Extend the UAT testing agents to capture successful test workflows and
automatically generate showcase documentation demonstrating real-world
usage of CleverAgents.
Key features added:
- Documentation generation when tests succeed end-to-end
- Intelligent duplicate detection to avoid redundant examples
- Categorization into cli-tools, api-clients, data-processing, testing-tools
- Automatic PR creation for new documentation examples
- Integration with existing UAT workflow without disruption
Documentation structure:
- New docs/showcase/ directory for real-world examples
- Category-specific subdirectories with README guides
- Example template for consistent formatting
- JSON index for tracking and duplicate detection
The UAT tester now serves dual purposes:
1. Finding bugs through comprehensive testing (existing behavior)
2. Generating high-quality documentation from successful test runs (new)
This enables the system to build its own showcase of capabilities while
performing regular quality assurance, providing valuable examples for
users and demonstrating the system's practical applications.
Implement unique naming tags for all supervisors and workers to enable
proper monitoring and management by the product-builder agent. The previous
generic [CA-AUTO] prefix made it impossible to distinguish between different
supervisor types and count their workers accurately.
Changes:
- Pool supervisors now use specific tags (AUTO-IMP-SUP, AUTO-REV-SUP, etc.)
- Workers use corresponding tags (AUTO-IMP, AUTO-REV, etc.)
- Singleton supervisors use unique tags (AUTO-ARCH, AUTO-EPIC, etc.)
- Product-builder can now count supervisors/workers by tag pattern
- Added metadata mapping for reliable supervisor re-launching
- Updated system-watchdog to recognize new tag patterns
This enables the product-builder to detect zombie supervisors, verify
worker counts, and re-launch failed supervisors reliably.
- Implemented missing all_checks_passing() function to query Forgejo API
- Added CI status verification via commit status endpoint
- Added safety warnings against using force_merge flag
- Fixed documentation to reflect correct merge responsibilities
- Added error handling to default to 'checks not passing' on API failures
This ensures PRs cannot be merged when CI checks are failing, respecting
branch protection rules and quality gates defined in CONTRIBUTING.md.
Adds comprehensive bug prevention safeguards to the issue-implementor agent
definition to prevent critical failure where PR priority gate logic was not
correctly implemented, resulting in 37 PRs being incorrectly skipped.
Changes made:
- Added explicit warnings never to use `limit` parameter when fetching PRs
- Added comprehensive logging during PR analysis with progress indicators
- Added mandatory verification that total analyzed PRs equals total fetched
- Added PR-first rule enforcement logging showing when issue work blocked/allowed
- Added error detection for violations of absolute PR priority rule
- Added historical bug documentation section with prevention measures
This ensures future instances will:
- Always fetch ALL open PRs (never use sampling/limits)
- Log verification counts during analysis
- Explicitly enforce the absolute PR-first priority rule
- Detect and report any violations of the priority rule
The bug caused the supervisor to incorrectly conclude "no PRs need work"
when 37 out of 50 open PRs actually required automated attention, violating
the fundamental PR-FIRST rule that blocks all issue work until every PR
has an active worker.
ISSUES CLOSED: #3377
- Fix session adoption logic with correct title patterns for both
worker-issue-impl and worker-pr-fix sessions
- Add PR worker adoption to coordinate orphaned PR fix workers
- Enhance worker verification with comprehensive status checking,
retry logic, and proper error handling
- Add defensive programming with worker count enforcement and
state validation to prevent coordination drift
- Improve JSON parsing with safe error handling throughout
- Add periodic maintenance cycle (every 5 iterations) for
worker state validation and limit enforcement
These fixes resolve the core issue where the implementation pool
supervisor was not properly coordinating 40+ existing workers,
causing worker count to exceed the designed limit of 32.
Fixed three critical issues in the CleverAgents autonomous system:
1. Worker Management: Enhanced issue-implementor health signaling to report
detailed worker listings with session IDs and status. Added worker
verification after dispatch to ensure workers actually start. Improved
idle detection with aggressive work discovery when capacity is available.
2. PR Priority: Fixed PR work detection to include orphaned PRs from
completed issues. Added absolute PR priority enforcement that blocks
all issue work when any PR needs attention. Fixed worker dispatch
prompts to clearly indicate operation mode (pr-fix vs issue-impl).
3. Bot Approval Requirements: Implemented single approval merging for bot
PRs. Bot PRs (containing 'Automated by CleverAgents Bot') now merge
with 1 approval while human PRs still require 2 per CONTRIBUTING.md.
Updated branch protection to required_approvals: 1 with logic in agents
to enforce the distinction. Added detection for approved-but-stuck PRs.
These changes ensure the system operates at maximum efficiency with proper
parallelism while maintaining quality gates through CI and code review.
Add label requirements to all 16 supervisor launch prompts in
product-builder.md so that any tracking issues created by supervisors
include the required Type/Automation, State/In Progress, and
Priority/Medium labels from creation.
This eliminates the persistent label compliance gap reported by the
system watchdog, where supervisor-created tracking issues consistently
missed required State/ and Priority/ labels.
ISSUES CLOSED: #3070
The issue-implementor supervisor was defining but not using its worker dispatch
logic, causing it to run only 1 worker at a time instead of the configured N
parallel workers. This fix implements proper pool supervision:
- Implement sliding window dispatch pattern to maintain N active workers
- Use curl with prompt_async for asynchronous worker launches
- Track PR workers and issue workers separately with proper monitoring
- Add explicit worker count reporting in health signals (X/Y format)
- Integrate PR priority gate - no new issues until all PRs have workers
- Fix session monitoring and cleanup for completed/failed workers
- Update product-builder heartbeat to show worker pool status
The supervisor now continuously fills empty worker slots for maximum throughput,
properly managing up to CA_MAX_PARALLEL_WORKERS parallel workers as designed.
ISSUES CLOSED: #1
BREAKING CHANGE: This completely changes how PRs are handled in the system.
Implementors now own their work from creation through merge, and reviewers
focus solely on code quality assessment.
Major changes:
- issue-implementor: Adds absolute PR prioritization - no new issues until
all PRs have workers. Dispatches workers in two modes: 'pr-fix' for
existing PRs and 'issue-impl' for new issues.
- ca-issue-worker: Now operates in dual mode. In 'pr-fix' mode, handles
review feedback, CI fixes, and merging. In 'issue-impl' mode, no longer
exits after PR creation - monitors the PR until merged.
- ca-continuous-pr-reviewer: Simplified to ONLY dispatch code reviewers.
Removed all fix, merge, and lifecycle management. Uses dynamic review
focus areas to catch different types of issues.
- ca-pr-self-reviewer: Removed ALL capabilities beyond code review. No
longer fixes issues, merges PRs, or manages issue states. Provides
actionable feedback using rotating focus areas.
- ca-pr-checker: Clarified that it should only be invoked by ca-issue-worker,
not by reviewers.
Benefits:
- No PR backlogs (absolute priority over new issues)
- Full accountability (creator owns through merge)
- Better reviews (focused on quality, not mechanics)
- Context preservation (no handoffs between agents)
- Cleaner history (amendments instead of fix commits)
This ensures implementors are accountable for their work while reviewers
provide high-quality, focused code reviews without operational overhead.
- Health Signal Frequency: Fixed spam from ca-test-infra-improver, ca-bug-hunter,
and ca-uat-tester by changing health signals from every 2-10 cycles to every
60 cycles (~10 min intervals)
- Story Point Assignment: Added automatic story point estimation to ca-project-owner
and ca-human-liaison during issue verification based on subtask count and
complexity (XS:1, S:2, M:3, L:5, XL:8, XXL:13)
- Deep Supervisor Inspection: Enhanced product-builder to check pool supervisors
every 5 heartbeats for actual worker activity, detecting zombie supervisors that
are running but not dispatching workers
- Watchdog Integration: Added watchdog alert monitoring to product-builder that
checks for critical alerts every 3 heartbeats and takes action based on severity
- Alert Format Standardization: Updated ca-system-watchdog to use structured
key-value alert format for easier parsing by product-builder
Fixes issues with excessive Forgejo API usage, missing story point assignments
during triage, and improves overall system reliability through better monitoring.
This commit addresses two critical issues in the CleverAgents autonomous system:
1. Pull Request Bottleneck:
- Added PR prioritization gate to issue-implementor that checks for open PRs before taking new issues
- Implementation pool now pauses new issue work when PRs need attention (failing CI, awaiting review, stale)
- Re-checks PR status every 5 cycles to ensure PRs don't accumulate
- Posts clear status updates explaining why new work is paused
2. Status Issue Proliferation:
- Product-builder now creates ONE canonical session state issue: '[Automated] CleverAgents Build Session - <date>'
- All 16 supervisors receive the session state issue number and post ALL status updates there
- Removed separate tracking issue creation from ca-uat-tester and other agents
- Standardized health signal format across all agents for consistent monitoring
The standardized health signal format enables system-watchdog to:
- Detect zombie supervisors from a single issue
- Monitor active workers per pool
- Track work progress across all agents
- Identify stuck or inactive agents
Modified agents:
- issue-implementor: Added PR prioritization gate
- product-builder: Single session state issue management
- All pool supervisors: Updated to use session state issue
- All agents: Standardized health signal format
These changes ensure PRs get merged quickly and reduce issue tracker noise.
Agent evolver identified a systematic pattern:
- Pattern: Dead-end conflict handling in PR reviewer
- Evidence: When the reviewer detects merge conflicts, it posts a comment
saying 'implementor needs to rebase' and marks the PR as done. But the
issue worker has already exited after PR creation — nobody acts on the
rebase request. This created a dead end where 11+ approved PRs were
abandoned due to conflicts (PRs #1219, #1236, #1247, #1248, #1220,
#1237, #1238, #1246, #1252, #1269).
- Fix: When the reviewer reports a conflict, the pool supervisor (which
has full bash permissions and maintains a clone) now attempts to rebase
the PR branch onto latest master itself. If the rebase succeeds, the
PR is re-queued for merge. If it fails, the PR is abandoned with a
clear comment explaining manual intervention is needed.
This change requires human approval before taking effect.
Tiered worker allocation: implementors get full N workers, PR reviewers
N//2, and discovery agents (UAT, bug hunter, test-infra) N//4 to prevent
issue creation from outpacing implementation throughput.
Dead PR cleanup: PR reviewer now auto-closes stale, superseded,
unmergeable, and orphaned PRs every 5 cycles.
Post-merge issue closure: PR reviewer and self-reviewer now verify that
linked issues actually close after merge, removing satisfied dependency
links that block closure. Backlog groomer scans last 24h of merged PRs
and repairs open PR dependency health (reversed links, stale deps).
Closed-item guards: agents no longer wastefully modify closed issues/PRs.
Human liaison still responds to new human comments on closed items but
efficiently without re-triage. Backlog groomer prioritizes open items
first. System watchdog detects and flags closed-item interaction waste.
Scope control: non-critical findings from UAT testers and bug hunters now
route to backlog (no milestone + Priority/Backlog) instead of inflating
active milestones. Epic planner and issue creator skip converging
milestones. Project owner monitors and alerts on scope creep.
Approved proposal: #2879
Pattern: prompt_improvement
Evidence: PRs #1566, #1567, #1569, #1481 referenced non-existent
Session fields (automation_profile, list_messages, etc.), causing
5 Pyright type errors and runtime crashes on session CLI commands.
Fix: Add domain model verification step to all three implementer
agents (sonnet, codex, opus) requiring them to read actual class
definitions before referencing fields/methods.
ISSUES CLOSED: #2879
Approved proposal: #2878
Pattern: workflow_fix
Evidence: Product-builder merged 31+ PRs without CI verification,
breaking 4/6 quality gates on master during v3.7.0 session.
Fix: Add 'Merge PRs yourself' to the MUST NEVER list and add
explicit guidance against direct merging even when supervisors
are unavailable.
ISSUES CLOSED: #2878
Approved proposal: #2443
Pattern: workflow_fix
Evidence: PR #1513 contained only a single comment line as its entire
diff, yet passed all quality gates (lint, typecheck, tests, coverage)
and was submitted for review, consuming 8 independent reviewer slots.
All quality gates verify code quality, not code existence — a change
that adds only comments passes every gate.
Fix: Add Step 1.5 (Meaningful Change Verification) between the
implementer invocation and test-writing step. This checks git diff
output for functional code changes and rejects attempts that produce
empty, comment-only, or trivially small diffs (< 3 functional lines),
immediately escalating to the next tier without wasting quality gate
and reviewer capacity.
ISSUES CLOSED: #2443
All 8 nox-running CI jobs in .forgejo/workflows/ci.yml now capture
stdout+stderr to build/nox-<job>-output.log via `2>&1 | tee` and upload
the log as a named Forgejo artifact (if: always(), retention-days: 30).
Artifact names follow the pattern ci-logs-<job>:
ci-logs-lint, ci-logs-typecheck, ci-logs-security, ci-logs-quality,
ci-logs-unit-tests, ci-logs-integration-tests, ci-logs-e2e-tests,
ci-logs-coverage
Seven agent definitions updated with a CI Log Artifacts section:
ca-pr-checker.md: artifact table + curl download instructions; Step 2
now downloads the relevant artifact before dispatching fix subagents.
ca-lint-fixer.md, ca-typecheck-fixer.md, ca-unit-test-runner.md,
ca-integration-test-runner.md, ca-coverage-checker.md,
ca-pr-self-reviewer.md: each receives a section explaining which
artifact corresponds to its domain and how to use it.
Design notes:
- tee (not redirect) preserves output in CI job logs AND captures to file
- if: always() ensures artifacts are available even when the job fails
- Multi-session jobs (lint, security) use tee -a to append to one file
- Existing coverage-reports artifact preserved alongside ci-logs-coverage
ISSUES CLOSED: #2750
The Forgejo blocks/dependencies REST API requires the IssueMeta schema
with owner, repo, and index fields — not the undocumented dependency_id
field that was previously used. All 10 curl examples across 6 agent
definitions were using {"dependency_id": N} which returns a 404
IsErrRepoNotExist error. Updated to the correct format:
{"owner": "<owner>", "repo": "<repo>", "index": N}
Files updated:
- ca-new-issue-creator.md (2 occurrences)
- ca-pr-api-creator.md (1 occurrence)
- ca-state-reconciler.md (1 occurrence)
- ca-project-owner.md (1 occurrence)
- ca-backlog-groomer.md (2 occurrences)
- ca-epic-planner.md (3 occurrences)
ISSUES CLOSED: #2750
Enhance the system watchdog with OpenCode Server API session introspection
to read actual supervisor conversations, tool calls, and todo lists.
Upgrade Audit 6 (Zombie Detection) to use message-based analysis instead
of only checking Forgejo activity — reads last 5 messages from each
supervisor session to detect sleep-only patterns, error loops, and
identical repeated tool calls.
Add Audit 11 (Quick Session Spot-Check) running every 5-minute cycle:
scans the 3 most recently active sessions for critical policy violations
including force_merge usage, direct pushes to master, and type:ignore
suppressions in written code.
Add Audit 12 (Deep Session Introspection) running every 30 minutes:
full analysis of all 16 supervisor sessions reading last 10 messages
and todo lists. Detects misbehavior patterns, progress stalls via todo
list analysis, conversation health metrics (error rates, sleep ratios),
context exhaustion signals, and cross-agent conflicts (multiple agents
touching the same PR or issue).
Update action dispatch to handle new finding types: force_merge_detected,
direct_push_to_master, stuck_supervisor, looping_supervisor, high_error_rate,
context_exhaustion, and cross_agent_pr_conflict.
Add ca-system-watchdog (16th supervisor) for continuous system health
monitoring with quality gate auditing, zombie detection, ticket state
reconciliation, and priority enforcement. Add ca-quality-enforcer and
ca-state-reconciler as one-off fix agents dispatched by the watchdog.
Critical fix: remove all force_merge: true usage from ca-pr-self-reviewer
which was bypassing branch protection and allowing PRs to merge with
failing CI. Replace with strict CI-gating merge logic that respects
branch protection rules per CONTRIBUTING.md.
Update product-builder to launch 16 supervisors, strengthen anti-return
language with explicit context hygiene, add tracking ticket lifecycle
management (one open at a time, closed on completion).
Update ca-project-bootstrapper with strict branch protection config
requiring status-check CI context, 2 approvals, and dismiss stale reviews.
Fix label set to match CONTRIBUTING.md exactly.
Update issue-implementor with priority gate enforcing lowest-milestone-first
and critical-bugs-first ordering. Update ca-backlog-groomer with closed
issue state reconciliation, PAT for REST API dependency operations, and
health signaling. Update ca-spec-updater with proactive full-scan mode.
Add health signaling and context self-management to 7 continuous
supervisors to prevent zombie sessions from context exhaustion.
Strengthen state label transitions in ca-pr-self-reviewer, ca-pr-api-creator,
ca-issue-state-updater, and ca-backlog-groomer to ensure closed issues
always have correct terminal state labels.
Add Forgejo PAT and REST API curl templates for dependency link creation
to ca-backlog-groomer and ca-project-owner since the MCP does not support
dependency manipulation.
Added critical warning block and step-by-step checklist to product-builder.md
to ensure the agent always follows the correct workflow:
1. Launch 15 supervisors via curl to http://localhost:4096/session/:id/prompt_async
2. Monitor them with bash sleep loop (60 seconds between checks)
3. Re-launch any that exit
Key changes:
- ⚠️ Critical execution model warning at top (what to do / what NOT to do)
- 📊 Execution flow diagram showing all phases
- ✅ Step-by-step Phase C checklist (C.1: Pre-flight, C.2: Launch, C.3: Monitor)
- 🔒 Clearer permission blocks with explicit bans on implementation agents
- 📝 Comments explaining why supervisors use curl not Task tool
This prevents the product-builder from trying to implement issues directly,
which is the supervisors' job. Product-builder is a process supervisor (like
systemd), not a worker.
Agent evolver identified a critical systematic pattern:
- Pattern: The backlog groomer was closing PRs as 'duplicates' of their
linked tracking issues. A PR containing 'Closes #N' was being treated
as a duplicate of issue #N, when it is actually the implementation
delivery vehicle for that issue.
- Evidence: At least 12 PRs were incorrectly closed (#1219, #1236, #1247,
#1269, #1267, #953, #1198, #1220, #1237, #1238, #1246, #1248) — all
with the same 'Duplicate Detected' comment pattern from groomer-1.
- Fix: Added explicit instructions to skip PRs during duplicate detection,
added a guard in the analysis loop pseudocode, and added a rule in the
Important Rules section.
This change requires human approval before taking effect.
ISSUES CLOSED: #2180
Agent evolver identified a systematic pattern:
- Pattern: PR stale/conflict cascade
- Evidence: 11+ PRs were approved but closed without merge due to
conflicts. PRs #1248, #1247, #1237, #1236, #1220, #1219, #1238,
#1246, #1269 were all bulk-closed as stale. Reviewer notes on
#1248, #1220, #1219, #1252 explicitly mention 'merge blocked by
conflicts'. With 16 parallel workers, master moves fast and branches
created minutes earlier are already behind by the time PRs are created.
- Fix: Add a rebase-onto-latest-master step (Phase 3, Step 3.0) in
ca-issue-worker before committing and creating the PR. This ensures
the branch is current when the PR is opened, dramatically reducing
the chance of merge conflicts when the reviewer processes it.
This change requires human approval before taking effect.
Agent evolver identified a systematic pattern:
- Pattern: UAT tester filing bugs for features already being implemented
- Evidence: 25+ UAT bugs filed for TUI MainScreen features (#1329-#1355)
that already had open implementation PRs (#1219, #1236, #1237, #1238,
#1246, #1247, #1248, etc.). The tester reported 'missing sidebar',
'missing tab bar', 'missing escape navigation' etc. while PRs
implementing these exact features were open and under review.
- Fix: Add step 4 to duplicate avoidance requiring the tester to check
for open PRs before filing 'missing feature' bugs.
This change requires human approval before taking effect.
BREAKING CHANGE: Supervisors can no longer use Task tool to launch workers
Major refactor of the permission model for product-builder and all 15
continuous supervisors to enforce strict separation: supervisors MUST use
curl/prompt_async via bash to launch workers, and CANNOT use the Task tool.
Key Changes:
1. Product-Builder Permissions (product-builder.md):
- Removed ALL Task permissions for supervisors (previously had 17)
- Kept Task permissions ONLY for 7 one-shot agents:
ca-project-bootstrapper, ca-ref-reader, ca-issue-finder,
ca-session-persister, ca-product-verifier, ca-milestone-reviewer,
ca-final-reporter
- Restricted bash to: echo, curl, sleep, jq only
- Removed Phase B (Architecture) and Phase C.1 (Planning)
- Updated to launch 15 supervisors (up from 13)
2. New Continuous Supervisors:
- ca-architect: Converted from one-shot to continuous supervisor
Monitors for spec needs, new milestones, ambiguities
- ca-epic-planner: Converted from one-shot to continuous supervisor
Monitors for milestones without issues, incomplete epics
3. All 15 Supervisors - Standardized Permissions:
- Removed ALL Task permissions for launching workers
- Workers MUST be launched via curl to OpenCode Server prompt_async API
- Added 'jq *' for JSON parsing (replacing python3)
- Restricted bash to specific commands only (deny all, allow specific)
- Git commands restricted to specific operations (clone*, fetch*, etc.)
- Directory operations (cd, mkdir, rm -rf) only where needed
4. Supervisor-Specific Updates:
- issue-implementor: Removed ca-issue-worker task permission
- ca-continuous-pr-reviewer: Added git + directory ops, removed worker tasks
- ca-uat-tester: Added read-only file/git commands, removed self-dispatch
- ca-bug-hunter: Restricted git to read-only, removed self-dispatch
- ca-test-infra-improver: Added read-only commands, removed self-dispatch
- ca-human-liaison: Removed ca-epic-planner/ca-architect task permissions
- ca-agent-evolver: Added git + directory operations
- ca-architecture-guard: Added read-only + git clone operations
- ca-spec-updater: Added git + directory operations
- ca-backlog-groomer: Removed ca-epic-planner task permission
- ca-docs-writer: Added git + directory operations
- ca-timeline-updater: Added git + directory operations
- ca-project-owner: Minimal permissions (curl, jq, sleep only)
Impact:
- Proper separation of concerns: supervisors orchestrate, workers execute
- No possibility of supervisors blocking on Task tool calls
- True fire-and-forget worker launching via prompt_async
- Consistent permission model across all 15 supervisors
- Maximum parallelism with proper isolation
Architecture now enforces: Product-builder → 15 supervisors → N workers
All launched via curl/prompt_async, NO Task tool for supervisors.
Restores the working OpenCode server mode + curl-based async supervisor
launch functionality from commit 9bbec0e6 (2026-04-02) and updates it for
the current 13-supervisor architecture.
Changes applied to 7 agent files (938 insertions, 221 deletions):
1. product-builder.md: Restored from 9bbec0e6 and updated for 13 supervisors
- Full bash permissions for curl/sleep
- Server URL: http://localhost:4096
- Launch via POST /session + POST /session/:id/prompt_async
- Session resume (adopts existing [CA-AUTO] sessions)
- Added ca-test-infra-improver and ca-project-owner to launch sequence
- Updated concurrent worker calculations (~5N + ~8 singletons)
2. issue-implementor.md: Restored curl-based worker dispatch
- 10-second polling loop with bash sleep
- Worker sessions via prompt_async
- Session resume for existing workers
3. ca-continuous-pr-reviewer.md: Restored curl dispatch pattern
4. ca-uat-tester.md: Restored curl pool mode
5. ca-bug-hunter.md: Restored curl pool mode
6. ca-test-infra-improver.md: Added self-dispatch permission
7. ca-session-cleanup.md: Restored utility agent
Architecture: 5 pool supervisors (N workers each) + 8 singleton supervisors
= 13 total supervisors running async via prompt_async.
Replaces the broken prompt_async implementation from commit 074c472e that
removed supervisors from task permissions without working server launch.
To use: Start OpenCode with --port 4096, then launch product-builder.
Refs: commit 9bbec0e6 (working version), commit 074c472e (broken version)
The product-builder was ignoring prompt_async instructions and implementing
tickets directly because its identity was "autonomous product builder that
handles everything." The LLM absorbed this framing and defaulted to doing
the work itself rather than launching supervisors.
Root cause fix — two structural changes applied to product-builder AND all
5 pool supervisors:
1. IDENTITY REFRAME: The product-builder is now explicitly a "Supervisor
Launcher and Monitor" — not a "product builder." The opening section
states: "YOUR ONLY JOB: Launch 13 supervisor sessions via bash curl
and keep them alive." A prominent DO NOT list prohibits implementing
issues, creating PRs, writing code, or doing any work a supervisor
handles. The file was compressed from 975 to 312 lines — prerequisites
are brief, the supervisor launch is the first major section, and the
monitoring loop is the primary content.
2. WORKER AGENTS REMOVED FROM TASK PERMISSIONS: Every pool supervisor had
its worker agent in the task permissions, giving the LLM the choice to
use the Task tool instead of prompt_async. Now removed:
- issue-implementor: removed ca-issue-worker
- ca-continuous-pr-reviewer: removed ca-pr-self-reviewer, ca-pr-checker
- ca-uat-tester: removed ca-uat-tester (self-dispatch)
- ca-bug-hunter: removed ca-bug-hunter (self-dispatch)
- ca-test-infra-improver: removed ca-test-infra-improver (self-dispatch)
Each supervisor now has a prominent framing block at the top: "YOU ARE A
POOL SUPERVISOR. You dispatch workers via bash curl prompt_async. Worker
agents have been REMOVED from your task permissions."
Non-worker task permissions preserved (ca-ref-reader, ca-spec-reader,
ca-new-issue-creator, etc.) for legitimate one-shot subagent calls.
Approved proposal: #1483
Pattern: workflow_fix — UAT supervisor creates 13+ separate issues for
progress reports instead of posting comments on a single tracking issue.
Evidence: 13 separate [UAT-SUPERVISOR] Progress Report issues created in
65 minutes during v3.7.0 session, polluting the issue tracker.
Fix: Create ONE tracking issue at startup, post all progress as comments.
Also reduces report frequency from every 2 cycles to every 10 cycles.
ISSUES CLOSED: #1483
Agent evolver identified a systematic pattern:
- Pattern: Multiple reviewer pool instances claiming the same PR within
seconds of each other, leading to duplicate reviews and wasted resources.
- Evidence: PRs #1219, #1236, #1247, #1198 were all double-claimed by
pr-reviewer-5 and pr-reviewer-4 within 28-64 seconds of each other.
The existing 'check before claiming' protocol has a race window that
is too small when multiple pools dispatch simultaneously.
- Fix: Added a two-phase claim protocol — after posting a claim comment,
wait 5 seconds and re-check for competing claims. Ties are broken by
lexicographic comparison of claim tokens.
This change requires human approval before taking effect.
Adds two new agent types to the autonomous system, bringing the total
from 11 to 13 supervisors launched by the product-builder via prompt_async.
New agents:
1. ca-test-infra-improver (12th supervisor — pool with N workers):
Dual-mode agent following the ca-bug-hunter pattern. In pool mode,
dispatches N parallel workers via prompt_async to analyze 8 aspects
of the testing infrastructure: CI execution time, coverage gaps, test
architecture (BDD quality), flaky tests, CI pipeline optimization,
test data quality, missing test levels (Behave/Robot/ASV per
CONTRIBUTING.md), and dependency security. Workers file actionable
Type/Testing or Type/Task issues. Hard constraint: never disables
or weakens existing checks — only proposes additions and optimizations.
Uses Gemini 2.5 Pro for large context. Follows all established patterns
(clone isolation, bash sleep, prompt_async dispatch, session resume,
bot signature).
2. ca-project-owner (13th supervisor — singleton, no pool):
Acts as autonomous project owner. Continuously triages State/Unverified
issues following CONTRIBUTING.md's 6-step triage process. Assigns
MoSCoW labels (Must Have / Should Have / Could Have) based on the
specification and milestone goals. Makes strategic priority decisions.
Tags specific developers with questions in Forgejo comments (discovers
expertise from git history and Forgejo assignments). Periodically
re-evaluates MoSCoW labels as the project evolves. Follows up on
unanswered questions after 48 hours. Single instance, not a pool —
one project owner is sufficient. Uses Opus for nuanced strategic
judgment. Launched via prompt_async like all other supervisors.
Modified files:
- product-builder.md: Updated from 11 to 13 supervisors in all locations
(architecture table, Phase C.2 launch list with entries #12 and #13,
validation count, checkpoint text, self-coordinate table). Added
test-infra-pool to pool supervisors list and project-owner to singletons.
- ca-human-liaison.md: Clarified MoSCoW responsibility split — the liaison
only adjusts MoSCoW labels when relaying explicit human feedback. The
ca-project-owner handles autonomous MoSCoW assignment.
The product-builder was ignoring the prompt_async instructions and falling
back to the Task tool for launching supervisors. It was also only launching
a few supervisors instead of all 11 because the pseudocode was too abstract.
Root cause: All 11 supervisor agents were listed in the task permissions,
so the LLM had a choice between Task (familiar, simpler) and bash curl
(correct but unfamiliar). It chose Task every time.
Fix — three changes:
1. REMOVED all 11 supervisor agents from task permissions. The product-
builder physically cannot invoke them via the Task tool anymore. Only
one-shot agents remain in task permissions (ca-epic-planner,
ca-session-persister, ca-product-verifier, ca-ref-reader, etc.).
2. REWROTE Phase C.2 as concrete curl command templates instead of
abstract pseudocode. The agent now has the exact curl pattern to
copy-paste for each supervisor, with clear variable placeholders.
Added a mandatory validation step: wc -l the tracking file and
confirm exactly 11 entries before proceeding.
3. ADDED aggressive warnings at three levels:
- Top of file: bold mandatory notice about prompt_async
- Phase C.2: large boxed warning block prohibiting the Task tool
- Coordination rules: explicit statement that supervisors are
removed from task permissions
- Monitoring loop: reminder to use bash curl for re-launches
Agents were failing when trying to run complex bash commands (curl with
pipes to python3, multi-command pipelines, etc.) because their bash
permissions were set to '"*": deny' with only specific simple patterns
allowed (e.g., "curl *": allow). Shell pipelines like:
curl -s http://localhost:4096/session | python3 -c "import json..."
don't match any single allow pattern and get denied.
Changed 17 agent files from restrictive bash permissions to '"*": allow'.
This includes all agents that need to:
- Run curl pipelines with python3 for prompt_async session management
- Create Forgejo dependency links via REST API curl calls
- Execute complex git operations with pipes
- Run bash sleep for polling loops
Only 3 truly read-only analysis agents remain restricted:
ca-difficulty-evaluator, ca-implementation-reviewer, ca-issue-analyzer.
These don't need bash access at all.
Issues and PRs created by agents were missing required labels, milestones,
and Forgejo dependency links per CONTRIBUTING.md. This commit adds explicit
API call instructions and a continuous compliance audit to fix the gaps.
Changes across 6 agent definitions:
- ca-new-issue-creator: Added curl bash permission. Added explicit
post-creation compliance steps: set labels (State/Unverified, Type/*,
Priority/*) via forgejo_add_issue_labels, set milestone via
forgejo_update_issue, create parent Epic dependency link via REST API
(POST /issues/{child}/blocks with parent Epic number — correct direction:
child blocks parent). Added compliance verification step.
- ca-epic-planner: Added curl bash permission. Added post-creation API
call checklists for both Epics (labels, Legendary link) and child issues
(labels, milestone, Epic dependency link, inter-issue dependency links).
Added compliance verification step.
- ca-backlog-groomer: Added curl and sleep bash permissions. Expanded
Pass 4 (Label Quality) to auto-fix missing labels (State, Type, Priority)
and milestones via Forgejo API. Added PR label/milestone compliance
checking. Added new Pass 9 (Dependency Link Compliance) to auto-fix
missing parent Epic links, PR-to-issue links, and wrong dependency
direction. Added new Pass 10 (Issue Body Compliance) to flag missing
Metadata, Subtasks, and Definition of Done sections.
- ca-pr-api-creator: Added curl bash permission. Replaced vague "add
dependency" instruction with explicit REST API curl call for creating
PR-blocks-issue dependency link. Added post-creation compliance
verification step.
- ca-agent-evolver: Added Priority/Backlog label and milestone assignment
to proposal issues.
- ca-spec-updater: Added Priority/Backlog label and milestone assignment
to proposal issues.
Both the spec-updater and agent-evolver previously skipped straight to
creating PRs with 'needs feedback' for proposed changes. The user needs
a two-step human-approval workflow:
Step 1: Agent creates a PROPOSAL ISSUE with 'needs feedback' label
describing what it wants to change and why. No branch, no code changes.
Step 2: Human reviews the issue and approves it (by removing 'needs
feedback', adding 'State/Verified', or commenting with approval).
Step 3: Agent detects approval, normalizes labels, creates branch + PR
(also with 'needs feedback') implementing the approved change.
Step 4: Human reviews the PR and merges it.
Changes across 3 agent definitions:
- ca-agent-evolver: Step 4 split into proposal issue creation (Step 4)
and approved-proposal implementation (Step 5). Added pending_proposals
and pending_prs state tracking. Approval detected via 3 signals:
label removal, State/Verified addition, or human approval comment.
- ca-spec-updater: Removed the minor/major classification and the
"commit directly to master" path. ALL spec changes now go through
proposal issues first (Step 6a creates issue, Step 7 monitors for
approval). Added pending_spec_proposals and rejected_proposals state.
Approval check runs every cycle before checking for new merged PRs.
- ca-human-liaison: Added Step 4 guard — issues with 'needs feedback'
label are NOT auto-verified. The liaison acknowledges them with a
comment but does not change state labels. Only issues WITHOUT 'needs
feedback' proceed to the normal auto-verify flow (now Step 5).
Agent evolver identified a systematic pattern:
- Pattern: Bug hunter filing speculative/false-positive issues
- Evidence: Issue #1408 filed a TLS/SSL bug caused by the agent using
the wrong hostname (git.cleveragents.com vs git.cleverthis.com).
Issue #1412 filed a vague 'review concurrency' audit request without
reading any actual code. These waste groomer and implementor time.
- Fix: Add mandatory validation checklist before filing any issue,
requiring concrete code evidence and prohibiting speculative findings.
This change requires human approval before taking effect.
Four changes in one commit across 27 agent files:
1. POOL SUPERVISOR PROMPT_ASYNC: All 4 pool supervisors (issue-implementor,
ca-continuous-pr-reviewer, ca-uat-tester, ca-bug-hunter) now dispatch
their internal workers via the OpenCode Server's prompt_async endpoint
instead of the Task tool. This eliminates the wait_for_all bottleneck
at the supervisor level — workers run independently, and a 10-second
polling loop detects completions and immediately refills vacant slots.
Added curl/sleep bash permissions where needed. Each supervisor keeps
N workers running at all times with zero idle slots.
2. SESSION RESUME INSTEAD OF CLEANUP: The product-builder and all 4 pool
supervisors now RESUME existing sessions from a previous interrupted
run instead of aborting them. Phase C.0 queries the server for sessions
titled "[CA-AUTO] supervisor:*" and adopts any that are still active
into the monitoring loop. Pool supervisors similarly adopt existing
"[CA-AUTO] worker-*" sessions. This enables "continue where you left
off" — restarting the product-builder reconnects to running supervisors
and workers rather than duplicating them.
3. DEDICATED CLEANUP AGENT: New ca-session-cleanup.md primary agent for
explicit fresh-start cleanup. Run this BEFORE the product-builder when
you want to abort all previous sessions and start completely fresh. It
finds all "[CA-AUTO]" sessions, aborts them, and deletes them. This is
the ONLY way to kill old sessions — the product-builder never does it
automatically.
4. BOT SIGNATURES: All 26 agents that post content to Forgejo now include
a mandatory "Bot Signature" section requiring every comment, issue body,
PR description, and review to end with:
---
**Automated by CleverAgents Bot**
Supervisor: <category> | Agent: <agent-name>
24 agents have hardcoded categories. 2 shared agents (ca-new-issue-creator,
ca-epic-planner) use a parameter-based category from their caller's prompt.
When the product-builder is interrupted mid-run (Ctrl+C, crash, timeout),
supervisor sessions launched via prompt_async survive independently on the
OpenCode server. Restarting the product-builder without cleanup creates
duplicate supervisors — 22 agents competing for the same work, causing
duplicate PR reviews, conflicting git pushes, and wasted resources.
Added Phase C.0 (runs before planning or launching) that:
1. Queries GET /session for all server sessions
2. Filters for sessions with titles starting with "[CA-AUTO] supervisor:"
3. Aborts any that are still active via POST /session/:id/abort
4. Deletes the stale sessions via DELETE /session/:id
5. Cleans up the /tmp/ca-supervisor-sessions.env tracking file
6. Logs the cleanup count to the session state issue
Also changed the supervisor session title convention from
"supervisor: <name>" to "[CA-AUTO] supervisor: <name>" to reliably
distinguish product-builder-managed sessions from user-created ones.
freemo
