langchain-community 0.4.2 removed ChatOllama from its chat_models
module. Switch to the standalone langchain-ollama package which is
the official replacement.
- ollama_provider.py: import ChatOllama from langchain_ollama
- pyproject.toml: replace ollama>=0.1.0 with langchain-ollama>=0.1.0
- uv.lock: regenerated to include langchain-ollama v1.1.0
- Fix import order in ollama_provider.py (langchain_community before langchain_core)
- Remove duplicate shared step definitions from ollama_provider_steps.py
- Remove duplicate shared step definitions from mistral_provider_steps.py
The duplicate @given step definitions caused AmbiguousStep errors when running the full Behave test suite. Shared steps (provider domain inputs, plan generation graph setup) are already defined in openai_provider_steps.py and loaded by Behave for all feature files.
- Implemented OllamaChatProvider to enable local Ollama model support.
- Implemented MistralChatProvider to integrate with the Mistral API.
- Added Behave BDD tests for both providers.
- Updated dependencies: langchain-mistralai and ollama.
- Updated provider exports to include the new providers.
ISSUES CLOSED: #5257
The docker gate has been failing on `curl: (22) ... error: 404` against
the v0.58.0 GitHub release tarball even after pinning the version. The
helm gate's kubeconform download from github.com/yannh/kubeconform works
in the same workflow, so it's a Trivy-asset-path-specific 404 (URL/CDN
state we don't control), not a blanket github.com block.
Switch to `aquasec/trivy:0.58.0` pulled from Docker Hub:
- Docker Hub is already proven reachable by the preceding `docker build`
steps (server image base layers pull successfully in this same dind
job).
- A pinned tag's manifest digest is itself the verifiable artifact — no
separate checksum file fetch and grep dance.
- Trivy runs against the just-built `cleveragents-server:test` image
via the mounted dind docker socket.
- Same severity gating (`--severity HIGH,CRITICAL --exit-code 1`) and
same trailing detailed-report step are preserved verbatim.
ISSUES CLOSED: #1927
The prior pin used TRIVY_VERSION=0.57.1, but Trivy never published a
v0.57.1 tag — the release sequence went v0.57.0 → v0.58.0. The CI
docker job consequently failed with `curl: (22) The requested URL
returned error: 404` when fetching trivy_0.57.1_Linux-64bit.tar.gz.
- Bump TRIVY_VERSION to 0.58.0 (the first stable release after v0.57.0).
- Factor the GitHub release base URL into TRIVY_BASE_URL.
- Add explicit `set -euo pipefail` so each curl failure surfaces
immediately instead of relying on the runner's implicit -e.
- Anchor the checksum grep with ` ${TRIVY_TARBALL}$` so a partial
filename match cannot smuggle in the wrong checksum line.
- Wrap the checksum verification in a subshell so `cd /tmp` does not
affect later commands.
ISSUES CLOSED: #1927
- Pin Trivy installation to v0.57.1 with checksum verification instead
of the insecure curl-pipe-sh install pattern
- Fix BDD step context initialization: load workflow_content in the
Background step so scenarios 17/24/31 no longer error with AttributeError
- Fix ruff format violations in step definitions
- Add Robot Framework integration test verifying CI scan configuration
- Add CHANGELOG entry for issue #1927
ISSUES CLOSED: #1927
Added Trivy-based security scanning to the CI pipeline for the Dockerfile.server image.
The scan is configured to fail the build on any HIGH or CRITICAL severity vulnerabilities,
preventing insecure images from being deployed to production.
Changes:
- Added security scan step to .forgejo/workflows/ci.yml docker job
- Trivy is installed and executed after building the Dockerfile.server image
- Scan results are displayed in CI job output with detailed vulnerability report
- Build fails (non-zero exit) if HIGH or CRITICAL vulnerabilities are detected
- Added BDD feature file and step definitions for security scanning verification
The two dataclasses used @dataclass decorator without importing it from
dataclasses, causing a NameError on import. This also violated the
architecture invariant that requires all dataclasses to use Pydantic
BaseModel instead of @dataclass.
Replace @dataclass with BaseModel inheritance and field(default_factory=...)
with Field(default_factory=...) which was already imported from pydantic.
Fix two critical issues identified by HAL9001 review #8271:
1. Rename literal step 'policy{1,2} has priority_weight' in loader
steps to 'loader policy{1,2} has priority_weight' to disambiguate
from parameterised 'policy(\d+) has priority_weight' in integration
steps (fixes AmbiguousStep Conflicts 1 & 2 - root cause of CI failures).
2. Fix NameError: change undefined variable 'weight' to float(weight_str)
in step_policy1_priority and step_policy2_priority functions.
3. Rename duplicate Python function names across step files to prevent
namespace shadowing: step_check_view_name, step_have_multiple_policies,
step_have_policy_config, step_policy_not_applied → suffixed with _loader
or _integration.
ISSUES CLOSED: #9584
Convert all Behave {param:d/f/int} cucumber-expression format specifiers
to raw regex patterns (\d+, [\d.]+) compatible with behave 1.3.x parse
library. Remove duplicate @given/@then step definitions across both ACMS
step files that caused AmbiguousStep errors: budget_override and assembled
context budget assertions. Remove overlapping 'I prepare LLM context'
handlers that matched the same plain text feature steps. Restore missing
ContextPolicyConfig/ConfigurationLoader/PolicyScope/ViewPolicyConfiguration
imports in acms/__init__.py.
ISSUES CLOSED: #9584
Resolve blocking issues identified in final review (ID 7998) for PR #9671:
1. AmbiguousStep fix: Renamed duplicate step '@then("the policy should not be applied")'
to '@then("the policy should not be applied to the LLM context")' in
acms_plan_execution_integration_steps.py and updated corresponding scenario in
features/acms_plan_execution_integration.feature
2. lint fix (SIM102): Combined nested if statements into single compound condition in
step_set_policy_priority() to remove ruff SIM102 violation
3. Type safety fix: Changed 'policy: Any' to 'policy: ContextPolicyConfig' in
ACMSContextAssembler._apply_policy() for proper Pyright type safety, added
ContextPolicyConfig to module imports
This resolves the unit_tests CI failure caused by AmbiguousStep and fixes
the lint CI failure introduced by commit 3457fc61.
ISSUES CLOSED: #9584
The Plan Execution ACMS Integration feature file was missing step
definitions for three key test scenarios: priority weight configuration,
budget override enforcement, and negative-scope policy rejection. Added:
- 'policy{count} has priority_weight {weight}' step
- 'the policy has budget_override {amount}' step
- generic 'I prepare LLM context' catch-all step
Also added explicit Then assertions for budget verification, scope
mismatch rejection, and negative context checks.
ISSUES CLOSED: #9584
Remove import inside function body in acms_plan_execution_integration_steps.py
which violated the project rule against imports inside functions. Move
StrategyDecision import to the top-level import block.
ISSUES CLOSED: #9584
Wire PlanExecutionACMSIntegration into PlanExecutor and RuntimeExecuteActor
via dependency injection. PlanExecutor now accepts an optional acms_integration
parameter and passes it to RuntimeExecuteActor, which uses it to assemble
context via ACMS policies before LLM calls instead of passing raw file dumps.
Added BDD tests verifying the DI wiring and context assembly integration.
Updated CHANGELOG to document the plan execution engine integration.
ISSUES CLOSED: #9584
The CI lint job runs both ruff check and ruff format --check. The format
check was failing because 5 files had formatting inconsistencies. Applied
ruff format to fix the CI lint failure.
ISSUES CLOSED: #9584
Implemented a new context policy configuration loader and integrated plan execution context assembly for ACMS. Key additions include:
- New module: src/cleveragents/acms/context_policy_loader.py
- ContextPolicyConfigurationLoader class for loading YAML/TOML configurations
- Data models: PolicyScope and ContextPolicyConfig dataclasses
- ViewPolicyConfiguration for per-view policy management
- Schema validation to ensure policy configurations adhere to expected structure and constraints
- Supports loading configurations from both files and strings, with robust error reporting
- New module: src/cleveragents/acms/plan_execution_integration.py
- ACMSContextAssembler for assembling runtime context based on policy-driven decisions
- PlanExecutionACMSIntegration to connect with the plan execution engine
- Flexible policy loading from files or strings, allowing runtime configurability
- BDD tests
- features/acms_context_policy_loader.feature (20 scenarios) validating loader behavior and policy scoping
- features/acms_plan_execution_integration.feature (8 scenarios) validating end-to-end plan-context integration
- features/steps/acms_context_policy_loader_steps.py (step definitions)
- features/steps/acms_plan_execution_integration_steps.py (step definitions)
- Tests cover YAML/TOML parsing, validation errors, per-view policy application, and plan integration flows
- Updated exports
- Updated src/cleveragents/acms/__init__.py to export the two new modules, enabling easier imports and usage
ISSUES CLOSED: #9584
Add threading.RLock to InvariantService to protect shared state
(_invariants dict, _enforcement_records list) from concurrent access
by multiple threads during parallel plan execution. Prevents
RuntimeError: dictionary changed size during iteration and data
corruption in multi-threaded environments.
Changes:
- Added self._lock = RLock() in __init__
- Wrapped all public methods (add_invariant, list_invariants,
remove_invariant, get_effective_invariants, enforce_invariants)
with lock acquisition via context managers
- Added helper read methods: get_enforcement_records(), get_invariant(),
get_invariants_snapshot() -- all thread-safe
- Added BDD tests for concurrent access patterns
- Updated CHANGELOG.md and CONTRIBUTORS.md
ISSUES CLOSED: #7524
CleverAgents Bot
HAL9000
controller-ci-rerun
cleveragents-auto
HAL9000
HAL9000