- docs/reference/plan_cli.md: add note about legacy/v3 plan workflow
mixing being disallowed (introduced in v3.8.0, issue #1577)
- docs/reference/uko_runtime.md: document v3.8.0 provenance tracking
(sourceResource, validFrom, isCurrent on typed triples) and revision
chain for temporal queries across indexing runs (issue #891)
- docs/reference/decision_correction.md: add CorrectionAttemptRecord
section documenting the correction_attempts table, state lifecycle,
repository API, and usage examples (issue #920)
- docs/modules/uko-provenance.md: new module guide for UKO provenance
tracking covering purpose, how provenance is attached, revision chain
mechanics, query patterns, persistence format, BDD coverage, and gotchas
- docs/api/tui.md: Document ShellDangerLevel, DangerousPattern, DEFAULT_PATTERNS,
DangerousPatternDetector, ShellSafetyService, and SafetyCheckResult with
full API reference, parameter tables, and usage examples
- docs/architecture.md: Add Invariant Reconciliation section covering the
builtin/invariant-reconciliation actor, four-scope algorithm, failure
behaviour, and DI registration
- README.md: Add Invariant Reconciliation, TUI shell danger detection, and
UKO provenance tracking to the Highlights section
ISSUES CLOSED: #3377
- Promote [Unreleased] CHANGELOG entries to [3.8.0] (2026-04-05)
- Add Shell Danger Detection section to docs/api/tui.md covering
ShellDangerLevel, DangerousPattern, ShellSafetyService, and
SafetyCheckResult with full API reference and usage examples
- Add InvariantService section to docs/api/core.md documenting
the new DI-registered singleton, its methods, and emitted events
- Update docs/architecture.md Plan Lifecycle section to document
invariant reconciliation as a phase transition gate
- Update README.md Highlights with shell danger detection, inline
permission questions, invariant reconciliation, UKO provenance
tracking, and JSON-RPC 2.0 A2A wire format
- Create docs/modules/shell-safety.md with full module guide
covering purpose, key classes, built-in patterns, custom pattern
registration, TUI integration, and testing guidance
ISSUES CLOSED: #1003#997#1391#1004#891#1501#1577#1941#2334
Per JSON-RPC 2.0 specification (Section 5.1), error codes must be integers.
This commit fixes the protocol compliance defect where A2aErrorDetail.code
was typed as str and error constants were string literals.
Changes:
- src/cleveragents/a2a/models.py: Change A2aErrorDetail.code from str to int;
update field_validator to only validate 'message' (code no longer needs
non-empty string check; Pydantic enforces int type)
- src/cleveragents/a2a/errors.py: Change all error code constants from string
literals to JSON-RPC 2.0 integer codes per docs/reference/a2a.md taxonomy:
NOT_FOUND = -32001, AUTH_ERROR = -32002, FORBIDDEN = -32003,
INVALID_STATE = -32004, PLAN_ERROR = -32008, CONFIGURATION_ERROR = -32009,
VALIDATION_ERROR = -32602, INTERNAL_ERROR = -32603
Update map_domain_error() return type from tuple[str, str] to tuple[int, str]
- features/steps/a2a_facade_steps.py: Update A2aErrorDetail construction to
map symbolic string names to integer codes via _CODE_MAP
- features/steps/a2a_facade_wiring_steps.py: Update error code assertion to
map symbolic names to integers for comparison
- features/steps/a2a_facade_coverage_boost_steps.py: Same as above
- features/steps/a2a_jsonrpc_wire_format_steps.py: Update all A2aErrorDetail
constructions and JSON-RPC dict payloads to use integer codes
- robot/helper_a2a_facade_wiring.py: Update wired_error_mapping() to compare
against integer codes
- robot/helper_a2a_jsonrpc_wire_format.py: Update response_error_wire_format()
to use integer code -32001 instead of string 'NOT_FOUND'
Wire format now produces {"code": -32001, ...} instead of {"code": "NOT_FOUND", ...},
making it compliant with JSON-RPC 2.0 and interoperable with standards-conformant clients.
ISSUES CLOSED: #2746
Final Day 95 timeline update (v3) with current Forgejo data as of 2026-04-05.
Key Changes:
- Open PRs: 92 → 170 (+78 new PRs from agent-driven activity)
- Open bugs: 536 → 809 (+273 new bugs from UAT/bug-hunt agents)
- Total open issues: 1547
- Session tracker: updated to #3377
- Milestone completions updated (all declined due to agent-driven issue creation outpacing closures)
- Gantt chart footer, update log, and both legend blocks updated
- Current Status Summary, Schedule Risk Summary, and Day 95 adherence entry all updated with final data
- New UAT bugs noted: #3444 (TUI HelpPanelOverlay keybinding mismatch), #3445 (plan rollback Rich output format incomplete)
Supersedes PR #3419 (docs/timeline-day95-v2) which had intermediate data.
Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
- docs/api/providers.md: new comprehensive API reference for
cleveragents.providers — ProviderRegistry, ProviderType,
ProviderCapabilities, ProviderInfo, LangChainChatProvider,
module-level helpers, environment variables, and ASV benchmarks
- docs/api/index.md: add providers module to module index table
- docs/architecture.md: add Provider Registry section with discovery,
selection, and factory usage examples
- CHANGELOG.md: add [Unreleased] entries for:
- agents plan list --namespace/-n option (#2616)
- ASV benchmark suite for providers module (#3022)
- MCP error extraction from content[0].text per MCP 1.4.0 (#2600)
- CI quality gates restored to passing on master (#2629)
Add DomainBaseModel section to docs/api/core.md documenting the shared Pydantic base class from PR #2014 (issue #1941), and add CHANGELOG entry for the CI template DB extension from PR #2399 (issue #2334).
ISSUES CLOSED: #1941
Co-authored-by: Jeffrey Phillips Freeman <jeffrey.freeman@cleverthis.com>
Co-committed-by: Jeffrey Phillips Freeman <jeffrey.freeman@cleverthis.com>
Add reference documentation for three new TUI features:
- docs/reference/tui_shell_safety.md: Full reference for the shell danger
detection subsystem (DangerousPatternDetector, ShellDangerLevel,
DangerousPattern, DangerousCommandWarning, DEFAULT_PATTERNS registry).
Covers all built-in patterns across CRITICAL/HIGH/MEDIUM/LOW levels,
usage examples, and custom pattern extension.
- docs/reference/tui_permission_question.md: Full reference for the inline
PermissionQuestionWidget (issue #997). Documents InlinePermissionQuestion,
PermissionRequestType, PermissionDecision, render_permission_question(),
PermissionDecisionEvent, and PermissionQuestionWidget with key bindings
and usage examples.
- docs/reference/tui.md: Extended with First-Run Experience section
(ActorSelectionOverlay, first_run helpers), Inline Permission Questions
section, shell danger detection note in Shell Mode, updated module table,
and links to new reference pages.
Add PermissionQuestionWidget API documentation to docs/api/tui.md including
method table, key bindings, PermissionDecisionEvent dataclass, and
render_permission_question() helper reference. Add corresponding CHANGELOG
entry under [Unreleased] Added section.
Refs: #997
Align Unicode box-drawing blocks and related tables in specification.md,
ADR-044/045/046, and reference pages for consistent MkDocs rendering.
ISSUES CLOSED: #1171
The TLS handshake failure on git.dev.cleveragents.com was caused by the
hostname being absent from the certificate's Subject Alternative Names
(SANs), or by SNI virtual-host misconfiguration on the server side.
This commit delivers the repository-side remediation:
- scripts/check-tls-cert.py: New TLS certificate health-check script.
Connects to a hostname, verifies the certificate's SANs include the
target hostname, checks expiry, and reports errors/warnings. Accepts
an injectable SSLContext for unit testing without real network access.
Supports wildcard SAN matching and configurable expiry warning threshold.
- docs/development/ops-runbook.md: New ops runbook documenting the full
certificate renewal procedure (Let's Encrypt/certbot and manual CA),
SNI misconfiguration diagnosis steps, expiry monitoring with cron, and
recommended alert thresholds (30/14/7/0 days).
- features/tls_certificate_check.feature: 14 Behave scenarios tagged
@tdd_issue @tdd_issue_1543 covering: missing SAN detection, valid SAN
acceptance, expired certificate detection, expiry warning threshold,
TLS handshake errors, connection timeouts, connection refused, wildcard
SAN matching, and _hostname_matches_san unit tests.
- features/steps/tls_certificate_check_steps.py: Step definitions for
the above feature, using unittest.mock to inject SSL contexts and
socket connections so no real network calls are made.
- mkdocs.yml: Added Ops Runbook to the Development section navigation.
The actual server-side certificate renewal (adding git.dev.cleveragents.com
as a SAN and reloading the web server) must be performed by the server
administrator following the procedure in docs/development/ops-runbook.md.
Closes#1543
ISSUES CLOSED: #1543
- CHANGELOG: add Fixed entries for PRs #1574, #1570, #1569, #1547, #1548,
#1522, #1524, #1525, #1520, #1553 covering rich output panels for session,
actor, and plan commands, plus version commit SHA and provider fix
- docs/reference/session_cli.md: document new rich output panels for
session create (Settings, Actor Details), session list (Name column,
Summary panel), session show (Automation field), session delete
(Deletion Summary, Cleanup panels); update export to document --format md
- docs/reference/actor_cli.md: document new rich output panels for
actor remove (Actor Removed, Impact, Cleanup) and actor list (Summary panel)
- docs/reference/plan_cli.md: document new rich output for plan list
(Elapsed column, Filters panel, Summary panel)
- docs/reference/cli_system_commands.md: document commit SHA resolution
order (CLEVERAGENTS_COMMIT env var → git rev-parse → 'unknown')
ISSUES CLOSED: #1574#1570#1569#1547#1548#1522#1524#1525#1520#1553
Implements issue #1552. Reorders the command synopsis in the specification to logically group validation commands separately from regular commands for better clarity.
Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
- CHANGELOG: add [Unreleased] entries for TUI first-run experience (#1391),
session Markdown export (#1004), and UKO provenance/temporal versioning (#891)
- README: add first-run experience and Markdown transcript export bullets
- docs/api/tui.md: new TUI API reference covering first-run, persona system,
input routing, slash commands, session export/import, and widgets
- docs/api/index.md: add TUI entry to module index
- docs/api/resource.md: document DatabaseResourceHandler and DevcontainerHandler
full protocol implementations with method tables and examples
- docs/architecture.md: expand UKO section with provenance/temporal versioning
details; update TUI design decision summary
- mkdocs.yml: add TUI page to API Reference nav
ISSUES CLOSED: #1391#1004#891
Renames `plan lifecycle-list` to `plan list` and `plan lifecycle-apply` to `plan apply` to align with the specification's canonical command names. Removes legacy V2 plan commands that occupied those names.
- Renamed CLI command registrations from lifecycle-list/lifecycle-apply to list/apply
- Removed legacy V2 apply and list commands (~200 lines)
- Updated apply shortcut in main.py to delegate to v3 lifecycle
- Added defensive null check for plan existence in apply command
- Updated 63+ test, doc, and benchmark files for consistency
Closes#881
Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Mid-day refresh: 47 open PRs (+2), 289 open issues (+15 new UAT/refactor
issues in v3.7.0 backlog). v3.5.0 advanced to 78% (164/209, +2 closed).
v3.7.0 at 60% (36/60, +1 new issue). 50 open bugs stable.
Updated sections: Gantt chart update log, footer, risk register legend,
Current Status Summary, What Remains To Be Done, Day 53 schedule adherence
entry (task inventory with per-developer breakdown).
Add docs/api/ with per-module API documentation for core, a2a, actor,
skills, tool, mcp, resource, and config packages. Add docs/architecture.md
with a developer-oriented system overview including component map, layer
diagram, plan lifecycle, and key design decisions. Update mkdocs.yml nav
to expose both new sections.
ISSUES CLOSED: #N/A
- Updated Day 53 entry with end-of-day data (32 PRs merged today)
- Open PRs: 119 → 86 (down 33)
- Open bugs: 40 → 65 (up 25, UAT testing discovered new issues)
- Milestone progress: M3 74%→79%, M4 74%→75%, M5 78%→87%, M6 69%→74%, M7 61%→71%, M8 50%→54%
- Updated gantt chart completion percentages and risk register
- Updated Current Status Summary with end-of-day figures
- Added Day 53 merge wave bullet to What Has Been Completed
- Updated What Remains To Be Done with current open counts
- Updated Schedule Risk Summary with UAT findings
- CHANGELOG.md: extend [3.7.0] section with 15 new entries covering
PermissionsScreen, ThoughtBlock, UKO runtime services, ACMS Phase 2
protocol aliases, DevcontainerHandler protocol completion,
DatabaseResourceHandler CRUD/checkpoint, estimation lifecycle hook,
user_identity domain events, PLAN_APPLIED/PLAN_CANCELLED enrichment,
server serve subcommand, async audit refactor, and CLI flag fixes
- README.md: extend Highlights with permissions screen, thought blocks,
UKO runtime, database handler, and estimation lifecycle
- docs/reference/uko_runtime.md: new reference for UKOQueryInterface,
UKOInferenceEngine, and UKOGraphPersistence (issue #891)
- docs/reference/tui_permissions.md: new reference for PermissionsScreen,
PermissionRequestService, and all domain models (issue #996)
- docs/reference/tui_thought_block.md: new reference for ThoughtBlock
domain model and ThoughtBlockWidget (issue #1001)
- docs/reference/database_handler.md: new reference for
DatabaseResourceHandler CRUD and checkpoint methods (issue #1241)
- docs/reference/devcontainer_resources.md: add DevcontainerHandler
protocol methods section (delete, list_children, diff, create_sandbox)
(issue #1242)
- docs/reference/tui.md: extend architecture table and add Permissions
Screen and Actor Thought Blocks sections
ISSUES CLOSED: #1393
- DomainEvent: add user_identity and correlation_id fields (PR #1257)
user_identity carries authenticated user in server mode (None in local
mode); correlation_id is a ULID linking related events in one request
chain. Both were implemented but missing from the spec model.
- EventType: promote to StrEnum, add PLAN_ESTIMATION_COMPLETE,
CORRECTION_APPLIED, CONFIG_CHANGED, ENTITY_DELETED, AUTH_SUCCESS,
AUTH_FAILURE, TIER_PROMOTED, TIER_DEMOTED, TIER_EVICTED,
VALIDATION_FIX_ATTEMPTED, VALIDATION_FIX_SUCCEEDED,
VALIDATION_FIX_EXHAUSTED (all present in implementation, missing from
spec enum).
- Audit log event details: enrich plan_applied row with changeset
statistics (lines_added, lines_removed, resources_modified,
apply_duration) per PR #1300; enrich plan_cancelled row with progress
context (cancelled_phase, last_completed_step, subplan_count) and
resource cleanup context (sandbox_refs, changeset_id,
resources_pending_cleanup) per PR #1301.
- Estimation actor: document 4-level fallback chain wired in
use_action() (PR #1310) and Strategize-to-Estimate lifecycle hook
that emits PLAN_ESTIMATION_COMPLETE on success.
ISSUES CLOSED: #1310#1300#1301#1257
- Update today marker to 2026-04-02 in both gantt charts
- Update gantt chart update log to Day 53 with Session 3 context
- Update risk register: M3-M9 completion percentages from Forgejo API
- Update footer: 40 open bugs, 119 open PRs, Session 3 active
- Update Current Status Summary: Day 53, 119 PRs, 114 issues, 40 bugs
- Update warning box: Session 3 launch with 16 workers / ~71 agents
- Update Parallel Workstreams: Testing track reflects current state
- Append What Has Been Completed: Day 50 reviewer blitz + Session 3 launch
- Update What Remains To Be Done: M8/M9 detail, 119 PRs, 40 bugs
- Update Schedule Risk Summary: Day 53 critical path blockers
- Append Day 53 Schedule Adherence entry with all required tables
- docs/reference/tui.md: new TUI reference covering launch, layout,
key bindings, input modes, help panel (F1), persona bar, full slash
command catalog (67 commands / 14 groups), persona YAML schema, and
module architecture table
- docs/reference/persona.md: new persona system reference covering
storage layout, YAML schema, validation rules, argument presets,
PersonaRegistry and PersonaState Python APIs, and TUI slash commands
- CHANGELOG.md: add [3.7.0] section summarising TUI, persona system,
session management, server mode, A2A integration, and key fixes
- README.md: extend Highlights with TUI, persona, session, server mode,
and A2A; add TUI quick-start, session management, and server mode
usage examples
Add --required and --informational as mutually exclusive boolean options
to the `agents validation add` CLI command. When specified, they override
the `mode` field from the YAML config file. This aligns the CLI with the
specification (specification.md line 22339) which states the validation
mode can be set "via --required/--informational on agents validation add".
The fix resolves the spec contradiction by:
- Implementing the flags in the CLI (per Core Concepts > Validation Mode)
- Updating the formal CLI reference to include the new flags
- Adding an exception to Design Principle #3 for validation add
- Removing the spurious positional name argument from the walkthrough
TDD tests from #1102 now run normally with @tdd_expected_fail removed.
New edge-case tests cover mutual exclusivity (both flags rejected).
Also excludes tool/wrapping.py from semgrep exec/compile rules since
that module intentionally uses exec() in a controlled sandbox for the
validation transform feature.
ISSUES CLOSED: #1038
freemo
eugen.thaci
arch-guard
brent.edwards