Commit Graph

1968 Commits

Author SHA1 Message Date
freemo 83ad855acb docs(skill): generalise SKILL.md for any programming language
Remove project-specific src/cleveragents/ path (now src/<package>/ with
examples). Replace all bare nox/Pyright/ruff/Behave references with the
language-agnostic 'task runner / type checker / linter / BDD framework'
abstractions, keeping the project-specific tool as a parenthetical example.

Add ecosystem-equivalents reference table (Python, JS/TS, Java/Kotlin, Go)
in the Quick Command Reference. Generalise type-suppression rules across
languages (# type: ignore, @ts-ignore, @SuppressWarnings). Generalise
TDD assertion failure type requirement with Python, Java, and JS examples.
Generalise import rules, project manifest references, and directory layout
descriptions. Remove Python-only step-file naming; add multi-language
examples throughout.

LangChain/LangGraph and v3/legacy plan workflow sections are left as-is
and clearly labelled as project-specific.

ISSUES CLOSED: #0
2026-04-16 05:54:03 +00:00
freemo c583ca0b1e docs(skill): expand cleverthis-guidelines SKILL.md with missing rules and new decision trees
Added 11 new decision trees (branch naming, documentation traceability,
nox session guide, CI failure diagnosis, file organization, dev setup,
Issue/Epic/Legendary hierarchy, ticket well-scoped checklist, v3 vs
legacy plan workflow, release process, TDD issue-capture test detail).

Expanded existing trees with previously missing rules: specification-
first development mandate, file organization per directory, backwards
compatibility policy (none pre-v3.0.0), AssertionError-only rule for
TDD expected-fail steps, tdd/mN- and bugfix/mN- branch naming with
shared suffix requirement, different-assignees preference for TDD vs
fix, full CI job list with required-for-merge gates, all nox sessions
(e2e_tests, benchmark, benchmark_regression, complexity, docs, build).

Fixed PR approval count from 2 to 1 (project-specific override; self-
approval permitted per CONTRIBUTING.md). Updated Key Numbers table with
12 new rows covering CI triggers, release trigger, ULID format, required
CI jobs, backwards compat start, dependency direction, and more.

ISSUES CLOSED: #0
2026-04-16 05:54:03 +00:00
freemo 4a5d798075 feat(skills): add cleverthis-guidelines agent skill
Adds a comprehensive opencode skill under .opencode/skills/cleverthis-guidelines/
covering every rule, regulation, directive, and guideline governing CleverThis
projects and company operations. Synthesized from CONTRIBUTING.md and the
CleverThis Operations Code (C.O.C. v0.4, 70 pages).

- 12 files, 2,384 lines across 11 reference categories
- 1,059-line SKILL.md with 16 exhaustive decision trees covering every
  procedural situation: writing code, committing, submitting PRs, code review,
  creating issues, applying labels, ticket state transitions, sprint planning,
  triaging, point estimation, definition of done, authoring documents,
  confidentiality classification, security/credentials, FOSS, bug fixes (TDD),
  architectural decisions, and escalation paths

Reference files cover:
  commits/     — Conventional Changelog format, atomic commit rules, pre-commit
  pull-requests/ — all 12 PR requirements, review process, merge criteria
  testing/     — BDD/Behave (unit), Robot Framework (integration), 97% coverage
                 threshold (project-specific), TDD bug fix workflow, mocking rules
  issue-tracking/ — ticket hierarchy (Issue→Epic→Legendary), all quality criteria,
                    mandatory issue sections, full label system (State/Type/Priority/
                    MoSCoW/Special), lifecycle flow, dependency direction rules
  sprints/     — DSDM, 6-stage triaging, MoSCoW, poker point estimation,
                 all 4 sprint ceremonies with complete rule sets
  code-style/  — SOLID, design patterns, import rules, error handling, type safety,
                 LangChain/LangGraph guidelines, v3 vs legacy plan lifecycle
  security/    — gopass-only password management, Yubikey rules, encryption policy
  information/ — 5 confidentiality stamp levels, document authoring, email conventions
  organizational/ — C-level hierarchy, ELB, OCRB, all 12 committees, personnel review
  project-tools/ — nox commands, CI/CD, release process, Hatch, Commitizen setup
  open-source/ — FOSS governance, open standards mandate, POSIX compliance

Key project-specific facts documented:
  - Coverage threshold: 97% (overrides C.O.C. baseline of 85%)
  - BDD framework: Behave (not pytest alone)
  - Type checker: Pyright (never disabled, no type: ignore)
  - Bug fixes: mandatory TDD workflow with @tdd_expected_fail tagging
2026-04-16 05:54:03 +00:00
freemo b82148ab6c fix(agents): improve label-manager permissions, merge supervisor clarity, and product-builder variable naming
forgejo-label-manager.md:
- Refactored curl permission rules to use explicit allow/deny ordering with
  clear comments explaining each rule; consolidated overlapping deny patterns
- Switched to curl-only approach via forgejo-api skill (deny all Forgejo MCP tools)
- Added read: deny and skill forgejo-api: allow to enforce the curl-only model
- Clarified permission block structure: deny by default, specific allows per endpoint

pr-merge-pool-supervisor.md:
- Expanded 'What You Receive' section to list each field individually with bold
  labels for clarity (owner, repo, PAT, git email/name, briefing)

product-builder.md:
- Added 'Local Variable' column to the Required Information table so agents know
  the canonical variable names to reuse throughout prompts
- Added forgejo_url, forgejo_owner, and forgejo_repo as explicit gather targets
  with env var fallbacks and remote-detection instructions
- Added concrete remote URL parsing example showing how to extract host/owner/repo
2026-04-16 05:54:03 +00:00
freemo 2edb05a2e5 fix(skills): comprehensive final audit pass for programming-patterns skill
Fixes and improvements from exhaustive audit:

Consistency fixes in SKILL.md:
- 'Pipe & Filter' → 'Pipe and Filter' (one stray '&' found and corrected)
- 'Singleton for factory instance' → clarified to 'register factory as
  singleton-scoped via DI container' (less misleading wording)
- Documentation Format section updated with note that SKILL.md itself is the
  authoritative source for related-pattern combinations

Coverage fix — Related Patterns sections:
- Added '## Related Patterns' to ALL 94 pattern files (was 0/94)
- Each section lists 3–6 related patterns with relationship descriptions
- Covers: why they're related, when to prefer one vs the other,
  and which are often confused

SOLID principles → Creational → Structural → Behavioral → Architectural →
Concurrency → Functional → Resilience → Data Access → Messaging →
Testing → Error Handling → Microservice — all 13 categories covered

Code verification:
- Python: 0 failures (all 85 testable blocks pass)
- Go: 0 failures (all 76 testable blocks pass)
- JavaScript: 0 failures (all 78 testable blocks pass)
- All 239 code blocks verified correct after edits

Final skill state:
- 108 files, 36,524 lines across 13 reference categories
- 94/94 pattern files have Related Patterns sections
- 2,815-line SKILL.md with 67 decision trees, 23 scenarios,
  0 broken references, 0 naming inconsistencies
2026-04-16 05:54:03 +00:00
freemo d2784ee7c9 docs(skills): expand programming-patterns SKILL.md — 16 new trees, 5 new scenarios, 2 new sections
Growth: 2,244 → 2,811 lines

New decision trees added (51 → 67):
  GraphQL API, data validation & sanitization, payment processing,
  booking/reservation systems, recommendation engines, distributed locking,
  graceful startup/shutdown lifecycle, schema/data migration, SaaS onboarding
  wizards, social graphs, API SDK design, multi-step form/wizard UI,
  user preferences management, microservice chassis/platform,
  dependency injection containers, import/export systems

New compound scenarios added (18 → 23):
  Scenario 19: Payment processing with provider failover
  Scenario 20: Hotel/resource booking with concurrent hold resolution
  Scenario 21: SaaS onboarding with multi-tenant provisioning
  Scenario 22: Distributed rate limiting across service instances
  Scenario 23: Recommendation engine with A/B testing and fallback

New sections added:
  '🔗 Pattern Synergies' — 20-row table of patterns that are always better together
  ' Code Review Checklist' — 30-item pattern-coverage checklist for PRs
    covering every class, service, external call, conditional, loop, and test
2026-04-16 05:54:02 +00:00
freemo 5b4cabeb11 docs(skills): expand programming-patterns SKILL.md with 17 new decision trees and 6 new scenarios
- 476 → 1,569 → 2,244 lines total growth
- Decision trees: 6 → 34 → 51 situation-specific trees
- Compound scenarios: 12 → 18 full architecture maps
- New trees added in this pass:
    search/discovery, game/simulation, feature flags, subscriptions/billing,
    soft delete/archiving, i18n/localization, database optimization,
    AI agents/LLM systems, file upload/media, CMS, OAuth2/SSO,
    graph traversal, audit/compliance, real-time collaboration,
    API versioning, bulk/batch processing, pagination/filtering,
    webhook delivery (17 new trees)
- New scenarios added:
    user registration with email verification, faceted search,
    feature flag system, shopping cart with session, rate limiting
    infrastructure, AI agent with tool use (6 new scenarios)
- New sections:
    'Pattern Progression' (5-stage evolution for a data service and flag)
    'Minimum Pattern Set per Component Type' (table of 15 component types)
    'When to Skip Patterns — Never' table expanded to 25 rationalizations
- All file references validated (0 broken)
2026-04-16 05:54:02 +00:00
freemo 779e258500 feat(skills): add exhaustive programming patterns agent skill
Adds a comprehensive opencode skill under .opencode/skills/programming-patterns/
covering 90+ design, architectural, concurrency, and functional patterns.

- 108 files, 33,500+ lines across 13 reference categories
- Every pattern: pseudocode + tested Python + Go + JavaScript implementations
- All 239 code blocks verified passing (85 Python, 76 Go, 78 JS)
- 1,569-line SKILL.md with:
  - Master decision tree (all 14 categories with multi-pattern suggestions)
  - 34 situation-specific decision trees covering every programming scenario
    (new feature, refactoring, REST API, CLI, data pipeline, rule engine,
     external integration, performance, memory, notifications, plugins,
     caching, events, auth, reporting, vendor lock-in, domain model,
     business rules, observability, file I/O, scheduling, testability,
     third-party libs, concurrency, complex domain interactions)
  - 12 compound pattern-combination scenarios with full architecture maps
    (e-commerce checkout, REST endpoint, background jobs, real-time dashboard,
     microservice resilience, ML pipeline, text editor, legacy migration,
     multi-tenant SaaS, document approval, financial transactions, chat)
  - 'When Am I Allowed to Skip Patterns?' mandate table (answer: never)
  - Quick pattern lookup tables for all 90+ patterns
  - Complete reference index
2026-04-16 05:54:02 +00:00
clever-agent 287d948852 Build: Added back the benchmark tests but made them so they only run after pull requests into master 2026-04-16 05:54:02 +00:00
HAL9000 6215efa0be fix(agents): make bug-hunt-pool-supervisor tracking non-blocking to prevent initialization hangs 2026-04-16 05:54:02 +00:00
HAL9000 f1bf30340a spec: document JSON-RPC 2.0 A2A wire format (AUTO-ARCH-8)
Updates the A2A Protocol section to reflect the rename of A2aRequest/
A2aResponse fields to standard JSON-RPC 2.0 names (method, id, result,
error). Documents A2aVersionNegotiator for backward compatibility.

Closes #8787
2026-04-16 05:54:02 +00:00
HAL9000 4735fc5eef fix(tests): resolve nox unit_tests timeout for agent_skills_loader and skill_search features
Adjusted test running and file-detection logic to stabilize unit tests in overlayfs environments and improve target feature handling.

- Modified scripts/run_behave_parallel.py to run sequentially when there are 2 or fewer feature files, avoiding fork deadlocks on overlayfs and reducing nox-based unit test timeouts for agent_skills_loader and skill_search features.
- Updated noxfile.py to correctly detect feature files in posargs, fixing the prior logic that appended the "features/" directory when specific feature files were provided. This ensures precise test selection and avoids unnecessary path expansion.

Rationale:
These changes address the root causes of flaky unit test timeouts by preventing problematic forking behavior with small feature sets and by ensuring nox respects explicitly provided feature file paths.

ISSUES CLOSED: #9374
2026-04-16 05:54:02 +00:00
HAL9000 8819b0063e chore(agents): improve pr-review-pool-supervisor — fix tracking prefix mismatch causing duplicate issues
Approved proposal: #7602
Pattern: workflow_fix
Evidence: Watchdog (Cycle 15, #7587) reports HIGH severity systemic issue —
AUTO-REV-SUP creating 10+ duplicate tracking issues per cycle. Root cause:
agent definition uses AUTO-REV-POOL prefix in ATM calls but actual issues
use AUTO-REV-SUP prefix. ATM cannot find/close old issues → duplicates.
Fix: Updated all tracking prefix references from AUTO-REV-POOL to AUTO-REV-SUP
and tracking type from 'Review Pool Status' to 'PR Review Pool Status'.

ISSUES CLOSED: #7602

# Conflicts:
#	.opencode/agents/pr-review-pool-supervisor.md
2026-04-16 05:54:02 +00:00
HAL9000 a80da4f410 docs(contributors): add HAL 9000 plugin security hardening contribution detail
Added detail entry for HAL 9000's contribution to the plugin entry point security hardening fix (#7476).

ISSUES CLOSED: #7476
2026-04-16 05:54:02 +00:00
HAL9000 8a0918780a docs(contributors): add HAL 9000 to contributors list
ISSUES CLOSED: #7476
2026-04-16 05:54:02 +00:00
HAL9000 03056d7ee9 fix(security): add Robot integration test and CONTRIBUTORS for #7476
Add Robot Framework integration test verifying that load_from_entry_points
does not call ep.load() for entry points with disallowed module prefixes
(security regression test for issue #7476).

Also add HAL 9000 to CONTRIBUTORS.md per CONTRIBUTING.md process rules.

ISSUES CLOSED: #7476
2026-04-16 05:54:02 +00:00
HAL9000 37318e1764 fix(security): fix plugins/loader.py load_from_entry_point security #7476
Parse entry point targets before import so allowlist enforcement happens prior to execution and add a Behave regression scenario covering the disallowed-prefix path.

ISSUES CLOSED: #7476
2026-04-16 05:54:02 +00:00
hurui200320 7ca1f24bdd fix(testing): document and harden non-AssertionError guard in apply_tdd_inversion to reduce flaky CI
Surface the non-AssertionError guard warning in standard Behave output by emitting to stderr in addition to the structured logger, and add infrastructure coverage that asserts this guard path is visible during test runs. Document the @tdd_expected_fail expectation that bug-signaling failures must use AssertionError so infrastructure exceptions are not accidentally treated as expected bug failures.

ISSUES CLOSED: #8294
2026-04-16 05:54:02 +00:00
CleverAgents Build Agent 27342f5ac6 feat(skills): add exhaustive Forgejo REST API agent skill
Adds a comprehensive opencode skill under .opencode/skills/forgejo-api/
covering all 473 Forgejo REST API endpoints across 25 reference categories.

- 78 files, 23,000+ lines, 149 distinct path parameter types
- Every curl command parameterised ({owner}/{repo}/{index}/etc) and
  tested against the live git.cleverthis.com server
- SKILL.md: 917-line entry point with quick-answer curl commands (35),
  jq cheat sheet for chaining API calls, 14 decision trees, 12 critical
  concepts (exclusive labels, lazy mergeability, SHA locking, auto-close
  keywords, search envelope differences, 412 stale-edit protection), full
  HTTP status code table, and environment variable reference
- references/pull-requests/: CRUD, 6 merge styles, automerge, server-side
  rebase without local clone, inline review comments, diff/patch
- references/issues/: comments, reactions, attachments, dependencies,
  time tracking, stopwatches, pinning
- references/labels/: repo + org labels, exclusive label groups,
  GET/POST/PUT/DELETE on issues and PRs
- references/ci-actions/ + references/commit-statuses/: workflow runs,
  dispatch, secrets, variables, quality gate verification
- references/web-interface/ci-logs.md: step-by-step CI log access via
  CSRF web session (not available through REST API)
- references/complex-workflows/: 10 multi-step recipes including
  PR review cycle, issue lifecycle, CI status check, server-side rebase,
  automerge, release workflow, org setup, fork contribution
2026-04-16 05:54:02 +00:00
hurui200320 1a4b2d2fae fix(testing): print behave-parallel worker logs only for failed chunks
In parallel mode, the behave runner previously replayed captured
stdout/stderr for every worker chunk, creating noisy output that
obscured failure diagnostics in CI and local runs.

Changes to scripts/run_behave_parallel.py:

- Added _chunk_has_failures() and _chunk_no_scenarios_ran() helpers
  to evaluate individual chunk summaries for failure/error/crash
  conditions.

- Updated the aggregation loop in main() to conditionally replay
  captured stdout/stderr only for chunks whose summary indicates
  failures, errors, or no scenarios ran (crash detection).  Passing
  chunks now suppress their output entirely.

- Added robust exception handling in _worker_run_features() so that
  worker crashes produce a full traceback in stderr and return a crash
  summary with features.errors = 1, enabling the parent to detect the
  crash via _chunk_has_failures (and also _chunk_no_scenarios_ran,
  since no scenarios reached a terminal state) and replay the
  diagnostics.

- The conditional replay uses summary-based checks rather than the
  raw runner.run() boolean, consistent with the existing exit-code
  logic.  This avoids spurious log replay for @tdd_expected_fail
  scenarios whose runner.run() returns True even though the TDD
  inversion handler has corrected the scenario status to passed.

- Existing summary merge, exit semantics, and the no-scenarios
  safety net are fully preserved.

New Behave unit tests (17 scenarios) cover the chunk-level helpers,
the conditional aggregation loop, the pure no-scenarios-ran path,
stderr replay for non-crash failed chunks, and the worker crash path.
New Robot integration tests (6 test cases) verify the same behavior
end-to-end via the helper_behave_parallel_log_filtering.py script.

Also updated:
- CHANGELOG.md: add unreleased entry for this behavioral change.
- features/steps/behave_parallel_log_filtering_steps.py: use
  contextlib.redirect_stdout/redirect_stderr instead of manual
  sys.stdout assignment; register module in sys.modules; document
  CWD requirement in _load_runner_module().
- robot/helper_behave_parallel_log_filtering.py: move import io to
  top-level; remove redundant inline imports; use contextlib for
  output capture; register module in sys.modules; document CWD
  requirement.

Branch note: the canonical branch for this fix is
bugfix/m3-behave-parallel-failed-chunk-logs.  The PR head branch
(bugfix/mX-behave-parallel-failed-chunk-logs) cannot be renamed via
the Forgejo API; both branches are kept in sync at the same SHA.

ISSUES CLOSED: #8351
2026-04-16 05:54:02 +00:00
HAL9000 422fa73f8d fix(concurrency): protect validate_fragment_scope with lock and update CONTRIBUTORS
- Wrapped validate_fragment_scope() body with self._lock to prevent
  RuntimeError: dictionary changed size during iteration when another
  thread mutates the tier stores during scope validation
- Updated CONTRIBUTORS.md to document HAL 9000's concurrency safety
  contributions including thread-safe context tier management (issue #7547)

Fixes review feedback from PR #8279.

ISSUES CLOSED: #7547
2026-04-16 05:54:02 +00:00
HAL9000 e67c9c4a8f fix(concurrency): add thread safety to ContextTierService
Implemented thread-safety improvements for ContextTierService by
introducing a re-entrant lock and guarding all critical sections
with self._lock. This prevents RuntimeError: dictionary changed
size during iteration under concurrent plan execution.

- Added threading.RLock to ContextTierService.__init__ as self._lock
- Wrapped all public methods (store, get, promote, demote, evict_lru,
  get_metrics, get_all_fragments, get_hot_fragments, get_for_actor,
  get_scoped_view) with with self._lock:
- Added _lock: threading.RLock type stub to TierRuntimeMixin and
  ScopedTierMixin
- Wrapped enforce_staleness in TierRuntimeMixin with self._lock
- Wrapped get_scoped_by_resource and get_scoped_metrics in
  ScopedTierMixin with self._lock
- Extracted settings helpers to new context_tier_settings.py to keep
  context_tiers.py under 500 lines
- Added BDD feature file context_tier_thread_safety.feature with
  10 thread-safety scenarios
- Added step definitions context_tier_thread_safety_steps.py
- Updated CHANGELOG.md with fix entry

ISSUES CLOSED: #7547
2026-04-16 05:54:02 +00:00
HAL9000 efd84bcb03 fix(cli): --format color now emits ANSI-coloured output instead of plain text
Route the COLOR format option through format_output_session (which uses
ColorMaterializer) instead of _format_plain. Previously --format color
produced identical output to --format plain because both were routed to
the same plain-text formatter. All other formats (plain, json, yaml,
rich, table) remain unaffected.

Updated CHANGELOG.md with the fix entry and CONTRIBUTORS.md with HAL 9000
contribution details.

ISSUES CLOSED: #7910
2026-04-16 05:54:02 +00:00
HAL9000 0ad8929449 fix(tests): fix create_template_db.py to create writable SQLite template database
Added os.chmod(db_path, 0o664) after database creation to ensure the template
database has writable permissions. This prevents sqlite3.OperationalError: attempt
to write a readonly database when tests copy and modify the template during test
setup.

The template database is now created with rw-rw-r-- (664) permissions instead of
the default rw-r--r-- (644), allowing the test runner process to write to it.

ISSUES CLOSED: #9372
2026-04-16 05:54:02 +00:00
HAL9000 708f15b84f fix(cli): add missing "✓ OK" footer to agents plan errors rich output
ISSUES CLOSED: #9355
2026-04-16 05:54:02 +00:00
CleverAgents Build Agent 95e6052cc5 Build: sped up bootstrap time of pr-merge pool agent 2026-04-16 05:54:02 +00:00
CoreRasurae 7c9f6d095c feat(plan): implement LLM-powered strategy actor
Implement StrategyActor class for the plan strategize phase that uses an
LLM to produce hierarchical execution strategies with dependencies,
resource requirements, estimated complexity, and risk scores.

Key components:
- StrategyActor: Core actor with LLM prompt construction, response
  parsing (JSON and numbered-list fallback), and graceful degradation
  to StrategizeStubActor when no LLM provider is configured
- StrategyAction/StrategyTree: Pydantic models for the hierarchical
  action tree with dependency links
- validate_no_cycles(): Kahns algorithm (deque-based) for dependency
  graph cycle detection, raising PlanError on circular dependencies
- build_strategy_prompt(): Context-aware prompt construction using
  definition_of_done, resources, project context, and ACMS analysis
  with XML-delimited user content sections for prompt injection
  hardening
- parse_strategy_response(): Robust LLM output parsing with JSON
  extraction and numbered-list fallback
- resolve_strategy_actor(): Integration point for the existing
  actor.default.strategy config key (CLEVERAGENTS_DEFAULT_STRATEGY_ACTOR)
- Decision conversion producing strategy_choice Decision objects
- build_decisions() preserves tree hierarchy via parent_id mapping,
  populates downstream_decision_ids from dependency edges, and
  validates plan_id

Structural tree hierarchy (B2 review fix):
- _build_tree infers parent_id from the dependency graph: each
  actions first resolved dependency becomes its structural parent.
  Actions with no dependencies fall back to the root.  This produces
  hierarchical trees for agents plan tree rendering per spec
  Plan Decision Tree.

Downstream decision tracking (B3 review fix):
- build_decisions populates downstream_decision_ids from the strategy
  trees dependency edges using a pre-generated decision_id map so
  influence relationships between decisions are recorded per the spec
  Decision Record Structure.

Post code-review hardening (PR #1175):
- Broadened exception handling in execute() and ACMS retrieval to
  catch all LLM provider errors (openai, httpx, anthropic, etc.)
  with graceful fallback to stub mode (H1, H2)
- Added warning log for unresolvable dependency references so
  dropped edges are visible in structured logs (H3)
- Added XML-delimited user content sections and explicit data-only
  instructions in system prompt for prompt injection hardening (H4)
- Switched prompt truncation to word-boundary-safe _truncate_at_word()
  for all prompt input sections (M1)
- Fixed _parse_actor_name to preserve user-specified provider or
  model when only one segment is empty, instead of discarding both (M2)
- Annotated _build_invariant_records as placeholder pending the
  Invariant Reconciliation Actor implementation (M5)
- Documented resources/project_context params as future-wired
  through PlanExecutor.run_strategize() (M8)
- Added docstring noting supersession relationship with
  LLMStrategizeActor in llm_actors.py (M9)
- Added __all__ export definition (L2)
- Improved validate_no_cycles docstring edge direction semantics (L7)
- Cap JSON parse retry loop at _MAX_JSON_PARSE_RETRIES (10)

Post second code-review hardening (PR #1175, review cycle 2):
- Fixed _truncate_at_word docstring: documented max_chars >= 3
  precondition for the result-length guarantee (R-H1)
- Added warning log in build_decisions for unresolvable parent_id
  references, matching the existing _build_tree warning for
  unresolvable dependency references (R-H2)
- Fixed _parse_actor_name to handle whitespace-only input by adding
  actor_name.strip() check alongside the emptiness check (R-M1)
- Tightened ACMS scenario assertions from non-empty to expected
  count of 5 decisions (R-L3)
- Added timeout=60s on_timeout=kill to all Robot test cases for
  consistency with project patterns (R-M5)

Post third code-review hardening (PR #1175, review cycle 3):
- Added _sanitize_xml_content() to escape XML special characters
  (<, >, &) in user content before embedding into XML-delimited
  prompt sections, preventing prompt injection via forged closing
  tags (spec Prompt Injection Mitigation) (CR3-M1)
- Upgraded _try_parse_json() to multi-anchor retry: collects all
  [{ positions left-to-right and tries each as a candidate start,
  fixing false-start anchoring when LLM preamble contains [{
  fragments before the real JSON array (CR3-M2)
- Added _truncate_at_word() guard for max_chars < 3: returns a
  hard slice instead of word-boundary truncation when the ellipsis
  would exceed the limit (CR3-L2)
- Changed _build_tree collision fallback key from -(idx+1) to
  -(1_000_000+idx) to eliminate theoretical collision with
  LLM-produced negative step numbers (CR3-L3)
- Added forward-looking API docstring note to build_decisions()
  documenting that it is not yet wired into PlanExecutor and will
  be integrated once Decision persistence lands (CR3-M3)

Post fourth code-review hardening (PR #1175, review cycle 4):
- Fixed _try_parse_json per-anchor retry counter: reset retries=0
  at the start of each anchor iteration so false-start [{ anchors
  in LLM preamble text no longer exhaust the retry budget for the
  correct anchor (CR4-B1)
- Added known-limitations docstring to module header documenting
  missing decision types (resource_selection, subplan_spawn,
  invariant_enforced) as future work (CR4-D1)
- Rewrote XML injection assertion in test to use regex extraction
  instead of fragile chained .split() calls that could IndexError
  on structural changes (CR4-T5)

Post fifth code-review hardening (PR #1175, review cycle 5):
- Added warning log in build_decisions for empty-string parent_id
  (distinct from None) so the silent fallback to root is visible
  in structured logs for debuggability (CR5-B1)
- Added plan_id propagation assertion to build_decisions test
  scenarios verifying decision.plan_id matches the input (CR5-T1)
- Added sequence_number monotonicity assertion verifying decision
  sequence_numbers are zero-indexed and monotonically increasing
  (CR5-T2)
- Added _truncate_at_word boundary test for max_chars=3 (exactly
  ellipsis length) verifying correct "..." output (CR5-T3)
- Tightened false-start anchor test from permissive len>=1 to
  specific description match "Sole real action" (CR5-T4)
- Added word-boundary truncation test using space-separated input
  to exercise the rfind(" ") path under oversized DoD (CR5-T5)

Post sixth code-review hardening (PR #1175, review cycle 6):
- Added _MAX_INVARIANTS cap (100) for invariant list truncation in
  prompt to prevent token limit overflows, consistent with other prompt
  section caps (CR6-M4)
- Added negative max_chars guard in _truncate_at_word returning empty
  string instead of slicing from end (CR6-M5)
- Added global JSON parse attempt cap _MAX_GLOBAL_JSON_ATTEMPTS (50)
  across all anchors in _try_parse_json (CR6-L3)
- Moved re import to module level in strategy_parsing.py per
  CONTRIBUTING import guidelines (CR6-L4)
- Extracted _DEFAULT_DESCRIPTION constant to eliminate duplication
  between _default_action() and _build_tree() (CR6-L5)

Post seventh code-review hardening (PR #1175, review cycle 7):
- Decoupled _execute_stub from StrategizeStubActor._parse_steps
  private method by delegating to parse_strategy_response, removing
  cross-class private method dependency (CR7-M1)
- Added ULID format validation on plan_id in execute() and
  build_decisions() for spec-consistent argument validation per
  §Plan glossary and CONTRIBUTING §Argument Validation (CR7-M2)
- Constrained StrategyAction.estimated_complexity to
  Literal["low", "medium", "high"] at Pydantic model level per
  CONTRIBUTING §Type Safety (CR7-M5)
- Documented XML-tag prompt boundary deviation from spec
  [USER_CONTENT_START]/[USER_CONTENT_END] markers with rationale
  for the more structured approach (CR7-M6)
- Added _build_tree empty-input guard comment documenting orphaned
  root_id semantics (CR7-L1)
- Added _truncate_at_word > 0 intent comment explaining why
  position-0 space is intentionally excluded (CR7-L2)
- Added build_decisions context_snapshot future-work comment
  referencing spec §Decision Record Structure (CR7-L5)
- Used enumerate() in _build_tree first loop for idiomatic
  Python (CR7-L7)
- Fixed false-start anchor test (CR5-T4) broken by CR6-L3 global
  cap: reduced preamble fragments from 15 to 3 so total attempts
  stay within _MAX_GLOBAL_JSON_ATTEMPTS (CR7-T1)
- Fixed test plan_ids containing non-Crockford-Base32 characters
  (L→K) to pass ULID format validation (CR7-T2)

Tests:
- 105 Behave BDD scenarios in features/strategy_actor_llm.feature
  adding: global JSON attempt cap exhaustion (CR7-L3), orphaned
  dependency edge silent drop (CR7-L4), non-ULID plan_id rejection
  in execute() and build_decisions() (CR7-M2)
- 101 Behave BDD scenarios in features/strategy_actor_llm.feature
  including new scenarios for _truncate_at_word edge cases (L3),
  create_llm argument verification (L4), non-numeric step field
  fallback (L5), updated assertions for XML-delimited prompts
  and _parse_actor_name partial-segment preservation (M2),
  lifecycle exception fallback (R1), PydanticValidationError
  re-raise verification (R2), self-loop cycle detection (R3),
  whitespace-only actor name (R4), XML tag injection sanitisation
  (CR3-M1), preamble bracket fragment parsing (CR3-M2),
  _truncate_at_word sub-3 limit (CR3-L2), resolve_strategy_actor
  with both llm config and registry (CR3-L5), build_decisions
  unresolvable parent_id fallback (CR3-L7), XML injection in
  resources/project_context/acms_context fields (CR4-S1),
  ampersand escaping (CR4-S1d), false-start anchor retry budget
  (CR4-T3), non-sequential step edge specificity (CR4-T4),
  plan_id propagation (CR5-T1), sequence_number monotonicity
  (CR5-T2), max_chars=3 boundary (CR5-T3), false-start anchor
  specificity (CR5-T4), word-boundary truncation (CR5-T5),
  invariant prompt constraints (CR6-M2), invariant XML
  sanitisation (CR6-M3), invariant truncation cap (CR6-M4),
  negative max_chars (CR6-M5), and no-space truncation (CR6-L8)
- 7 Robot Framework integration tests in robot/strategy_actor.robot
- Mock LLM provider in features/mocks/mock_strategy_llm.py

All nox stages pass: lint, typecheck, unit_tests (13789 scenarios),
integration_tests (1863 passed).
integration_tests (1863 passed, 2 pre-existing TDD failures unrelated
to this change).

ISSUES CLOSED: #828
2026-04-16 05:54:01 +00:00
CleverAgents Build Agent abcbe2b3a6 Build: doom loops are detected and killed 2026-04-16 05:54:01 +00:00
CleverAgents Build Agent dc78c55d34 Build: Refined some of the wording in the supervisors to get more reliable performance out of them. Made permissions stricter so we will get less circumvention of intended permissions 2026-04-16 05:54:01 +00:00
HAL9000 1f4b4d6667 docs(timeline): update schedule adherence Day 104 (2026-04-14) [AUTO-TIME-1] 2026-04-16 05:54:01 +00:00
CleverAgents Build Agent d3002b21f4 Build: Improved merge, review, and implementor logic to have better and more clear priorities 2026-04-16 05:54:01 +00:00
HAL9000 9984eb56ab docs(spec): add v3.8.0 Server Implementation milestone plan and update status table (#7701)
Co-authored-by: CleverThis <hal9000@cleverthis.com>
Co-committed-by: CleverThis <hal9000@cleverthis.com>
2026-04-16 05:54:01 +00:00
HAL9000 3c824ad89c docs(api): add ACMS/UKO API reference and update nav
Add comprehensive API documentation for the cleveragents.acms package,
covering the four-layer UKO ontology hierarchy (Layer 0-3), all public
types (VocabularyRegistry, ProvenanceInfo, UKOClass, UKOProperty,
UKOVocabulary, Layer2Dependency, ParadigmVocabulary), detail level maps
(DetailLevelMapBuilder, build_detail_level_map, build_effective_map,
resolve_detail_level), and all Layer 3 language vocabulary types for
Python, TypeScript, Rust, and Java.

- Add docs/api/acms.md with full API reference and usage example
- Update docs/api/index.md to include ACMS/UKO in the module index
- Update mkdocs.yml nav to include the new ACMS/UKO page
- Update CHANGELOG.md [Unreleased] with the documentation addition
2026-04-16 05:54:01 +00:00
CleverAgents Bot 321fcfda49 docs(timeline): update schedule adherence Day 102 (2026-04-12) 2026-04-16 05:40:50 +00:00
HAL9000 885eebeb1f docs: integrate docs-writer automation tracking workflows
- document docs-writer responsibilities and automation tracking requirements\n- enforce automation tracking label validation and clean coverage regression tags\n\nISSUES CLOSED: #7616

# Conflicts:
#	CHANGELOG.md
#	docs/development/automation-tracking.md
#	docs/development/docs-writer.md
#	mkdocs.yml
2026-04-16 05:32:14 +00:00
HAL9000 f0efaac564 docs(changelog): add plan action-arguments UNIQUE constraint fix (#4197)
Documents the fix for sqlite3.IntegrityError when agents plan use is called on an action that already has arguments registered via action create.

ISSUES CLOSED: #6856
2026-04-16 05:32:14 +00:00
CleverAgents Build Agent ebd4bd2288 Build: improve grooming worker permissions, milestone enforcement, and PR merge throughput
- Fix grooming-worker Forgejo permissions (deny → allow) to unblock direct API calls
- Route PR label fetching through forgejo-label-manager subagent
- Replace priority-alignment check with milestone enforcement (every issue must have a milestone)
- Add step 11: address non-code review remarks (labels, description, milestone) during grooming
- Clarify grooming-pool-supervisor stale threshold to explicit 24-hour window
- Refactor pr-merge-pool-supervisor main loop into explicit numbered steps
- Add triage strategy section emphasising parallel review checks and immediate worker dispatch
- Tighten merge criteria: explicit APPROVED state, no unresolved REQUEST_CHANGES on current head
- Dispatch workers for all PR processing, not only rebase operations
- Add rule to batch forgejo_list_pull_reviews calls instead of checking serially
2026-04-16 05:32:14 +00:00
HAL9000 78695fc7f2 docs(contributors): add HAL 9000 concurrency-fix contribution detail
Add a Details entry for HAL 9000 describing the plan lifecycle
concurrency race-condition fix (#7989) — wiring LockService into
execute_plan/apply_plan with unique per-invocation owner identities.

ISSUES CLOSED: #7989
2026-04-16 05:32:14 +00:00
HAL9000 ab1933af0d fix(concurrency): fix lock owner identity to prevent re-entrant acquisition
The original implementation used plan_id as the owner_id when acquiring
the advisory lock. Because LockService treats owner_id as the caller
identity and allows re-entrant acquisition for the same owner, concurrent
sessions attempting to lock the same plan would all present the same
owner_id and thus silently renew the lock instead of raising
LockConflictError.

This fix generates a unique UUID for each invocation as the owner_id,
ensuring that concurrent sessions present different owners and thus
trigger LockConflictError when attempting to acquire the same plan lock.
The lock is still acquired before the phase transition and released in
a finally block to ensure cleanup even on error.

ISSUES CLOSED: #8067
2026-04-16 05:32:14 +00:00
HAL9000 fdcc59e7e6 fix(concurrency): wire LockService into plan lifecycle — guard execute_plan and apply_plan
LockService was implemented but never integrated into the plan execution
path, leaving execute_plan() and apply_plan() unprotected against
concurrent calls on the same plan_id (race condition, issue #7989).

Changes:
- container.py: add _build_lock_service() factory and register
  LockService as a Singleton provider; inject it into
  PlanLifecycleService via the DI container.
- plan_lifecycle_service.py: accept optional lock_service parameter in
  __init__; in execute_plan() and apply_plan() acquire a plan-level
  advisory lock before the critical section and release it in a finally
  block so the lock is always freed even when exceptions occur.

When lock_service is None (existing tests without DI wiring) the
behaviour is unchanged — locking is silently skipped for backward
compatibility.

Closes #7989
2026-04-16 05:32:13 +00:00
HAL9000 14223dbc25 docs: update mkdocs nav and CHANGELOG for v3.2.0/v3.3.0 API docs 2026-04-14 20:04:01 +00:00
HAL9000 4167f7371a docs(api): add decision tree, invariant, checkpoint, and plan correction references (v3.2.0/v3.3.0) 2026-04-14 20:04:01 +00:00
CleverAgents Build Agent 8e0fa1733f Build: Better protection against agents editing the main working directory 2026-04-14 20:04:01 +00:00
HAL9000 f10ec45c75 docs(changelog): add v3.3.0 changelog entry for #7582 fail_fast fix 2026-04-14 20:04:01 +00:00
HAL9000 415785a358 fix(concurrency): fix SubplanExecutionService._execute_parallel() #7582
Ensure fail_fast cancels in-flight futures and reports them as CANCELLED.

Add Behave coverage that reproduces the concurrency regression.

ISSUES CLOSED: #7582
2026-04-14 20:04:01 +00:00
CleverAgents Build Agent 143538c200 Build: Made conflict resolution a more explicit part of the pr-merge agents 2026-04-14 20:04:01 +00:00
HAL9000 dafe37da7a fix(plan-lifecycle): record prompt_definition as root decision during Strategize
Fixes a bug where the root decision was recorded as 'strategy_choice' instead of
the correct 'prompt_definition' type during the Strategize phase. The decision tree
now correctly records the plan's prompt/description as the root decision, ensuring
proper decision tree structure and downstream decision evaluation.

Changes:
- Modified start_strategize() to record prompt_definition as the root decision
- Updated decision question to 'What is the plan prompt?'
- Set chosen_option to plan.description with fallback to action_name or plan_id
- Added test scenario to verify root decision type is prompt_definition

Closes #9061
2026-04-14 20:04:00 +00:00
HAL9000 b47f9440ba [AUTO-TIME-1] Update timeline: 2026-04-14 milestone status 2026-04-14 20:03:34 +00:00
HAL9000 e75db02f2c test(benchmarks): add ASV benchmarks for LangGraph and TUI 2026-04-14 12:42:25 +00:00
HAL9000 64d7b22620 docs(timeline): update milestone status and schedule adherence 2026-04-14 [AUTO-TIME-1] 2026-04-14 01:17:22 +00:00