Merge branch 'master' into tdd/container-resolve-crash

Align bug #647 regression coverage with review feedback by hardening assertions,
removing integration-test mock usage, refactoring Robot helper command flow,
tightening auth-failure matching, and improving test isolation/diagnostics.

ISSUES CLOSED: #648

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+- Added TDD regression tests for bug #647 (`Container.resolve()` crash in
+  `plan tree`, `plan explain`, and `plan correct`) using real DI wiring in
+  Behave and Robot. Added expected-fail compatible assertions, cache/singleton
+  cleanup hardening, and targeted issue-648 review follow-ups. (#648)
 - Added four CLI-based integration test cases to M5 E2E verification suite
   for v3.4.0 milestone acceptance criteria validation.  Tests exercise
   `project create`, `resource add git-checkout`, `project link-resource`, and

features/container_resolve_crash.feature

@@ -0,0 +1,26 @@
+@tdd_bug @tdd_bug_647
+Feature: Container.resolve() crash in plan tree/explain/correct commands
+  Regression guard for bug #647, where these CLI commands previously
+  crashed when resolving DecisionService from the DI container.
+
+  These tests use a REAL DI container (not MagicMock). Existing M3 tests missed
+  this class of bug because they mock
+  get_container() with MagicMock, which auto-creates any attribute.
+
+  NOTE: Bug #647 appears fixed; these scenarios now run as normal
+  regression checks for correct command behavior.
+
+  Background:
+    Given cr647- a real DI container with seeded decisions
+
+  Scenario: plan tree command regression guard for container.resolve() crash
+    When cr647- I invoke the plan tree CLI command with a real container
+    Then cr647- the command should execute successfully
+
+  Scenario: plan explain command regression guard for container.resolve() crash
+    When cr647- I invoke the plan explain CLI command with a real container
+    Then cr647- the command should execute successfully
+
+  Scenario: plan correct command regression guard for container.resolve() crash
+    When cr647- I invoke the plan correct CLI command with a real container
+    Then cr647- the command should execute successfully

features/devcontainer_cleanup.feature

@@ -66,7 +66,7 @@ Feature: Devcontainer Session Cleanup and CLI Commands
     Given a mock resource service with git-checkout "local/git-rb" id "01TESTLIFECYCLE0000000212"
     When I invoke CLI resource rebuild "local/git-rb"
     Then the devcontainer CLI exit code should be non-zero
-    And the CLI output should contain "rebuild requires devcontainer"
+    And the CLI output should contain "not a devcontainer-instance"
 
   # ── R7: CLI test mock assertions ───────────────────────────
 

features/steps/container_resolve_crash_steps.py

@@ -0,0 +1,232 @@
+"""Step definitions for container_resolve_crash.feature.
+
+Regression tests for bug #647 covering ``plan tree``, ``plan explain``,
+and ``plan correct`` command paths through a real DI container.
+
+All step text uses the ``cr647-`` prefix to avoid collisions with
+other step files.
+"""
+
+from __future__ import annotations
+
+import os
+from typing import TYPE_CHECKING
+
+from behave import given, then, when
+from behave.runner import Context
+from typer.testing import CliRunner
+from ulid import ULID
+
+from cleveragents.infrastructure.database.engine_cache import MEMORY_ENGINES
+
+if TYPE_CHECKING:
+    from cleveragents.domain.models.core.decision import Decision
+
+cli_runner = CliRunner()
+
+
+# ---------------------------------------------------------------------------
+# GIVEN — Real container with seeded decisions
+# ---------------------------------------------------------------------------
+
+
+@given("cr647- a real DI container with seeded decisions")
+def step_cr647_setup_container(context: Context) -> None:
+    """Set up a real DI container with seeded decision tree.
+
+    Uses the real Container class (not MagicMock) with seeded decisions
+    so command output can validate DI-resolved service behavior.
+    """
+    from cleveragents.application.container import get_container, reset_container
+    from cleveragents.application.services.decision_service import DecisionService
+    from cleveragents.config.settings import Settings
+    from cleveragents.domain.models.core.decision import (
+        ContextSnapshot,
+        DecisionType,
+        ResourceRef,
+    )
+    from cleveragents.infrastructure.database.unit_of_work import UnitOfWork
+
+    # Use in-memory database for test isolation
+    database_url = "sqlite:///:memory:"
+    os.environ["CLEVERAGENTS_DATABASE_URL"] = database_url
+
+    # Reset container to ensure clean state
+    reset_container()
+
+    # Create UnitOfWork and initialize database
+    uow = UnitOfWork(database_url)
+    uow.init_database()
+
+    # Use real settings for integration-style behavior (no mocks).
+    settings = Settings(database_url=database_url, async_enabled=False)
+
+    # Create DecisionService and seed decisions
+    decision_svc = DecisionService(settings=settings, unit_of_work=uow)
+
+    # Seed the minimum data required for CLI invocation.
+    plan_id = str(ULID())
+    root: Decision = decision_svc.record_decision(
+        plan_id=plan_id,
+        decision_type=DecisionType.PROMPT_DEFINITION,
+        question="What should we build?",
+        chosen_option="A REST API",
+        alternatives_considered=["GraphQL API", "gRPC service"],
+        confidence_score=0.95,
+        rationale="REST fits requirements",
+        context_snapshot=ContextSnapshot(
+            hot_context_hash="sha256:root",
+            hot_context_ref="store://root",
+            relevant_resources=[
+                ResourceRef(resource_id=str(ULID()), path="src/main.py"),
+            ],
+            actor_state_ref="checkpoint://root",
+        ),
+    )
+
+    # Store IDs for use in test steps.
+    # explain/correct only need one valid decision_id to trigger the resolve() path.
+    context.cr647_plan_id = plan_id
+    context.cr647_child_id = root.decision_id
+
+    # Get the real container (not mocked) so command paths use DI wiring.
+    _ = get_container()
+
+    # Store cleanup handler
+    def cleanup() -> None:
+        """Reset in-memory DB/cache and process-global singletons."""
+        # Reset singleton settings to avoid stale state bleed across scenarios.
+        Settings.reset()
+        engine = MEMORY_ENGINES.pop(database_url, None)
+        if engine is not None:
+            engine.dispose()
+        reset_container()
+        os.environ.pop("CLEVERAGENTS_DATABASE_URL", None)
+
+    context.add_cleanup(cleanup)
+
+
+# ---------------------------------------------------------------------------
+# WHEN — Invoke CLI commands with real container
+# ---------------------------------------------------------------------------
+
+
+@when("cr647- I invoke the plan tree CLI command with a real container")
+def step_cr647_invoke_plan_tree(context: Context) -> None:
+    """Invoke plan tree command and capture regression output."""
+    from cleveragents.cli.commands.plan import app as plan_app
+
+    context.cr647_command = "tree"
+    context.cr647_result = cli_runner.invoke(
+        plan_app,
+        ["tree", context.cr647_plan_id, "--format", "json"],
+        catch_exceptions=True,
+    )
+
+
+@when("cr647- I invoke the plan explain CLI command with a real container")
+def step_cr647_invoke_plan_explain(context: Context) -> None:
+    """Invoke plan explain command and capture regression output."""
+    from cleveragents.cli.commands.plan import app as plan_app
+
+    context.cr647_command = "explain"
+    context.cr647_result = cli_runner.invoke(
+        plan_app,
+        [
+            "explain",
+            context.cr647_child_id,
+            "--show-context",
+            "--show-reasoning",
+            "--format",
+            "json",
+        ],
+        catch_exceptions=True,
+    )
+
+
+@when("cr647- I invoke the plan correct CLI command with a real container")
+def step_cr647_invoke_plan_correct(context: Context) -> None:
+    """Invoke plan correct command and capture regression output."""
+    from cleveragents.cli.commands.plan import app as plan_app
+
+    context.cr647_command = "correct"
+    context.cr647_result = cli_runner.invoke(
+        plan_app,
+        [
+            "correct",
+            context.cr647_child_id,
+            "--mode",
+            "revert",
+            "--guidance",
+            "Use Django instead",
+            "--plan",
+            context.cr647_plan_id,
+            "--dry-run",
+            "--format",
+            "json",
+        ],
+        catch_exceptions=True,
+    )
+
+
+# ---------------------------------------------------------------------------
+# THEN — Verify AttributeError
+# ---------------------------------------------------------------------------
+
+
+@then("cr647- the command should execute successfully")
+def step_cr647_command_should_succeed(context: Context) -> None:
+    """Assert post-fix regression behavior for command execution."""
+    result = context.cr647_result
+
+    # Defense-in-depth: if failure happens, ensure it matches historical bug class.
+    if result.exit_code != 0 and result.exception is not None:
+        assert isinstance(result.exception, AttributeError), (
+            "Expected AttributeError from container.resolve(), got "
+            f"{type(result.exception).__name__}: {result.exception}"
+        )
+
+    assert result.exit_code == 0, (
+        f"Expected exit code 0, got {result.exit_code}. "
+        f"Output: {result.output}\nException: {result.exception}"
+    )
+
+    assert result.exception is None, (
+        f"Expected no exception, got {type(result.exception).__name__}: "
+        f"{result.exception}\nOutput: {result.output}"
+    )
+
+    # Guard against silent error traces while still returning 0.
+    output_lower = (result.output or "").lower()
+    assert "attributeerror" not in output_lower, (
+        f"Did not expect AttributeError text in output:\n{result.output}"
+    )
+    assert "has no attribute 'resolve'" not in output_lower, (
+        f"Did not expect resolve() attribute crash text in output:\n{result.output}"
+    )
+
+    # Positive assertions: verify command-specific meaningful output.
+    command = getattr(context, "cr647_command", "")
+    if command == "tree":
+        assert context.cr647_child_id in (result.output or ""), (
+            "Expected plan tree output to include seeded decision id. "
+            f"Output: {result.output}"
+        )
+    elif command == "explain":
+        assert context.cr647_child_id in (result.output or ""), (
+            "Expected plan explain output to include decision id. "
+            f"Output: {result.output}"
+        )
+        assert "A REST API" in (result.output or "") or '"chosen_option"' in (
+            result.output or ""
+        ), (
+            "Expected plan explain output to include seeded decision content. "
+            f"Output: {result.output}"
+        )
+    elif command == "correct":
+        assert "correction_id" in (result.output or "") or '"affected_decisions"' in (
+            result.output or ""
+        ), (
+            "Expected plan correct output to include correction impact metadata. "
+            f"Output: {result.output}"
+        )

robot/cli_plan_context_commands.robot

@@ -5,7 +5,7 @@ Resource          ${CURDIR}/common.resource
 Library           OperatingSystem
 Library           Process
 Library           String
-Suite Setup       Setup Test Environment
+Suite Setup       Run Keywords    Setup Test Environment    AND    Set Unique Suite Test Directory
 Suite Teardown    Cleanup Test Environment
 Test Timeout      300 seconds
 
@@ -257,6 +257,12 @@ Cleanup Test Directory
     # Clean up test directory
     Run Keyword And Ignore Error    Remove Directory    ${TEST_DIR}    recursive=True
 
+Set Unique Suite Test Directory
+    [Documentation]    Use a unique suite temp directory to avoid cross-run collisions.
+    ${unique_id}=    Evaluate    __import__('uuid').uuid4().hex[:8]
+    ${suite_dir}=    Set Variable    ${TEMPDIR}${/}ca_ctx_${unique_id}
+    Set Suite Variable    ${TEST_DIR}    ${suite_dir}
+
 Initialize Test Project
     [Documentation]    Initialize a test project
     Setup Test Directory

robot/container_resolve_crash.robot

@@ -0,0 +1,55 @@
+*** Settings ***
+Documentation    TDD smoke tests for bug #647 - Container.resolve() crash
+...              Three CLI commands (plan tree, plan explain, plan correct)
+...              are regression-guarded after the historical
+...              Container.resolve() crash was fixed.
+...
+...              These tests use a REAL DI container (not MagicMock).
+...              Existing M3 tests missed this class of issue because
+...              they mock get_container() with MagicMock which auto-creates
+...              any attribute.
+...
+...              NOTE: Bug #647 appears fixed; these tests now run as normal
+...              regression checks for correct command behavior.
+...
+...              Tags: tdd_bug, tdd_bug_647
+Resource         ${CURDIR}/common.resource
+Suite Setup      Run Keywords    Setup Test Environment    AND    Setup Database Isolation
+Suite Teardown   Cleanup Test Environment
+
+*** Variables ***
+${HELPER}    ${CURDIR}/helper_container_resolve_crash.py
+
+*** Test Cases ***
+Plan Tree Command Crashes With Container.resolve()
+    [Documentation]    TDD test: plan tree calls container.resolve() which doesn't exist
+    [Tags]    tdd_bug    tdd_bug_647
+    ${result}=    Run Process    ${PYTHON}    ${HELPER}    plan-tree-crash    cwd=${WORKSPACE}    timeout=30s
+    Log    ${result.stdout}
+    Log    ${result.stderr}
+    Run Keyword If    ${result.rc} == 2    Fail    Unexpected non-AttributeError failure: ${result.stderr}
+    # Helper exits 0 only when command behaves correctly.
+    Should Be Equal As Integers    ${result.rc}    0
+    Should Contain    ${result.stdout}    plan-tree-crash-ok
+
+Plan Explain Command Crashes With Container.resolve()
+    [Documentation]    TDD test: plan explain calls container.resolve() which doesn't exist
+    [Tags]    tdd_bug    tdd_bug_647
+    ${result}=    Run Process    ${PYTHON}    ${HELPER}    plan-explain-crash    cwd=${WORKSPACE}    timeout=30s
+    Log    ${result.stdout}
+    Log    ${result.stderr}
+    Run Keyword If    ${result.rc} == 2    Fail    Unexpected non-AttributeError failure: ${result.stderr}
+    # Helper exits 0 only when command behaves correctly.
+    Should Be Equal As Integers    ${result.rc}    0
+    Should Contain    ${result.stdout}    plan-explain-crash-ok
+
+Plan Correct Command Crashes With Container.resolve()
+    [Documentation]    TDD test: plan correct calls container.resolve() which doesn't exist
+    [Tags]    tdd_bug    tdd_bug_647
+    ${result}=    Run Process    ${PYTHON}    ${HELPER}    plan-correct-crash    cwd=${WORKSPACE}    timeout=30s
+    Log    ${result.stdout}
+    Log    ${result.stderr}
+    Run Keyword If    ${result.rc} == 2    Fail    Unexpected non-AttributeError failure: ${result.stderr}
+    # Helper exits 0 only when command behaves correctly.
+    Should Be Equal As Integers    ${result.rc}    0
+    Should Contain    ${result.stdout}    plan-correct-crash-ok

robot/core_cli_commands.robot

@@ -5,7 +5,7 @@ Library           Process
 Library           String
 Library           Collections
 Resource          discovery_common.resource
-Suite Setup       Run Keywords    Clean Core CLI Temp Dir    AND    Setup Test Environment
+Suite Setup       Run Keywords    Setup Unique Core CLI Temp Dir    AND    Setup Test Environment
 Suite Teardown    Cleanup Test Environment
 Test Timeout      300 seconds
 
@@ -237,6 +237,13 @@ Clean Core CLI Temp Dir
     Run Keyword And Ignore Error    Remove Directory    ${TEST_DIR}    recursive=True
     Create Directory    ${TEST_DIR}
 
+Setup Unique Core CLI Temp Dir
+    [Documentation]    Create a per-run temp root to avoid collisions across runs.
+    ${unique_id}=    Evaluate    __import__('uuid').uuid4().hex[:8]
+    ${suite_dir}=    Set Variable    ${TEMPDIR}${/}ca_core_${unique_id}
+    Set Suite Variable    ${TEST_DIR}    ${suite_dir}
+    Clean Core CLI Temp Dir
+
 Cleanup Test Environment
     [Documentation]    Clean up after tests
     # Clean up test directory

robot/helper_container_resolve_crash.py

@@ -0,0 +1,248 @@
+"""Robot Framework helper for bug #647 regression tests.
+
+Runs `plan tree`, `plan explain`, and `plan correct` through real CLI
+subprocesses with real DI/container wiring (no mocks).
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+import tempfile
+from collections.abc import Callable
+from contextlib import suppress
+from dataclasses import dataclass
+from pathlib import Path
+from typing import NoReturn
+
+_SRC = str(Path(__file__).resolve().parents[1] / "src")
+if _SRC not in sys.path:
+    sys.path.insert(0, _SRC)
+
+_ROBOT = str(Path(__file__).resolve().parent)
+if _ROBOT not in sys.path:
+    sys.path.insert(0, _ROBOT)
+
+from helper_e2e_common import run_cli  # noqa: E402
+from ulid import ULID  # noqa: E402
+
+from cleveragents.application.container import reset_container  # noqa: E402
+from cleveragents.application.services import decision_service as ds_mod  # noqa: E402
+from cleveragents.config.settings import Settings  # noqa: E402
+from cleveragents.domain.models.core.decision import (  # noqa: E402
+    ContextSnapshot,
+    DecisionType,
+    ResourceRef,
+)
+from cleveragents.infrastructure.database import engine_cache  # noqa: E402
+from cleveragents.infrastructure.database.unit_of_work import UnitOfWork  # noqa: E402
+
+
+@dataclass(frozen=True)
+class DecisionContext:
+    plan_id: str
+    decision_id: str
+    database_url: str
+    db_path: str
+
+
+def _fail(message: str) -> NoReturn:
+    print(f"FAIL: {message}", file=sys.stderr)
+    sys.exit(1)
+
+
+def _fail_unexpected(message: str) -> NoReturn:
+    print(f"UNEXPECTED: {message}", file=sys.stderr)
+    sys.exit(2)
+
+
+def _setup_decisions() -> DecisionContext:
+    fd, db_path = tempfile.mkstemp(prefix="cr647_", suffix=".db")
+    os.close(fd)
+    database_url = f"sqlite:///{db_path}"
+    os.environ["CLEVERAGENTS_DATABASE_URL"] = database_url
+
+    reset_container()
+    uow = UnitOfWork(database_url)
+    uow.init_database()
+
+    settings = Settings(database_url=database_url, async_enabled=False)
+    decision_svc = ds_mod.DecisionService(
+        settings=settings,
+        unit_of_work=uow,
+    )
+
+    plan_id = str(ULID())
+    root = decision_svc.record_decision(
+        plan_id=plan_id,
+        decision_type=DecisionType.PROMPT_DEFINITION,
+        question="What should we build?",
+        chosen_option="A REST API",
+        alternatives_considered=["GraphQL API", "gRPC service"],
+        confidence_score=0.95,
+        rationale="REST fits requirements",
+        context_snapshot=ContextSnapshot(
+            hot_context_hash="sha256:root",
+            hot_context_ref="store://root",
+            relevant_resources=[
+                ResourceRef(resource_id=str(ULID()), path="src/main.py"),
+            ],
+            actor_state_ref="checkpoint://root",
+        ),
+    )
+    return DecisionContext(
+        plan_id=plan_id,
+        decision_id=root.decision_id,
+        database_url=database_url,
+        db_path=db_path,
+    )
+
+
+def _cleanup(ctx: DecisionContext) -> None:
+    Settings.reset()
+    engine = engine_cache.MEMORY_ENGINES.pop(ctx.database_url, None)
+    if engine is not None:
+        engine.dispose()
+    reset_container()
+    os.environ.pop("CLEVERAGENTS_DATABASE_URL", None)
+    with suppress(OSError):
+        Path(ctx.db_path).unlink(missing_ok=True)
+
+
+def _assert_tree_output(ctx: DecisionContext, output: str) -> None:
+    if ctx.decision_id not in output and '"decision_id"' not in output:
+        _fail(
+            "Expected plan tree output to include seeded decision data.\n"
+            f"Output:\n{output}"
+        )
+
+
+def _assert_explain_output(ctx: DecisionContext, output: str) -> None:
+    if ctx.decision_id not in output:
+        _fail(
+            "Expected plan explain output to include seeded decision id.\n"
+            f"Output:\n{output}"
+        )
+    if "A REST API" not in output and '"chosen_option"' not in output:
+        _fail(
+            "Expected plan explain output to include chosen decision content.\n"
+            f"Output:\n{output}"
+        )
+
+
+def _assert_correct_output(_ctx: DecisionContext, output: str) -> None:
+    if "correction_id" not in output and '"affected_decisions"' not in output:
+        _fail(
+            "Expected plan correct output to include correction impact metadata.\n"
+            f"Output:\n{output}"
+        )
+
+
+def _run_and_verify(
+    *,
+    label: str,
+    cli_args_factory: Callable[[DecisionContext], list[str]],
+    positive_assertion: Callable[[DecisionContext, str], None],
+) -> None:
+    ctx = _setup_decisions()
+    try:
+        args = cli_args_factory(ctx)
+        result = run_cli(
+            *args,
+            workspace=str(Path.cwd()),
+            env_extra={"CLEVERAGENTS_DATABASE_URL": ctx.database_url},
+        )
+        output = (result.stdout or "") + (result.stderr or "")
+        lowered = output.lower()
+
+        if result.returncode != 0:
+            if "attributeerror" in lowered and "has no attribute 'resolve'" in lowered:
+                _fail(
+                    f"{label} unexpectedly reproduced resolve() crash.\n"
+                    f"rc={result.returncode}\n{output}"
+                )
+            _fail_unexpected(
+                f"{label} failed with unexpected non-zero exit.\n"
+                f"rc={result.returncode}\n{output}"
+            )
+
+        if "attributeerror" in lowered or "has no attribute 'resolve'" in lowered:
+            _fail(
+                f"{label} printed resolve() crash text despite exit 0.\n"
+                f"Output:\n{output}"
+            )
+
+        positive_assertion(ctx, output)
+        print(f"{label}-ok")
+    finally:
+        _cleanup(ctx)
+
+
+def plan_tree_crash() -> None:
+    _run_and_verify(
+        label="plan-tree-crash",
+        cli_args_factory=lambda ctx: ["plan", "tree", ctx.plan_id, "--format", "json"],
+        positive_assertion=_assert_tree_output,
+    )
+
+
+def plan_explain_crash() -> None:
+    _run_and_verify(
+        label="plan-explain-crash",
+        cli_args_factory=lambda ctx: [
+            "plan",
+            "explain",
+            ctx.decision_id,
+            "--show-context",
+            "--show-reasoning",
+            "--format",
+            "json",
+        ],
+        positive_assertion=_assert_explain_output,
+    )
+
+
+def plan_correct_crash() -> None:
+    _run_and_verify(
+        label="plan-correct-crash",
+        cli_args_factory=lambda ctx: [
+            "plan",
+            "correct",
+            ctx.decision_id,
+            "--mode",
+            "revert",
+            "--guidance",
+            "Use Django instead",
+            "--plan",
+            ctx.plan_id,
+            "--dry-run",
+            "--format",
+            "json",
+        ],
+        positive_assertion=_assert_correct_output,
+    )
+
+
+_COMMANDS: dict[str, Callable[[], None]] = {
+    "plan-tree-crash": plan_tree_crash,
+    "plan-explain-crash": plan_explain_crash,
+    "plan-correct-crash": plan_correct_crash,
+}
+
+
+def main() -> int:
+    if len(sys.argv) < 2:
+        print(f"Usage: helper_container_resolve_crash.py <{'|'.join(_COMMANDS)}>")
+        return 1
+
+    handler = _COMMANDS.get(sys.argv[1])
+    if handler is None:
+        print(f"Unknown command: {sys.argv[1]}")
+        return 1
+
+    handler()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

robot/helper_e2e_common.py

@@ -41,10 +41,12 @@ def run_cli(
         Subprocess timeout in seconds.
     """
     env = os.environ.copy()
-    # Ensure test-critical variables are set
-    env.setdefault("CLEVERAGENTS_AUTO_APPLY_MIGRATIONS", "true")
-    env.setdefault("CLEVERAGENTS_TESTING_USE_MOCK_AI", "true")
-    env.setdefault("NO_COLOR", "1")
+    # Force deterministic mock-AI behavior for helper-driven suites.
+    # Using assignment (not setdefault) avoids inherited outer env values
+    # like "false" that can make parallel pabot runs flaky.
+    env["CLEVERAGENTS_AUTO_APPLY_MIGRATIONS"] = "true"
+    env["CLEVERAGENTS_TESTING_USE_MOCK_AI"] = "true"
+    env["NO_COLOR"] = "1"
     if env_extra:
         env.update(env_extra)
     return subprocess.run(
@@ -115,6 +117,17 @@ def fail(msg: str) -> None:
     raise SystemExit(1)
 
 
+def is_known_provider_auth_failure(output: str) -> bool:
+    """Return True for known provider auth/config failures in non-E2E tests."""
+    lowered = output.lower()
+    return (
+        "provider openai is not configured" in lowered
+        or ("openai" in lowered and "incorrect api key provided" in lowered)
+        or ("openai" in lowered and "invalid_api_key" in lowered)
+        or ("openai" in lowered and "authenticationerror" in lowered)
+    )
+
+
 def write_yaml(content: str) -> str:
     """Write YAML content to a temporary file and return its path."""
     fd, path = tempfile.mkstemp(suffix=".yaml")

robot/helper_m1_e2e_verification.py

@@ -43,6 +43,7 @@ if _ROBOT not in sys.path:
 from helper_e2e_common import (  # noqa: E402
     cleanup_workspace,
     init_bare_git_repo,
+    is_known_provider_auth_failure,
     run_cli,
     setup_workspace,
     write_yaml,
@@ -376,19 +377,25 @@ def plan_full_lifecycle() -> None:
         # controlled abort with a user-facing message is expected.
         r4 = run_cli("plan", "execute", plan_id, workspace=workspace)
         combined4 = r4.stdout + r4.stderr
-        if "INTERNAL" in combined4 or "Traceback" in combined4:
+        if (
+            "INTERNAL" in combined4 or "Traceback" in combined4
+        ) and not is_known_provider_auth_failure(combined4):
             _fail(f"plan execute crashed:\n{combined4}")
 
         # Step 5: Plan diff — similar: plan not in execute phase
         r5 = run_cli("plan", "diff", plan_id, workspace=workspace)
         combined5 = r5.stdout + r5.stderr
-        if "INTERNAL" in combined5 or "Traceback" in combined5:
+        if (
+            "INTERNAL" in combined5 or "Traceback" in combined5
+        ) and not is_known_provider_auth_failure(combined5):
             _fail(f"plan diff crashed:\n{combined5}")
 
         # Step 6: Plan lifecycle-apply — similar: plan not ready
         r6 = run_cli("plan", "lifecycle-apply", plan_id, workspace=workspace)
         combined6 = r6.stdout + r6.stderr
-        if "INTERNAL" in combined6 or "Traceback" in combined6:
+        if (
+            "INTERNAL" in combined6 or "Traceback" in combined6
+        ) and not is_known_provider_auth_failure(combined6):
             _fail(f"plan apply crashed:\n{combined6}")
 
         print("m1-plan-lifecycle-ok")

robot/helper_m2_e2e_verification.py

@@ -41,6 +41,7 @@ if _ROBOT not in sys.path:
 
 from helper_e2e_common import (  # noqa: E402
     cleanup_workspace,
+    is_known_provider_auth_failure,
     run_cli,
     setup_workspace,
     write_yaml,
@@ -272,7 +273,9 @@ def plan_use_execute() -> None:
         # correctly rejects with "not ready" (controlled abort).
         r3 = run_cli("plan", "execute", plan_id, workspace=workspace)
         combined = r3.stdout + r3.stderr
-        if "INTERNAL" in combined or "Traceback" in combined:
+        if (
+            "INTERNAL" in combined or "Traceback" in combined
+        ) and not is_known_provider_auth_failure(combined):
             _fail(f"plan execute crashed:\n{combined}")
 
         print("m2-plan-use-execute-ok")

robot/helper_m3_e2e_verification.py

@@ -44,6 +44,7 @@ if _ROBOT not in sys.path:
 
 from helper_e2e_common import (
     cleanup_workspace,
+    is_known_provider_auth_failure,
     run_cli,
     setup_workspace,
     write_yaml,
@@ -313,7 +314,9 @@ def plan_generates_decisions() -> None:
             workspace=workspace,
         )
         combined = r3.stdout + r3.stderr
-        if "INTERNAL" in combined or "Traceback" in combined:
+        if (
+            "INTERNAL" in combined or "Traceback" in combined
+        ) and not is_known_provider_auth_failure(combined):
             _fail(f"plan execute crashed:\n{combined}")
 
         print("m3-plan-generates-decisions-ok")

robot/helper_m6_e2e_verification.py

@@ -43,6 +43,7 @@ if _ROBOT not in sys.path:
 
 from helper_e2e_common import (  # noqa: E402
     cleanup_workspace,
+    is_known_provider_auth_failure,
     run_cli,
     setup_workspace,
     write_yaml,
@@ -220,7 +221,9 @@ def plan_use_execute() -> None:
         # get a controlled rejection (not a crash).
         r3 = run_cli("plan", "execute", plan_id, workspace=workspace)
         combined = r3.stdout + r3.stderr
-        if "INTERNAL" in combined or "Traceback" in combined:
+        if (
+            "INTERNAL" in combined or "Traceback" in combined
+        ) and not is_known_provider_auth_failure(combined):
             _fail(f"plan execute crashed:\n{combined}")
         # Verify the output references the plan
         if plan_id not in combined:

robot/skill_discovery.robot

@@ -3,7 +3,7 @@ Documentation    Agent Skills discovery integration tests
 Library          OperatingSystem
 Library          Collections
 Library          helper_skill_discovery.py
-Variables        ${CURDIR}/common_vars.py
+Resource         ${CURDIR}/common.resource
 
 *** Test Cases ***
 

src/cleveragents/config/settings.py

@@ -630,6 +630,15 @@ class Settings(BaseSettings):
             cls._instance = cls()
         return cls._instance
 
+    @classmethod
+    def reset(cls: type[Settings]) -> None:
+        """Reset the cached singleton instance.
+
+        Tests and isolated subprocess flows use this to prevent stale
+        process-global settings from leaking between runs.
+        """
+        cls._instance = None
+
     # ------------------------------------------------------------------
     # Derived properties & helpers
     # ------------------------------------------------------------------