycle): pin role_constraint values + clarify Task-5 handoff Two reviewer findings on Task 4 _STATUS_TRANSITIONS, addressed in one commit: 1. The original Task-4 tests verified (source, target) pairs but not role_constraint contents. A typo in a single role name (e.g. forgetting MAIN_PM from escalate_to_ceo) would have slipped past them silently. Add test_status_transitions_role_constraints_match_canon pinning every non-None constraint and the cancel-block invariant. 2. role_constraint=None on the `claim` rows from PENDING and NEEDS_REVISION was load-bearing — it is the explicit handoff point between the StatusTransition table (state machine layer) and CLAIM_RULES (per-role claim authority, lands in Task 5). The original inline comment said this in passing; expand it so the design choice is unmissable for a stranger reading just spec.py. * feat(lifecycle): _ATOMIC_ACTIONS + CLAIM_RULES + ROLE_TEAM_RULES tables Direct port of PERMISSIONS.md. Every task management tool gets an ActionSpec with allowed_roles, source_statuses, target_status, self_review_block, and needs_team_match flags. CLAIM_RULES maps each Role to the statuses they can claim from. ROLE_TEAM_RULES is the per-slug team restriction. * fix(lifecycle): tighten ActionSpec contracts per Task 5 review Three reviewer findings on Task 5's _ATOMIC_ACTIONS table, addressed in one commit: 1. set_plan.source_statuses widened to {CLAIMED, IN_PROGRESS} but every existing caller (i_will_work_on / i_will_plan compositions) runs set_plan while CLAIMED, between claim and start. Narrow to {CLAIMED} only. If a future "edit plan mid-flight" feature lands, widen explicitly with test coverage at that time. 2. needs_team_match was set True only on claim/qa_pass/qa_fail/ docs_complete. Defense-in-depth says every role-scoped task action should re-assert team match (don't rely on the inheritance chain through assigned_to alone). Flip to True on: start, set_plan, block, pause, submit_verification, submit_qa, submit_pm_review, complete, create_subtask. Leave False on board/CEO actions and PM cross-cell interventions (unblock, resume, cancel) where the cross-cell semantics are intentional. 3. claim.source_statuses is intentionally a SUPERSET of any single role's CLAIM_RULES allowance (the table holds the union; CLAIM_RULES holds the per-role authority). Add an inline comment above the claim ActionSpec so a future reader doesn't conclude the two tables disagree — they don't, they encode overlapping facts at different grains. * feat(lifecycle): _INTENT_VERBS table — every gateway verb declared Each gateway intent verb is now a named composition of atomic actions plus optional side effects. i_will_work_on = (claim, set_plan, start); i_am_done = (submit_verification, submit_qa); open_pr is pure side effects (push_branch, create_pr); etc. * fix(lifecycle): widen block.allowed_roles to include QA + Documenter Task 6 review caught a role-set inconsistency: i_am_blocked.allowed_roles admits dev/QA/doc, but the underlying block.allowed_roles only allowed dev+PM. Result: a QA or documenter calling i_am_blocked would pass the IntentSpec gate and then be rejected by the composed ActionSpec gate when Task 7 wires can_invoke_intent. Widen block to include QA + Documenter. The semantic case is sound: a QA reviewing a task can discover an external blocker; a documenter writing docs may need PM intervention. Predecessor PERMISSIONS.md restricted block to dev+PM, but with the gateway exposing i_am_blocked to all worker roles, the underlying atomic must agree. The deeper unclaim/escalate_up "imperative verb" concern from the same review (composes=() but mutates state) is deferred to Task 8 where the validator design lands. * feat(lifecycle): public lookup functions + Context + preconditions can_claim, can_invoke_action, can_invoke_intent, valid_next_verbs, composed_actions_for, intents_for_role, status_after — the entire public surface every consumer will use. Context carries the caller-supplied state preconditions need (plan, journal-decision flag, etc.). Preconditions for plan/commits/no_pr/ownership are declared once and wired into the relevant IntentSpecs. * fix(lifecycle): wire PRECONDITION_OWNERSHIP through Context.actor_id Task 7 review found _p_owns_task reads agent.id but every call site passes None for the agent arg. Result: getattr(None, "id", object()) returns a fresh sentinel, task.assigned_to == <sentinel> is always False, and open_pr / i_am_done would reject every owner the moment Task 9 wires consumers. Fix: thread identity through Context.actor_id (new UUID field) and rewrite _p_owns_task to read from the context. Both call sites already pass the Context — no signature changes elsewhere. Add green-path test exercising the owner-can-open-pr case the existing tests missed (the Task 7 plan only tested precondition-failure paths, which masked the bug). Plus surface hygiene: STATUS_GRAPH, CLAIM_RULES, ROLE_TEAM_RULES, and the four PRECONDITION_* constants are now in roboco.lifecycle.__init__.__all__ so consumers in Tasks 8/9 don't depend on the implicit `from roboco.lifecycle.spec import ...` backdoor. * feat(lifecycle): import-time self-consistency validators 10 validators run at module import; first failure raises LifecycleSpecError and prevents the package from loading. Covers status enum coverage, reachability, terminal exits, intent compositions, status chain consistency, claim-rule role/status coverage, self-review symmetry, team-rule slug existence, and StatusTransition action references. * fix(lifecycle): close validator gaps; resolve BACKLOG-claim and submit_qa IN_PROGRESS-shortcut ambiguity Three reviewer follow-ups on Task 8's _validate.py, plus two real data corrections the new action-target-reachability validator surfaced. 1. Design spec §9 calls for "every ActionSpec.target_status, when set, is reachable from each source_status via STATUS_GRAPH" — missing from Task 8's 10 validators. Add _check_action_target_reachable_from_source. 2. _check_role_team_rules_slugs verified slug existence in AGENT_UUIDS but NOT that the cell team in ROLE_TEAM_RULES matches the seed. Add _check_role_team_rules_team_match, scoped to non-None entries only — None means "exempt from team-match enforcement" (cross-cell roles), not "no team in org chart". 3. test_validators_pass_on_real_spec was ceremonial. Add test_run_all_validators_raises_on_unknown_intent_action, a deliberate-break regression that monkeypatches _INTENT_VERBS to inject a fake action and asserts LifecycleSpecError raises. The new action-target-reachability validator caught two real data inconsistencies between the predecessor canon docs and the spec tables: A. claim.source_statuses listed BACKLOG and CLAIM_RULES[*PM] listed BACKLOG, but STATUS_GRAPH[BACKLOG] = {PENDING, CANCELLED} only. Resolution: PMs use the explicit \`activate\` action to move BACKLOG → PENDING, then claim from PENDING. Drop BACKLOG from claim.source_statuses and CLAIM_RULES. B. submit_qa.source_statuses listed IN_PROGRESS, but STATUS_GRAPH[IN_PROGRESS] does NOT include AWAITING_QA. The intent verb i_am_done composes (submit_verification, submit_qa) which forces IN_PROGRESS → VERIFYING → AWAITING_QA — no shortcut. Drop the stale IN_PROGRESS entry from submit_qa.source_statuses. Both corrections tighten the canonical state machine to a strict no-skip transition graph. Pre-gateway PERMISSIONS.md/STATUS_TRANSITIONS.md disagreements are resolved here; spec.py is the canon now. * feat(gateway): Envelope.from_decision maps lifecycle Decisions to envelopes Single shape adapter so verb bodies stop hand-composing rejection envelopes. Each rejection_kind maps to a specific envelope flavor; 'self_review' folds into 'not_authorized' with a parenthetical hint; constructing from an allow Decision raises (programmer error). * feat(gateway): VerbRunner for atomic composed-action dispatch Wraps spec.composed_actions_for(intent) in session.begin_nested() so mid-sequence failures roll the DB back. Side effects run AFTER the savepoint commits. Each atomic action name dispatches to a TaskService method via a single, exhaustive _dispatch_atomic mapping. New verbs slot in by adding an IntentSpec entry + a _dispatch_atomic case if a new atomic is needed. * refactor(gateway): i_will_work_on uses spec.can_invoke_intent + VerbRunner Replace the bespoke status-branch dispatcher in i_will_work_on with the spec-driven flow: load task -> load agent -> build spec.Context -> spec.can_invoke_intent (and spec.can_claim for per-role status authority) -> Envelope.from_decision on rejection -> VerbRunner.run_intent on success. The _i_will_work_on_pending, _i_will_work_on_claimed, _i_will_work_on_needs_revision, and _start_failed_envelope helpers are removed; the runner replaces them. Two narrow verb-body re-entry blocks remain for behaviors the spec does not yet model: 1. in_progress + same agent -> idempotent heartbeat-only return 2. claimed + same agent -> _resume_from_claimed (set_plan + start) to recover from a stuck mid-claim crash without re-running claim against a state the spec excludes. The behavioral claim guards (already_active / paused / sibling_sequence) also stay imperative for now -- they're not in the spec yet and migrate into spec.extra_preconditions in a later task. Per-role claim authority is enforced via spec.can_claim because the atomic claim action's source_statuses are the union across roles; CLAIM_RULES narrows. Parity test in tests/lifecycle/test_consumer_parity.py runs the verb against every (role x status x task_type='code') combo (112 rows) and asserts the envelope error matches the spec's Decision (or can_claim's Decision when the intent gate passes but per-role claim authority does not). This is the contract that makes spec/verb drift impossible. Existing tests updated where rejection-message text changed (the spec now produces the messages, e.g. "role 'cell_pm' may not call 'i_will_work_on'" instead of "PM cannot execute code") or where the spec's stricter view ("invalid_state" -> "not_authorized" for a dev trying to claim awaiting_qa) is more accurate. Test fixtures were updated to wire task.session.begin_nested as a proper async context manager (required by VerbRunner) and to set agent_for().id so runner- driven calls line up with assert_awaited_with(task_id, agent_id). * refactor(lifecycle): push CLAIM_RULES enforcement into can_invoke_action Task 11's i_will_work_on migration had to call spec.can_claim() separately after spec.can_invoke_intent() because the claim action's source_statuses is the union across all claim-eligible roles — can_invoke_intent alone would let a developer pass for claiming awaiting_qa (a QA-only state). The retrofit pattern would repeat in every claim-composing verb (i_will_plan, claim_review, claim_doc_task). Push the per-role narrowing inside can_invoke_action when the action is "claim", using the same not_authorized vs invalid_state disambiguation can_claim already implemented (status-reserved-for-another-role returns not_authorized; status-no-role-can-claim returns invalid_state). Extracted the body to _check_claim_rules_narrow to keep can_invoke_action under xenon's complexity threshold. Update _i_will_work_on_gate to drop the redundant spec.can_claim call. Update test_consumer_parity.py to assert only against can_invoke_intent's Decision. Tasks 12-22 will inherit the cleaner pattern: spec.can_invoke_intent is the single gate; verb bodies don't need per-action retrofits. * refactor(gateway): i_will_plan uses spec.can_invoke_intent + VerbRunner Migrates i_will_plan to the spec-driven pattern Task 11 set up for i_will_work_on. The verb body now: (1) loads task + agent, (2) builds Context, (3) checks idempotent/recovery re-entry, (4) calls spec.can_invoke_intent, (5) returns Envelope.from_decision on rejection, (6) delegates composition to VerbRunner. The _i_will_plan_* helpers are removed — the runner replaces them. Parity test in tests/lifecycle/test_consumer_parity.py runs the verb against every (role × status × task_type) combo and asserts the envelope matches spec.Decision. * refactor(gateway): delegate uses spec.can_invoke_intent for role/state gate Migrates delegate to the spec-driven role/state gate. The chain validation (main_pm->cell_pm, cell_pm->its team's devs), the assignee-vs-task_type rule (Cell PMs receive planning-typed only), the enum coercion, and the parent-lifecycle/cap guards STAY in the verb body — they encode delegate-specific semantics the spec doesn't model. Parity test in tests/lifecycle/test_consumer_parity.py asserts the spec's role+state rejection is correctly surfaced. Chain/assignee rejections continue to be tested in test_choreographer_pm_extras. * refactor(gateway): open_pr uses spec.can_invoke_intent + VerbRunner Migrates open_pr to spec-driven gating. The spec's extra_preconditions (PRECONDITION_OWNERSHIP, PRECONDITION_COMMITS, PRECONDITION_NO_PR) handle all three precondition checks; the verb body delegates side-effect dispatch (push_branch, create_pr) to VerbRunner. Idempotent re-entry retained: an open_pr call against a task that already has a PR (and the caller owns it) returns OK without re-opening, rather than the tracing_gap the spec would otherwise produce. This preserves agent ergonomics — two calls in a row shouldn't surface a misleading "no_prior_pr" hint. Parity test in tests/lifecycle/test_consumer_parity.py runs the verb against representative (status x commits x pr_number) combos and asserts the envelope matches spec.Decision. * refactor(gateway): i_am_done uses spec.can_invoke_intent + VerbRunner Migrates i_am_done to spec-driven gating. The spec's extra_preconditions (PRECONDITION_OWNERSHIP, PRECONDITION_COMMITS) handle ownership and commit-count checks; VerbRunner dispatches the (submit_verification, submit_qa) atomic chain. The tracing-gate preconditions (progress entry, journal:reflect, acceptance criteria) and the field-level submit-qa gates stay in the verb body — they model gates the spec doesn't yet cover. Defense-in-depth: those gates run after the spec accepts the ownership/commits checks. Parity test in tests/lifecycle/test_consumer_parity.py runs the verb against (role × status × ownership × commits) and asserts the envelope matches spec.Decision. * refactor(gateway): i_am_blocked uses spec.can_invoke_intent + VerbRunner Migrates i_am_blocked to spec-driven gating. The journal:struggle write stays in the verb body (it's a side effect outside the lifecycle action). VerbRunner dispatches the `block` atomic action via task_service.escalate. Parity test in tests/lifecycle/test_consumer_parity.py. * refactor(gateway): unclaim and resume use spec.can_invoke_intent Migrates both verbs to the spec-driven gate. unclaim's verb body keeps its dispatch (task.unclaim_for_agent) because composes=(); resume goes through VerbRunner with composes=("resume",). The reassignment-rejection branch (introduced in 19f27b4 for the 2026-05-08 trace's "not your claim" case) stays - the spec doesn't model "task got reassigned out from under you by an upstream verb," and the existing envelope text ("current owner: X - call give_me_work() to find your current work") is the load-bearing hint that fixed the original bug. Extracted the shared branch into _reassigned_rejection / _ReassignedCtx so both verbs reuse it without duplicating the envelope construction. Parity tests in tests/lifecycle/test_consumer_parity.py. * refactor(gateway): complete uses spec.can_invoke_intent at the dispatcher Migrates the top-level `complete` dispatcher to gate role/state via spec.can_invoke_intent before routing to cell_pm_complete or main_pm_complete. The two lower-level methods keep their existing PR-merge / CEO-escalation logic and pre-flight guards (those model journal:decision preconditions and PR-mergeability checks the spec doesn't model yet). The runner pattern is NOT applied here — `complete` has two divergent runtime paths (Cell PM merges leaf into parent branch; Main PM opens master PR + escalates to CEO) that don't fit the runner's single-composition model. Verb-body-owns-dispatch is the right pattern. Parity test in tests/lifecycle/test_consumer_parity.py runs the verb against (role × status) combos and asserts the dispatcher's spec rejection is correctly surfaced. * refactor(gateway): escalate_up, escalate_to_ceo, submit_up use spec.can_invoke_intent Migrates the three PM-side escalation/submission verbs to spec-driven role/state gating. The verb-specific guards (journal:decision, escalation_target configured, _submit_up_guard's ownership + notes-length + subtasks-terminal) STAY in the verb body - the spec doesn't model these. escalate_up has composes=() so the verb body owns dispatch via task.escalate. escalate_to_ceo and submit_up route their compositions through VerbRunner. Parity tests in tests/lifecycle/test_consumer_parity.py. * refactor(gateway): qa.py + doc.py role mixins use spec.can_invoke_intent Migrates the five QA + Documenter verbs (claim_review, pass_review, fail_review, claim_doc_task, i_documented) to spec-driven gating. The self-review block lives at the atomic-action layer (_ATOMIC_ACTIONS["qa_pass"|"qa_fail"|"docs_complete"].self_review_block=True) and naturally fires when the verb body builds a Context with actor_slug==original_developer_slug. No verb-body retrofits needed. The verb-specific helpers (_verify_qa_owner, _qa_pass_gate_check, _check_i_documented_inputs) STAY — they encode notes-length / journal:learning / files-list / qa_evidence_inspected gates the spec doesn't model. claim_review and claim_doc_task own dispatch via task.qa_claim / task.doc_claim respectively (not the runner) because those specialized claim methods keep status at AWAITING_QA / AWAITING_DOCUMENTATION, which is what the downstream qa_pass / qa_fail / docs_complete source-status requirement expects. The spec gate still validates role + claim source-status + task_type before dispatch. pass_review / fail_review / i_documented route their compositions (qa_pass / qa_fail / docs_complete) through VerbRunner.run_intent inside a savepoint. Parity tests in tests/lifecycle/test_consumer_parity.py for all five verbs. * fix(lifecycle): claim_review and claim_doc_task have empty composes Tasks 21-22 surfaced a real spec/runtime mismatch: both verbs were declared composes=("claim", "start"), but the actual implementation uses task.qa_claim / task.doc_claim which intentionally keep status at AWAITING_QA / AWAITING_DOCUMENTATION. If the runner ever ran the declared composition, it would transition the task to CLAIMED then IN_PROGRESS, breaking the source-status invariants of qa_pass, qa_fail, and docs_complete. The spec is the canon — align it to the runtime. composes=() means "verb body owns dispatch" (same pattern as escalate_up and unclaim). The spec gate still validates role + AWAITING_QA / AWAITING_ DOCUMENTATION source-status via the role's CLAIM_RULES narrowing, enforced through special handling in can_invoke_intent, so role/state safety is preserved. * refactor(gateway): role_config flow lists derived from spec.intents_for_role Hand-maintained _DEV_FLOW etc. tuples replaced with calls into the spec. Adding/removing a role from an IntentSpec.allowed_roles now automatically updates the MCP manifest. The spec is the canon; role_config becomes a thin shim that adds the do-tool / write / subagent / description metadata the spec doesn't carry. * feat(lifecycle): generators + make lifecycle for deterministic artifact regen Renders intent-verbs.md, status-transitions.md, panel/lib/lifecycle.json, and per-role agents/prompts/_generated/lifecycle-{role}.md fragments from the canonical spec. `make lifecycle` runs the regenerator; deterministic output enables CI to gate on `git diff --exit-code` after running it. The agent prompt fragments will be injected at the top of each role's system prompt (Task 25) so agents see the same verbs the gateway accepts. * feat(lifecycle): inject generated prompt fragments + CI drift gate Each agent's system prompt now starts with the spec-generated 'verbs available to your role' fragment. CI runs make lifecycle and fails if regeneration produces a diff — drift between spec and artifacts cannot land on master. * refactor(gateway): delete verb_gates.py — superseded by lifecycle.spec verb_gates.is_verb_allowed and verb_gates.valid_next_verbs are now spec.can_invoke_intent(...).allowed and spec.valid_next_verbs. Importers updated to consume the canonical spec module directly. tests/unit/gateway/test_verb_gates.py removed — coverage lives in tests/lifecycle/test_spec.py. envelope.with_introspection wraps spec.valid_next_verbs with role-string coercion + best-effort try/except so malformed task fixtures (AsyncMock status) and unknown role strings still yield [] instead of raising — preserves the legacy verb_gates contract. content_actions content-tool RBAC (commit/notify) is now a pair of explicit role frozensets in this file. These are content tools, not lifecycle intents, so they intentionally do NOT live in spec._INTENT_VERBS. Two existing introspection tests asserted "commit" in valid_next_verbs; fixed to assert open_pr/i_am_done — commit is correctly absent under the canonical spec because it is a do-server content tool, not a flow intent verb. * refactor(gateway): collapse scattered role constants into spec The pm_cannot_execute_code_guard and role_typed_claim_guard guards both modeled rules the spec now handles via can_invoke_action's CLAIM_RULES narrowing and ActionSpec.allowed_task_types. Drop them from claim_guards.py — the choreographer's existing skip-flags on _run_claim_guards are now permanent: those guards no longer fire. Simplify _run_claim_guards's signature accordingly. The concurrency-invariant guards (already_active_guard, paused_tasks_guard, sibling_sequence_guard) STAY — the spec doesn't model these system-level invariants. sibling_sequence_guard's loop body extracted into _earlier_blocking_sibling helper to keep the slimmed module under xenon's --max-modules A average. * refactor(enforcement): task_lifecycle becomes a thin view of lifecycle.spec VALID_TRANSITIONS and ROLE_RESTRICTED_TRANSITIONS are now derived from roboco.lifecycle.spec — no independent tables. The 433-line file collapses to ~30 lines of view definitions; future changes go in spec.py. Helper functions exported by the legacy module are preserved as thin wrappers so existing consumers don't need to change their imports today. A small _LEGACY_OPERATIONAL_EDGES table sits alongside the spec-derived view to cover transitions the runtime exercises but the spec has not yet absorbed (voluntary unclaim, reaper sweep, PM-direct completes from in_progress, parallel-doc-PR developer trigger). It is fenced and clearly documented; once those callers are migrated to spec-driven dispatch the constant goes empty and the file collapses to a pure view. A test in test_task_service_lifecycle_misc.py was rewritten: the predecessor asserted CEO-only authority over awaiting_ceo_approval cancels (legacy table behavior), but the canonical spec authorizes {CELL_PM, MAIN_PM, CEO} uniformly across all non-terminal cancel sources. The test now exercises the broader spec-defined cascade. * feat(lifecycle): UNMIGRATED guard pins known-debt consumers Two pieces of debt surfaced during Task 28's collapse of enforcement/task_lifecycle.py: (1) ~11 operational edges still in the shim's _LEGACY_OPERATIONAL_EDGES because the spec's _STATUS_TRANSITIONS doesn't yet model them; (2) role-gate disagreements in _LEGACY_ROLE_GATES that the spec disagrees with. UNMIGRATED is the named-debt set; KNOWN_UNMIGRATED_CONSUMERS pins the catalog so a contributor adding a new entry must update both sides. Validator (_check_unmigrated_is_subset) fires at import if they drift. Test pins the current entries. Phase 3's terminal invariant is `UNMIGRATED == frozenset()` — expected when both legacy data carriers fold into spec, at which point the assertion becomes a permanent regression guard. * test(lifecycle): tier 3 end-to-end real-DB happy paths Eight integration tests covering every major lifecycle path: dev (pending → awaiting_qa), QA pass, QA fail, doc handoff, Cell PM complete, Main PM escalate-to-CEO, block+unblock, pause+resume. Each test drives the spec → choreographer → TaskService → DB stack with only the git layer mocked. Catches "spec says X, DB constraint says Y" mismatches the unit-tier parametrized parity suite cannot detect. * test(lifecycle): tier 4 smoke replay — pin known-bug shapes after spec migration Synthesized fixture covering the 9 bugs from the 2026-05-08 audit-log trace + the 2 from the 2026-05-09 follow-up trace. Each record documents (verb, role, task setup, expected post-fix envelope shape, fix commit, spec invariant). The replay test parametrizes over the records and asserts the spec / choreographer behavior now matches the post-fix expectation — locks in the fixes as permanent regressions. The original audit log was wiped during cleanup; the fixture is a documented synthesis, not a verbatim capture. The bug list is faithful to the prior session's analysis of the trace. * fix(orchestrator): silence dev-dispatcher noise for non-dev-lane tasks Dev dispatcher fetched all pending/claimed/in_progress tasks regardless of assignee role and warned 'role/task_type mismatch' on each pass when it found cell_pm/main_pm/product_owner/etc. tasks — those belong to _dispatch_pm_work, not this lane. The 30s warning loop showed up prominently in the 2026-05-10 smoke run. Filter at the lane boundary: silently skip when assignee role is not developer/documenter/unknown. The D-49 misassignment warning still fires for the legitimate cases (developer assigned a documentation task, etc.). * fix(gateway,prompts): unblock the three smoke-run dead-ends Three issues surfaced by the 2026-05-10 smoke run, fixed together because they're all blockers for end-to-end task completion: 1. Acceptance-criteria tracing gate was unsatisfiable. Nothing in the codebase writes to task.acceptance_criteria_status, so _check_acceptance_criteria always returned every criterion as missing. Treat a reflect note as the addressing artifact: when the agent has written one, the gate clears. Per-criterion citation via acceptance_criteria_status is still honored when populated, so the schema stays available for future per-criterion tracking. 2. Cell PM runaway re-decomposition. On every wake-up be-pm re-decomposed its parent task without checking for existing children, producing duplicate dev subtasks. cell_pm.md now teaches 'list children before delegating' and 'one dev subtask is usually enough — QA/Documenter/PM-merge engage automatically'. Added anti-pattern entries for re-decomposition and over-decomposition. 3. Main PM exit/respawn loop on claimed-state tasks. The model cycled through delegate/resume/escalate/unblock looking for a verb that worked on 'claimed', and got cleanly rejected by every one. The right verb is i_will_plan (it composes claim+set_plan+start and resumes from claimed). main_pm.md now spells this out explicitly with a worked example of which verbs reject and why. * feat(prompts): restore pre-gateway lifecycle scaffolding across all 6 roles The gateway migration shrank role prompts from ~50 lines to ~15 (commit 534152c for dev; analogous shrinks for qa/doc/cell_pm/main_pm/board in e12a596, 05ac832, 8dc381b). The verb surface got cleaner but the prescription for using verbs through the lifecycle disappeared. The 2026-05-10 smoke run surfaced the regression: agents thrash through verbs hoping one fits, journal sparsely, skip the dev reflect note, and (for cell PMs) re-decompose on every wake-up. Each role prompt now restores three sections that the pre-gateway versions had: 1. State -> Verb table — what to call when respawned in each lifecycle status. Eliminates the verb-cycling antipattern: the agent looks up its current status and calls the one verb that transitions out of it. 2. Mandatory pre-handoff checklist — explicit walk-through of the gates the next verb will check, ordered so the agent fixes the missing piece before retrying: - developer: 7 items before i_am_done - qa: 8 items before pass/fail (incl. self-review forbidden, read dev journal not just diff, name artifact per criterion) - doc: 7 items before i_documented - cell_pm: 7 items before submit_up (incl. integration green) - main_pm: 7 items before complete(root) - board: separate checklists for escalate_to_ceo (PO/HoM) and reflect-note quality (Auditor — its only output) 3. Journaling cadence — when to use each of the five scopes (note/decision/struggle/learning/reflect). The pre-gateway prompts named all five scopes with role-specific examples; the post-gateway prompts mention 'reflect' once and skip the rest. Restored across every role. Plus restored the load-bearing rules that got dropped: - Cell PM: 'A SINGLE subtask flows through dev -> QA -> doc -> PM-merge. DON'T split into per-role subtasks.' This is exactly what be-pm violated in the smoke run, creating duplicate 'branch naming subtask' / 'PR workflow subtask' / etc. - QA + Doc: 'read the dev's journal, not just the diff' — pre- gateway forced this via roboco_journal_read_team; post-gateway the inline data exists but the agent isn't told to use it. - Developer: 'every acceptance criterion gets a citation in the reflect note' — pairs with the tracing-gate change in 75b667d where the reflect note is treated as the addressing artifact. * feat(foundation): bootstrap foundation/identity.py with Role/Team/RoleLevel Phase 1 task 1 of the foundation canonicalization plan (docs/superpowers/specs/2026-05-10-foundation-canonicalization-design.md). Three enums, no consumers yet — separate tasks migrate the existing forks (models.base.AgentRole, lifecycle.spec.Role, agents_config role sets, services/permissions.PM_ROLES) onto this canonical surface. * feat(foundation/identity): add AGENTS catalog (single source for slug->role+team+UUID) Resolves head-marketing.team drift (spec §5.1) by setting Team.BOARD authoritatively. Team.MARKETING remains in the enum for legacy seed data but no agent claims it; flagged for removal in cleanup. * feat(foundation/identity): add role-sets + ROLE_LEVEL hierarchy * feat(foundation/identity): add lookups + public API re-exports * feat(foundation): import-time validators (uniqueness, role coverage, role-level) * chore(foundation): verify+align postgres agentrole/team enums with foundation/identity scripts/verify_postgres_enums.py reads the live agentrole+team enums from postgres (via asyncpg using roboco.config.settings.database_*) and compares them against the foundation Role+Team enums. Exits 0 on match, 1 on drift (with a per-side diff), and 1 with a clear message if postgres is unreachable so callers like make foundation-check can treat that as a skip. alembic/versions/012_align_agentrole_team_with_foundation.py is the forward-only safety-net migration. It runs ALTER TYPE agentrole ADD VALUE IF NOT EXISTS 'system' (idempotent on postgres >= 9.6) so any DB without the recently-added Role.SYSTEM sentinel gets it on next upgrade. Postgres has no DROP VALUE primitive without a destructive type recreation, so foundation keeps legacy values (e.g. Team.MARKETING) to absorb the inverse direction; the migration's downgrade is intentionally a no-op. Local verification deferred: postgres is not reachable from this workstation (role 'roboco' does not exist), so the script could not confirm the live enum shape. The migration is idempotent and runs unconditionally on the next alembic upgrade head, and whoever next runs make foundation-check against a live DB will get the post-migration proof of alignment. * refactor(lifecycle): re-export Role from foundation.identity (single source) * refactor(models): re-export AgentRole and Team from foundation.identity Removes the parallel Team and AgentRole StrEnum definitions in models/base.py. They are now bound to roboco.foundation.identity.Role and roboco.foundation.identity.Team respectively, so AgentRole IS identity.Role (same Python class object). SQLAlchemy column types bound as sa.Enum(AgentRole, name='agentrole') continue to work because identity is preserved across import paths. Note: foundation.Team drops the legacy 'fullstack' member that lived on models.base.Team. The two _resolve_team_dir tests that used Team.FULLSTACK to exercise the 'fullstack' branch now pass the literal string 'fullstack' instead — same code path, no enum-membership coupling. Adds two identity assertions to tests/foundation/test_role_reexport.py verifying AgentRole is identity.Role and Team is identity.Team. * fix(foundation): correct Team enum — add FULLSTACK, remove QA The original plan's audit incorrectly identified the models/base.Team membership. Actual original was 7 values: backend, frontend, ux_ui, fullstack, main_pm, board, marketing. My plan replaced fullstack with qa and added system — but qa was never a team (only a role). Postgres team enum has fullstack (alembic 009), and services/task.py:675 + services/git.py:779 branch on the literal "fullstack". Without foundation.Team.FULLSTACK, any Project row with assigned_cell="fullstack" would fail to round-trip through the SQLAlchemy ORM. This correction: - Adds FULLSTACK; removes QA from foundation.Team - Updates the 8-value test expected set - Restores tests/integration/test_task_service_misc.py to use Team.FULLSTACK * refactor(agents_config): derive AGENT_ROLE_MAP/AGENT_TEAM_MAP/CELL_MEMBERS from foundation * refactor(roles): canonicalize role-sets via foundation.identity - agents_config.PM_ROLES (5-role: PMs + board + CEO) renamed to TASK_CREATOR_ROLES; the name PM_ROLES is reserved for the canonical 2-role set (CELL_PM + MAIN_PM) defined in foundation.identity. - agents_config._BOARD_ROLES aliased to foundation.BOARD_ROLES (drops main_pm from the set; board A2A handler updated to keep allowing board -> main_pm direct messaging via explicit branch). - services/permissions.PM_ROLES (2-role) re-exported from foundation. Closes the silent semantic divergence flagged in spec section 3 (HIGH severity). * refactor(seeds,orchestrator): derive agent catalogs from foundation - seeds/initial_data.AGENT_UUIDS derived from foundation.AGENTS. - DEFAULT_AGENTS row generation pulls slug+role+team+id from foundation; per-agent presentation strings (display name) stay in this file in _AGENT_PRESENTATION dict. The system sentinel remains a literal with team=None because the postgres `team` enum has no 'system' value. - runtime/orchestrator._AGENT_TEAM_MAP and the cell-prefix table replaced with foundation.team_for_slug. _AGENT_TEAM_MAP is now a derived ClassVar covering every slug (not just management). - head-marketing.team resolved to "board" (was "marketing" in seed + orchestrator, "board" in agents_config — three-way drift, now unified). - ceo.team resolved to "board" (was None in seed; foundation declares board membership so the seed-bootstrapped DB row now reflects that). - Adds tests/foundation/test_seed_orchestrator_parity.py — gate against future drift between seed/orchestrator and foundation. Closes the identity sub-phase. Adding an agent edits exactly one file: foundation/identity.py:AGENTS. * feat(foundation/policy): task_completeness rules + denylist Implements spec §5.2: field-level completeness rules at create/delegate time, plus the denylist that catches the literal placeholder string from the deleted services/task.py:5061-5062 silent fallback ("completed and reviewed by assignee" — agents copy-paste this from old logs). CompletenessSpec is data; check() is a pure function; field_hints map gives the agent the literal answer key for each missing field. * feat(envelope): add incomplete_input envelope kind for interrogation pattern Sister to tracing_gap; distinct error code lets agent prompts teach incomplete_input handling separately from tracing-gap recovery. Carries missing + field_hints + remediate for the spec §5.2.1 interrogation pattern; Task 19 will wire the gateway delegate verb to use it. * feat(foundation/task_completeness): auto-fill helpers (team, priority, parent) * feat(api/schemas): DelegateRequest enforces TASK_AT_CREATE constraints Removes silent defaults for nature/task_type/estimated_complexity; adds min_length=20 to description; requires non-empty acceptance_criteria. Mirrors foundation.policy.task_completeness.TASK_AT_CREATE so under-filled delegate calls fail at the request boundary (422) instead of being silently papered over downstream. Tests touching delegate calls updated to pass the now-required fields. * feat(models/task): TaskCreate + TaskCreateRequest enforce TASK_AT_CREATE * feat(api/schemas): TaskUpdate rejects blanking acceptance_criteria Golden Rule preservation — acceptance_criteria cannot be set to []/None via PATCH. Pydantic field min_length doesn't catch explicit None, so a model_validator(mode='before') guards the patch payload. * fix(services/task): delete silent acceptance_criteria fallback (skeleton-task root cause) The fallback at services/task.py:5061-5062 silently replaced empty acceptance_criteria with ['completed and reviewed by assignee'] - the proximate cause of every skeleton task in the 2026-05-10 smoke run. Removed; create_subtask now invokes foundation.policy.task_completeness and raises TaskCompletenessError on missing fields (spec section 5.2). Two existing transition tests relied on a 1-char description default that the new completeness check rejects (description min_length=20); both updated to pass an explicit valid description. New integration test pins the rejection contract (empty list + legacy phrase both raise). Companion code path at services/gateway/choreographer/_impl.py:1852 (the upstream `or []` collapse) is fixed in the next task. * fix(gateway/delegate): use task_completeness + Envelope.incomplete_input Replaces the `acceptance_criteria=inputs.acceptance_criteria or []` collapse at _impl.py:1852 with a foundation.policy.task_completeness check that rejects empty / placeholder input via Envelope.incomplete_input — the spec section 5.2.1 interrogation pattern. Auto-fill helpers (fill_team_from_assignee + fill_priority_from_parent) fill the unambiguous fields before the check, then anything still missing surfaces as a structured rejection with field_hints; the agent gets a literal answer key for what to provide on retry. DelegateInputs gains an explicit `nature` field (no default) so the HTTP boundary can thread DelegateRequest.nature through to the choreographer. Route handlers (flow_cell_pm, flow_main_pm) forward it. The hardcoded TaskNature.TECHNICAL fallback in _create_subtask_from_inputs is removed; the helper now coerces inputs.nature to the enum or raises TaskCompletenessError if a non-gateway caller bypassed the check. Closes the gateway-side path to skeleton tasks. Service-layer raise (Task 18) remains as defense-in-depth for non-gateway callers. Existing delegate-guard tests updated to pass full payloads — the prior `title='x', description='y'` minimal stubs now hit the completeness gate first; the full payloads still exercise the auth/chain/cap guards downstream. * feat(api/routes/tasks): POST /tasks uses foundation.task_completeness check Replace the hand-rolled acceptance_criteria non-empty check in the POST /tasks handler with a call to task_completeness.check(TASK_AT_CREATE, data). Route, schema (TaskCreate), and service (TaskCreateRequest) now all share one canonical notion of 'complete' — the fourth and final create path is now strict. Pydantic still rejects structurally invalid payloads (empty AC list, short title/description, missing enums) with 422. The TC check at the route boundary additionally rejects denylisted placeholder phrases ('completed and reviewed by assignee', etc.) that pass schema validation but signal a stub task. Add tests/integration/test_post_tasks_completeness.py: - empty acceptance_criteria -> 422 (Pydantic) - placeholder phrase -> 400/422 with 'acceptance_criteria' in body * chore(make): add foundation-check drift gate (mirrors lifecycle-check) * test(foundation): Phase 1 smoke gate — skeleton-task path returns incomplete_input Phase 1 closes here: identity catalogs are single-sourced; the silent acceptance_criteria fallback is gone; gateway delegate returns incomplete_input with populated field_hints when criteria are missing. The 2026-05-10 smoke run that produced skeleton tasks no longer can. Phases 2-4 (tracing, journaling, communications, agent_loop, housekeeping) get their own plans. * feat(foundation/policy): journaling scope catalog (5 panel-UI scopes) * feat(foundation/policy/journaling): role read tiers + protected journals * refactor(content_actions): derive _VALID_NOTE_SCOPES from foundation.journaling * refactor(services/journal): derive _SCOPE_TO_TYPE from foundation.journaling * refactor(enforcement/journal_perms): import read-tier rules from foundation PROTECTED_JOURNALS + ROLE_READ_TIERS now sourced from foundation.policy.journaling. The local helpers (_check_protected_access, _check_cell_pm_access, _check_cell_member_access) are collapsed into a single tier-driven check via _decide_protected / _decide_by_tier. Pre-Phase-2 GLOBAL_READERS that lumped CEO/auditor/PO/HoM/main_pm together is split into ReadTier.ALL (ceo+auditor — includes protected) vs ReadTier.ALL_CELLS (others — excludes protected). Observable behavior preserved. * feat(foundation/policy): tracing Requirement enum + check_requirements 19 requirements (16 from pre-Phase-2 tracing_gate + 3 pre-gateway parity: JOURNAL_NOTE_AT_CLAIM, JOURNAL_DECISION_AT_CLAIM, JOURNAL_DURING_WORK). GateContext expanded with the new presence flags and journal_during_work_count. Acceptance-criteria checker keeps the spec §9 item 1 reflect-note shortcut. * feat(foundation/policy/tracing): VERB_REQUIREMENTS table + verb parity validator Maps every gateway intent verb to its required-set. Includes the 6 inline journal:decision callsites (submit_up, complete, unblock, escalate_up, escalate_to_ceo, delegate) plus the 4 pre-gateway parity additions (NOTE_AT_CLAIM, DECISION_AT_CLAIM, REFLECT on complete, DURING_WORK). Validator asserts every spec verb is covered or explicitly waived, and every Requirement enum value is used by at least one verb. PLAN added to i_will_work_on / i_will_plan (mirrors spec.PRECONDITION_PLAN in the tracing layer). SELF_VERIFIED added to i_am_done as a defense-in-depth backstop (auto-set by the in_progress→verifying transition). * refactor(gateway/i_am_done): tracing gates via foundation.policy.tracing Adds JOURNAL_DURING_WORK_AT_LEAST_ONE check (pre-gateway parity P2 — agents must write at least one decision/learning/struggle entry between claim and submit). Adds journal.has_struggle_for_task helper. Replaces the pre-Phase-2 tracing_gate.check_requirements call. SELF_VERIFIED is filtered from the pre-flight required-set: the spec composes (submit_verification, submit_qa) for i_am_done and the auto-run submit_verification flips self_verified=True before submit_qa runs. The flag therefore acts as a defense-in-depth backstop AFTER the spec, not before — checking it pre-flight would block the auto-verify path. SELF_VERIFIED stays in the foundation required-set and is re-asserted by the spec action's own preconditions. Test fixtures updated: 9 i_am_done success-path tests now mock has_decision_for_task=True (or equivalent) so the new during-work cadence gate is satisfied. NO_PR-token assertion broadened to also accept the foundation token "pr_open". * refactor(gateway/qa): pass/fail gates via foundation.policy.tracing * refactor(gateway/doc): i_documented gates via foundation.policy.tracing Doc-specific missing-key translations (docs_notes>=min, docs_files_non_empty) added to the central _build_tracing_gap translator established in Task 9. * refactor(gateway): unify 6 inline journal:decision checks via tracing.check_requirements Pre-Phase-2 inline blocks at _impl.py lines ~2230/2394/2442/2574/2814/2895 each ran the same has_decision_for_task + Envelope.tracing_gap pattern. They now call: - _check_pm_decision_required(verb, ...) — for unblock, escalate_up, escalate_to_ceo, delegate. Each declares only JOURNAL_DECISION in VERB_REQUIREMENTS, so a single helper consuming tracing.requirements_for(verb) suffices. - _check_complete_gates — for cell_pm_complete and main_pm_complete. Consumes VERB_REQUIREMENTS["complete"] = JOURNAL_DECISION + JOURNAL_REFLECT + NOTES_MIN_CHARS. The inline _subtasks_not_terminal_envelope is kept because its remediation enumerates the non-terminal subtask ids — strictly richer than the foundation hint. - _check_submit_up_gates — for submit_up. Consumes VERB_REQUIREMENTS["submit_up"] minus SUBTASKS_TERMINAL (deferred to the inline envelope for the same reason as complete). Also adds the journal:decision tracing gate to the delegate verb (VERB_REQUIREMENTS["delegate"] = {JOURNAL_DECISION}) — pre-gateway PM.md required journal:decision before each delegate, but the gateway path had not yet enforced it. Threaded into _delegate_extra_guards so the verb body's return count stays under the lint cap. _build_tracing_gap gains hint translations for journal:decision, notes>=min, and subtasks_terminal. The body is refactored to a static dispatch table + acceptance-criteria batch handler so the branch count stays under the lint cap. PM-verb success-path tests updated to provide notes >= 20 chars (the new NOTES_MIN_CHARS gate); has_reflect_for_task mocks added to a few tests where they're now load-bearing (AsyncMock truthiness covers most). 6575 tests passing, mypy + ruff clean. * feat(gateway/claim): require journal:note_at_claim and journal:decision_at_claim Pre-gateway parity P1, P3: developers wrote a note (scope='note') on every claim; PMs wrote a decision (scope='decision') on plan. Restored via foundation.policy.tracing requirements wired through a new _post_claim_journal_gate helper that runs AFTER the composed (claim, set_plan, start) sequence completes. Failed checks return tracing_gap with a remediate hint that tells the agent to journal then retry. The claim itself stays — the agent journals and re-issues the verb (idempotent re-entry shortcuts back to OK once the entry is present). Adds journal.has_note_for_task helper paralleling has_decision/reflect/learning/struggle. The PLAN requirement is filtered out of the post-claim check because spec.PRECONDITION_PLAN already enforced it before the runner ran — re-asserting at the tracing layer would emit a misleading hint. Two new tests verify the gate fires for missing note/decision; existing success-path tests already mock the journal service via AsyncMock (returning truthy) so no regressions. * test(foundation): Phase 2 smoke gate + tracing_gate.py deleted Phase 2 closes here: - foundation/policy/journaling.py owns the 5-scope catalog + read tiers - foundation/policy/tracing.py owns Requirement enum + VERB_REQUIREMENTS - 6 inline journal:decision checks replaced with unified helpers - pre-gateway parity restored: NOTE_AT_CLAIM, DECISION_AT_CLAIM, DURING_WORK, REFLECT-on-complete - services/gateway/tracing_gate.py deleted - enforcement/journal_perms.py read-tier rules canonicalized Smoke gate 2 enforces: no inline has_decision_for_task remains; every intent verb has a tracing decision; tracing_gate module is gone. * fix(foundation/task_completeness): align hint strings with actual enum values _HINT_NATURE listed 5 values (technical | bugfix | feature | refactor | docs) but TaskNature only has 2 (TECHNICAL / NON_TECHNICAL). _HINT_ESTIMATED_COMPLEXITY listed "critical" which Complexity doesn't have. _HINT_TEAM omitted FULLSTACK (real, used) and didn't note that MARKETING is legacy seed-data. _HINT_TASK_TYPE was already correct. Hints now reflect the actual enums in roboco/models/base.py and roboco/foundation/identity.py — agents reading the gateway's incomplete_input remediate envelopes will no longer be told to send values the enums reject. Tests using nature="feature" (DelegateRequest's nature is `str`, not the enum, so it accepted the fake value silently) updated to nature="technical" so they exercise a real enum value end-to-end. * fix(orchestrator): remove dead "critical" complexity branches Complexity enum has only LOW / MEDIUM / HIGH — no CRITICAL value. The three "critical" branches in dispatch logic at lines ~3032 / 3331 / 5049 were dead code (the comparison can never be true). Removed. Surfaced during Phase 2 closeout when the foundation hint string was audited against the actual enum. * feat(foundation/policy/communications): Priority + NOTIFY_SENDER_ROLES + ACK_REQUIRED_BY_TYPE * feat(foundation/policy/communications): CHANNELS catalog (channel topology) * refactor(agents_config): derive CHANNEL_ACCESS from foundation.communications * refactor(seeds): derive DEFAULT_CHANNELS / CHANNEL_MEMBERSHIPS from foundation * refactor(content_actions): derive notify allowlist + priorities from foundation Replaces _NOTIFY_ALLOWED_ROLES + _VALID_NOTIFY_PRIORITIES literals with derivations from foundation.communications.NOTIFY_SENDER_ROLES + Priority. Behavior change: pre-Phase-3 the literal frozenset {cell_pm, main_pm, product_owner, head_marketing} excluded CEO. Foundation includes CEO (per spec 5.5). The contradiction with agents_config.NOTIFICATION_PERMISSIONS (which already granted CEO can_send=True) is now resolved. * refactor(notification_delivery): requires_ack from foundation.ACK_REQUIRED_BY_TYPE * refactor(enforcement,agents_config): delete dead notification policy - enforcement/notification_perms.py deleted (dead at call-graph; only the enforcement/__init__.py re-export kept it reachable, and that re-export is gone too). - agents_config.NOTIFICATION_PERMISSIONS dict deleted; agents_config .can_send_notifications now derives from foundation.policy.communications.NOTIFY_SENDER_ROLES (auditor correctly excluded — silent observer per spec §5.5). - services/permissions.py: _can_role_send_notifications and can_agent_send_notifications now derive from NOTIFY_SENDER_ROLES; _get_notification_scope encodes the scope rule (cell/all/list) locally as a function-of-role and returns list[AgentRole] instead of list[slug]; can_notify list-scope branch updated to match. - enforcement/__init__.py: removed the notification_perms re-export and the NotificationPermissionError, get_notification_scope, validate_notification_permission names from __all__. Closes the spec §3 contradiction: gateway content_actions ._NOTIFY_ALLOWED_ROLES (Task 5) and the legacy agents_config.NOTIFICATION_PERMISSIONS no longer disagree about whether auditor may call notify(). Both now derive from foundation.NOTIFY_SENDER_ROLES. * fix(content_actions): runtime auditor guard in say/dm (defense in depth) Closes the spec §5.5 gap where the auditor's silent role was enforced ONLY by manifest exclusion. The manifest pre-filters the tool surface exposed to the auditor agent, but if anything bypassed it, the auditor could speak. The new runtime guard in ContentActions.say/dm refuses with Envelope.not_authorized when the caller's role is "auditor", regardless of how the call arrived. * fix(a2a): pass Priority tristate end-to-end (was reduced to boolean) Pre-Phase-3 path: request priority: str -> services/a2a.py reduces to urgent: bool -> services/notification.py maps bool back to NotificationPriority This made Priority.HIGH unreachable through the A2A path. After this fix the full tristate (NORMAL/HIGH/URGENT) survives end-to-end: * services/a2a.py:create_a2a_notification parses metadata["priority"] (preferred) or falls back to legacy metadata["urgent"] / config.urgent (URGENT-only). Unknown values fall back to NORMAL. * services/notification.py:send_a2a_notification now takes a2a_context["priority"] (NotificationPriority); a defensive bool/str coerce keeps legacy callers from crashing. * runtime/orchestrator.py:_build_a2a_prompt reads priority off the notification row (the source of truth) instead of a non-existent metadata.urgent and renders three tiers: URGENT bold, HIGH softer, NORMAL no prefix. Cosmetic [URGENT] body/subject prefix stays urgent-only; HIGH gets no prefix but is recorded as HIGH at the NotificationTable.priority column. Tests: * 9 new tests in tests/integration/test_a2a_priority_tristate.py pinning the round-trip for HIGH/NORMAL/URGENT through both layers plus legacy-bool backcompat. * Updated tests/unit/services/test_notification.py::test_send_a2a_notification to the new priority= contract. Closes the spec section 3 contradiction flagged in the audit. * feat(foundation/policy): agent_loop BudgetPolicy + VERB_RETRY_LIMITS * refactor(agent_sdk): import budget thresholds from foundation * refactor(orchestrator): import _PM_RESPAWN_MAX_UNPRODUCTIVE from foundation * fix(post-tool-budget-hook): exit 1 on loop-halt (was exit 0 / non-blocking) Pre-Phase-3 the hook printed [Loop] and exit 0'd — agents could ignore it and keep retrying. The 2026-05-10 smoke run showed i_am_done retried 5+ times within the global 150-tool budget, never hitting a real wall. Now the hook reads the SDK response's loop_action field (sourced from foundation.BudgetPolicy.loop_action; default "halt") and exits 1 to deny the wrapping tool call when the rolling-window loop detector fires AND loop_action is "halt". Operators can soften via env ROBOCO_AGENT_LOOP_ACTION=warn for debugging. Changes: - BudgetStatus pydantic model: add loop_action: Literal["warn", "halt"] (default "halt") so the SDK response carries the policy. - agent_sdk/server.py: read ROBOCO_AGENT_LOOP_ACTION env override on top of foundation default and surface it in _budget_snapshot(). - post-tool-budget-hook.sh: parse .loop_action, exit 1 to stderr when loop+halt; falls back to legacy warn-only print if the field is missing (older SDK / partial deploy). * feat(agent_sdk): per-verb retry circuit breaker via foundation.VERB_RETRY_LIMITS Pre-Phase-3 the gateway had no per-verb retry cap. The 2026-05-10 smoke showed i_am_done retried 5+ times in 2 minutes within the global 150-tool budget — the agent never hit a real wall. Now the SDK tracks (verb, task_id) -> deque[timestamp] over a 60s sliding window. When the count for a verb exceeds foundation.retry_limit_for(verb), the next attempt receives Envelope.circuit_open with a remediate hint pointing to i_am_blocked / i_am_idle as graceful exits. Verbs in foundation.UNLIMITED_RETRY_VERBS (give_me_work, triage, evidence, etc.) bypass the breaker. Only rejection envelopes (tracing_gap, invalid_state, not_authorized, incomplete_input) feed the counter — successful calls do not count. Wire-up: - Envelope.circuit_open classmethod + as_dict pass-through - _SessionState.verb_attempts: defaultdict[(verb, task_id), deque[float]] - Helpers _record_verb_attempt / _verb_attempt_count / _check_verb_circuit - POST /verb/attempted: hook posts after a rejected gateway call; response carries breaker state + (when open) the wire-format Envelope.circuit_open dict the agent should surface to itself - GET /verb/circuit_status: read-only state probe - _state.reset() (also POST /budget/reset) wipes the tracker on spawn * test(foundation): Phase 3 smoke gate + foundation-check extended Phase 3 closes here: - foundation/policy/communications.py owns Priority, NOTIFY_SENDER_ROLES, ACK_REQUIRED_BY_TYPE, ChannelSpec, CHANNELS, parse_priority - foundation/policy/agent_loop.py owns BudgetPolicy, VERB_RETRY_LIMITS, UNLIMITED_RETRY_VERBS, retry_limit_for - 6 channel topology fork sites collapsed to one source (CHANNELS) - Notification sender contradiction closed (CEO included; auditor excluded) - A2A urgency tristate restored (HIGH reachable end-to-end); A2A service now consumes parse_priority instead of inlining branches (also drops create_a2a_notification CC from C/13 to A/<10) - Auditor silent role enforced at runtime in say/dm - enforcement/notification_perms.py deleted (was dead code) - 7 hand-set requires_ack callsites consolidated to ACK_REQUIRED_BY_TYPE - post-tool-budget-hook.sh exits 1 on loop-halt - Per-verb retry circuit breaker live in agent_sdk (60s sliding window) make foundation-check now validates communications + tracing + journaling + identity drift in one command. make quality green. * refactor(lifecycle): copy spec.py to foundation/policy/lifecycle.py + shim Phase 4 Task 1 — relocates the canonical lifecycle spec next to its policy siblings (task_completeness, tracing, journaling, communications, agent_loop). The original roboco/lifecycle/spec.py is now an explicit re-export shim; consumers continue to work unchanged. Subsequent Phase 4 tasks (2-7) migrate the imports in batches, then Task 8 deletes the shim. No behavior change — pure code move. * refactor(services): import lifecycle from foundation (Phase 4 batch) * refactor(agents,enforcement): import lifecycle from foundation (Phase 4 batch) * refactor(tests): import lifecycle from foundation (Phase 4 batch) * refactor(foundation): absorb lifecycle _validate + _generators Phase 4 Tasks 9 + 10. Moves the lifecycle spec's internal validators to roboco/foundation/_validate_lifecycle.py and its RAG/prompt artifact emitter to roboco/foundation/_generators.py. The lifecycle validators live in a sibling module (not merged with foundation/_validate.py) because the lifecycle spec imports from foundation at module load — placing the lifecycle checks alongside the identity checks would create an import cycle between roboco.foundation and roboco.foundation.policy.lifecycle (the latter calls the validators at the bottom of its own definition). The _validate_lifecycle module defers its policy.lifecycle imports to function bodies so it loads cleanly when the spec hasn't finished initialising yet; the per-file PLC0415 exemption in pyproject.toml documents the reason. Test files relocated: - tests/lifecycle/test_spec.py -> tests/foundation/test_lifecycle_spec.py - tests/lifecycle/test_generators.py -> tests/foundation/test_lifecycle_generators.py scripts/build_lifecycle_artifacts.py now imports the generators from roboco.foundation; the on-disk artifacts (docs/rag/lifecycle, panel/lib/lifecycle.json, agents/prompts/_generated/lifecycle-*.md) regenerate byte-identically. After this commit, roboco/lifecycle/ contains only the spec.py and __init__.py re-export shims — Task 8 deletes those. No behavior change. 6638 tests pass; make quality green. * refactor(lifecycle): delete legacy roboco/lifecycle/ package Phase 4 Task 8. All consumers migrated to roboco.foundation.policy.lifecycle in Tasks 2-7; the internal validators + generators moved to foundation in Tasks 9-10. The legacy package contained only re-export shims. Also trims tests/foundation/test_role_reexport.py — the two assertions that checked the lifecycle.spec shim's object-identity are gone with the shim. The two models.base shim assertions (AgentRole / Team) are still meaningful and stay. Inline docstrings / comments in enforcement/task_lifecycle.py, services/gateway/role_config.py, services/gateway/content_actions.py, tests/integration/test_task_service_lifecycle_misc.py and foundation/policy/lifecycle.py that referenced the now-deleted roboco.lifecycle.spec module are updated to point at roboco.foundation.policy.lifecycle. After this commit, roboco.lifecycle is gone. Lifecycle policy lives only at roboco.foundation.policy.lifecycle. Adding new lifecycle rules edits exactly that one file. * refactor(api): consolidate route-guard role-sets via foundation Replace hand-written role-name string frozensets in roboco/api/deps.py (_PM_OR_ABOVE_ROLES, _DEVELOPER_OR_ABOVE_ROLES, _GLOBAL_CELL_ACCESS_ROLES) and roboco/api/routes/v2/_role_dep.py (require_dev/qa/doc/cell_pm/main_pm/ board/auditor) with foundation-derived expressions over PM_ROLES, BOARD_ROLES, DEV_ROLES, and Role enum members. Behavior is preserved: Role is a StrEnum, so the lowercase X-Agent-Role header still compares equal to its matching member. HEAD_MARKETING stays excluded from every -or-above set (marketing spokesperson, not approver); the carve-out is now expressed as (BOARD_ROLES - {Role.HEAD_MARKETING}) instead of an opaque literal. Adds tests/foundation/test_route_guard_consolidation.py (6 tests) pinning both the foundation-derived membership and the import contract. * test(foundation): Phase 4 smoke gate + housekeeping closeout Phase 4 closes the foundation canonicalization effort (Phases 1-4 spanning 2026-05-10 -> 2026-05-11): Phase 1 - identity + task_completeness (skeleton-task bug killed) Phase 2 - tracing + journaling (pre-gateway cadence restored) Phase 3 - communications + agent_loop (channel/notification/A2A/circuit-breaker) Phase 4 - housekeeping (lifecycle moved to foundation; consumers migrated) All cross-cutting policy now lives in roboco/foundation/. Adding a policy edits exactly one file. The legacy roboco.lifecycle package is gone. Smoke gates 1-4 enforce: no skeleton tasks, no inline journal:decision checks, channel topology canonical, A2A tristate preserved, auditor silent at runtime, lifecycle module path canonical. make quality + make foundation-check both green. * fix(mcp/agent_sdk): wire per-verb circuit breaker into response handler Phase 3 Task 14 added the SDK infrastructure (tracker, endpoints, Envelope.circuit_open, retry_limit_for) but nothing was actually recording rejections — the breaker never tripped. This commit wires the gateway-response path so every rejection envelope (tracing_gap / invalid_state / not_authorized / incomplete_input) hits POST /verb/attempted, and if the breaker is open, the envelope is substituted with the circuit_open response before the agent sees it. Best-effort: SDK-unreachable / malformed-response failures fall open (agent sees the original rejection), so the breaker never breaks the gateway path. * fix(notification_delivery): retype CEO approval-flow notifications APPROVAL notify_assignee_of_ceo_rejection and notify_ceo_of_escalation were both typed NotificationType.TASK_ASSIGNMENT, which the Phase 3 foundation table (ACK_REQUIRED_BY_TYPE in roboco/foundation/policy/communications.py) maps to requires_ack=False. Both are approval-flow notifications and should mandate acknowledgment. Retyped both to NotificationType.APPROVAL so the table lookup yields requires_ack=True via ACK_REQUIRED_BY_TYPE[NotificationType.APPROVAL]. * test(foundation): move lifecycle parity + smoke-replay tests under tests/foundation/ Phase 4 Task 8 deleted roboco/lifecycle/ but tests/lifecycle/ still held two files importing roboco.foundation.policy.lifecycle. Mirror the layout of test_lifecycle_spec.py and test_lifecycle_generators.py (moved in Phase 4 Tasks 9+10) by relocating them under tests/foundation/ with the test_lifecycle_* prefix, then delete the now-empty tests/lifecycle/ package. tests/lifecycle/test_consumer_parity.py -> tests/foundation/test_lifecycle_consumer_parity.py tests/lifecycle/test_smoke_replay.py -> tests/foundation/test_lifecycle_smoke_replay.py * build(make): consolidate ci-lifecycle-check into foundation-check ci-lifecycle-check was a thin wrapper that regenerated lifecycle artifacts via scripts/build_lifecycle_artifacts.py and gated on git diff. After Phase 4 it sat alongside foundation-check covering the same drift-gate intent. Merge the lifecycle-artifact regen + git-diff step into foundation-check so a single 'make foundation-check' is the canonical drift gate. Keep ci-lifecycle-check as a phony alias forwarding to foundation-check for any external script or CI lane still using the old target name. Drop the redundant ci-lifecycle-check call from 'make quality'. * ++ --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-05-11 02:15:47 +02:00
Renn F	9aa30fb945	100% Coverage	2026-05-06 21:02:31 +02:00