mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
Renn F
4829f93a68
Resolves the 100% claim-failure rate introduced by the gateway rewrite
(commit 62bda0c plus 78 follow-ups). Live smoke runs hit
`404 /api/v2/flow/developer/...` on every dev verb plus a manifest
fallback that silently exposed off-role verbs to PMs — confirmed
firing simultaneously in NAS agent logs (be-dev-1, be-pm, main-pm).
Audit reports under docs/internal/audit_2026_05_04/ catalogue 49
defects across gateway, services, prompts, MCP transport, substrate,
and tests (8 detail reports + master synthesis). Six smoking guns;
three proven in production logs.
Phase 0 — unblock claim:
- URL prefix /api/v2/flow/dev → /developer; slug-map board roles
(product_owner, head_marketing) → /board (D-01)
- _i_will_work_on AttributeError on None across pending /
needs_revision / claimed re-entry branches (D-02)
- Seed last_heartbeat_at in _qa_or_doc_claim (D-03)
- Drop misleading i_have_committed verb; dev flow uses commit() (D-04)
- Manifest mount via compose; flow_server + do_server fail loud
instead of exposing all-verbs fallback (D-12)
- MCP _post() surfaces envelope body on 4xx so agents see remediate
hints (D-13)
on git failure so retries aren't blocked by half-state (S-01)
Phase 1 — lifecycle stability:
- _resolve_skill falls back to AgentTable.capabilities (D-06)
- main_pm_complete uses kwargs for escalate_to_ceo (D-07)
- i_am_done auto-runs submit_verification when in_progress (D-08)
- active_claimant_id wired in claim/unclaim paths — single-claimant
invariant now functional (D-05)
- qa_pass/qa_fail assert claimed_by parity with qa_agent_id (D-18)
- Prompt-drift sweep: fail() shape, i_am_done(task_id, notes),
subtask cap (12 hard / 8 soft), error-code symbology rewritten in
base.md + per-role anti-patterns (D-10/11/29/30/31, D-37)
Phase 2 — invariants + architecture:
- Real-DB integration test exercising claim → in_progress → commit
→ submit_for_qa → i_am_done → awaiting_qa (P2-1)
- choreographer.py → package; 3 of 6 role mixins extracted
(board, doc, qa). _impl.py 2,526 → 2,080 lines (-18%). Continuation
plan in docs/internal/audit_2026_05_04/p2_2_decompose_plan.md (P2-2)
- Closure guards consolidated via _subtasks_not_terminal_envelope (P2-3)
- TaskService.unclaim_for_reaper routed through canonical
_validate_and_set_status; in_progress → pending added to
VALID_TRANSITIONS (P2-4)
- Dead code removed: i_am_done_with_catchup verb, _run_catch_up helper
(P2-5)
- 6 state-machine invariants asserted via property test (P2-6)
- attempt_id (uuid4) stamped on every gateway.rejected audit row (P2-7)
- _reconcile_orphan_claims_on_startup rolls back tasks left CLAIMED
with branch_name=NULL from prior crashes (P2-8)
- scripts/regenerate_verb_tables.py introspects Pydantic schemas +
role_config; compose_prompt injects per-role tables as a layer.
Eliminates the prompt-drift class structurally (P2-9)
Other:
- D-48: orchestrator mounts host's ~/.claude.json when present so
agents don't boot from backup recovery on every spawn
- D-49: dev dispatcher rejects role-mismatched spawns (e.g. doc task
assigned to dev agent)
Tests: 553 pass · ruff + mypy clean. Live NAS smoke verification
pending — needs the stack brought back up.
85 lines
2.6 KiB
Python
85 lines
2.6 KiB
Python
"""v2 flow routes reject requests with the wrong X-Agent-Role.
|
|
|
|
Defense-in-depth check: every v2 flow router declares router-level
|
|
dependencies that 403 if `X-Agent-Role` doesn't match the router's role.
|
|
We verify that gate by mounting only the dev router on a minimal app
|
|
with the choreographer mocked — no DB / lifespan needed because the
|
|
role check fires BEFORE any body validation or choreographer call.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from unittest.mock import AsyncMock, MagicMock
|
|
|
|
from fastapi import FastAPI
|
|
from fastapi.testclient import TestClient
|
|
from roboco.api.deps import get_choreographer
|
|
from roboco.api.routes.v2.flow_dev import router as flow_dev_router
|
|
|
|
_HTTP_200 = 200
|
|
_HTTP_403 = 403
|
|
|
|
|
|
def _build_app() -> FastAPI:
|
|
app = FastAPI()
|
|
app.include_router(flow_dev_router)
|
|
mock_chore = MagicMock()
|
|
mock_envelope = MagicMock()
|
|
mock_envelope.as_dict.return_value = {"status": "idle", "next": "..."}
|
|
mock_chore.give_me_work = AsyncMock(return_value=mock_envelope)
|
|
app.dependency_overrides[get_choreographer] = lambda: mock_chore
|
|
return app
|
|
|
|
|
|
def test_dev_route_rejects_qa_role() -> None:
|
|
client = TestClient(_build_app())
|
|
r = client.post(
|
|
"/api/v2/flow/developer/give_me_work",
|
|
json={},
|
|
headers={
|
|
"X-Agent-ID": "00000000-0000-0000-0000-000000000001",
|
|
"X-Agent-Role": "qa",
|
|
},
|
|
)
|
|
assert r.status_code == _HTTP_403
|
|
assert "role" in r.json()["detail"].lower()
|
|
|
|
|
|
def test_dev_route_accepts_developer_role() -> None:
|
|
client = TestClient(_build_app())
|
|
r = client.post(
|
|
"/api/v2/flow/developer/give_me_work",
|
|
json={},
|
|
headers={
|
|
"X-Agent-ID": "00000000-0000-0000-0000-000000000001",
|
|
"X-Agent-Role": "developer",
|
|
},
|
|
)
|
|
# Role gate passes through; mocked choreographer returns 200.
|
|
assert r.status_code != _HTTP_403
|
|
|
|
|
|
def test_dev_route_accepts_developer_role_case_insensitive() -> None:
|
|
client = TestClient(_build_app())
|
|
r = client.post(
|
|
"/api/v2/flow/developer/give_me_work",
|
|
json={},
|
|
headers={
|
|
"X-Agent-ID": "00000000-0000-0000-0000-000000000001",
|
|
"X-Agent-Role": "DEVELOPER",
|
|
},
|
|
)
|
|
assert r.status_code != _HTTP_403
|
|
|
|
|
|
def test_dev_route_rejects_missing_role_header() -> None:
|
|
client = TestClient(_build_app())
|
|
r = client.post(
|
|
"/api/v2/flow/developer/give_me_work",
|
|
json={},
|
|
headers={"X-Agent-ID": "00000000-0000-0000-0000-000000000001"},
|
|
)
|
|
# Missing X-Agent-Role => FastAPI 422 from header validation.
|
|
# We just need it not to silently pass as 200.
|
|
assert r.status_code != _HTTP_200
|