2746 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
freemo	921c13f410	fix(agents): restore server mode + prompt_async supervisor launch from 9bbec0e6 ... Restores the working OpenCode server mode + curl-based async supervisor launch functionality from commit 9bbec0e6 (2026-04-02) and updates it for the current 13-supervisor architecture. Changes applied to 7 agent files (938 insertions, 221 deletions): 1. product-builder.md: Restored from 9bbec0e6 and updated for 13 supervisors - Full bash permissions for curl/sleep - Server URL: http://localhost:4096 - Launch via POST /session + POST /session/:id/prompt_async - Session resume (adopts existing [CA-AUTO] sessions) - Added ca-test-infra-improver and ca-project-owner to launch sequence - Updated concurrent worker calculations (~5N + ~8 singletons) 2. issue-implementor.md: Restored curl-based worker dispatch - 10-second polling loop with bash sleep - Worker sessions via prompt_async - Session resume for existing workers 3. ca-continuous-pr-reviewer.md: Restored curl dispatch pattern 4. ca-uat-tester.md: Restored curl pool mode 5. ca-bug-hunter.md: Restored curl pool mode 6. ca-test-infra-improver.md: Added self-dispatch permission 7. ca-session-cleanup.md: Restored utility agent Architecture: 5 pool supervisors (N workers each) + 8 singleton supervisors = 13 total supervisors running async via prompt_async. Replaces the broken prompt_async implementation from commit 074c472e that removed supervisors from task permissions without working server launch. To use: Start OpenCode with --port 4096, then launch product-builder. Refs: commit 9bbec0e6 (working version), commit 074c472e (broken version)	2026-04-02 20:56:06 -04:00
freemo	72a9a17a67	docs(timeline): update schedule adherence Day 54 (2026-04-03) ... Day 54 morning update. No merges overnight. Agents created 100+ new issues. Key changes: - Appended Day 54 schedule adherence entry - Updated today marker to 2026-04-03 in both gantt charts - Open bugs: 35 → 50 (+15 new bugs from agents overnight) - Open PRs: 79 → 84 (+5 new fix/CI branches) - Open issues: 400 → 500 (+100 new from agents overnight) - M3 (v3.2.0): 82% → 75% (212/281, milestone grew 256→281) - M4 (v3.3.0): 79% → 78% (99/127, milestone grew 126→127) - M5 (v3.4.0): 88% → 87% (126/145, milestone grew 143→145) - M6 (v3.5.0): 77% → 71% (172/241, milestone grew 221→241) - M7 (v3.6.0): 73% → 68% (120/177, milestone grew 164→177) - M8 (v3.7.0): 36% → 29% (54/185, milestone grew 152→185) - M9 (v3.8.0): 40% → 26% (64/242, milestone grew 160→242)	2026-04-03 00:33:20 +00:00
freemo	f0ff4bce69	fix(deps): upgrade aiohttp to 3.13.4 to remediate CVE-2026-34515 open redirect ... Add explicit aiohttp>=3.13.4 dependency constraint to pyproject.toml to remediate CVE-2026-34515, a high-severity open redirect vulnerability in aiohttp that affects the A2A server HTTP transport, MCP tool source fetching, and agent communication layers. The uv.lock already resolves aiohttp to 3.13.5 which satisfies the >=3.13.4 constraint. Adding the explicit constraint ensures vulnerable versions (<3.13.4) cannot be installed even if upstream transitive dependency constraints are loosened. ISSUES CLOSED: #1544	2026-04-03 00:32:00 +00:00
freemo	9c6d69153e	fix(a2a): rename A2aRequest/A2aResponse fields to comply with JSON-RPC 2.0 wire format ... Rewrites the A2aRequest and A2aResponse Pydantic models to use the field names mandated by the JSON-RPC 2.0 specification, fixing a fundamental protocol compliance issue that prevented external A2A-compliant clients from communicating with the server. Changes: - A2aRequest: a2a_version→jsonrpc (fixed '2.0'), request_id→id, operation→method; auth field removed (not in JSON-RPC 2.0) - A2aResponse: a2a_version→jsonrpc, request_id→id, status+data→result (success path), timing_ms removed; added _result_xor_error validator enforcing mutual exclusion of result and error fields - A2aLocalFacade.dispatch(): updated to use request.method, request.id, result=data, error=A2aErrorDetail(...) - A2aHttpTransport.send(): updated to use request.method - CLI call sites (session.py, plan.py): updated A2aRequest(method=...) and response.result / response.error field access - All existing A2A Behave step files updated to new field names - New 35-scenario Behave feature (a2a_jsonrpc_wire_format.feature) covering serialisation, deserialisation, validation, and facade dispatch - New 7-test Robot Framework suite (a2a_jsonrpc_wire_format.robot) for end-to-end wire format verification ISSUES CLOSED: #1501	2026-04-03 00:29:46 +00:00
freemo	d430d671a0	fix(cli): add missing Type field, Config, Capabilities, and Tools panels to actor add rich output ... Extended `_print_actor()` to render the full spec-required output for `agents actor add`: the Actor Added panel now includes a Type field, and three additional panels (Config, Capabilities, Tools) plus a success status line are rendered when `show_add_panels=True`. - Add `Type:` field to the Actor Added panel (from `config_blob["type"]`) - Implement Config panel: Path, Hash, Options count, Nodes count, Edges count - Implement Capabilities panel: bulleted list (rendered only when non-empty) - Implement Tools panel: Rich table with Tool, Read-Only, Safe columns (rendered only when non-empty; string tool entries default to yes/yes) - Add `✓ OK Actor added` success status line after all panels - Pass `config_path` and `show_add_panels=True` from `add()` command - Add Behave BDD scenarios covering each new panel and the success line - Add Robot Framework integration test verifying the full rich output ISSUES CLOSED: #1499	2026-04-03 00:23:58 +00:00
freemo	300a5d6ddc	fix(cli): disallow mixing legacy and v3 plan workflows ... Add ULID format validation to all v3 plan commands to prevent users from accidentally mixing legacy ('agents tell') and v3 ('agents plan use') workflows. The two systems use separate storage backends and cannot be mixed; this change detects the mismatch early and provides actionable error messages. Changes: - Add _validate_plan_ulid() with proper Crockford Base32 regex (^[0-9A-HJKMNP-TV-Z]{26}$, re.IGNORECASE) that correctly rejects invalid characters (I, L, O, U), hyphens, and wrong-length strings - Add _PLAN_ULID_RE compiled regex and _ULID_VALIDATION_ERROR_MSG constant with actionable guidance explaining the legacy/v3 incompatibility - Apply ULID validation to all v3 commands: execute_plan, _lifecycle_apply_with_id, lifecycle_apply_plan, plan_status, plan_errors, cancel_plan (only on user-provided IDs, not auto-discovered) - Update _LEGACY_DEPRECATION_MSG and tell/build command warnings to explicitly state that the two workflows are INCOMPATIBLE and cannot be mixed - Add comprehensive BDD tests in features/plan_ulid_validation.feature with step definitions using Typer CLI runner (not subprocess) - Update CONTRIBUTING.md with 'Workflow Choice: Legacy vs. v3 Plan Lifecycle' section documenting the incompatibility and migration path ISSUES CLOSED: #1560	2026-04-03 00:01:48 +00:00
freemo	8c81f13758	fix(infra): resolve TLS handshake failure on git.dev.cleveragents.com ... The TLS handshake failure on git.dev.cleveragents.com was caused by the hostname being absent from the certificate's Subject Alternative Names (SANs), or by SNI virtual-host misconfiguration on the server side. This commit delivers the repository-side remediation: - scripts/check-tls-cert.py: New TLS certificate health-check script. Connects to a hostname, verifies the certificate's SANs include the target hostname, checks expiry, and reports errors/warnings. Accepts an injectable SSLContext for unit testing without real network access. Supports wildcard SAN matching and configurable expiry warning threshold. - docs/development/ops-runbook.md: New ops runbook documenting the full certificate renewal procedure (Let's Encrypt/certbot and manual CA), SNI misconfiguration diagnosis steps, expiry monitoring with cron, and recommended alert thresholds (30/14/7/0 days). - features/tls_certificate_check.feature: 14 Behave scenarios tagged @tdd_issue @tdd_issue_1543 covering: missing SAN detection, valid SAN acceptance, expired certificate detection, expiry warning threshold, TLS handshake errors, connection timeouts, connection refused, wildcard SAN matching, and _hostname_matches_san unit tests. - features/steps/tls_certificate_check_steps.py: Step definitions for the above feature, using unittest.mock to inject SSL contexts and socket connections so no real network calls are made. - mkdocs.yml: Added Ops Runbook to the Development section navigation. The actual server-side certificate renewal (adding git.dev.cleveragents.com as a SAN and reloading the web server) must be performed by the server administrator following the procedure in docs/development/ops-runbook.md. Closes #1543 ISSUES CLOSED: #1543	2026-04-02 23:59:37 +00:00
freemo	ee1710dc3e	docs(timeline): update schedule adherence Day 53 (2026-04-02) night refresh ... Night refresh after UAT/bug-hunt/CI agents created 50+ new issues. Key changes: - Open bugs: 6 → 35 (UAT/bug-hunt agents created 29 new bugs #1749-#1791) - Open PRs: 74 → 79 (+5 new CI/security PRs) - Open issues: 339 → 400 (+61 new from UAT/bug-hunt/CI agents) - M3 (v3.2.0): 85% → 82% (211/256, milestone grew from 236→256) - M4 (v3.3.0): 80% → 79% (99/126, milestone grew from 124→126) - M5 (v3.4.0): 89% → 88% (126/143, milestone grew from 142→143) - M6 (v3.5.0): 79% → 77% (171/221, milestone grew from 214→221) - M7 (v3.6.0): 75% → 73% (120/164, milestone grew from 150→164) - M8 (v3.7.0): 38% → 36% (55/152, milestone grew from 107→152) - M9 (v3.8.0): 35% → 40% (64/160, milestone grew from 49→160) - Critical: coverage at 37% (#1782), AmbiguousStep crash (#1791)	2026-04-02 23:57:25 +00:00
freemo	33f1978bd0	fix(ci): resolve repository push failure in CI pipeline ... Root cause: actions/checkout@v4 was not configured with explicit write credentials (token + persist-credentials), and no git user identity (user.name/user.email) was set. Both are required for any git push operation in Forgejo Actions. Changes: - release.yml create-release job: add token: secrets.FORGEJO_TOKEN and fetch-depth: 0 to checkout; add 'Configure git identity for push operations' step using HTTPS credential store; add 'Smoke-test push access' step that validates write permission via Forgejo API before any push attempt - ci.yml: add push-validation job that validates push credentials on every CI run using FORGEJO_TOKEN, including credential helper verification and API-based write permission check; add push-validation to status-check needs and result reporting - docs/development/ci-cd.md: add FORGEJO_TOKEN, FORGEJO_URL, and CONTAINER_REGISTRY* secrets to the secrets table; add 'Repository Push Authentication' section documenting root cause, fix pattern, smoke-test step, setup instructions, and security notes; add push-validation to CI job dependency graph and quality gates table Design decisions: - HTTPS token authentication (not SSH deploy keys) -- simpler to manage - ~/.git-credentials with chmod 600 for ephemeral, secure storage - Smoke-test validates write permission via API before push attempts - push-validation job is independent (no needs) -- runs in parallel - No hardcoded credentials -- all secrets via Forgejo Secrets ISSUES CLOSED: #1541	2026-04-02 23:54:52 +00:00
freemo	8843872ce0	fix(tests): resolve flakiness in test_example_flaky_test ... Add deterministic BDD feature and step definitions to resolve the flaky-test detection alert for test_example_flaky_test (issue #1542). Root cause: the async-job heartbeat step previously relied on a fixed time.sleep(0.01) that was insufficient on fast CI runners. When two consecutive datetime.now(UTC) calls returned the same microsecond value the 'heartbeat updated' assertion failed intermittently. The busy-wait guard (already present in async_execution_steps.py) is the correct fix. This commit adds a dedicated feature that: - Validates the heartbeat timestamp strictly advances after the busy-wait (the primary test_example_flaky_test scenario) - Covers rejection of heartbeat recording for queued and completed jobs - Adds a bounded heartbeat step that asserts the busy-wait terminates within a wall-clock budget, preventing infinite hangs on broken clocks ISSUES CLOSED: #1542	2026-04-02 23:53:13 +00:00
freemo	288ff276b3	fix(a2a): reformat SseEventFormatter output to JSON-RPC 2.0 notification structure ... - Add _EVENT_TYPE_TO_METHOD class-level mapping (ClassVar[dict[str, str]]) to convert A2A event types to JSON-RPC 2.0 method names: TaskStatusUpdateEvent → task/statusUpdate TaskArtifactUpdateEvent → task/artifactUpdate - Refactor SseEventFormatter.format() to produce JSON-RPC 2.0 notification envelope: {"jsonrpc": "2.0", "method": "...", "params": {...}} - Move event data fields into params object; include taskId (from plan_id) in params when plan_id is present, per spec §Streaming Architecture - Remove non-spec fields (event_id, event_type, timestamp, plan_id) from the data payload; these remain in SSE envelope headers (event: and id:) - Update BDD feature to verify JSON-RPC 2.0 structure for both event types, events with/without plan_id, custom data in params, and exclusion of non-spec fields - Fix pre-existing type errors in step definitions: replace try/except ImportError pattern with direct imports and use behave.runner.Context for proper static typing (0 pyright errors) ISSUES CLOSED: #1502	2026-04-02 23:53:13 +00:00
freemo	37586882b3	chore(ci): extract behave-parallel runner script from noxfile.py into scripts/ ... Move the large embedded `_BEHAVE_PARALLEL_CLI_SOURCE` string constant out of noxfile.py and into a standalone `scripts/run_behave_parallel.py` module. The `_install_behave_parallel()` helper now reads the script from disk via `Path(__file__).parent / 'scripts' / 'run_behave_parallel.py'` instead of embedding the source as a raw string literal. This allows ruff to lint and type-check the runner independently, and makes noxfile.py significantly shorter and easier to read. No functional changes: the installed `behave-parallel` entry point is identical to the previous embedded version. Parallel and sequential modes, coverage integration, and the multiprocessing fork model are all preserved. Fixed two SIM105 lint violations in the extracted script (replaced try/except/pass with contextlib.suppress). ISSUES CLOSED: #1538	2026-04-02 23:44:30 +00:00
freemo	e03fd2956d	test(actors): fix actor examples missing provider fields and incorrect name ... Add missing provider: field to all actor examples in examples/actors/. Fix llm_with_tools.yaml actor name from assistants/file_analyzer to local/assistants-file_analyzer (custom actors must use local/ namespace and cannot contain two slashes). Add validate-all command to helper_actor_examples.py that uses ActorLoader to validate all examples via business logic checks. Add integration test Validate All Actor Examples Import Without Errors to actor_examples.robot that confirms every example in examples/actors/ can be imported without errors. ISSUES CLOSED: #1504	2026-04-02 23:31:25 +00:00
freemo	99aa459bad	chore(ci): consolidate uv cache key across all workflow jobs ... Replace per-job cache key prefixes (uv-lint-, uv-typecheck-, uv-security-, uv-quality-, uv-tests-, uv-coverage-) with a single shared key uv-${{ hashFiles('pyproject.toml') }} across all jobs in ci.yml. Also add a missing uv cache step to the build job and add uv caching to nightly-quality.yml, which previously had no cache at all. All jobs now share the same cache entry when pyproject.toml is unchanged, eliminating redundant package downloads and reducing CI wall-clock time. ISSUES CLOSED: #1535	2026-04-02 23:20:11 +00:00
freemo	6f7ced1a19	ci(pipeline): parallelize lint, typecheck, security, and quality jobs ... The lint, typecheck, security, and quality static analysis jobs already run in parallel (no needs dependencies between them). However, downstream jobs only gated on a subset of these jobs, allowing the pipeline to proceed even when some static analysis checks failed. Updated needs dependencies for downstream jobs: - coverage: [lint, typecheck] → [lint, typecheck, security, quality] - benchmark-regression: [lint, typecheck] → [lint, typecheck, security, quality] - docker: [lint, typecheck, unit_tests, security] → [lint, typecheck, security, quality, unit_tests] All four static analysis jobs (lint, typecheck, security, quality) now run in parallel and all downstream jobs correctly gate on the full set, ensuring no job proceeds unless all static analysis checks pass. ISSUES CLOSED: #1536	2026-04-02 23:17:49 +00:00
freemo	f063bed3e6	docs(timeline): update schedule adherence Day 53 (2026-04-02) ... End-of-day refresh after CLI fix wave merged 18 PRs. Key changes: - Open bugs: 143 → 6 (massive CLI fix wave resolved 137 bugs) - Open PRs: 68 → 74 (6 net new after CLI fix wave) - Open issues: 342 → 339 - M6 (v3.5.0): 77% → 79% (168/214 closed) - M8 (v3.7.0): 44% → 38% (41/107 closed, milestone grew from 81→107) - M9 (v3.8.0): 40% → 35% (17/49 closed, milestone grew from 42→49) - Added end-of-day CLI fix wave bullet to What Has Been Completed - Updated all sections with end-of-day data	2026-04-02 23:16:27 +00:00
freemo	0382b2f722	docs: update changelog and CLI reference docs for 2026-04-02 merged PRs ... - CHANGELOG: add Fixed entries for PRs #1574, #1570, #1569, #1547, #1548, #1522, #1524, #1525, #1520, #1553 covering rich output panels for session, actor, and plan commands, plus version commit SHA and provider fix - docs/reference/session_cli.md: document new rich output panels for session create (Settings, Actor Details), session list (Name column, Summary panel), session show (Automation field), session delete (Deletion Summary, Cleanup panels); update export to document --format md - docs/reference/actor_cli.md: document new rich output panels for actor remove (Actor Removed, Impact, Cleanup) and actor list (Summary panel) - docs/reference/plan_cli.md: document new rich output for plan list (Elapsed column, Filters panel, Summary panel) - docs/reference/cli_system_commands.md: document commit SHA resolution order (CLEVERAGENTS_COMMIT env var → git rev-parse → 'unknown') ISSUES CLOSED: #1574 #1570 #1569 #1547 #1548 #1522 #1524 #1525 #1520 #1553	2026-04-02 23:06:12 +00:00
freemo	629154488e	Merge pull request 'chore(agents): consolidate UAT supervisor progress reports into comments' (#1545) from improvement/uat-tester-consolidate-progress-reports into master	2026-04-02 23:02:59 +00:00
freemo	074c472e36	build(agents): restructure product-builder as supervisor launcher, force prompt_async everywhere ... The product-builder was ignoring prompt_async instructions and implementing tickets directly because its identity was "autonomous product builder that handles everything." The LLM absorbed this framing and defaulted to doing the work itself rather than launching supervisors. Root cause fix — two structural changes applied to product-builder AND all 5 pool supervisors: 1. IDENTITY REFRAME: The product-builder is now explicitly a "Supervisor Launcher and Monitor" — not a "product builder." The opening section states: "YOUR ONLY JOB: Launch 13 supervisor sessions via bash curl and keep them alive." A prominent DO NOT list prohibits implementing issues, creating PRs, writing code, or doing any work a supervisor handles. The file was compressed from 975 to 312 lines — prerequisites are brief, the supervisor launch is the first major section, and the monitoring loop is the primary content. 2. WORKER AGENTS REMOVED FROM TASK PERMISSIONS: Every pool supervisor had its worker agent in the task permissions, giving the LLM the choice to use the Task tool instead of prompt_async. Now removed: - issue-implementor: removed ca-issue-worker - ca-continuous-pr-reviewer: removed ca-pr-self-reviewer, ca-pr-checker - ca-uat-tester: removed ca-uat-tester (self-dispatch) - ca-bug-hunter: removed ca-bug-hunter (self-dispatch) - ca-test-infra-improver: removed ca-test-infra-improver (self-dispatch) Each supervisor now has a prominent framing block at the top: "YOU ARE A POOL SUPERVISOR. You dispatch workers via bash curl prompt_async. Worker agents have been REMOVED from your task permissions." Non-worker task permissions preserved (ca-ref-reader, ca-spec-reader, ca-new-issue-creator, etc.) for legitimate one-shot subagent calls.	2026-04-02 18:50:22 -04:00
freemo	dc035e9bc9	fix(session): add name field and summary section to session list JSON output (#1574) ... Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-02 22:04:39 +00:00
freemo	48cdcb6ea7	docs(spec): remove optional parentheses from required --config flags in command synopsis (#1573) ... Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-02 22:00:58 +00:00
freemo	36e6a4a520	fix(cli): add Name column, Summary panel fields, and OK message to session list rich output (#1570) ... Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-02 21:56:04 +00:00
freemo	a7af4e1921	fix(cli): add Deletion Summary and Cleanup panels to session delete rich output (#1569) ... Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-02 21:52:03 +00:00
freemo	0d5d9cf051	fix(cli): add Settings and Actor Details panels to session create rich output (#1547) ... Implements issue #1547. The agents session create command now displays Settings and Actor Details panels per specification. Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-02 21:46:15 +00:00
freemo	23edfe3d15	fix(cli): add Automation field and success message to session show rich output (#1548) ... Implements issue #1548. The agents session show command now displays the Automation field and success message per specification. Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-02 21:46:14 +00:00
freemo	1a07a891ca	fix(cli): render spec-required Filters, Summary panels and Elapsed column in agents plan list rich output (#1522) ... Implements issue #1522. The agents plan list command now displays spec-compliant rich output with proper table columns, Filters panel, Summary panel, and success message. Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-02 21:39:20 +00:00
freemo	e069a2edde	fix(cli): render Actor Removed, Impact, and Cleanup panels for actor remove command (#1524) ... Implements issue #1524. The agents actor remove command now displays the spec-required Actor Removed, Impact, and Cleanup panels, plus success message. Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-02 21:36:56 +00:00
freemo	7f626a7a47	fix(cli): add Summary panel and success message to actor list rich output (#1525) ... Implements issue #1525. The agents actor list command now displays the spec-required Summary panel with statistics and success message. Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-02 21:36:40 +00:00
freemo	71ce95fdf6	docs(specification): reorder command synopsis to separate validation commands (#1552) ... Implements issue #1552. Reorders the command synopsis in the specification to logically group validation commands separately from regular commands for better clarity. Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-02 21:30:26 +00:00
freemo	09be821a38	fix(cli): make version command show actual git commit (#1520) ... Implements issue #1520. The version command now displays the actual git commit SHA to help identify which version of the code is running. Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-02 21:30:05 +00:00
freemo	f862bcb256	Merge pull request 'fix(provider): make LangChainChatProvider name and model_id mutable properties (#1553)' (#1558) from fix/provider-immutable-properties into master	2026-04-02 21:13:37 +00:00
freemo	6a6ce518bf	fix(provider): make LangChainChatProvider name and model_id mutable properties ... The LangChainChatProvider class defined name and model_id as read-only properties without setters, causing AttributeError when PlanService attempted to set these properties after provider instantiation. Root Cause: - LangChainChatProvider.name and .model_id were @property without @setter - PlanService._resolve_ai_provider_for_actor() attempts to mutate these properties at lines 411 and 413 - This caused: AttributeError: property 'name' of 'LangChainChatProvider' object has no setter Solution: Added property setters for both name and model_id: @name.setter def name(self, value: str) -> None: self._name = value @model_id.setter def model_id(self, value: str) -> None: self._model_id = value This allows PlanService to correctly resolve provider names and model IDs without raising AttributeError. Impact: - Fixes the agents build command crash when using agents tell - No regression: existing functionality unchanged - Properties remain type-safe (str -> str) ISSUES CLOSED: #1553	2026-04-02 21:12:08 +00:00
freemo	d318d92d1f	docs(timeline): update schedule adherence Day 53 (2026-04-02) ... Late-day refresh: Open PRs 50→68 (+18 new fix PRs for UAT findings), open issues 362→342 (-20 closed), open bugs 155→143 (-12 fixed). Milestones: M3 85% (197/231), M4 80% (99/124), M5 89% (126/142), M6 77% (165/214), M7 75% (112/149), M8 44% (36/81), M9 40% (17/42). Recent merges: #1498 (tool add YAML), #1481 (session checksum), #1479 (TUI CSS), #1338 (persona export/import).	2026-04-02 20:54:36 +00:00
freemo	50357e435c	chore(agents): consolidate UAT supervisor progress reports into comments ... Approved proposal: #1483 Pattern: workflow_fix — UAT supervisor creates 13+ separate issues for progress reports instead of posting comments on a single tracking issue. Evidence: 13 separate [UAT-SUPERVISOR] Progress Report issues created in 65 minutes during v3.7.0 session, polluting the issue tracker. Fix: Create ONE tracking issue at startup, post all progress as comments. Also reduces report frequency from every 2 cycles to every 10 cycles. ISSUES CLOSED: #1483	2026-04-02 20:49:02 +00:00
freemo	5c49b2134b	feat(tui): implement shell danger detection patterns ... Implement dangerous shell pattern detection with configurable pattern registry, danger level classification, and user warning system. - Domain: ShellDangerLevel enum (LOW, MEDIUM, HIGH, CRITICAL) - Domain: DangerousPattern value object with regex matching - Domain: DangerousCommandWarning value object - Domain: DangerousPatternDetector with configurable pattern registry - Application: ShellSafetyService with warn_callback and block_level - Default patterns: rm -rf, fork bomb, dd if=, mkfs, chmod 777, sudo rm, wget/curl piped to sh/bash, git push --force - BDD tests covering all pattern categories, safe commands, registry management, and service behavior ISSUES CLOSED: #1003	2026-04-02 20:48:33 +00:00
freemo	7f5a330f23	docs(changelog): add Fixed entries for PRs #1498, #1481, #1479 ... - tool add: handle tool: wrapper key (#1471) - session export: sha256: prefix checksum (#1450) - ThoughtBlockWidget: correct background color (#1448) ISSUES CLOSED: #1471 #1450 #1448	2026-04-02 20:21:43 +00:00
freemo	c81afea06b	docs(timeline): update schedule adherence Day 53 (2026-04-02) ... End-of-day refresh: UAT supervisor fleet (cycles 11-131) discovered 100+ spec compliance bugs, surging open bug count from 50 to 155. M8 (v3.7.0) net regression from 60% to 55% (36/65) due to 29 new UAT issues. Updated milestone completion rates, gantt chart legend, risk register, current status summary, and schedule adherence entry with end-of-day data. Key changes: - Open bugs: 50 → 155 (+105 UAT discoveries) - Open PRs: 47 → 50 (+3 new UAT/bug PRs) - Open issues: 289 → 362 (+73 new UAT/refactor/bug issues) - M3 83% (190/227), M4 77% (89/115), M5 88% (126/143) - M6 78% (165/211), M7 75% (114/152), M8 55% (36/65), M9 42% (17/40)	2026-04-02 19:50:26 +00:00
freemo	0022c9c035	fix(cli): handle tool: wrapper key in agents tool add YAML config #1471 (#1498) ... Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-02 19:33:36 +00:00
freemo	71177c6e1a	docs: update changelog, API docs, and architecture for 2026-04-02 merged PRs ... - CHANGELOG: add [Unreleased] entries for TUI first-run experience (#1391), session Markdown export (#1004), and UKO provenance/temporal versioning (#891) - README: add first-run experience and Markdown transcript export bullets - docs/api/tui.md: new TUI API reference covering first-run, persona system, input routing, slash commands, session export/import, and widgets - docs/api/index.md: add TUI entry to module index - docs/api/resource.md: document DatabaseResourceHandler and DevcontainerHandler full protocol implementations with method tables and examples - docs/architecture.md: expand UKO section with provenance/temporal versioning details; update TUI design decision summary - mkdocs.yml: add TUI page to API Reference nav ISSUES CLOSED: #1391 #1004 #891	2026-04-02 19:30:53 +00:00
freemo	b96154d612	fix(session): session export checksum stored with sha256 prefix per spec #1450 (#1481) ... Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-02 19:29:50 +00:00
freemo	19d4771aa2	fix(tui): use $primary-muted background for ThoughtBlockWidget per spec #1448 (#1479) ... Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-02 19:29:49 +00:00
freemo	5eb272b50f	fix(agents): add two-phase claim protocol to prevent duplicate PR reviews ... Agent evolver identified a systematic pattern: - Pattern: Multiple reviewer pool instances claiming the same PR within seconds of each other, leading to duplicate reviews and wasted resources. - Evidence: PRs #1219, #1236, #1247, #1198 were all double-claimed by pr-reviewer-5 and pr-reviewer-4 within 28-64 seconds of each other. The existing 'check before claiming' protocol has a race window that is too small when multiple pools dispatch simultaneously. - Fix: Added a two-phase claim protocol — after posting a claim comment, wait 5 seconds and re-check for competing claims. Ties are broken by lexicographic comparison of claim tokens. This change requires human approval before taking effect.	2026-04-02 19:28:14 +00:00
freemo	d2322b3206	build(agents): add test infrastructure improver and project owner agents (13 supervisors) ... Adds two new agent types to the autonomous system, bringing the total from 11 to 13 supervisors launched by the product-builder via prompt_async. New agents: 1. ca-test-infra-improver (12th supervisor — pool with N workers): Dual-mode agent following the ca-bug-hunter pattern. In pool mode, dispatches N parallel workers via prompt_async to analyze 8 aspects of the testing infrastructure: CI execution time, coverage gaps, test architecture (BDD quality), flaky tests, CI pipeline optimization, test data quality, missing test levels (Behave/Robot/ASV per CONTRIBUTING.md), and dependency security. Workers file actionable Type/Testing or Type/Task issues. Hard constraint: never disables or weakens existing checks — only proposes additions and optimizations. Uses Gemini 2.5 Pro for large context. Follows all established patterns (clone isolation, bash sleep, prompt_async dispatch, session resume, bot signature). 2. ca-project-owner (13th supervisor — singleton, no pool): Acts as autonomous project owner. Continuously triages State/Unverified issues following CONTRIBUTING.md's 6-step triage process. Assigns MoSCoW labels (Must Have / Should Have / Could Have) based on the specification and milestone goals. Makes strategic priority decisions. Tags specific developers with questions in Forgejo comments (discovers expertise from git history and Forgejo assignments). Periodically re-evaluates MoSCoW labels as the project evolves. Follows up on unanswered questions after 48 hours. Single instance, not a pool — one project owner is sufficient. Uses Opus for nuanced strategic judgment. Launched via prompt_async like all other supervisors. Modified files: - product-builder.md: Updated from 11 to 13 supervisors in all locations (architecture table, Phase C.2 launch list with entries #12 and #13, validation count, checkpoint text, self-coordinate table). Added test-infra-pool to pool supervisors list and project-owner to singletons. - ca-human-liaison.md: Clarified MoSCoW responsibility split — the liaison only adjusts MoSCoW labels when relaying explicit human feedback. The ca-project-owner handles autonomous MoSCoW assignment.	2026-04-02 15:19:53 -04:00
freemo	48cff5cfe0	refactor(cli): rename plan lifecycle-list and lifecycle-apply to match specification ... Renames `plan lifecycle-list` to `plan list` and `plan lifecycle-apply` to `plan apply` to align with the specification's canonical command names. Removes legacy V2 plan commands that occupied those names. - Renamed CLI command registrations from lifecycle-list/lifecycle-apply to list/apply - Removed legacy V2 apply and list commands (~200 lines) - Updated apply shortcut in main.py to delegate to v3 lifecycle - Added defensive null check for plan existence in apply command - Updated 63+ test, doc, and benchmark files for consistency Closes #881 Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me> Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>	2026-04-02 19:09:04 +00:00
freemo	908d5854a3	Merge pull request 'fix(test): remove lingering @tdd_expected_fail tags for closed bugs #797 and #1028' (#1185) from feature/m3-tdd-tag-cleanup into master	2026-04-02 19:08:28 +00:00
arch-guard	136c27a337	docs(timeline): update schedule adherence Day 53 (2026-04-02) ... Mid-day refresh: 47 open PRs (+2), 289 open issues (+15 new UAT/refactor issues in v3.7.0 backlog). v3.5.0 advanced to 78% (164/209, +2 closed). v3.7.0 at 60% (36/60, +1 new issue). 50 open bugs stable. Updated sections: Gantt chart update log, footer, risk register legend, Current Status Summary, What Remains To Be Done, Day 53 schedule adherence entry (task inventory with per-developer breakdown).	2026-04-02 19:04:05 +00:00
freemo	e9c96c3d0c	docs: add API reference and architecture overview ... Add docs/api/ with per-module API documentation for core, a2a, actor, skills, tool, mcp, resource, and config packages. Add docs/architecture.md with a developer-oriented system overview including component map, layer diagram, plan lifecycle, and key design decisions. Update mkdocs.yml nav to expose both new sections. ISSUES CLOSED: #N/A	2026-04-02 19:02:53 +00:00
freemo	7e38aad929	build(agents): force prompt_async by removing supervisors from task permissions ... The product-builder was ignoring the prompt_async instructions and falling back to the Task tool for launching supervisors. It was also only launching a few supervisors instead of all 11 because the pseudocode was too abstract. Root cause: All 11 supervisor agents were listed in the task permissions, so the LLM had a choice between Task (familiar, simpler) and bash curl (correct but unfamiliar). It chose Task every time. Fix — three changes: 1. REMOVED all 11 supervisor agents from task permissions. The product- builder physically cannot invoke them via the Task tool anymore. Only one-shot agents remain in task permissions (ca-epic-planner, ca-session-persister, ca-product-verifier, ca-ref-reader, etc.). 2. REWROTE Phase C.2 as concrete curl command templates instead of abstract pseudocode. The agent now has the exact curl pattern to copy-paste for each supervisor, with clear variable placeholders. Added a mandatory validation step: wc -l the tracking file and confirm exactly 11 entries before proceeding. 3. ADDED aggressive warnings at three levels: - Top of file: bold mandatory notice about prompt_async - Phase C.2: large boxed warning block prohibiting the Task tool - Coordination rules: explicit statement that supervisors are removed from task permissions - Monitoring loop: reminder to use bash curl for re-launches	2026-04-02 18:52:09 +00:00
freemo	4ecf446360	build(agents): open bash permissions to allow complex commands ... Agents were failing when trying to run complex bash commands (curl with pipes to python3, multi-command pipelines, etc.) because their bash permissions were set to '"*": deny' with only specific simple patterns allowed (e.g., "curl *": allow). Shell pipelines like: curl -s http://localhost:4096/session | python3 -c "import json..." don't match any single allow pattern and get denied. Changed 17 agent files from restrictive bash permissions to '"*": allow'. This includes all agents that need to: - Run curl pipelines with python3 for prompt_async session management - Create Forgejo dependency links via REST API curl calls - Execute complex git operations with pipes - Run bash sleep for polling loops Only 3 truly read-only analysis agents remain restricted: ca-difficulty-evaluator, ca-implementation-reviewer, ca-issue-analyzer. These don't need bash access at all.	2026-04-02 18:36:23 +00:00
freemo	3e9de4ca21	build(agents): enforce CONTRIBUTING.md label, milestone, and dependency compliance ... Issues and PRs created by agents were missing required labels, milestones, and Forgejo dependency links per CONTRIBUTING.md. This commit adds explicit API call instructions and a continuous compliance audit to fix the gaps. Changes across 6 agent definitions: - ca-new-issue-creator: Added curl bash permission. Added explicit post-creation compliance steps: set labels (State/Unverified, Type/*, Priority/*) via forgejo_add_issue_labels, set milestone via forgejo_update_issue, create parent Epic dependency link via REST API (POST /issues/{child}/blocks with parent Epic number — correct direction: child blocks parent). Added compliance verification step. - ca-epic-planner: Added curl bash permission. Added post-creation API call checklists for both Epics (labels, Legendary link) and child issues (labels, milestone, Epic dependency link, inter-issue dependency links). Added compliance verification step. - ca-backlog-groomer: Added curl and sleep bash permissions. Expanded Pass 4 (Label Quality) to auto-fix missing labels (State, Type, Priority) and milestones via Forgejo API. Added PR label/milestone compliance checking. Added new Pass 9 (Dependency Link Compliance) to auto-fix missing parent Epic links, PR-to-issue links, and wrong dependency direction. Added new Pass 10 (Issue Body Compliance) to flag missing Metadata, Subtasks, and Definition of Done sections. - ca-pr-api-creator: Added curl bash permission. Replaced vague "add dependency" instruction with explicit REST API curl call for creating PR-blocks-issue dependency link. Added post-creation compliance verification step. - ca-agent-evolver: Added Priority/Backlog label and milestone assignment to proposal issues. - ca-spec-updater: Added Priority/Backlog label and milestone assignment to proposal issues.	2026-04-02 18:28:08 +00:00