cleveragents/cleveragents-core

Fork 3

UAT: plan apply bypasses automation profile auto_apply threshold — explicit apply always proceeds regardless of profile #5418

New issue

Open

opened 2026-04-09 06:37:36 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-09 06:37:36 +00:00

Owner

Bug Report

Feature Area: Plan Lifecycle Core — agents plan apply
Severity: Priority/Backlog (spec deviation, but explicit user action is a reasonable override)

What Was Tested

Code-level analysis of agents plan apply <plan_id> against the specification's automation profile semantics.

Expected Behavior (from spec)

The spec defines automation profiles with thresholds that gate which operations proceed automatically vs. requiring human approval. The select_tool threshold gates the Apply phase. When select_tool >= 1.0, the Apply phase should require human approval and not proceed automatically.

Actual Behavior

The lifecycle_apply_plan command at src/cleveragents/cli/commands/plan.py lines 2263–2268 explicitly bypasses the automation profile threshold check:

# plan.py lines 2263-2268 — INTENTIONAL BYPASS (but spec-violating):
plan = service.get_plan(plan_id)
if (
    plan.phase == PlanPhase.APPLY
    and plan.processing_state == ProcessingState.QUEUED
):
    plan = service._complete_apply_if_queued(plan_id)

The code comment at lines 2258–2262 explicitly states:

"This intentionally bypasses the automation profile's auto_apply threshold: explicitly running apply IS the human approval action for the manual profile."

While this reasoning is sound for the manual profile (where the user explicitly running apply IS the approval), it also bypasses the threshold for ALL profiles, including cases where the spec might want to enforce additional guardrails.

Additional Issue: Private Method Called from CLI Layer

The CLI directly calls service._complete_apply_if_queued(plan_id) — a private method (prefixed with _). This is an architectural violation: CLI commands should only call public service methods.

Impact

The automation profile's select_tool threshold is effectively ignored when the user explicitly runs agents plan apply
The private method _complete_apply_if_queued is exposed to the CLI layer, creating a fragile coupling

Code Location

Bug: src/cleveragents/cli/commands/plan.py, lines 2258–2268 (the lifecycle_apply_plan command)
Fix:
1. Extract _complete_apply_if_queued to a public method complete_apply_if_queued
2. Consider whether explicit apply should always bypass the threshold (current behavior) or respect it

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Bug Report **Feature Area**: Plan Lifecycle Core — `agents plan apply` **Severity**: Priority/Backlog (spec deviation, but explicit user action is a reasonable override) ## What Was Tested Code-level analysis of `agents plan apply <plan_id>` against the specification's automation profile semantics. ## Expected Behavior (from spec) The spec defines automation profiles with thresholds that gate which operations proceed automatically vs. requiring human approval. The `select_tool` threshold gates the Apply phase. When `select_tool >= 1.0`, the Apply phase should require human approval and not proceed automatically. ## Actual Behavior The `lifecycle_apply_plan` command at `src/cleveragents/cli/commands/plan.py` lines 2263–2268 explicitly bypasses the automation profile threshold check: ```python # plan.py lines 2263-2268 — INTENTIONAL BYPASS (but spec-violating): plan = service.get_plan(plan_id) if ( plan.phase == PlanPhase.APPLY and plan.processing_state == ProcessingState.QUEUED ): plan = service._complete_apply_if_queued(plan_id) ``` The code comment at lines 2258–2262 explicitly states: > "This intentionally bypasses the automation profile's `auto_apply` threshold: explicitly running `apply` IS the human approval action for the manual profile." While this reasoning is sound for the `manual` profile (where the user explicitly running `apply` IS the approval), it also bypasses the threshold for ALL profiles, including cases where the spec might want to enforce additional guardrails. ## Additional Issue: Private Method Called from CLI Layer The CLI directly calls `service._complete_apply_if_queued(plan_id)` — a private method (prefixed with `_`). This is an architectural violation: CLI commands should only call public service methods. ## Impact - The automation profile's `select_tool` threshold is effectively ignored when the user explicitly runs `agents plan apply` - The private method `_complete_apply_if_queued` is exposed to the CLI layer, creating a fragile coupling ## Code Location - **Bug**: `src/cleveragents/cli/commands/plan.py`, lines 2258–2268 (the `lifecycle_apply_plan` command) - **Fix**: 1. Extract `_complete_apply_if_queued` to a public method `complete_apply_if_queued` 2. Consider whether explicit `apply` should always bypass the threshold (current behavior) or respect it --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

HAL9000 added the

labels

2026-04-09 06:37:59 +00:00

HAL9000 added this to the v3.2.0 milestone

2026-04-09 06:49:36 +00:00

HAL9000 commented

2026-04-09 06:50:41 +00:00

Author

Owner

Label compliance fix applied:

Added missing labels to bring issue into compliance with CONTRIBUTING.md

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: backlog-groomer

Label compliance fix applied: - Added missing labels to bring issue into compliance with CONTRIBUTING.md --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: backlog-groomer

HAL9000 added

and removed

labels

2026-04-09 06:51:18 +00:00

HAL9000 referenced this issue

2026-04-09 06:52:21 +00:00