UAT: `agents resource unlink-child` does not block auto-discovered links — spec requires rejection with error #4835

New issue

Open

opened 2026-04-08 20:03:54 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-08 20:03:54 +00:00

Owner

Bug Report

Feature Area: Resource Registry — agents resource unlink-child command

Severity: Medium — spec-required safety guard missing; auto-discovered DAG structure can be corrupted

What Was Tested

unlink_child() in src/cleveragents/application/services/_resource_registry_dag.py and resource_unlink_child() in src/cleveragents/cli/commands/resource.py.

Expected Behavior (from spec, line 11943)

Remove a manual parent/child link between two resources. Auto-discovered links cannot be manually unlinked.

When a user attempts to unlink a child resource that was auto-discovered (not manually linked), the command should fail with an error message explaining that auto-discovered links cannot be removed manually.

Actual Behavior (from code)

unlink_child() in _resource_registry_dag.py queries ResourceLinkModel (the resource_links table) and deletes any matching link without checking whether it was auto-discovered:

def unlink_child(self, parent_name_or_id, child_name_or_id):
    parent = self.show_resource(parent_name_or_id)
    child = self.show_resource(child_name_or_id)
    session = self._session()
    try:
        link = session.query(ResourceLinkModel).filter_by(
            parent_id=parent.resource_id,
            child_id=child.resource_id,
        ).first()
        if link is None:
            raise NotFoundError(...)
        session.delete(link)  # No check for auto_discovered!
        session.flush()
        session.commit()

The ResourceLinkModel (resource_links table) has no auto_discovered column, so there's no way to distinguish manual vs auto-discovered links in this table. However, the ResourceEdgeModel (resource_edges table) does have auto_discovered = Column(Boolean, ...).

Code Location

src/cleveragents/application/services/_resource_registry_dag.py — unlink_child() — missing auto-discovered check
src/cleveragents/infrastructure/database/models.py — ResourceLinkModel (line 1694) — no auto_discovered column
src/cleveragents/infrastructure/database/models.py — ResourceEdgeModel (line 1629) — has auto_discovered column

Root Cause

The resource_links table (used by link_child/unlink_child) has no auto_discovered flag. Auto-discovered links are stored in resource_edges (a separate table). The unlink_child method only operates on resource_links, so it cannot check whether a link was auto-discovered.

Fix Required

Either:

Add auto_discovered column to ResourceLinkModel and set it when auto-discovery creates links, then check it in unlink_child()
Or cross-check resource_edges before allowing unlink_child() to proceed

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Bug Report **Feature Area:** Resource Registry — `agents resource unlink-child` command **Severity:** Medium — spec-required safety guard missing; auto-discovered DAG structure can be corrupted --- ## What Was Tested `unlink_child()` in `src/cleveragents/application/services/_resource_registry_dag.py` and `resource_unlink_child()` in `src/cleveragents/cli/commands/resource.py`. ## Expected Behavior (from spec, line 11943) > Remove a manual parent/child link between two resources. **Auto-discovered links cannot be manually unlinked.** When a user attempts to unlink a child resource that was auto-discovered (not manually linked), the command should fail with an error message explaining that auto-discovered links cannot be removed manually. ## Actual Behavior (from code) `unlink_child()` in `_resource_registry_dag.py` queries `ResourceLinkModel` (the `resource_links` table) and deletes any matching link without checking whether it was auto-discovered: ```python def unlink_child(self, parent_name_or_id, child_name_or_id): parent = self.show_resource(parent_name_or_id) child = self.show_resource(child_name_or_id) session = self._session() try: link = session.query(ResourceLinkModel).filter_by( parent_id=parent.resource_id, child_id=child.resource_id, ).first() if link is None: raise NotFoundError(...) session.delete(link) # No check for auto_discovered! session.flush() session.commit() ``` The `ResourceLinkModel` (resource_links table) has no `auto_discovered` column, so there's no way to distinguish manual vs auto-discovered links in this table. However, the `ResourceEdgeModel` (resource_edges table) does have `auto_discovered = Column(Boolean, ...)`. ## Code Location - `src/cleveragents/application/services/_resource_registry_dag.py` — `unlink_child()` — missing auto-discovered check - `src/cleveragents/infrastructure/database/models.py` — `ResourceLinkModel` (line 1694) — no `auto_discovered` column - `src/cleveragents/infrastructure/database/models.py` — `ResourceEdgeModel` (line 1629) — has `auto_discovered` column ## Root Cause The `resource_links` table (used by `link_child`/`unlink_child`) has no `auto_discovered` flag. Auto-discovered links are stored in `resource_edges` (a separate table). The `unlink_child` method only operates on `resource_links`, so it cannot check whether a link was auto-discovered. ## Fix Required Either: 1. Add `auto_discovered` column to `ResourceLinkModel` and set it when auto-discovery creates links, then check it in `unlink_child()` 2. Or cross-check `resource_edges` before allowing `unlink_child()` to proceed --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

HAL9000 referenced this issue

2026-04-08 20:06:13 +00:00

[Automated] CleverAgents Build Session - 2026-04-08 #4799

HAL9000 referenced this issue

2026-04-08 20:08:52 +00:00

[Automated] CleverAgents Build Session - 2026-04-08 #4799

HAL9000 added this to the v3.5.0 milestone

2026-04-08 20:17:59 +00:00

HAL9000 referenced this issue

2026-04-08 20:19:20 +00:00

[Automated] CleverAgents Build Session - 2026-04-08 #4799

HAL9000 referenced this issue