docs(plan): add CHANGELOG and CONTRIBUTORS entries for #9084 fix

- Add changelog entry under [Unreleased]/Fixed for plan artifacts JSON completeness (#9084)
- Add contributors detail for validation_summary and apply_summary fix work.

ISSUES CLOSED: #9084
This commit is contained in:
2026-05-07 10:39:53 +00:00
committed by drew
parent 70a302a368
commit 87cfdae489
2 changed files with 16 additions and 139 deletions
+15 -139
View File
@@ -207,7 +207,7 @@ ensuring data is stored with proper parameter values.
### Added
- **A2A module rename BDD test suite** (#8615): Comprehensive Behave tests validating that the ACP→A2A module rename is complete — verifying all 22 A2A symbols are properly exported, no legacy ACP references remain in `.py` files under `cleveragents.a2a/`, and the module docstring uses current A2A naming. The step definitions include self-contained symbol lookups to avoid cross-scenario dependency failures.
- **A2A module rename BDD test suite** (#8615): Comprehensive Behave tests validating that the ACP→A2A module rename is complete — verifying all 22 A2A symbols are properly exported, no legacy ACP references remain in `.py` files under `cleveragents.a2a/`, and the module docstring uses current A2A naming. The step definitions include self-contained symbol lookups to avoid cross-scenario dependency failures.
- Fixed `ReactiveEventBus.emit()` exception handler to log the full exception
message (`str(exc)`) and enable traceback forwarding (`exc_info=True`).
@@ -350,129 +350,9 @@ ensuring data is stored with proper parameter values.
untyped `config` dict), the old code always returned an empty string, causing
cross-actor cycle detection to silently fail and leaving the system vulnerable to
infinite recursion at runtime. Added Behave regression tests
(`features/actor_subgraph_cycle_detection.feature`) and a Robot Framework
(`features/actor_subgraph_cycle_detection.feature`) and a Robot Framework
integration test (`robot/actor_compiler.robot`) to prevent regressions.
- **ActorLoader.list_actors TOCTOU race condition** (#8588): Moved the namespace
filter inside the ``with self._lock:`` block so that the actors dictionary is read
and filtered atomically. Previously an actor ``.clear()`` could run between the
dictionary read and the filter step, causing the loader to return stale results or
raise ``RuntimeError: dictionary changed size during iteration``. Added a
``@unit @actor @concurrency`` Behave scenario in ``features/actor_loading.feature``
that exercises ``list_actors(namespace=...)`` and ``clear()`` on multiple threads
via ``threading.Barrier``.
- **Devcontainer auto-discovery wired into `git-checkout`/`fs-directory` handlers** (#4740):
`GitCheckoutHandler.discover_children()` and `FsDirectoryHandler.discover_children()` now
call `discover_devcontainers()` after scanning for `fs-directory` children. Any
`.devcontainer/devcontainer.json` or root-level `.devcontainer.json` found at the resource
location is registered as a `devcontainer-instance` child resource with
`provisioning_state: discovered`. Named configurations (`.devcontainer/<name>/devcontainer.json`)
are also discovered and carry the configuration name in the `config_name` property.
This wires the previously-isolated `discover_devcontainers()` function into the production
code path, enabling the spec's zero-configuration devcontainer experience.
- **Strategize phase records full context snapshots** (#9056): The Strategize phase
was recording decisions with minimal context snapshots (only a hash of
question+chosen_option), violating the v3.2.0 acceptance criterion that decisions
must include full context snapshots sufficient to replay the decision. Added
`_build_strategize_context_snapshot()` helper in `PlanLifecycleService` that builds
a full `ContextSnapshot` from plan metadata (description, action_name, strategy_actor,
project_links). Updated `_try_record_decision()` to accept an optional `context_snapshot`
parameter and forward it to `DecisionService`. Added BDD scenarios verifying
`hot_context_hash`, `hot_context_ref`, `actor_state_ref`, and `relevant_resources`
are all populated for Strategize-phase decisions.
- **Plan tree JSON output missing `decision_id` field** (#9096): The `step_tree_json_valid`
BDD step was asserting a raw list from `format_output`, but the function wraps all
machine-readable output in a spec-required envelope dict (`{"data": [...]}`). Updated
the assertion to validate envelope structure and removed `@tdd_expected_fail` from the
`@tdd_issue_4254` scenario so it runs as a permanent regression guard. The code producing
`decision_id` in tree nodes was already correct; only the test assertion needed fixing.
### Changed
- Fixed stale `AUTO-BUG-POOL` tracking prefix references in automation-tracking.md documentation and agent-system-specification.md spec document, replaced with correct `AUTO-BUG-SUP` prefix used by the bug-hunt-pool-supervisor agent (#7875).
- **`agents session list` now displays full 26-character session ULIDs** (#10970): The Rich table
and Summary panel ("Most Recent" / "Oldest") previously showed only the first 8 characters of
each session ULID. This made the output unusable for copy-paste into `session tell`,
`session show`, `session delete`, and `session export`, all of which require the full
26-character identifier. The full ULID is now displayed in all output formats (Rich, plain,
JSON, YAML, table).
- **`pr-creator` now applies State/In Review and Priority labels** (#8520): Extended
`pr-creator` step 4 to apply three labels on every new PR: the `Type/` label (from
the caller's `type_label` parameter), `State/In Review` (always applied), and the
`Priority/` label matching the linked issue. Updated Rule 1 to enumerate all required
labels. Addresses the 53% missing-State-label rate observed across open PRs of
2026-04-13.
- **Suppress passing BDD scenario output in `unit_tests` by default** (#10987): Implemented
`PassSuppressFormatter`, a custom Behave formatter (in `scripts/behave_pass_suppress_formatter.py`)
that buffers all per-scenario output and only flushes it to stdout when a scenario fails or
errors. An all-passing `nox -s unit_tests` run now produces ≤ 10 lines (the summary block
only), eliminating ~100,000 lines of noise that previously made CI logs unreadable. The
formatter is embedded in the `behave-parallel` in-process runner; coverage mode
(`BEHAVE_PARALLEL_COVERAGE=1`) is unaffected.
### Security
- **PyYAML upgraded to >=6.0.3 to address known security vulnerability** (#9055):
Added an explicit `pyyaml>=6.0.3` dependency constraint to `pyproject.toml` to
prevent installation of vulnerable older versions with known YAML parsing security
issues.
- **aiohttp upgraded to >=3.13.4 to remediate CVE-2026-34513 and CVE-2026-34515** (#1549, #1544):
Added an explicit `aiohttp>=3.13.4` dependency constraint to `pyproject.toml` to remediate
two high-severity open redirect vulnerabilities. Both CVEs affect the CleverAgents platform's
HTTP infrastructure including A2A server communication, tool source fetching (MCP servers,
Agent Skills), and agent-to-agent protocol handlers. The version floor ensures vulnerable
versions (<3.13.4) cannot be installed even if upstream transitive dependencies have loose
version constraints.
### Fixed
- **Concurrent ValidationPipeline stdout/stderr restoration** (#7623): Fixed a race
condition where concurrent `ValidationPipeline.run()` calls could permanently leave
`sys.stdout` and `sys.stderr` wrapped in `_ThreadLocalStream` objects. Pipeline B
could capture Pipeline A's wrapper as its "original" stream, then restore that wrapper
in its `finally` block — permanently leaving the global streams wrapped. The fix
introduces a reference-counted shared wrapper manager (`_install_thread_local_streams`
/ `_release_thread_local_streams`) protected by a `threading.Lock`. The first caller
saves the true original streams and installs the wrappers; subsequent concurrent callers
increment the reference count and reuse the same wrappers; the last caller restores the
saved originals. Per-pipeline stdout/stderr capture remains fully isolated via
thread-local buffers.
- **Error suppression removed from `reactive_registry_adapter.py`** (#9060): Removed two `try...except Exception:` blocks in `register_registry_agents()` that silently suppressed errors, violating the CONTRIBUTING.md fail-fast policy. Exceptions from `actor_registry.list_actors()` and the route bridge refresh now propagate to the caller instead of being swallowed. Added Behave scenarios verifying RuntimeError, AttributeError, and TypeError propagation.
- **Implementation Supervisor PR Compliance Checklist** (#9824): Added a mandatory
8-item PR Compliance Checklist to the worker prompt body in `implementation-supervisor.md`
that every implementation worker must complete before creating a PR. Checklist covers:
CHANGELOG.md update, CONTRIBUTORS.md update, commit footer (`ISSUES CLOSED: #N`),
CI verification, BDD tests, Epic reference, label application via `forgejo-label-manager`,
and milestone assignment. This eliminates systemic PR merge blockers caused by workers
omitting required items.
- **Implementation Pool Supervisor PR Compliance Checklist** (#9824): Added a mandatory
8-item PR Compliance Checklist to the new `implementation-pool-supervisor.md` agent definition.
Supervisors must enforce that workers complete all 8 checklist items (CHANGELOG.md update,
CONTRIBUTORS.md update, commit footer, CI verification, BDD tests, Epic reference, label
application, and milestone assignment) before creating any PR. Includes concrete markdown
examples for each subsection and compliance verification pseudocode to ensure reproducible
adherence.
- **ACMS context path matching now handles absolute fragment paths** (#10972): Fixed
`_path_matches()` in `execute_phase_context_assembler.py` and `_matches_pattern()` in
`context_phase_analysis.py` to correctly match absolute paths (e.g. `/app/.opencode/skills/SKILL.md`)
against relative glob patterns (e.g. `.opencode/**`, `docs/*`). Previously
`PurePath.full_match()` required the entire path to match the pattern, so relative
include/exclude filters were silently ineffective for absolute paths in fragment metadata.
Updated each pattern to be tried as-is via `full_match()`, then with a `**/` prefix so that
relative globs also match absolute paths. Added BDD regression tests in
`execute_phase_context_assembler_coverage.feature` and `project_context_phase_analysis.feature`.
### Changed
- Restored `benchmark-regression` CI job to `master.yml` with `pull_request` trigger guard
@@ -542,8 +422,7 @@ _ALL_DATA_COLUMNS + ") " "SELECT " + _ALL_DATA_COLUMNS + " FROM v3_plans"`.
`is_superseded` flag. The command handles empty decision trees gracefully and includes
ULID validation and proper error handling consistent with other plan commands.
- `agents actor context clear` command to reset actor message history and
state while preserving the underlying context directory via `ContextManager`
- `agents actor context clear` command to reset actor message history and state while preserving the underlying context directory via `ContextManager`
(#6370).
- **Quick Start Guide** (PR #9245): Added `docs/quickstart.md` with an end-to-end quick start guide covering prerequisites, installation, project creation, resource registration, plan/apply workflow, and troubleshooting. Updated `mkdocs.yml` navigation to include the Quick Start page.
- **container-instance --clone-into and devcontainer-instance sandbox strategy** (#7555):
@@ -640,10 +519,7 @@ _ALL_DATA_COLUMNS + ") " "SELECT " + _ALL_DATA_COLUMNS + " FROM v3_plans"`.
session is provided (UoW mode), the method now calls only `session.flush()`, leaving
transaction control to the caller. When no session is provided (standalone mode), the
method creates its own session, flushes, commits, and closes it to ensure durable
persistence. This eliminates three data-integrity violations: premature commit of outer
UoW transactions, loss of rollback capability for subsequent failures, and a mismatch
between the class docstring ("Callers are responsible for commit") and the implementation.
Input validation for the `trace` argument was also added. Two new BDD scenarios verify
persistence. Input validation for the `trace` argument was also added. Two new BDD scenarios verify
the session contract: `Repository save() calls flush not commit` and `LLM trace rolled
back when UnitOfWork transaction rolls back`.
@@ -680,19 +556,19 @@ back when UnitOfWork transaction rolls back`.
- **Unified provider factory: eliminate divergence between `create_llm()` and `create_ai_provider()`** (#10949):
Introduced `_create_provider_instance()` as the single internal factory so that
both public methods delegate to one place. Creating a new provider now
both public methods delegate to one place. Creating a new provider now
requires changes in exactly one method.
- **Fixed API key regression**: the unified factory now explicitly passes
the validated API key to all LangChain constructors (OpenAI, Anthropic,
Google / Gemini, Azure, Groq, Together, Cohere, and OpenRouter). Users
Google / Gemini, Azure, Groq, Together, Cohere, and OpenRouter). Users
who configure providers via `CLEVERAGENTS_`-prefixed variables are no
longer silently failed when LangChain falls back to raw environment
variable lookup. Pre-validated keys are forwarded through the
variable lookup. Pre-validated keys are forwarded through the
`api_key` kwarg to avoid a second settings lookup in the factory
closure. (Closes #10949)
- **Fixed mock provider accessibility in production**: `ProviderType.MOCK`
is now gated by the `CLEVERAGENTS_ALLOW_MOCK_PROVIDER=true` sentinel
environment variable. Without this flag, both `create_llm()` and
environment variable. Without this flag, both `create_llm()` and
`create_ai_provider()` raise `ValueError` when MOCK is requested,
preventing accidental or malicious use of the fake LLM in production.
`resolve_provider_by_name("mock")` now also respects the guard and
@@ -760,7 +636,7 @@ back when UnitOfWork transaction rolls back`.
`agents actor run` silently returning empty output for v3 `type:llm` actors.
`_build_from_v3()` and `_build()` now synthesise a default single-node
graph route when agents are created without explicit routes, ensuring
`run_single_shot()` can invoke the LLM via `GraphExecutor`. The nested
`run_single_shot()` can invoke the LLM via `GraphExecutor`. The nested
`actors:` map format also translates the v3 `actor: "provider/model"` key
into separate `provider` and `model` keys so the correct LLM provider is
instantiated.
@@ -785,10 +661,10 @@ uko-oo:Class` triple emission in `PythonAnalyzer._extract_class()` so that
- **Actor CLI v3 YAML Schema Support** (#6283): Fixed three components to add
full v3 `ActorConfigSchema` support to the actor CLI registration and
execution paths. `ActorConfiguration.from_blob()` now detects v3 format
execution paths. `ActorConfiguration.from_blob()` now detects v3 format
(top-level `type` key of `llm`/`graph`/`tool`) and correctly extracts
provider, model, and graph descriptors — including `type: tool` actors
without a `model` field. `ActorRegistry.add()` validates against the full
without a `model` field. `ActorRegistry.add()` validates against the full
Pydantic v2 schema, persists `skills`/`lsp`/`description` in the config
blob, and compiles graph actors with proper metadata.
`ReactiveConfigParser._build_from_v3()` now uses correct `source`/`target`
@@ -797,9 +673,9 @@ uko-oo:Class` triple emission in `PythonAnalyzer._extract_class()` so that
`env_vars`/`response_format`/`lsp_capabilities`/`lsp_context_enrichment`
into agent configs, and validates `entry_node` against the nodes map.
Exception handling narrowed from broad `except Exception` to specific
`NotFoundError` and `ActorCompilationError`. v3 registration logic
`NotFoundError` and `ActorCompilationError`. v3 registration logic
extracted to `v3_registry.py` to keep `registry.py` under the 500-line
limit. 19 BDD scenarios cover all v3 paths including tool actors,
limit. 19 BDD scenarios cover all v3 paths including tool actors,
update mode, LSP dict bindings, and field propagation.
- **TDD Non-AssertionError Guard Visibility** (#8294): `apply_tdd_inversion` in
@@ -816,8 +692,8 @@ uko-oo:Class` triple emission in `PythonAnalyzer._extract_class()` so that
- **Parallel Behave Runner Log Noise Reduction** (#8351): The parallel behave
runner now suppresses captured stdout/stderr for passing worker chunks and
only replays diagnostics for failed, errored, or crashed chunks. This makes
failure output significantly easier to spot in CI and local runs. A worker
only replays diagnostics for failed, errored, or crashed chunks. This makes
failure output significantly easier to spot in CI and local runs. A worker
crash (unhandled exception) is detected via an all-zero summary and the
captured traceback is always surfaced.
+1
View File
@@ -23,6 +23,7 @@ Below are some of the specific details of various contributions.
* HAL 9000 has contributed concurrency safety improvements, including thread-safe context tier management (issue #7547) for parallel plan execution.
* HAL 9000 has contributed the configurable agent limits refactor (#9246/#9050): replaced hardcoded ``deps[:10]`` in ``ContextAnalysisAgent`` and ``contexts[:5]`` in ``PlanGenerationGraph`` with validated constructor parameters ``max_dependencies`` (default: 10) and ``max_context_files`` (default: 5), including 12 BDD scenarios covering defaults, custom values, edge cases, and invalid-input error handling.
* HAL 9000 has contributed the plan concurrency race-condition fix (#7989): wired `LockService` into the plan lifecycle, guarding `execute_plan()` and `apply_plan()` with plan-level advisory locks and unique per-invocation owner identities to prevent silent concurrent state corruption.
* HAL 9000 has contributed the plan artifacts JSON completeness fix (#9084): ensured `validation_summary` and `apply_summary` are correctly included in `_build_artifacts_dict`, removing stale `@tdd_expected_fail` tags from Behave scenarios to enable full regression test coverage.
* HAL 9000 has contributed the bug-hunt-pool-supervisor non-blocking tracking fix (#7875 / PR #7957): updated step 5 to be best-effort and added rule 9 to prevent the automation-tracking-manager call from blocking the main supervisor loop.
* Jeffrey Phillips Freeman has contributed the complete AUTO-BUG-POOL to AUTO-BUG-SUP tracking prefix fix across agent-system-specification.md, automation-tracking.md documentation and agent-system-specification.md spec document, replaced with correct `AUTO-BUG-SUP` prefix used by the bug-hunt-pool-supervisor agent (#7875).
* HAL 9000 has contributed the plugin entry point security hardening fix (#7476): enforced entry point allowlist validation before importing plugin modules to prevent malicious plugin loading.