UAT: `agents invariant add` missing `--non-overridable` flag and `InvariantService.add_invariant` missing `non_overridable` parameter — cannot create non-overridable global invariants #4584

New issue

Open

opened 2026-04-08 15:52:21 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-08 15:52:21 +00:00

Owner

Bug Report

Feature Area

agents invariant add CLI command / InvariantService / non_overridable invariants

What Was Tested

Code-level analysis of src/cleveragents/cli/commands/invariant.py and src/cleveragents/application/services/invariant_service.py.

Expected Behavior (from spec)

The spec (docs/specification.md, Layer 3: Invariant Enforcement) states:

Non-overridable invariants are set via agents invariant add --global --non-overridable "<constraint>". The non_overridable flag is only meaningful on GLOBAL-scoped invariants; it is ignored on project, action, and plan invariants.

The spec also says:

A global invariant may be marked non_overridable: true. When set, this invariant takes precedence over all lower-scope invariants regardless of the normal precedence chain — even plan-level invariants cannot override it.

Actual Behavior (from code)

1. CLI command (invariant.py) has no --non-overridable flag:

@app.command()
def add(
    text: Annotated[str, typer.Argument(help="The invariant constraint text")],
    is_global: Annotated[bool, typer.Option("--global", ...)] = False,
    project: Annotated[str | None, typer.Option("--project", ...)] = None,
    plan: Annotated[str | None, typer.Option("--plan", ...)] = None,
    action: Annotated[str | None, typer.Option("--action", ...)] = None,
    fmt: Annotated[str, typer.Option("--format", ...)] = "rich",
) -> None:

There is no --non-overridable flag. Running agents invariant add --global --non-overridable "..." would fail with an unrecognized option error.

2. InvariantService.add_invariant has no non_overridable parameter:

def add_invariant(
    self,
    text: str,
    scope: InvariantScope,
    source_name: str,
) -> Invariant:

The non_overridable parameter is missing. Even if the CLI had the flag, there's no way to pass it to the service.

3. The Invariant domain model DOES have the non_overridable field:

non_overridable: bool = Field(
    default=False,
    description=(
        "When True and scope is GLOBAL, this invariant cannot be "
        "overridden by lower-scope invariants during reconciliation"
    ),
)

The field exists in the model but is never set to True through any supported code path.

Steps to Reproduce

# This should work per spec but fails with unrecognized option:
agents invariant add --global --non-overridable "Never commit secrets to version control"

Code Locations

src/cleveragents/cli/commands/invariant.py — add command (missing --non-overridable flag)
src/cleveragents/application/services/invariant_service.py — add_invariant method (missing non_overridable parameter)

Fix Required

Add --non-overridable flag to agents invariant add CLI command (only meaningful with --global)
Add non_overridable: bool = False parameter to InvariantService.add_invariant
Pass non_overridable when constructing the Invariant object in the service
Add validation: if --non-overridable is used without --global, emit a warning that the flag is ignored (per spec)

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Bug Report ### Feature Area `agents invariant add` CLI command / `InvariantService` / `non_overridable` invariants ### What Was Tested Code-level analysis of `src/cleveragents/cli/commands/invariant.py` and `src/cleveragents/application/services/invariant_service.py`. ### Expected Behavior (from spec) The spec (docs/specification.md, Layer 3: Invariant Enforcement) states: > Non-overridable invariants are set via `agents invariant add --global --non-overridable "<constraint>"`. The `non_overridable` flag is only meaningful on `GLOBAL`-scoped invariants; it is ignored on project, action, and plan invariants. The spec also says: > A global invariant may be marked `non_overridable: true`. When set, this invariant takes precedence over all lower-scope invariants regardless of the normal precedence chain — even plan-level invariants cannot override it. ### Actual Behavior (from code) **1. CLI command (`invariant.py`) has no `--non-overridable` flag:** ```python @app.command() def add( text: Annotated[str, typer.Argument(help="The invariant constraint text")], is_global: Annotated[bool, typer.Option("--global", ...)] = False, project: Annotated[str | None, typer.Option("--project", ...)] = None, plan: Annotated[str | None, typer.Option("--plan", ...)] = None, action: Annotated[str | None, typer.Option("--action", ...)] = None, fmt: Annotated[str, typer.Option("--format", ...)] = "rich", ) -> None: ``` There is no `--non-overridable` flag. Running `agents invariant add --global --non-overridable "..."` would fail with an unrecognized option error. **2. `InvariantService.add_invariant` has no `non_overridable` parameter:** ```python def add_invariant( self, text: str, scope: InvariantScope, source_name: str, ) -> Invariant: ``` The `non_overridable` parameter is missing. Even if the CLI had the flag, there's no way to pass it to the service. **3. The `Invariant` domain model DOES have the `non_overridable` field:** ```python non_overridable: bool = Field( default=False, description=( "When True and scope is GLOBAL, this invariant cannot be " "overridden by lower-scope invariants during reconciliation" ), ) ``` The field exists in the model but is never set to `True` through any supported code path. ### Steps to Reproduce ```bash # This should work per spec but fails with unrecognized option: agents invariant add --global --non-overridable "Never commit secrets to version control" ``` ### Code Locations - `src/cleveragents/cli/commands/invariant.py` — `add` command (missing `--non-overridable` flag) - `src/cleveragents/application/services/invariant_service.py` — `add_invariant` method (missing `non_overridable` parameter) ### Fix Required 1. Add `--non-overridable` flag to `agents invariant add` CLI command (only meaningful with `--global`) 2. Add `non_overridable: bool = False` parameter to `InvariantService.add_invariant` 3. Pass `non_overridable` when constructing the `Invariant` object in the service 4. Add validation: if `--non-overridable` is used without `--global`, emit a warning that the flag is ignored (per spec) --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

HAL9000 referenced this issue

2026-04-08 17:38:18 +00:00

UAT: merge_invariants and InvariantService.get_effective_invariants implement 3-tier precedence (plan > project > global) instead of spec-required 4-tier (plan > action > project > global) #4589

HAL9000 added this to the v3.5.0 milestone

2026-04-08 17:41:24 +00:00

HAL9000 added the