3 Commits

Include renames

Author	SHA1	Message	Date
Renn F	7716830322	feat(fleet): opus-fable adoption — doctrine + discipline hooks (v0.18.0 A) ... Fleet behaves more like Fable 5 on existing model tiers, behind ROBOCO_FABLE_MODE_ENABLED (config default off; armed :-true on the NAS compose, absent from the registry compose). - Doctrine: vendored agents/prompts/doctrine/fable.md composed into every agent's system prompt via fable_doctrine_layer() after base.md. - Hooks (Claude Code): 4 non-overlapping hooks (stop-gate/bash-discipline/ honesty-nudge/precompact) appended per-agent via _fable_hook_groups(). The make-quality + lint-suppression duplicates are deliberately NOT added (already gate-enforced); session-start skipped. - Hooks (grok): conservative V1 — only the non-denying honesty-nudge, since a grok hook deny cancels the whole run. - Flag on the feature-flags card; hook scripts shipped into the agent image. Flag-off spawn path proven byte-identical (worktree diff, sha256 match); full suite green (2074 unit + e2e-smoke + hook harness), mypy/xenon/ruff clean. Fixed a real stdin bug in the vendored stop-gate hook (heredoc + pipe both claimed stdin). Distilled from rennf93/opus-fable-playbook (MIT).	2026-07-04 06:44:40 +02:00
3 people	d1cf6ecbf3	Wave 1: PR-gate turn cut, task search, trace timestamps, Secretary edits + e2e scenarios 2–3 (#295) ... * feat(tests): e2e scenario 2 — the PM merge chain through the PR gate Shared arcs extracted (arcs.py: canonical-company seeding + dev/qa/doc segments); scenario 2 seeds a root->cell->dev hierarchy mid-flight, rides the child through the scenario-1 arc into the cell branch (real squash via the fake GitHub), then submit_up -> claim_gate_review/pr_pass -> dispatcher re-claim (mirrored) -> PM complete merging cell->root. This is the exact PM->reviewer->PM turn sequence the wave-1 turn cut shortens — the BEFORE-net. Learned seams scripted: commit-subject validator (>=20 chars), reviewer learning-note gate, pr_pass clears ownership by design. * feat(runtime): PR-gate turn cut — assembled parents auto-submit to the reviewer When every child of an assembled parent is terminal, the closure dispatcher now runs the real submit_up/submit_root through the internal API as the owning PM (_try_auto_submit) instead of spawning the PM for that turn — the submit's substance is deterministic gate code. Any gate refusal falls back to the classic PM closure spawn; pr_fail routing and the PM's final merge turn are unchanged; umbrellas never auto-submit. ROBOCO_PR_GATE_AUTO_SUBMIT_ENABLED default-on; task.auto_submitted audit row per cut. Proven by e2e scenario 2b (real API, real gates, real git) against scenario 2 as the before-net. * feat(notes): structured note sections carry a written_at trace stamp Sections are overwrite-in-place, so without a stamp there was no way to reconstruct WHEN a dev/qa/doc/reviewer note landed (CEO reMarkable item: trace TIMESTAMPS). apply_structured_note stamps ISO written_at beside the model fields; the panel notes tab renders it next to each card title (pre-stamp rows render nothing). Progress updates, commits, and journal entries already carried timestamps — this was the one gap. * feat(tasks): server-side task search — title, details, and id prefix The task list's search box only matched titles client-side, and the trimmed summary payload deliberately carries no description — so keyword/details/id search was impossible in the browser by design. GET /tasks/summary gains q (ILIKE over title+description, id-prefix match, composed with team/status and the view-permission scoping); the panel debounces the box into the summary fetch and drops the title-only client filter that would have hidden description matches. * feat(wave-1): trace timestamps, real task search, Secretary task edits - apply_structured_note stamps written_at per section; the panel notes tab shows it (the one trace surface without a timestamp). - GET /tasks/summary?q= searches title+description+id-prefix server-side (summaries carry no description by design); panel debounces into the fetch and drops the title-only client filter. - Secretary control_task gains a CEO-gated edit action over the content allowlist, and GET /secretary/tasks?q= resolves task names to ids for the chat. PM-side expansion deferred per the CEO's 'not that much'. * fix(workspace): dep-update probe scrubs the inherited venv pin Under uv run the orchestrator's process tree carries VIRTUAL_ENV, and a uv-based dep_update_command in the throwaway probe clone would target that venv instead of the clone's — the same hazard _uv_subprocess_env already guards on the install path. * build: private per-repo uv cache — isolate from machine-wide uvx servers Root cause of the recurring rich/pip/bandit rot, with evidence: uv cache clean timed out on the ~/.cache/uv lock ('is another uv process running?') — three uvx mcp-server-fetch processes (Claude Code fetch MCP, one alive since Wednesday) share that cache and race repo syncs on it; poisoned entries then survive venv rebuilds because rm -rf .venv never touches the cache, and every re-link reproduces the breakage. UV_CACHE_DIR now pins <repo>/.uv-cache (gitignored). The earlier UV_NO_SYNC serialization stays as defense-in-depth but was not the whole story. * feat(tests): e2e scenario 3 — pr_fail revision loop + root→CEO chain 3a: reviewer pr_fail with a concrete issue -> needs_revision -> i_will_plan re-entry (full plan gates) -> real fix lands on the cell branch (the unchanged-PR hard gate refuses resubmit until it does) -> clean second pass -> merge. 3b: submit_root -> gate -> Main PM complete escalates the root to the CEO -> the REAL approve-and-merge endpoint squash-merges to the origin's master. Harness gains the tasks router, a seeded CEO identity, origin_commit, and a fake GitHub whose head.sha is recomputed live (real-GitHub semantics the unchanged gate reads). Seeds now encode the real shape: delivery roots are team=main_pm and planning-typed. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-02 21:05:50 +02:00
3 people	1c87a4e4e4	Leak fixes, gate green again, uv/CI hardening, e2e lifecycle smoke harness (#294) ... * test: align phase1 smoke mock with the armed team-match gate The 8e5f84c4 sweep fixed 13 test files' inconsistent-team mocks but ran only the gateway/foundation/runtime subsets; the full gate caught this integration mock whose parent task carried an auto-generated MagicMock team and died on not_authorized before the incomplete_input assertion. * fix(runtime): attribute every agent.spawned audit to its dispatcher A rogue spawner could not be identified live (2026-07-02): agent.spawned rows carry container/model but not which dispatch loop launched them. spawn_agent now takes spawned_by, stamps it into the spawned/spawn_failed audit details, every call site passes its loop name, and an AST sweep test holds future callers to it. * fix(api): admin-complete refuses when the task's PR is still open PATCH status=completed on a task with an OPEN PR stranded its commits unmerged (bit the CEO twice live 2026-07-02). The override now refuses with the PR number/URL and the consequence before the generic hatch text; force:true stays the deliberate, audited escape. * fix(panel): awaiting_ceo_approval offers the working ceo-approve path The header's only approve action was Approve & Merge (POST /approve-and-merge, no notes) which 400s NO_PR on a branchless MegaTask umbrella — the CEO's approve button just failed. Primary action is now Approve & Complete via the CeoApproveDialog (POST /ceo-approve, notes >=20 chars, proven live); Approve & Merge stays for PR-bearing tasks. * test: stop leaking self-heal + rate-limit state into live Redis Two test files wrote real keys into a developer's localhost Redis: self-heal originate tests left self_heal:notified:* (2h TTL) and the i_am_blocked rate-limited tests left a NO-TTL 'anthropic rate-limited' tracker blob — order/state-dependent poison for anything reading the real tracker, and the prime suspect class for the one-off test_self_heal_engine full-run failure (not reproduced in 5x dir runs, adversarial orders, and a green full gate). Both files now point the computed redis_url at an unreachable port; the engines' fail-open paths keep every assertion intact. Leaked keys scrubbed live. * docs: changelog + map delta for the leak-fix batch; mypy-clean attribution test The attribution test's direct method assignments tripped the full gate's mypy (method-assign) — switched to the house monkeypatch idiom, no suppressions. * fix(gate): clear the ten xenon C-ranks; isolate all tests from live Redis Master CI has been red at the phase1 smoke test, so neither CI nor a local full gate had reached the xenon step since the team-match sweep — whose inline 'agent_team=str(agent.team) if ...' kwarg pushed nine verb bodies from B(10) to C(11-12) unseen. A shared actor_context_fields() (_protocol.py) computes (actor_slug, agent_team) once per verb, restoring all nine to B with zero behavior change; the new admin-complete override helper extraction does the same for routes/tasks.py. tests/conftest.py gains an autouse fixture pointing the computed redis_url at an unreachable port for every test — the root fix for the three families caught writing live-Redis keys (self-heal dedupe, rate-limit tracker, notification purpose-dedupe); no test uses a real Redis, and every production path is fail-open by design. * refactor(runtime): delete the never-wired dispatch-time spawn cooldown _safe_spawn / gateway_pre_spawn_check / trigger_filter had no caller in the repo's entire history (87ef42bf only flipped the flag). Its five rules are superseded: provider parking runs inside spawn_agent, claim freshness is the guards+reaper, runaway respawns are the progress-aware breaker + notification cooldown; the per-task cooldown rule would queue-stall every normal stage handoff if wired today. gateway_triggers table kept inert. Ratified by the CEO over wiring it. * build: serialize uv — gate recipes never implicitly sync the venv Every uv run re-syncs implicitly, so a background make quality plus any foreground uv run raced two writers on one .venv and tore site-packages apart (the recurring rich/pip/bandit ImportError corruption; bit twice today, four times on 2026-07-02's first session). UV_NO_SYNC=1 is now exported Makefile-wide and quality/quality-fast/gate depend on one explicit up-front sync step. * fix(git): PR/merge/branch REST calls honor github_api_base_url Fifteen sites hardcoded https://api.github.com while the CI-run and open-PR-list calls already read settings.github_api_base_url — a GHE or test override silently applied to half the surface. One _api_base() helper keeps them uniform; default behavior unchanged. * ci: split the monolith — backend CI, Panel CI, E2E Smoke ci.yml keeps its file name and the backend quality job only (self-heal / ci-watch / release-readiness default to the ci.yml workflow); the panel job moves to panel-ci.yml scoped to panel/**, and the new scripted-agent lifecycle smoke gets e2e-smoke.yml + a make e2e-smoke target (env-gated out of the default pytest run). Trade: a panel-only red now lands on Panel CI, which the ci.yml-pinned watch engines don't see. * feat(tests): e2e lifecycle smoke harness — scripted agents, real gates tests/e2e_smoke stands up the real API (flow/do routers + middleware on uvicorn) over the ephemeral test Postgres, a local bare origin standing in for GitHub, and a fake GitHub REST layer whose merges are real git merges. A deterministic driver reloads the real MCP flow/do modules per agent and walks claim (real clone + worktree) -> tracing-gap -> note -> plan gate -> commit -> PR -> the full i_am_done ladder -> QA verdicts -> documenter -> awaiting_pm_review in ~5s. Runs via make e2e-smoke + its own CI workflow; skipped (env-gated) in the default suite. The freeze-lift condition's first half: scenario 1 green. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-02 18:28:07 +02:00