mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
* fix(gateway): push the branch before QA handoff so reviewers see the latest commits The commit content tool commits locally without pushing; only open_pr pushed the branch. On the first submission that was fine, but a fix committed while addressing needs_revision never reached origin (open_pr is skipped once the PR exists), so QA — which reviews the remote PR branch — re-reviewed the stale remote and re-failed the task on every cycle, a loop that never converged. i_am_done now pushes the task branch (idempotent; a no-op when nothing is unpushed) as part of the shared submit gate, covering both the normal and resume-from-verifying paths. A push failure blocks the handoff with a clear remediation rather than parking the task in awaiting_qa with commits that exist only in the developer's local workspace. * fix(orchestrator): don't reap a stale claim while the agent's container is alive The stale-claim reaper released any claimed/in_progress task whose last_heartbeat_at exceeded the TTL. The heartbeat only updates on certain gateway calls, so a developer deep in a long edit/test cycle outran the TTL and had its claim reaped mid-work — churning the task and risking a double spawn against the still-running container. The reaper now skips a task whose assignee still holds a live (ACTIVE) agent instance, trusting container liveness — the ground truth — over the heartbeat proxy. The check is defensive on missing fields so a heartbeat-only caller (and the reaper's existing unit tests) behave exactly as before. * fix(gateway): refuse to unblock a task while a dependency is unfinished A PM unblock on a dependency-gated task moved it straight to in_progress, overriding the dependency — letting a dependent proceed without its upstream's work (e.g. a frontend task built before its UX design lands). A dependency block is meant to clear on its own via _unblock_dependents the moment the upstream reaches a terminal state. unblock now refuses while any dependency is still non-terminal, returning a clear remediation that the block resolves automatically. Manual unblock remains available for genuine, non-dependency blockers. * fix(gateway): release a dependency-blocked claim to pending instead of looping A task that reached claimed/in_progress with an unfinished dependency was left in that state when the claim guard rejected, so the orchestrator's respawn loop kept reviving its assignee — which could make no progress — burning work for nothing. The claim guard now releases such a task back to pending. claimed -> blocked is not a legal transition, so pending — held by the dispatch dependency filter — is the lifecycle-correct resting state: the respawn loop ignores pending tasks, and _unblock_dependents re-dispatches it once the upstream reaches a terminal state. release_dependency_blocked_claim shares a _force_unclaim_to_pending core with unclaim_for_reaper so both record a truthful work-session abandon reason. * feat(security): warn at startup in header-trust mode + document the auth posture When ROBOCO_AGENT_AUTH_REQUIRED is not enabled the API accepts the X-Agent-Id / X-Agent-Role headers without a signed token, so any client that can reach it may act as any role (including 'ceo'). The API now logs a clear warning at startup in this mode, and the README gains a Security section documenting the auth posture and how to harden it. Acceptable only on a trusted private network — do not expose the API to untrusted networks. * fix(workspace): scope the refresh fetch to current + default branch ensure_workspace's healthy short-circuit ran an all-refs 'git fetch origin' to keep every origin/<branch> ref current. On a monorepo with many accumulated feature/* branches that exceeds the refresh timeout, the fetch silently fails, and the workspace keeps a stale base — so an agent builds on an out-of-date branch. The refresh now fetches only the workspace's current branch and the repo's default branch (resolved via origin/HEAD), with --no-tags --prune: it transfers near-nothing and can't time out. Readers need their own branch and the default; the integration branch is refreshed at branch-creation time. * fix(git): refresh a dependency-blocked task's branch off the current integration tip A cross-cell dependent (e.g. a frontend task waiting on the UX design) was branched off a base captured before its upstream merged into the integration branch, and the branch was never re-synced — so the agent built on a stale snapshot with none of the upstream's work. Two changes close the gap: - release_dependency_blocked_claim now clears branch_name, so the re-claim (after the dependency clears) re-runs branch creation. - create_branch, when the branch is already on disk with no commits of its own, resets it onto the freshly-pulled base — the dependent now builds on the current integration tip. A branch carrying real commits is left untouched, so no work is discarded; the cell->leaf cascade carries the upstream down to the dev branch automatically. * refactor(gateway): drop the sibling-sequence claim guard Sibling sequence no longer gates a claim. Cross-cell ordering is enforced by task dependencies — a cell task that depends on another is held until its upstream reaches a terminal state, a stronger, status-aware gate than the sequence-number check. That check was dormant in practice anyway: every fan-out child carries sequence 0, on which the guard short-circuited. `sequence` stays a sibling-ordering / dispatch-priority field (list_pending ordering and the panel). Removes sibling_sequence_guard and its _earlier_blocking_sibling helper, the now-unused skip_sequence parameter threaded through the claim verbs, and the sibling fetch that fed it. * feat(gateway): sort a cross-cell dependent after its upstream When the frontend cell task is wired to depend on its UX/UI sibling, set its sequence to the upstream's sequence + 1 so it sorts after the design it waits on — list_pending ordering and the panel now show UX ahead of the implementation it gates, in either delegation order. Adds TaskService.set_sequence (the sibling-ordering field is a service write; it carries no claim-gating semantics — dependencies gate claims). * feat(gateway): make the backend cell depend on UX too UX/UI design defines the screens and API contracts both implementation cells build against, so the backend cell — not just the frontend — waits on the UX/UI cell task in a product fan-out and sorts after it. Wires in either delegation order: a backend task delegated after UX gets the dependency directly; a UX task delegated after a still-pending backend sibling retro-wires it. Mirrors the existing frontend wiring (_depend_backend_on_ux and _depend_pending_backends_on_ux). Backend is held by the same dependency gate, so it costs no extra dispatch churn. * fix(websocket): forward notification acks instead of logging them incomplete The bridge handler serves both notification.sent and notification.acked, but acked events carry `agent_id` (the acking agent) rather than `recipient_id`, so every acknowledgement tripped the missing-field guard and logged "Incomplete notification event" instead of reaching the panel. Accept either field as the recipient. * feat(api): hint the full UUID when a truncated task id fails validation Agents copy the 8-character task prefix the system shows them (the commit prefix, task summaries) and send it as task_id, which fails UUID validation with an opaque "invalid length" 422 and wastes a call. The request-validation handler now detects a task_id UUID error and attaches a `remediate` hint telling the agent to retry with the full 36-character UUID from its task envelope. * fix(audit): record the blocked transition when a task is escalated Escalation sets a task to blocked by writing task.status directly, which bypassed the validated transition helper and so never emitted a task.blocked audit row — the lifecycle moved but the Auditor saw nothing. Extract the audit emit from the central transition helper into _emit_status_transition_audit and call it from the escalate path, capturing the prior status and outgoing owner before reassignment so the row is attributed correctly. * fix(docs): stop doubling the docs path so design specs index into RAG The documenter sometimes hands a doc path already rooted at docs/, and joining it onto DOCS_BASE_PATH (/app/docs) produced /app/docs/docs/..., so the file was never found and the spec never indexed — the frontend cell could not retrieve the UX design over RAG. Normalize the path before joining: trust an absolute path, otherwise strip a single redundant leading docs/ segment. * feat(security): let the control panel authenticate in secure mode With ROBOCO_AGENT_AUTH_REQUIRED=true every request must carry a valid HMAC token, which locked the human control panel out — it sends role headers but no token. nginx, the only trusted hop between the browser and the API, now injects the CEO token on /api and /ws, so the browser never holds the signing secret. The injected value is just the existing per-agent token issued for the CEO identity (issue_panel_token), so the token-verification path is unchanged. An empty value (dev/header-trust mode) renders to no header. `make panel-token` prints the value; set it as ROBOCO_PANEL_AGENT_TOKEN in .env before enabling secure mode. .env.example and the README Security section document the flow. * chore(compose): consolidate the two compose files into one docker-compose.yml and docker-compose.yaml had diverged: .yml — the file Docker actually uses — carried ROBOCO_PUBLIC_BASE_URL but was missing the /app/manifests bind-mount, while .yaml had the manifests mount but not the base URL. Merge the union into docker-compose.yml and delete the duplicate so there is one source of truth and no "multiple config files" warning. This activates the manifests mount in the deployed file: without it the orchestrator writes per-agent tool manifests to its ephemeral container fs, they never reach the host for the daemon to bind-mount, and agents fall back to all-verbs registration. Drop the stale .yaml reference from the config.py docstring, the labeler, and the CI path filters. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>
372 lines
13 KiB
Python
372 lines
13 KiB
Python
"""#14: a descendant executable task is never assigned to a board/advisory role.
|
|
|
|
The main_pm -> product_owner escalation rung used to hand an in_progress child
|
|
code task to the Product Owner and mark it BLOCKED. The board has no verb to
|
|
claim/build/complete cell-executed work, so the dev's finished work deadlocked.
|
|
The guard covers every CELL-executed task type — code, documentation, AND
|
|
design — because a board role has no verb to own any of them. The shared write
|
|
primitive ``TaskService.apply_escalation`` now diverts such an escalation: the
|
|
task is released to PENDING for a role-matched cell claim instead of being
|
|
stranded on a board role.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import asyncio
|
|
from unittest.mock import AsyncMock, MagicMock, patch
|
|
from uuid import uuid4
|
|
|
|
import pytest
|
|
from roboco.models.base import AgentRole, TaskStatus, TaskType, Team
|
|
from roboco.services.task import TaskService, _is_descendant_executable_task
|
|
|
|
|
|
def _bind(svc: TaskService, name: str, value: object) -> None:
|
|
object.__setattr__(svc, name, value)
|
|
|
|
|
|
def _service() -> TaskService:
|
|
session = MagicMock()
|
|
session.flush = AsyncMock()
|
|
return TaskService(session)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# _is_descendant_executable_task (pure)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
def test_descendant_code_task_is_flagged() -> None:
|
|
task = MagicMock(parent_task_id=uuid4(), task_type=TaskType.CODE)
|
|
assert _is_descendant_executable_task(task) is True
|
|
|
|
|
|
def test_descendant_documentation_task_is_flagged() -> None:
|
|
# #14 broaden: documentation is cell-executed (documenter), not board work.
|
|
task = MagicMock(parent_task_id=uuid4(), task_type=TaskType.DOCUMENTATION)
|
|
assert _is_descendant_executable_task(task) is True
|
|
|
|
|
|
def test_descendant_design_task_is_flagged() -> None:
|
|
# #14 broaden: design is cell-executed (UX/design cell), not board work.
|
|
task = MagicMock(parent_task_id=uuid4(), task_type=TaskType.DESIGN)
|
|
assert _is_descendant_executable_task(task) is True
|
|
|
|
|
|
def test_root_code_task_is_not_descendant() -> None:
|
|
# A root task can legitimately escalate up the chain (the CEO reviews it).
|
|
task = MagicMock(parent_task_id=None, task_type=TaskType.CODE)
|
|
assert _is_descendant_executable_task(task) is False
|
|
|
|
|
|
def test_root_documentation_task_is_not_descendant() -> None:
|
|
# Roots are reviewed up the chain regardless of (executable) type.
|
|
task = MagicMock(parent_task_id=None, task_type=TaskType.DOCUMENTATION)
|
|
assert _is_descendant_executable_task(task) is False
|
|
|
|
|
|
def test_descendant_planning_task_is_not_executable() -> None:
|
|
# PLANNING routes to a PM, not a cell agent — not diverted by the guard.
|
|
task = MagicMock(parent_task_id=uuid4(), task_type=TaskType.PLANNING)
|
|
assert _is_descendant_executable_task(task) is False
|
|
|
|
|
|
def test_descendant_research_task_is_not_executable() -> None:
|
|
task = MagicMock(parent_task_id=uuid4(), task_type=TaskType.RESEARCH)
|
|
assert _is_descendant_executable_task(task) is False
|
|
|
|
|
|
def test_descendant_administrative_task_is_not_executable() -> None:
|
|
task = MagicMock(parent_task_id=uuid4(), task_type=TaskType.ADMINISTRATIVE)
|
|
assert _is_descendant_executable_task(task) is False
|
|
|
|
|
|
def test_code_task_type_as_raw_string_is_flagged() -> None:
|
|
# Detached/partially-hydrated rows may surface task_type as a raw string.
|
|
task = MagicMock(parent_task_id=uuid4(), task_type="code")
|
|
assert _is_descendant_executable_task(task) is True
|
|
|
|
|
|
def test_documentation_task_type_as_raw_string_is_flagged() -> None:
|
|
task = MagicMock(parent_task_id=uuid4(), task_type="documentation")
|
|
assert _is_descendant_executable_task(task) is True
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# apply_escalation board-role divert
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_apply_escalation_diverts_descendant_code_to_board() -> None:
|
|
svc = _service()
|
|
target_id = uuid4()
|
|
task = MagicMock(
|
|
id=uuid4(),
|
|
parent_task_id=uuid4(),
|
|
task_type=TaskType.CODE,
|
|
assigned_to=uuid4(),
|
|
blocker_raised_by=None,
|
|
status=TaskStatus.IN_PROGRESS,
|
|
)
|
|
_bind(svc, "_is_board_advisory_agent", AsyncMock(return_value=True))
|
|
release_mock = AsyncMock()
|
|
_bind(svc, "_release_code_task_to_pool", release_mock)
|
|
|
|
await svc.apply_escalation(
|
|
task=task,
|
|
target_agent_id=target_id,
|
|
escalator_slug="main-pm",
|
|
target_slug="product-owner",
|
|
reason="please review",
|
|
)
|
|
|
|
# Diverted to the pool release — NOT blocked, NOT reassigned to the board.
|
|
release_mock.assert_awaited_once()
|
|
assert task.status == TaskStatus.IN_PROGRESS # untouched by the guard branch
|
|
assert task.assigned_to != target_id
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_apply_escalation_diverts_descendant_documentation_to_board() -> None:
|
|
# #14 broaden: a descendant DOCUMENTATION task escalated to a board role is
|
|
# diverted too — the board has no verb to write/complete docs either.
|
|
svc = _service()
|
|
target_id = uuid4()
|
|
task = MagicMock(
|
|
id=uuid4(),
|
|
parent_task_id=uuid4(),
|
|
task_type=TaskType.DOCUMENTATION,
|
|
assigned_to=uuid4(),
|
|
blocker_raised_by=None,
|
|
status=TaskStatus.IN_PROGRESS,
|
|
)
|
|
_bind(svc, "_is_board_advisory_agent", AsyncMock(return_value=True))
|
|
release_mock = AsyncMock()
|
|
_bind(svc, "_release_code_task_to_pool", release_mock)
|
|
|
|
await svc.apply_escalation(
|
|
task=task,
|
|
target_agent_id=target_id,
|
|
escalator_slug="main-pm",
|
|
target_slug="head-marketing",
|
|
reason="please review docs",
|
|
)
|
|
|
|
release_mock.assert_awaited_once()
|
|
assert task.status == TaskStatus.IN_PROGRESS # untouched by the guard branch
|
|
assert task.assigned_to != target_id
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_apply_escalation_diverts_descendant_design_to_board() -> None:
|
|
# #14 broaden: a descendant DESIGN task escalated to a board role is diverted.
|
|
svc = _service()
|
|
target_id = uuid4()
|
|
task = MagicMock(
|
|
id=uuid4(),
|
|
parent_task_id=uuid4(),
|
|
task_type=TaskType.DESIGN,
|
|
assigned_to=uuid4(),
|
|
blocker_raised_by=None,
|
|
status=TaskStatus.IN_PROGRESS,
|
|
)
|
|
_bind(svc, "_is_board_advisory_agent", AsyncMock(return_value=True))
|
|
release_mock = AsyncMock()
|
|
_bind(svc, "_release_code_task_to_pool", release_mock)
|
|
|
|
await svc.apply_escalation(
|
|
task=task,
|
|
target_agent_id=target_id,
|
|
escalator_slug="ux-pm",
|
|
target_slug="product-owner",
|
|
reason="please review design",
|
|
)
|
|
|
|
release_mock.assert_awaited_once()
|
|
assert task.status == TaskStatus.IN_PROGRESS
|
|
assert task.assigned_to != target_id
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_apply_escalation_blocks_descendant_planning_to_board() -> None:
|
|
# PLANNING is NOT a cell-executed type — the guard does not divert it even to
|
|
# a board target, so it follows the normal block+reassign path.
|
|
svc = _service()
|
|
target_id = uuid4()
|
|
task = MagicMock(
|
|
id=uuid4(),
|
|
parent_task_id=uuid4(),
|
|
task_type=TaskType.PLANNING,
|
|
assigned_to=uuid4(),
|
|
blocker_raised_by=None,
|
|
dev_notes=None,
|
|
status=TaskStatus.IN_PROGRESS,
|
|
)
|
|
board_check = AsyncMock(return_value=True)
|
|
_bind(svc, "_is_board_advisory_agent", board_check)
|
|
release_mock = AsyncMock()
|
|
_bind(svc, "_release_code_task_to_pool", release_mock)
|
|
|
|
await svc.apply_escalation(
|
|
task=task,
|
|
target_agent_id=target_id,
|
|
escalator_slug="main-pm",
|
|
target_slug="product-owner",
|
|
reason="planning review",
|
|
)
|
|
|
|
release_mock.assert_not_called()
|
|
assert task.status == TaskStatus.BLOCKED
|
|
assert task.assigned_to == target_id
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_apply_escalation_proceeds_for_non_board_target() -> None:
|
|
svc = _service()
|
|
target_id = uuid4()
|
|
task = MagicMock(
|
|
id=uuid4(),
|
|
parent_task_id=uuid4(),
|
|
task_type=TaskType.CODE,
|
|
assigned_to=uuid4(),
|
|
blocker_raised_by=None,
|
|
dev_notes=None,
|
|
status=TaskStatus.IN_PROGRESS,
|
|
)
|
|
_bind(svc, "_is_board_advisory_agent", AsyncMock(return_value=False))
|
|
release_mock = AsyncMock()
|
|
_bind(svc, "_release_code_task_to_pool", release_mock)
|
|
|
|
await svc.apply_escalation(
|
|
task=task,
|
|
target_agent_id=target_id,
|
|
escalator_slug="be-pm",
|
|
target_slug="main-pm",
|
|
reason="cell blocked",
|
|
)
|
|
|
|
# Normal escalation: blocked + reassigned to the (non-board) target.
|
|
release_mock.assert_not_called()
|
|
assert task.status == TaskStatus.BLOCKED
|
|
assert task.assigned_to == target_id
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_apply_escalation_blocks_root_code_task_to_board_target() -> None:
|
|
# A ROOT code task is not a descendant — the guard does not fire even when
|
|
# the target is a board role (the CEO/board reviews roots legitimately).
|
|
svc = _service()
|
|
target_id = uuid4()
|
|
task = MagicMock(
|
|
id=uuid4(),
|
|
parent_task_id=None,
|
|
task_type=TaskType.CODE,
|
|
assigned_to=uuid4(),
|
|
blocker_raised_by=None,
|
|
dev_notes=None,
|
|
status=TaskStatus.IN_PROGRESS,
|
|
)
|
|
board_check = AsyncMock(return_value=True)
|
|
_bind(svc, "_is_board_advisory_agent", board_check)
|
|
release_mock = AsyncMock()
|
|
_bind(svc, "_release_code_task_to_pool", release_mock)
|
|
|
|
await svc.apply_escalation(
|
|
task=task,
|
|
target_agent_id=target_id,
|
|
escalator_slug="main-pm",
|
|
target_slug="product-owner",
|
|
reason="root review",
|
|
)
|
|
|
|
# Guard short-circuits on _is_descendant_executable_task BEFORE the board
|
|
# check, so a root task escalates normally.
|
|
board_check.assert_not_called()
|
|
release_mock.assert_not_called()
|
|
assert task.status == TaskStatus.BLOCKED
|
|
assert task.assigned_to == target_id
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_release_code_task_to_pool_sets_pending_and_clears_assignee() -> None:
|
|
svc = _service()
|
|
task = MagicMock(
|
|
id=uuid4(),
|
|
assigned_to=uuid4(),
|
|
claimed_by=uuid4(),
|
|
active_claimant_id=uuid4(),
|
|
dev_notes="prior",
|
|
status=TaskStatus.IN_PROGRESS,
|
|
)
|
|
await svc._release_code_task_to_pool(
|
|
task=task,
|
|
escalator_slug="main-pm",
|
|
blocked_target_slug="product-owner",
|
|
reason="cannot own code",
|
|
)
|
|
assert task.status == TaskStatus.PENDING
|
|
assert task.assigned_to is None
|
|
assert task.claimed_by is None
|
|
assert task.active_claimant_id is None
|
|
assert "ESCALATION REDIRECTED" in task.dev_notes
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_is_board_advisory_agent_classifies_roles() -> None:
|
|
for role, expected in [
|
|
(AgentRole.PRODUCT_OWNER, True),
|
|
(AgentRole.HEAD_MARKETING, True),
|
|
(AgentRole.AUDITOR, True),
|
|
(AgentRole.MAIN_PM, False),
|
|
(AgentRole.CELL_PM, False),
|
|
(AgentRole.DEVELOPER, False),
|
|
]:
|
|
session = MagicMock()
|
|
result = MagicMock()
|
|
result.scalar_one_or_none = MagicMock(return_value=role)
|
|
session.execute = AsyncMock(return_value=result)
|
|
svc = TaskService(session)
|
|
assert await svc._is_board_advisory_agent(uuid4()) is expected
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_apply_escalation_emits_blocked_audit_event() -> None:
|
|
"""A non-divert escalation sets BLOCKED and MUST record a task.blocked audit
|
|
row. The escalate path sets status directly (bypassing the validated
|
|
transition), and used to skip the audit log entirely."""
|
|
svc = _service()
|
|
task = MagicMock(
|
|
id=uuid4(),
|
|
parent_task_id=uuid4(),
|
|
task_type=TaskType.PLANNING, # not cell-executed → never diverted
|
|
assigned_to=uuid4(),
|
|
claimed_by=uuid4(),
|
|
blocker_raised_by=None,
|
|
dev_notes="",
|
|
team=Team.BACKEND,
|
|
status=TaskStatus.IN_PROGRESS,
|
|
)
|
|
_bind(svc, "_is_board_advisory_agent", AsyncMock(return_value=False))
|
|
audit_mock = MagicMock(log_task_event=AsyncMock())
|
|
|
|
with patch("roboco.services.audit.get_audit_service", return_value=audit_mock):
|
|
await svc.apply_escalation(
|
|
task=task,
|
|
target_agent_id=uuid4(),
|
|
escalator_slug="be-pm",
|
|
target_slug="main-pm",
|
|
reason="needs a decision",
|
|
)
|
|
# Drain the fire-and-forget audit task so the assertion sees the call.
|
|
pending = list(svc._background_tasks)
|
|
if pending:
|
|
await asyncio.gather(*pending, return_exceptions=True)
|
|
|
|
assert task.status == TaskStatus.BLOCKED
|
|
audit_mock.log_task_event.assert_awaited_once()
|
|
kwargs = audit_mock.log_task_event.await_args.kwargs
|
|
assert kwargs["event_type"] == "task.blocked"
|
|
assert kwargs["details"]["from_status"] == "in_progress"
|
|
assert kwargs["details"]["to_status"] == "blocked"
|