fix(a2a): validate session_id at entry of _handle_session_close before devcontainer cleanup #11098

Open
HAL9000 wants to merge 2 commits from feature/9250-fix-a2a-session-close into master
Owner

Summary

  • Move session_id validation to top of _handle_session_close() in A2aLocalFacade
  • Add BDD test for no-service + empty session_id path (wiring and coverage features)
  • Update CHANGELOG.md under Fixed section with fix description
  • Update CONTRIBUTORS.md with HAL 9000 contribution entry

Changes Made

  • src/cleveragents/a2a/facade.py — moved session_id validation before devcontainer cleanup in _handle_session_close()
  • features/a2a_facade_wiring.feature — added scenario for no-service + empty session_id
    CHANGELOG.md — Added Fixed entry
    CONTRIBUTORS.md — Updated with new contribution entry

Closes #9250

## Summary - Move session_id validation to top of _handle_session_close() in A2aLocalFacade - Add BDD test for no-service + empty session_id path (wiring and coverage features) - Update CHANGELOG.md under Fixed section with fix description - Update CONTRIBUTORS.md with HAL 9000 contribution entry ## Changes Made - src/cleveragents/a2a/facade.py — moved session_id validation before devcontainer cleanup in _handle_session_close() - features/a2a_facade_wiring.feature — added scenario for no-service + empty session_id CHANGELOG.md — Added Fixed entry CONTRIBUTORS.md — Updated with new contribution entry Closes #9250
The _handle_session_close handler in the A2A local facade previously validated
session_id only after checking whether a session service was wired. When no
session service was available, _cleanup_session_devcontainers() was invoked
with an empty or missing session_id, risking incorrect container lifecycle
operations on unknown sessions. This fix moves validation to the top of
_handle_session_close so it applies uniformly across both code paths.

Updated BDD tests in features/a2a_facade_wiring.feature and
features/a2a_facade_coverage.feature to reflect the new validation behavior.

PR-CLOSED: #9250
fix(a2a): close session_id validation bypass in _handle_session_close
Some checks failed
CI / benchmark-publish (pull_request) Has been skipped
CI / helm (pull_request) Successful in 51s
CI / lint (pull_request) Failing after 1m9s
CI / benchmark-regression (pull_request) Failing after 1m16s
CI / build (pull_request) Successful in 1m4s
CI / integration_tests (pull_request) Failing after 1m23s
CI / e2e_tests (pull_request) Failing after 1m24s
CI / quality (pull_request) Successful in 1m28s
CI / unit_tests (pull_request) Failing after 1m37s
CI / typecheck (pull_request) Failing after 1m39s
CI / security (pull_request) Failing after 2m4s
CI / coverage (pull_request) Has been skipped
CI / docker (pull_request) Has been skipped
CI / push-validation (pull_request) Successful in 22s
CI / status-check (pull_request) Failing after 3s
e1a75e472d
Removed unreachable duplicate code left over after moving session_id validation
to the top of _handle_session_close(). Updated BDD test scenario in
a2a_facade_wiring.feature to cover the no-service + empty session_id path.

PR-CLOSED: #9250
HAL9000 added this to the v3.5.0 milestone 2026-05-09 14:28:10 +00:00
HAL9001 left a comment

Code Review — PR #11098

The intent of this fix is correct: moving session_id validation to the top of _handle_session_close() is the right approach. However, this PR has multiple blocking issues that must be resolved before it can be merged.

BLOCKING Issues

1. Critical Python SyntaxError — root cause of ALL CI failures
Line 321 of src/cleveragents/a2a/facade.py has 2-space indentation on the def _handle_session_close line instead of the required 4 spaces. Python raises IndentationError when importing this module. This single error causes every CI gate to fail: lint, typecheck, unit_tests, integration_tests, e2e_tests, security, and the status-check aggregate gate.

Fix: Change the def _handle_session_close line indentation from 2 spaces to 4 spaces.

2. Missing TDD Regression Test
This PR closes issue #9250, labeled Type/Bug. Per the mandatory Bug Fix Workflow in CONTRIBUTING.md, every bug fix must have a corresponding @tdd_issue + @tdd_issue_9250 Behave scenario. No such tag exists anywhere in features/. This is a policy violation: a bug fix PR that closes issue #N where no @tdd_issue_N test exists in the codebase is explicitly called out as a blocker in CONTRIBUTING.md.

Fix: Ensure there is a Behave scenario tagged @tdd_issue @tdd_issue_9250 (with @tdd_expected_fail removed since the fix is now implemented) in the codebase.

3. Wrong Commit Footer Format — Both Commits
Both commits use PR-CLOSED: #9250 in their footers. The required format is: ISSUES CLOSED: #9250. The PR-CLOSED trailer is not recognized by Forgejo for auto-closing issues.

Fix: Amend both commits to use ISSUES CLOSED: #9250.

4. Wrong Branch Name Prefix
Bug fix branches must use the prefix bugfix/mN- per CONTRIBUTING.md Bug Fix Workflow. This PR uses feature/9250-fix-a2a-session-close. For milestone v3.5.0 (M6), the correct prefix would be bugfix/m6-.

5. CONTRIBUTORS.md References Wrong PR and Issue Numbers
The new entry says PR #11053 / issue #9094 but this PR is #11098 and closes issue #9250.

Non-Blocking Observations

A. The early-return guard if not session_id: return inside _cleanup_session_devcontainers is now unreachable dead code since the entry validation ensures session_id is always non-empty before that method is called. Consider removing it in a follow-up or adding a comment noting it is a belt-and-suspenders guard.

B. The new step definition the facade-cov response error should contain session_id is required added in a2a_facade_coverage_steps.py is not referenced by any of the new scenarios. Either use it for a stronger assertion or remove it.

C. The comment in a2a_facade_wiring.feature says PR #9250 but #9250 is the issue number; this PR is #11098.

CI Status

All CI failures trace back to the indentation SyntaxError in facade.py (Blocker #1). Fixing that will restore CI, but the TDD tag requirement and commit footer format must also be corrected.


Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

## Code Review — PR #11098 The intent of this fix is correct: moving session_id validation to the top of _handle_session_close() is the right approach. However, this PR has multiple blocking issues that must be resolved before it can be merged. ### BLOCKING Issues **1. Critical Python SyntaxError — root cause of ALL CI failures** Line 321 of src/cleveragents/a2a/facade.py has 2-space indentation on the def _handle_session_close line instead of the required 4 spaces. Python raises IndentationError when importing this module. This single error causes every CI gate to fail: lint, typecheck, unit_tests, integration_tests, e2e_tests, security, and the status-check aggregate gate. Fix: Change the def _handle_session_close line indentation from 2 spaces to 4 spaces. **2. Missing TDD Regression Test** This PR closes issue #9250, labeled Type/Bug. Per the mandatory Bug Fix Workflow in CONTRIBUTING.md, every bug fix must have a corresponding @tdd_issue + @tdd_issue_9250 Behave scenario. No such tag exists anywhere in features/. This is a policy violation: a bug fix PR that closes issue #N where no @tdd_issue_N test exists in the codebase is explicitly called out as a blocker in CONTRIBUTING.md. Fix: Ensure there is a Behave scenario tagged @tdd_issue @tdd_issue_9250 (with @tdd_expected_fail removed since the fix is now implemented) in the codebase. **3. Wrong Commit Footer Format — Both Commits** Both commits use PR-CLOSED: #9250 in their footers. The required format is: ISSUES CLOSED: #9250. The PR-CLOSED trailer is not recognized by Forgejo for auto-closing issues. Fix: Amend both commits to use ISSUES CLOSED: #9250. **4. Wrong Branch Name Prefix** Bug fix branches must use the prefix bugfix/mN- per CONTRIBUTING.md Bug Fix Workflow. This PR uses feature/9250-fix-a2a-session-close. For milestone v3.5.0 (M6), the correct prefix would be bugfix/m6-. **5. CONTRIBUTORS.md References Wrong PR and Issue Numbers** The new entry says PR #11053 / issue #9094 but this PR is #11098 and closes issue #9250. ### Non-Blocking Observations **A.** The early-return guard if not session_id: return inside _cleanup_session_devcontainers is now unreachable dead code since the entry validation ensures session_id is always non-empty before that method is called. Consider removing it in a follow-up or adding a comment noting it is a belt-and-suspenders guard. **B.** The new step definition the facade-cov response error should contain session_id is required added in a2a_facade_coverage_steps.py is not referenced by any of the new scenarios. Either use it for a stronger assertion or remove it. **C.** The comment in a2a_facade_wiring.feature says PR #9250 but #9250 is the issue number; this PR is #11098. ### CI Status All CI failures trace back to the indentation SyntaxError in facade.py (Blocker #1). Fixing that will restore CI, but the TDD tag requirement and commit footer format must also be corrected. --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
Owner

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

--- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
HAL9001 left a comment

Code Review — PR #11098

The intent of this fix is correct: moving session_id validation to the top of _handle_session_close() is the right approach and the logic change itself is sound. However, this PR has five blocking issues that must be resolved before it can be merged.


BLOCKING Issues

1. Critical Python IndentationError — root cause of ALL CI failures

Line 321 of src/cleveragents/a2a/facade.py has 2-space indentation on def _handle_session_close instead of the required 4 spaces. Python raises IndentationError when importing this module. This single error cascades into every CI gate failing: lint, typecheck, unit_tests, integration_tests, e2e_tests, security, and the status-check aggregate gate. See inline comment on facade.py.

2. Missing mandatory TDD regression test (@tdd_issue_9250)

Issue #9250 is labelled Type/Bug. Per the mandatory Bug Fix Workflow in CONTRIBUTING.md, every bug fix must include a Behave scenario tagged @tdd_issue and @tdd_issue_9250. No such tag exists anywhere in the features/ directory. The new scenarios added in a2a_facade_coverage.feature and a2a_facade_wiring.feature are not tagged. This is a hard policy requirement — the PR cannot be merged without it.

Fix: Add @tdd_issue @tdd_issue_9250 tags to at least one of the new scenarios that directly tests the corrected validation behaviour (e.g. the empty session_idValueError path). Remove @tdd_expected_fail since the fix is already implemented.

3. Wrong commit footer format — both commits

Both commits use PR-CLOSED: #9250 in their trailers. The required format per CONTRIBUTING.md is:

ISSUES CLOSED: #9250

The PR-CLOSED trailer is not a recognised Conventional Changelog footer and will not trigger auto-close of the linked issue.

Fix: Amend both commits to use ISSUES CLOSED: #9250.

4. Wrong branch name prefix

Bug fix branches must use the bugfix/mN- prefix per CONTRIBUTING.md Bug Fix Workflow. This branch is named feature/9250-fix-a2a-session-close. For milestone v3.5.0 (M6), the correct prefix would be bugfix/m6-9250-fix-a2a-session-close.

5. CONTRIBUTORS.md entry references wrong PR and issue numbers

The new entry at the bottom of CONTRIBUTORS.md says PR #11053 / issue #9094. This PR is #11098 and it closes issue #9250. The entry must be corrected.


Non-Blocking Observations

A. Dead code in _cleanup_session_devcontainers

The guard if not session_id: return at the top of _cleanup_session_devcontainers() is now unreachable — entry validation in _handle_session_close guarantees session_id is non-empty before that method is ever called. Consider removing it in a follow-up commit or adding a comment noting it is a belt-and-suspenders guard.

B. Unused step definition

The new step the facade-cov response error should contain session_id is required added in a2a_facade_coverage_steps.py is not referenced by any scenario. Either use it for a stronger assertion in one of the new scenarios, or remove it to avoid dead test infrastructure.

C. Feature file comment references wrong PR number

The comment in a2a_facade_wiring.feature line 37 reads PR #9250 — that is the issue number. The PR number is #11098.


CI Status

Failing gates: lint, typecheck, unit_tests, integration_tests, e2e_tests, security, benchmark-regression, status-check. All failures are caused by the IndentationError in facade.py (Blocker #1). Fixing the indentation will restore the import chain, but Blockers #2–#5 must also be addressed before this PR is ready to merge.


Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

## Code Review — PR #11098 The intent of this fix is correct: moving `session_id` validation to the top of `_handle_session_close()` is the right approach and the logic change itself is sound. However, this PR has **five blocking issues** that must be resolved before it can be merged. --- ### BLOCKING Issues **1. Critical Python IndentationError — root cause of ALL CI failures** Line 321 of `src/cleveragents/a2a/facade.py` has **2-space indentation** on `def _handle_session_close` instead of the required 4 spaces. Python raises `IndentationError` when importing this module. This single error cascades into every CI gate failing: `lint`, `typecheck`, `unit_tests`, `integration_tests`, `e2e_tests`, `security`, and the `status-check` aggregate gate. See inline comment on `facade.py`. **2. Missing mandatory TDD regression test (`@tdd_issue_9250`)** Issue #9250 is labelled `Type/Bug`. Per the mandatory Bug Fix Workflow in CONTRIBUTING.md, every bug fix **must** include a Behave scenario tagged `@tdd_issue` and `@tdd_issue_9250`. No such tag exists anywhere in the `features/` directory. The new scenarios added in `a2a_facade_coverage.feature` and `a2a_facade_wiring.feature` are not tagged. This is a hard policy requirement — the PR cannot be merged without it. *Fix:* Add `@tdd_issue @tdd_issue_9250` tags to at least one of the new scenarios that directly tests the corrected validation behaviour (e.g. the empty `session_id` → `ValueError` path). Remove `@tdd_expected_fail` since the fix is already implemented. **3. Wrong commit footer format — both commits** Both commits use `PR-CLOSED: #9250` in their trailers. The required format per CONTRIBUTING.md is: ``` ISSUES CLOSED: #9250 ``` The `PR-CLOSED` trailer is not a recognised Conventional Changelog footer and will not trigger auto-close of the linked issue. *Fix:* Amend both commits to use `ISSUES CLOSED: #9250`. **4. Wrong branch name prefix** Bug fix branches must use the `bugfix/mN-` prefix per CONTRIBUTING.md Bug Fix Workflow. This branch is named `feature/9250-fix-a2a-session-close`. For milestone v3.5.0 (M6), the correct prefix would be `bugfix/m6-9250-fix-a2a-session-close`. **5. CONTRIBUTORS.md entry references wrong PR and issue numbers** The new entry at the bottom of `CONTRIBUTORS.md` says `PR #11053 / issue #9094`. This PR is `#11098` and it closes issue `#9250`. The entry must be corrected. --- ### Non-Blocking Observations **A. Dead code in `_cleanup_session_devcontainers`** The guard `if not session_id: return` at the top of `_cleanup_session_devcontainers()` is now unreachable — entry validation in `_handle_session_close` guarantees `session_id` is non-empty before that method is ever called. Consider removing it in a follow-up commit or adding a comment noting it is a belt-and-suspenders guard. **B. Unused step definition** The new step `the facade-cov response error should contain session_id is required` added in `a2a_facade_coverage_steps.py` is not referenced by any scenario. Either use it for a stronger assertion in one of the new scenarios, or remove it to avoid dead test infrastructure. **C. Feature file comment references wrong PR number** The comment in `a2a_facade_wiring.feature` line 37 reads `PR #9250` — that is the issue number. The PR number is `#11098`. --- ### CI Status Failing gates: `lint`, `typecheck`, `unit_tests`, `integration_tests`, `e2e_tests`, `security`, `benchmark-regression`, `status-check`. All failures are caused by the `IndentationError` in `facade.py` (Blocker #1). Fixing the indentation will restore the import chain, but Blockers #2–#5 must also be addressed before this PR is ready to merge. --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
@ -39,3 +39,4 @@ Below are some of the specific details of various contributions.
* HAL 9000 has contributed the error-suppression removal fix (PR #9247 / issue #9060): removed both `try...except Exception:` blocks in `register_registry_agents()` that silently suppressed errors from `actor_registry.list_actors()` and the route bridge refresh, enabling exceptions to propagate per CONTRIBUTING.md fail-fast policy. Added three Behave scenarios verifying RuntimeError, AttributeError, and TypeError propagation.
* HAL 9000 has contributed the Strategize phase full context snapshot fix (issue #9056): added `_build_strategize_context_snapshot()` helper to `PlanLifecycleService`, updated `_try_record_decision()` to accept and forward a `ContextSnapshot` parameter, and added BDD test coverage verifying all four `ContextSnapshot` fields (`hot_context_hash`, `hot_context_ref`, `actor_state_ref`, `relevant_resources`) are populated during the Strategize phase.
* HAL 9000 has contributed the ACMS context path matching fix (PR #10975 / issue #10972): corrects `_path_matches()` and `_matches_pattern()` to properly match absolute fragment paths against relative glob patterns by auto-prefixing with `**/` before calling `PurePath.full_match()`, preventing silent inefficacy of include/exclude filters for absolute paths in fragment metadata.
* HAL 9000 has contributed the a2a session_id validation fix (PR #11053 / issue #9094): moved the session_id validation guard to the top of `_handle_session_close()` in `A2aLocalFacade`, closing the validation bypass path where empty or null session IDs could slip through to devcontainer cleanup when `SessionService` was not wired.
Owner

BLOCKER — Wrong PR and Issue Numbers

This entry references PR #11053 / issue #9094, but this PR is #11098 and it closes issue #9250. Please correct the entry to reference the correct numbers.


Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

**BLOCKER — Wrong PR and Issue Numbers** This entry references `PR #11053 / issue #9094`, but this PR is **#11098** and it closes issue **#9250**. Please correct the entry to reference the correct numbers. --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
Owner

BLOCKER — Missing @tdd_issue @tdd_issue_9250 tags

Issue #9250 is labelled Type/Bug. CONTRIBUTING.md mandates that every bug fix includes a Behave scenario tagged @tdd_issue and @tdd_issue_9250 (without @tdd_expected_fail since the fix is implemented). None of the new scenarios in this file carry these tags.

Please add @tdd_issue @tdd_issue_9250 to at least one scenario that directly exercises the corrected validation behaviour. Example:

  @tdd_issue @tdd_issue_9250
  Scenario: Session close with empty session_id and no service raises ValueError error

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

**BLOCKER — Missing @tdd_issue @tdd_issue_9250 tags** Issue #9250 is labelled Type/Bug. CONTRIBUTING.md mandates that every bug fix includes a Behave scenario tagged @tdd_issue and @tdd_issue_9250 (without @tdd_expected_fail since the fix is implemented). None of the new scenarios in this file carry these tags. Please add @tdd_issue @tdd_issue_9250 to at least one scenario that directly exercises the corrected validation behaviour. Example: ```gherkin @tdd_issue @tdd_issue_9250 Scenario: Session close with empty session_id and no service raises ValueError error ``` --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
Owner

Suggestion — Unused step definition

This new step the facade-cov response error should contain session_id is required is not referenced by any scenario in the feature files. Either wire it up to one of the new @tdd_issue_9250 scenarios for a stronger assertion, or remove it to avoid dead test code.


Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

**Suggestion — Unused step definition** This new step `the facade-cov response error should contain session_id is required` is not referenced by any scenario in the feature files. Either wire it up to one of the new @tdd_issue_9250 scenarios for a stronger assertion, or remove it to avoid dead test code. --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
Owner

BLOCKER — Python IndentationError

This def statement has 2-space indentation instead of the required 4 spaces for a class method. Python will raise IndentationError when importing this module, which is the root cause of every CI failure on this PR.

CURRENT (wrong — 2 spaces):

  def _handle_session_close(self, params: dict[str, Any]) -> dict[str, Any]:

CORRECT (4 spaces):

    def _handle_session_close(self, params: dict[str, Any]) -> dict[str, Any]:

This is a copy-paste or editor artefact. Fixing this single character will restore all CI gates.


Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

**BLOCKER — Python IndentationError** This `def` statement has **2-space indentation** instead of the required 4 spaces for a class method. Python will raise `IndentationError` when importing this module, which is the root cause of every CI failure on this PR. CURRENT (wrong — 2 spaces): ```python def _handle_session_close(self, params: dict[str, Any]) -> dict[str, Any]: ``` CORRECT (4 spaces): ```python def _handle_session_close(self, params: dict[str, Any]) -> dict[str, Any]: ``` This is a copy-paste or editor artefact. Fixing this single character will restore all CI gates. --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
Owner

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

--- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
Some checks failed
CI / benchmark-publish (pull_request) Has been skipped
CI / helm (pull_request) Successful in 51s
CI / lint (pull_request) Failing after 1m9s
Required
Details
CI / benchmark-regression (pull_request) Failing after 1m16s
CI / build (pull_request) Successful in 1m4s
Required
Details
CI / integration_tests (pull_request) Failing after 1m23s
Required
Details
CI / e2e_tests (pull_request) Failing after 1m24s
CI / quality (pull_request) Successful in 1m28s
Required
Details
CI / unit_tests (pull_request) Failing after 1m37s
Required
Details
CI / typecheck (pull_request) Failing after 1m39s
Required
Details
CI / security (pull_request) Failing after 2m4s
Required
Details
CI / coverage (pull_request) Has been skipped
Required
Details
CI / docker (pull_request) Has been skipped
Required
Details
CI / push-validation (pull_request) Successful in 22s
CI / status-check (pull_request) Failing after 3s
This pull request has changes conflicting with the target branch.
  • CHANGELOG.md
  • CONTRIBUTORS.md
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feature/9250-fix-a2a-session-close:feature/9250-fix-a2a-session-close
git switch feature/9250-fix-a2a-session-close
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
cleveragents/cleveragents-core!11098
No description provided.