3 Commits

Include renames

Author	SHA1	Message	Date
3 people	a36a180b73	fix(orchestrator): let a failed Board Program exploration retry (#706) ... `_board_dispatched` is an in-memory, never-expiring set of (agent_slug, task_id). The solo exploration dispatchers consulted it, so an exploration whose propose verb rejected was never retried for the life of the process — Periscope, Sentinel, Scales and Barfly each spawned once on 2026-07-25, failed, and sat PENDING until the stack restarted. The guard was written for the two-reviewer board REVIEW pass, where it is correct: a reviewer has no verb to advance the task, so a respawn can only loop. An explorer is the opposite — `propose_*` is exactly such a verb, so a respawn can and should advance it. Drop it from the 15 `_dispatch_*_exploration` functions. Bounding falls to `_pm_respawn_should_gate`, which is what actually bounds a loop: DB-persisted, reset by a status change, and cooled down so a deploy that fixes the cause lets the work resume. `_dispatch_board_reviewer` keeps the set (its `_board_review_complete` reads it as a has-run signal) as does vault curation (same-process race guard behind its own durable marker). The 14 `*_dispatch_is_one_shot` tests asserted the old contract on the false rationale that board roles have no progression verb; they now assert a second tick re-attempts. Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-26 15:52:33 +02:00
3 people	e77c3b7a63	feat(board): Board Program registry — Phase 1 (engine, LEARN ledger, per-project scoping, panel) (#689) ... * feat(board): Board Program registry — generic trigger/dedup/originate/LEARN engine One registry (foundation/policy/board_programs.py) + one BoardProgramEngine + one orchestrator loop replace the bespoke roadmap/spotlight loops, behavior- preserved: same sources, dispatch routing, one-open-cycle dedup (ledger rows auto-close when their exploration task goes terminal, so x_feature's complete-at-propose flow can't wedge), and live per-program interval overrides with the tick capped at 1h. program_armed() is the single arming chokepoint: the settings-store board_program.<key>.enabled override when present, else the legacy flag — routed through BoardProgramEngine, RoadmapEngine.run_cycle, and XEngine's spotlight gate, so the panel toggle can never be a silent no-op against a legacy boot flag. LEARN: board_program_cycles (migration 087) accrues per-item CEO decisions (exact attribution by exploration_task_id where the caller holds it) and feeds the last closed cycles back into both exploration prompts. The strategy engine's idle signal now opens a roadmap cycle (enabled+dedup respected) instead of only nudging. Per-project scoping (migration 088, projects.board_programs, dual polarity): plain keys opt a project INTO project-scoped programs; "!key" opts it OUT of an org-scoped program's outputs (default eligible — parity). Enforced at propose_roadmap (names the excluded project) and defensively at materialize; validation rejects unknown keys and meaningless polarity both directions. API: GET /api/board-programs + POST /api/board-programs/{key}/run-now (CEO-gated); settings keys for both migrated programs. * feat(panel): Board Programs card + per-project program controls Business page gains a Programs tab: per-program rows (role, trigger, scope, open-cycle badge), enabled switch on the settings-store key, Run now (disabled while a cycle is open). The edit-project dialog gains the program controls next to the CI-watch/video toggles: participates-in checkboxes for project-scoped programs, excluded-from checkboxes for org-scoped outputs. * test(board): full-gate hermeticity — mypy casts + shared-DB purge fixtures make quality runs one pytest process over all suites against the shared persistent DB: integration collects before unit, so the board-programs API test's committed run-now state (settings-store overrides, an open cycle row, its board_roadmap task) poisoned 13 downstream unit tests that pass in isolation. The polluter now purges its own committed state in fixture teardown, and the four consumer files get an autouse per-test purge (board_program.% settings keys, ledger rows, open exploration tasks) so they are hermetic regardless of collection order. Also the four cast("UUID", ...) sites the tests-scope mypy run requires. * feat(panel): re-home per-project program controls onto the settings page Wave C deleted the edit-project dialog these controls originally landed in; they now live on the project settings page's budget/ops card next to the CI-watch/video toggles — participates-in switches for project-scoped programs, excluded-from switches for org-scoped outputs, dual-polarity tooltips, order-independent dirty tracking. Nine makeProject test fixtures gain the required board_programs field the rebase left behind. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-25 05:39:44 +02:00
3 people	3ccc723cd4	v0.17.0 — Wave 3: sandbox DB, DB isolation, mobile UI, cloud auth, X account, roadmap engine (#303) ... * feat(sandbox): throwaway per-agent Postgres/Redis sandbox containers Orchestrator-provisioned sibling containers per agent spawn (SandboxProvisioner, roboco/runtime/sandbox.py). Per-project opt-in via projects.sandbox_services (migration 057); master switch ROBOCO_SANDBOX_DB_ENABLED, default-off, armed in the NAS compose only. When active, ROBOCO_TEST_DB_* / ROBOCO_TEST_REDIS_* point at the sandbox and the prod-creds gate-env injection is suppressed (sandbox replaces, never coexists). Sandbox lifetime tracks the agent container: teardown at every removal path, orphan janitor at startup + each reaper tick with a grace window for mid-flight spawns. The pre-spawn stale-clear spares the just-provisioned sandbox; provision pre-clears stale same-named containers from a crash-missed teardown. Panel: per-project sandbox-service switches in the edit dialog + feature flag card entry. * docs: CLAUDE.md entry for the sandboxed dev DB/Redis subsystem * feat(security): isolate prod Postgres/Redis from agent containers (roboco_data network) Second user-defined bridge roboco_data carries postgres+redis only; the orchestrator is multi-homed (default + data). Spawned agents and their sandbox sidecars stay on roboco_default and can no longer resolve or reach roboco-postgres:5432 / roboco-redis:6379 (redis has no auth — membership is its only containment). Normal bridge, so host-published ports (15432/16379) keep working. Applied to both build composes and the registry compose; docker-compose.yml re-synced byte-identical with docker-compose.yaml (it had drifted by the sandbox flag block). ROBOCO_DB_NETWORK_ISOLATED (config default false, armed alongside the topology) suppresses the legacy _append_gate_env prod-creds injection: under isolation those creds dead-end, and unreachable creds are worse than none. DB-needing projects opt into sandbox_services instead. The flag is deliberately not a panel feature flag - it must travel with the compose networks: stanzas. Preserved by construction: agent<->agent A2A and orchestrator->agent SDK polls on :9000, MCP->orchestrator on :8000, ollama reachability, docker exec/inspect (daemon socket), host port publishing. * feat(panel): full mobile responsiveness pass Shared primitives: useIsMobile (useSyncExternalStore, hydration-safe, memoized matchMedia subscribe), ResponsiveTable table->card switch below md (single subtree mounted, no duplicated interactive rows), scrollable snap TabsList in the base primitive (justify-center-safe so the first tab stays reachable on overflow), persistent md:hidden bottom tab bar (Overview/Tasks/Kanban/Chat, safe-area padded). Applied: card lists for tasks/projects/products/work-sessions/sessions + the three raw metrics tables; CEO approval queue / release proposal / playbook review action rows stack on narrow; command-center reorders approvals above the fold on mobile; task-header metadata wraps; Communications + A2A become URL-driven single-pane drill-downs below lg (fixes the unconstrained-height ScrollArea bug) with dvh heights; recharts label density/radius adapts via useIsMobile; git diff viewer gets mobile font + wrap toggle; vh->dvh sweep; chat composers get safe-area-inset padding; dashboard main p-4 md:p-6 + pb-20 for the bar. Verified at 375px on the built app: bottom bar, drawer, approval-first overview, swipeable kanban tab strip. All gates green (eslint, tsc, vitest 249, next build 24/24 routes). * feat(auth): cloud auth via FastAPI Users (default-off, single-user cookie session) ROBOCO_CLOUD_AUTH_ENABLED (default off) lets the panel/API be exposed beyond localhost without changing the CEO's local no-login flow while off — get_agent_context and the WS gate are byte-for-byte unchanged in off-mode. On: header-trust dies for humans — any agent-role claim (ceo or a privileged PM/board role) with no valid HMAC token or session cookie is 401, closing the header-spoof hole on the host-published :8000 port for every role. The agent-fleet HMAC path and the system self-PATCH keep working unmodified in both modes. Single seeded CEO user (migration 058 users table, UserTable), no registration router — idempotent env-driven upsert at startup by PK. Cookie transport (httponly/secure/samesite=lax) + a JWTStrategy bound to a fingerprint of the current password hash (rotating the password invalidates every prior session). Sliding 30-day session: every authenticated request re-mints the cookie, so an active session never expires — no unexpected logouts. Panel: (auth)/login page + proxy.ts (Next 16 rename of middleware; probes /auth/status over the docker-internal URL, fails open to off) gate the dashboard; client.ts gets withCredentials + 401->/login. nginx unchanged. Review hardening: broadened the on-mode rejection from ceo-only to every non-CEO role without a valid token (was only closed when ROBOCO_AGENT_AUTH_REQUIRED was also armed); Next-16 proxy.ts rename to clear the middleware deprecation warning. * feat(x): RoboCo X account engine — HoM drafts, per-post CEO approval (default-off) ROBOCO_X_ENGINE_ENABLED (default off, inert without creds). Mirrors the ReleaseManagerEngine held-artifact shape: XEngine drafts a post when a release publishes (via a draft_release_post seam on ReleaseProposalService .approve) and drafts replies to meaningful mentions (dedicated poll loop, x_seen_mentions dedup ledger, per-cycle/open caps). Drafting is local-model-only, clamped to 280 chars. Nothing auto-posts — every tweet is a held task (source x_post/x_reply, confirmed_by_human=False, Secretary-owned, dispatcher-skipped) the CEO edits/approves/rejects in a panel queue. The four OAuth 1.0a secrets live Fernet-encrypted in a singleton x_credentials row (migration 059, all-or-nothing, API returns only has_credentials); decryption is server-side, agents never hold creds or egress. Hand-rolled OAuth 1.0a HMAC-SHA1 signer, no new dependency; NullXClient makes the unconfigured path a graceful no-op. XPostService.approve (CEO-only) is the sole caller of post_tweet. Review hardening: closed a double-post race — the approve path now re-reads committed task state inside the Redis lock and commits COMPLETED before releasing, so a concurrent approve that acquires the lock after the winner released can't re-post (SET-NX is non-waiting, and the route-level commit landed after the lock dropped). Added a regression test. * feat(roadmap): board roadmap engine — PO proposes themed cycles, CEO approves per-item (default-off) ROBOCO_ROADMAP_ENGINE_ENABLED (default off). Weekly, RoadmapEngine opens ONE held exploration task (source=board_roadmap, confirmed_by_human=False, Product-Owner-assigned), deduped to one open cycle. A dedicated one-shot _dispatch_roadmap_exploration spawns the PO solo (not the two-reviewer board path, which would also spawn HoM + fire Approve-&-Start). The PO explores read-only (git/KB/metrics/releases/charter/web) and makes one propose_roadmap call (PO-only content verb) authoring a themed cycle — goal + 3-7 item drafts — persisted as a roadmap_cycle marker (no table, no migration; head stays 059). The CEO acts per-item in the panel roadmap queue: approve materializes a BACKLOG task (source=roadmap, no assignee — never auto-starts), reject records a reason; all-items-terminal completes the exploration task. RoadmapService is idempotent per item. Dispatchers skip board_roadmap. Includes a real SQLAlchemy dirty-check fix (deep-copy the JSON marker before mutating, or the in-place edit + reassign compares equal to its own baseline and the UPDATE is skipped). Review hardening: create_task_from_draft now honors a draft-declared source only from a {prompter, roadmap} whitelist — drafts are LLM-authored, so an unbounded source could impersonate a privileged origin (release_manager would even wedge that engine's dedup). * chore(release): 0.17.0 Wave 3 — six default-off subsystems: sandboxed dev DB/Redis, prod Postgres/Redis network isolation, full mobile UI pass, cloud auth (FastAPI Users), the RoboCo X account engine, and the board roadmap engine. Plus the waves 1+2 work already on master since 0.16.0. Version bumped across the canonical set (config.py, __init__.py, pyproject.toml, panel/package.json, uv.lock); CHANGELOG [Unreleased] cut to [0.17.0]; docs/map delta added. Compose: every optional feature armed :-true in the NAS composes, OFF in the user-facing registry compose. Two opt-in exceptions default off (CLOUD_AUTH — needs email/password/secret + TLS, would otherwise fail startup; ROUTING_STRICT — fail-closed spawning). DB_NETWORK_ISOLATED stays on in both (coupled to the roboco_data topology). * chore(compose): arm cloud_auth + routing_strict ON in the NAS composes Every feature defaults ON in the NAS composes per policy — these two were wrongly left off. Both keep the ${VAR:-true} form so the operator controls the real runtime via .env: cloud auth needs ROBOCO_CLOUD_AUTH_EMAIL/_PASSWORD/_SECRET + TLS set there before a boot (else startup fails loud), and routing_strict is fail-closed. Registry compose keeps both off. * fix(ci): reflow board.md prose (quality gate) + document v0.17.0 env creds The roadmap section added hard-wrapped prose that failed the markdown prose gate; reflowed (token-invariant). Also brought .env.example current: cloud auth (now armed — needs SECRET or startup fails), routing strict, the X engine (panel-entered OAuth), and web research. * fix(ci): reduce cyclomatic complexity of five wave-3 blocks (xenon gate) The wave-3 subagents introduced C-rank functions the CI xenon gate rejects (my per-item reviews ran ruff/mypy/pytest but not xenon): - sandbox.janitor_sweep -> extract _list_labeled_sandboxes / _list_live_agent_containers / _prune_grace - x_client.fetch_mentions -> extract _parse_mention_items - x_engine.run_cycle -> extract _process_mentions - orchestrator._dispatch_pm_work -> extract the source-skip into a MODULE-level _is_held_ceo_source (module, not method, so the wholesale-mocked dispatcher unit tests exercise the real logic) - auth/seed.ensure_seed_user -> extract _apply_seed_updates (module avg -> A) Behavior-preserving; full suite green (11902), xenon clean. * fix(ci): declare pyjwt + fastapi-users-db-sqlalchemy as direct deps (deptry) The cloud-auth code imports jwt and fastapi_users_db_sqlalchemy directly but they were only transitive deps (via fastapi-users), which deptry (quality gate, DEP003) rejects. Declared explicitly; deptry roboco/ clean. Missed originally because local make quality stopped at earlier gates before reaching deptry. * feat(x): gate mention replies behind ROBOCO_X_REPLIES_ENABLED (default off) Per CEO decision: the X engine should only post about releases by default. Reading mentions needs a paid X API tier, so the mention-reply half is now a deliberate opt-in on top of release posting. New default-off flag x_replies_enabled gates the mentions poll loop (_x_mentions_poll_loop) and XEngine.run_cycle; release-post drafting (the release-proposal approve hook) is unaffected and still runs when x_engine_enabled + credentials are set. Added to FEATURE_FLAGS + the panel card. Tests: release posting works with replies off; run_cycle + the poll loop are no-ops with replies off. * fix: 401 only redirects to /login when cloud auth is on; panel-token strips .env quotes Two bugs that together dead-ended login in secure mode: - client.ts redirected to /login on ANY 401, so a mismatched panel token (header-trust/secure mode, cloud auth off) bounced the user to a login page whose backend route isn't mounted -> 404. Now it probes /auth/status (bare fetch, no interceptor re-entry) and only redirects when cloud_auth_enabled. - make panel-token read the .env secret with grep|cut without stripping surrounding quotes, so a quoted ROBOCO_AGENT_AUTH_SECRET produced a token signed with the quotes included — which never verifies against the orchestrator (docker-compose/pydantic unquote the secret). Now strips surrounding single/double quotes. * fix: git-log 500 on '|' in commit message; X queue shows an empty state - GET /api/git/log 500'd (ValueError: Invalid isoformat) when a commit SUBJECT contained a '|' (e.g. the 'curl|sh' lockdown commit): the fixed '|' field delimiter let the subject's pipe shift the split so author+date collapsed into one field. Switched to \x1f (Unit Separator), which can't appear in commit content. Regression test with a piped subject. - The X Post Queue returned null when empty, so there was no visible place for the X drafts. It now renders a discoverable empty state pointing at Settings -> X credentials. * docs: bring docs/rag + docs/map current for v0.17.0 (waves 1-3) Agent-facing RAG corpus and codebase map updated for every feature in the 0.17.0 span, code-verified: - wave 3: sandbox DB, DB network isolation, cloud auth, X engine (+ x_replies_enabled sub-flag), board roadmap engine — new RAG architecture pages + role/tool/config-reference updates; new symbols, migrations 057-059, panel surfaces, and the get_agent_context dual-path across the map slices. - waves 1-2: A2A live view + switchboard, prompter memory (search_past_tasks), Secretary edit access + PM-lighter scope, the PR-gate auto-submit turn cut (ROBOCO_PR_GATE_AUTO_SUBMIT_ENABLED). - correctness fix: api-routes-schemas.md no longer claims the A2A admin routes are reachable by any authenticated agent — they carry a _require_ceo gate (wave 2c). docs/internal, _front.md deltas, and the frozen _complete_map.md snapshot untouched. * fix(rag): atomic upsert for indexed-doc tracking (kills e2e segfault) The indexed-document tracking write used check-then-insert in two paths (IndexedDocumentRepository.upsert_batch and the file-source _upsert_doc_record). Under concurrent indexing both callers saw no row and both inserted, so the second violated uq_indexed_doc_source and poisoned its transaction — surfacing in CI as the intermittent _checkin_failed SIGSEGV on the failed connection's pool checkin. Both paths now use INSERT ... ON CONFLICT DO UPDATE against the constraint: coalesce keeps an existing title/preview when the new value is empty (matching the old guards) and metadata is jsonb-merged. The batch dedupes within itself first (ON CONFLICT can't touch a row twice in one statement). expire_all after the Core upsert keeps same-session ORM reads consistent with the merged DB row. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-03 19:24:00 +02:00