2 Commits

Include renames

Author	SHA1	Message	Date
3 people	a036c97985	fix(tg): cockpit data correctness — real GLM pricing, display timezone, agent activity tracking (#666) ... * fix(tg): cockpit data correctness — real GLM pricing, display timezone, agent activity tracking Three root causes behind the Mini App/bot showing wrong numbers: Pricing: glm-5.2 gets a grounded per-token rate (z.ai published pricing, $1.40/$4.40/$0.26 per 1M, source+date in the table comment) so a GLM fleet day stops reporting $0.00 for half a million tokens; ungrounded Ollama-Cloud models render "subscription (untracked)" instead of a bare zero (is_ollama_cloud_model, consumed directly by the cockpit). Side effect, intended and documented: honestly-priced GLM now trips the downgrade-only comparator for new qa/documenter complexity pins. Display timezone: the cockpit bucketed days in UTC for a GMT+2 operator. New pure foundation module display_time (resolve_zone/local_date/ trailing_dates/day_bounds_utc, DST-correct with tests for the 23h/25h days) + ROBOCO_DISPLAY_TIMEZONE (IANA-validated, default UTC); the cockpit's spend/velocity series bucket raw session/completion rows by the display zone. The UTC-keyed rollup table and the main dashboard are deliberately untouched. Agent activity: AgentTable.status was never set to ACTIVE and current_task_id was never written anywhere — "active: 0, working: []" was structurally permanent. Every claim path now marks the claimant ACTIVE with rollback symmetry (_finalize_claim for dev/PM claims, _qa_or_doc_claim for QA/doc/PR-gate claims, pr_review_claim for external review) and every release path clears it (pass/fail QA, pr_pass/pr_fail, complete_review, advance-to-PM-review, reaper unclaim, voluntary unclaim, reassign retarget, pool divert, admin transitions, unblock restore-to-in-progress). The bot's /status shares the cockpit's fleet derivation so the two surfaces can't disagree. Known ceiling, commented: one current_task_id column shows a multi-root coordinator PM's most recent claim only. Drill: sonnet develop -> sonnet adversarial (refuted the original chokepoint coverage claim; QA/doc/reviewer paths were unwired) -> correction round (wired them all + restored a dropped assertion, deleted a dead helper and the dead subscription_billed field) -> review. * fix(db): post_update on AgentTable.current_task breaks the flush cycle agents.current_task_id and tasks.assigned_to reference each other, so a flush touching both rows — every claim now marks its agent ACTIVE — is an instance-level circular dependency SQLAlchemy cannot topologically sort. The e2e smoke's full verb paths (12 tests) hit it; the unit and integration suites never flush both dirty rows with relationships loaded. post_update emits the FK as a second UPDATE, the canonical fix for mutually-referencing rows. * fix(budgets): enforce only explicitly-set budgets — no per-TaskType defaults The per-TaskType default cap table blocked an unbudgeted coordination root one opus planning turn in ($1.50 PLANNING default vs. real coordination spend) — a false positive by design the moment the fleet runs a priced model. Budgets are now explicit-input only: effective_task_budget_usd returns None for an unset budget_usd, the budget sweep skips enforcement (and never prices spend) on None, and the unblock re-check passes on None so clearing the budget field is itself a valid resolution. The project monthly cap stays as the explicit-input fleet-wide backstop. Panel copy tells the truth ("No cap" placeholder; empty = uncapped), and the TaskType default table plus its resolver are deleted. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-23 21:09:50 +02:00
3 people	7c8453e210	feat(budgets): per-task and per-project cost budgets (flag-gated) (#654) ... * fix(notifications): exponential backoff + CAS claim for expired-unacked re-escalation The sweep re-escalated every expired unacked ack-required notification on every ~60s tick, forever — the live incident: 3 fresh blocker escalations + Telegram DMs per minute from a static stale pile. Now each notification carries reescalation_count / last_reescalated_at / reescalation_delivered_count (migration 079): first fire at expiry, then doubling intervals from 1h capped at 24h, hard stop after ROBOCO_NOTIFICATION_MAX_REESCALATIONS (default 5) with one permanent log carrying attempts-vs-delivered so 'seen and ignored' is distinguishable from 'route never worked'. The due/wait/capped decision is a pure function in foundation/policy/communications.py. Per adversarial review, the attempt slot is claimed by compare-and-set (UPDATE ... WHERE reescalation_count = :n) BEFORE delivery — the previous draft leaned on the 60s dedup window, which never engages for BLOCKER_ESCALATION (_LOOP_PRONE_TYPES excludes it), so concurrent sweeps would have double-delivered. A lost claim skips delivery outright. Legacy rows read as count=0 and keep today's first-fire semantics. 61 tests incl. a two-session CAS race and a real alembic upgrade/downgrade round trip. * feat(budgets): per-task and per-project cost budgets (flag-gated) tasks.budget_usd + projects.monthly_budget_usd (migration 080, chained on 079; adds ix_agent_spawn_sessions_task_id since both enforcement seams filter on bare task_id). Behind ROBOCO_TASK_BUDGETS_ENABLED (default off, feature-flags card) — verifiably inert when off. Claim-time: a project-month-spend guard applies to WORK-STARTING claims only (i_will_work_on / i_will_plan) — per adversarial review, review/ doc/gate/inbound-PR claims are exempt so in-flight work can always finish reviewing and merging at cap. Spend counts closed sessions' estimated_cost_usd PLUS open sessions priced live from token snapshots (the original closed-only sum read parallel long sessions as $0). Sweep-side: the existing budget sweep also prices the active task's spend vs budget_usd (TaskType defaults when null); on breach the task is BLOCKED (HUMAN resolver, budget marker) BEFORE the graceful stop so the unclaim no-ops and the dispatcher never respawns onto it, and the CEO notification names both recovery steps. unblock on a budget-blocked task re-checks live spend and refuses while still over — no silent re-breach loop. Panel: budget inputs in both dialogs (0 rejected — a zero budget silently blocks everything), spend logic consolidated in TaskService.task_spend_usd. 42 new tests incl. a real-DB spend-query suite and a two-tick non-refire sweep test. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-23 00:06:14 +02:00