diff --git a/implementation_plan.md b/implementation_plan.md index be7914005..c6866a1a9 100644 --- a/implementation_plan.md +++ b/implementation_plan.md @@ -1038,19 +1038,6 @@ Merge points and acceptance checks are tracked as checklist items under each mil - [X] Add argument parsing for action parameters (`--arg name:type:required|optional:description`) - [X] Location: `src/cleveragents/domain/models/core/action.py` - [X] Tests: Behave scenarios for action model validation (22 scenarios in `features/action_model.feature`) -<<<<<<< HEAD - **Parallel Group A2b: Action/Plan Spec Rebaseline (M1-critical)** - **PARALLEL SUBTRACK A2b.alpha [Jeff]**: Action model alignment + YAML-first semantics - **PARALLEL SUBTRACK A2b.beta [Luis]**: Plan model alignment + action/project linkage - **PARALLEL SUBTRACK A2b.gamma [Aditya]**: Action YAML schema + examples + loader - **SEQUENTIAL MERGE NOTE**: A2b.alpha + A2b.beta + A2b.gamma must land before A4b CLI rebaseline. -||||||| parent of 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) - **Parallel Group A2b: Action/Plan Spec Alignment (M1-critical)** - **PARALLEL SUBTRACK A2b.alpha [Jeff]**: Action model alignment + invariants/automation metadata - **PARALLEL SUBTRACK A2b.beta [Luis]**: Plan metadata alignment + action linkage - **PARALLEL SUBTRACK A2b.gamma [Aditya]**: Action YAML schema + examples (config-first) - **SEQUENTIAL MERGE NOTE**: A2b.alpha + A2b.beta must land before A4b CLI wiring. -======= - [X] **A2.1** [Luis] Extend Action model with additional fields (follow-up): - [X] Field `estimation_actor: str | None` - optional actor for cost/risk estimation (already present at `action.py:219`) - [X] Field `review_actor: str | None` - optional actor for code review (already present at `action.py:211`) @@ -1066,12 +1053,11 @@ Merge points and acceptance checks are tracked as checklist items under each mil - [ ] Scenario: Action with estimation_actor validates correctly - [ ] Scenario: Safety profile enforced during execution - **Parallel Group A2b: Action/Plan Spec Alignment (M1-critical)** - **PARALLEL SUBTRACK A2b.alpha [Jeff]**: Action model alignment + invariants/automation metadata - **PARALLEL SUBTRACK A2b.beta [Luis]**: Plan metadata alignment + action linkage - **PARALLEL SUBTRACK A2b.gamma [Aditya]**: Action YAML schema + examples (config-first) - **SEQUENTIAL MERGE NOTE**: A2b.alpha + A2b.beta must land before A4b CLI wiring. ->>>>>>> 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) + **Parallel Group A2b: Action/Plan Spec Rebaseline (M1-critical)** + **PARALLEL SUBTRACK A2b.alpha [Jeff]**: Action model alignment + YAML-first semantics + **PARALLEL SUBTRACK A2b.beta [Luis]**: Plan model alignment + action/project linkage + **PARALLEL SUBTRACK A2b.gamma [Aditya]**: Action YAML schema + examples + loader + **SEQUENTIAL MERGE NOTE**: A2b.alpha + A2b.beta + A2b.gamma must land before A4b CLI rebaseline. - [ ] Git [Jeff]: `git checkout master` - [ ] Git [Jeff]: `git pull origin master` - [ ] Git [Jeff]: `git checkout -b feature/m1-action-model` @@ -1284,52 +1270,20 @@ Merge points and acceptance checks are tracked as checklist items under each mil - [ ] Git [Luis]: `git checkout -b feature/m1-orm-models` - [ ] Git [Luis]: `git push -u origin feature/m1-orm-models` - [ ] Git [Luis]: `git fetch origin && git merge origin/master` (run before final tests and before commit) -<<<<<<< HEAD - [ ] Forgejo PR [Luis]: Open PR from `feature/m1-orm-models` to `master`, wait for CI + review, merge in UI (no CLI merge) - [ ] Git [Luis]: `git branch -d feature/m1-orm-models` - [ ] Git [Luis]: `git push origin --delete feature/m1-orm-models` - [ ] **COMMIT (Owner: Luis | Group: A5.beta | Branch: feature/m1-orm-models) - Commit message: "feat(models): add action and lifecycle plan ORM models"** - - [ ] Code [Luis]: Add SQLAlchemy base model mixins for ULID PKs, timestamps, and JSON columns (reused by plan/resource models). - - [ ] Code [Luis]: Implement `ActionModel` with PK `namespaced_name`, namespace/name, description/long_description, actor refs, DoD, automation_profile, invariant_actor, state (available/archived), inputs_schema_json, tags_json, created_by. - - [ ] Code [Luis]: Implement `ActionInvariantModel` with FK to actions by namespaced_name, invariant_text, position, and created_at. - - [ ] Code [Luis]: Implement `ActionArgumentModel` with FK to actions by namespaced_name, name, arg_type, requirement, defaults/min/max/regex, position, and constraints. - - [ ] Code [Luis]: Implement `LifecyclePlanModel` with identity fields, phase/processing enums (strategize/execute/apply), action_name linkage, rendered DoD/description, policy metadata, and execution placeholders. - - [ ] Code [Luis]: Implement `PlanProjectLinkModel` with plan_id, project_name, alias, read_only, and created_at, plus uniqueness constraint. - - [ ] Code [Luis]: Implement `PlanArgumentModel` and `PlanInvariantModel` with ordered `position` fields and source_scope for invariants. - - [ ] Code [Luis]: Define ORM relationships with ordering (`order_by=position`) and cascade rules for argument/invariant collections. - - [ ] Code [Luis]: Implement `to_domain()` and `from_domain()` mappers with enum conversion and timestamp normalization. - - [ ] Code [Luis]: Add repository-facing helpers for filtering by namespace/phase/state and eager-load action arguments + plan links. -||||||| parent of 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) -- [ ] Forgejo PR [Luis]: Open PR from `feature/a5-beta-orm-models` to `master`, wait for CI + review, merge in UI (no CLI merge) -- [ ] Git [Luis]: `git branch -d feature/a5-beta-orm-models` -- [ ] Git [Luis]: `git push origin --delete feature/a5-beta-orm-models` -- [ ] **COMMIT (Owner: Luis | Group: A5.beta | Branch: feature/a5-beta-orm-models) - Commit message: "feat(models): add action and lifecycle plan ORM models"** - - [ ] Code [Luis]: Add SQLAlchemy base model mixins for ULID PKs, timestamps, and JSON columns (reused by action/plan models). - - [ ] Code [Luis]: Implement `ActionModel` with columns for namespaced_name, namespace, actor refs, DoD fields, automation_profile, invariant_actor, state, tags_json, created_by. - - [ ] Code [Luis]: Implement `ActionInvariantModel` with FK to actions, scope, invariant_text, position, and created_at. - - [ ] Code [Luis]: Implement `ActionArgumentModel` with FK to actions, name, arg_type, requirement, defaults/min/max/regex, position, and constraints. - - [ ] Code [Luis]: Implement `LifecyclePlanModel` with identity fields, phase/state/processing enums, action linkage, DoD fields, policy metadata, and execution placeholders. - - [ ] Code [Luis]: Implement `PlanProjectLinkModel` with plan_id, project_name, alias, read_only, and created_at, plus uniqueness constraint. - - [ ] Code [Luis]: Implement `PlanArgumentModel` and `PlanInvariantModel` with ordered `position` fields and constraints. - - [ ] Code [Luis]: Define ORM relationships with ordering (`order_by=position`) and cascade rules for argument/invariant collections. - - [ ] Code [Luis]: Implement `to_domain()` and `from_domain()` mappers for each model with ULID validation, enum conversion, and timestamp normalization. - - [ ] Code [Luis]: Add repository-facing helpers for filtering by namespace/phase/state and eager-load action arguments + plan links. -======= -- [ ] Forgejo PR [Luis]: Open PR from `feature/a5-beta-orm-models` to `master`, wait for CI + review, merge in UI (no CLI merge) -- [ ] Git [Luis]: `git branch -d feature/a5-beta-orm-models` -- [ ] Git [Luis]: `git push origin --delete feature/a5-beta-orm-models` -- [ ] **COMMIT (Owner: Luis | Group: A5.beta | Branch: feature/a5-beta-orm-models) - Commit message: "feat(models): add action and lifecycle plan ORM models"** - - [X] Code [Luis]: Add SQLAlchemy base model mixins for ULID PKs, timestamps, and JSON columns (reused by action/plan models). - - [X] Code [Luis]: Implement `ActionModel` with columns for namespaced_name, namespace, actor refs, DoD fields, automation_profile, invariant_actor, state, tags_json, created_by. - - [X] Code [Luis]: Implement `ActionInvariantModel` with FK to actions, scope, invariant_text, position, and created_at. - - [X] Code [Luis]: Implement `ActionArgumentModel` with FK to actions, name, arg_type, requirement, defaults/min/max/regex, position, and constraints. - - [X] Code [Luis]: Implement `LifecyclePlanModel` with identity fields, phase/state/processing enums, action linkage, DoD fields, policy metadata, and execution placeholders. + - [X] Code [Luis]: Add SQLAlchemy base model mixins for ULID PKs, timestamps, and JSON columns (reused by plan/resource models). + - [X] Code [Luis]: Implement `ActionModel` with PK `namespaced_name`, namespace/name, description/long_description, actor refs, DoD, automation_profile, invariant_actor, state (available/archived), inputs_schema_json, tags_json, created_by. + - [X] Code [Luis]: Implement `ActionInvariantModel` with FK to actions by namespaced_name, invariant_text, position, and created_at. + - [X] Code [Luis]: Implement `ActionArgumentModel` with FK to actions by namespaced_name, name, arg_type, requirement, defaults/min/max/regex, position, and constraints. + - [X] Code [Luis]: Implement `LifecyclePlanModel` with identity fields, phase/processing enums (strategize/execute/apply), action_name linkage, rendered DoD/description, policy metadata, and execution placeholders. - [X] Code [Luis]: Implement `PlanProjectLinkModel` with plan_id, project_name, alias, read_only, and created_at, plus uniqueness constraint. - - [X] Code [Luis]: Implement `PlanArgumentModel` and `PlanInvariantModel` with ordered `position` fields and constraints. + - [X] Code [Luis]: Implement `PlanArgumentModel` and `PlanInvariantModel` with ordered `position` fields and source_scope for invariants. - [X] Code [Luis]: Define ORM relationships with ordering (`order_by=position`) and cascade rules for argument/invariant collections. - - [X] Code [Luis]: Implement `to_domain()` and `from_domain()` mappers for each model with ULID validation, enum conversion, and timestamp normalization. + - [X] Code [Luis]: Implement `to_domain()` and `from_domain()` mappers with enum conversion and timestamp normalization. - [X] Code [Luis]: Add repository-facing helpers for filtering by namespace/phase/state and eager-load action arguments + plan links. ->>>>>>> 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) - [ ] Docs [Luis]: Update ORM mapping notes in `docs/reference/database_schema.md` with model field mapping table. - [ ] Tests (Behave) [Luis]: Add scenarios for ORM round-trip serialization, enum conversions, and ordered argument persistence. - [ ] Tests (Robot) [Luis]: Add Robot test that loads a plan and asserts field mapping correctness. @@ -1346,13 +1300,7 @@ Merge points and acceptance checks are tracked as checklist items under each mil - [ ] Git [Jeff]: `git push origin --delete feature/m1-repositories` - [ ] **COMMIT (Owner: Jeff | Group: A5.gamma | Branch: feature/m1-repositories) - Commit message: "feat(repo): add action and lifecycle plan repositories"** - [ ] Code [Jeff]: Define repository interfaces in `src/cleveragents/domain/repositories/` for ActionRepository and PlanRepository (methods + expected errors). -<<<<<<< HEAD - - [ ] Code [Jeff]: Implement ActionRepository CRUD keyed by namespaced_name with deterministic ordering (created_at) and filters (namespace, state, automation_profile). -||||||| parent of 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) - - [ ] Code [Jeff]: Implement ActionRepository CRUD with deterministic ordering (created_at) and filters (namespace, state, automation_profile). -======= - - [X] Code [Luis]: Implement ActionRepository CRUD with deterministic ordering (created_at) and filters (namespace, state, automation_profile). (completed by Luis) ->>>>>>> 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) + - [X] Code [Luis]: Implement ActionRepository CRUD keyed by namespaced_name with deterministic ordering (created_at) and filters (namespace, state, automation_profile). (completed by Luis) - [ ] Code [Jeff]: Implement ActionRepository persistence for arguments + invariants with ordered `position` preservation. - [ ] Code [Jeff]: Implement PlanRepository CRUD with filters (phase/state/project_name/action_name) and lookup by plan_id/ namespaced_name. - [ ] Code [Jeff]: Implement PlanRepository persistence for plan_projects, plan_arguments, plan_invariants with ordered retrieval. @@ -1501,30 +1449,14 @@ Merge points and acceptance checks are tracked as checklist items under each mil - [ ] Git [Jeff]: `git checkout -b feature/m4-automation-profiles-core` - [ ] Git [Jeff]: `git push -u origin feature/m4-automation-profiles-core` - [ ] Git [Jeff]: `git fetch origin && git merge origin/master` (run before final tests and before commit) -<<<<<<< HEAD - [ ] Forgejo PR [Jeff]: Open PR from `feature/m4-automation-profiles-core` to `master`, wait for CI + review, merge in UI (no CLI merge) - [ ] Git [Jeff]: `git branch -d feature/m4-automation-profiles-core` - [ ] Git [Jeff]: `git push origin --delete feature/m4-automation-profiles-core` - [ ] **COMMIT (Owner: Jeff | Group: A6.core | Branch: feature/m4-automation-profiles-core) - Commit message: "feat(domain): add automation profile model and built-ins"** - - [ ] Code [Jeff]: Add `AutomationProfile` model with **10 confidence thresholds + 3 boolean safety flags** per spec; validate 0.0–1.0 ranges and boolean types. - - [ ] Code [Jeff]: Add built-in profiles (`manual`, `review`, `supervised`, `cautious`, `trusted`, `auto`, `ci`, `full-auto`) with exact threshold values per spec and stable IDs. -||||||| parent of 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) -- [ ] Forgejo PR [Jeff]: Open PR from `feature/a6-core-automation-profile` to `master`, wait for CI + review, merge in UI (no CLI merge) -- [ ] Git [Jeff]: `git branch -d feature/a6-core-automation-profile` -- [ ] Git [Jeff]: `git push origin --delete feature/a6-core-automation-profile` -- [ ] **COMMIT (Owner: Jeff | Group: A6.core | Branch: feature/a6-core-automation-profile) - Commit message: "feat(domain): add automation profile model and built-ins"** - - [ ] Code [Jeff]: Add `AutomationProfile` model with threshold fields (phase transitions, decision autonomy, child plan spawn, self-repair, apply gating) and validation for 0.0-1.0 ranges. - - [ ] Code [Jeff]: Add built-in profiles (`manual`, `review`, `supervised`, `full-auto`, etc.) per spec with constant definitions and stable IDs. -======= -- [ ] Forgejo PR [Jeff]: Open PR from `feature/a6-core-automation-profile` to `master`, wait for CI + review, merge in UI (no CLI merge) -- [ ] Git [Jeff]: `git branch -d feature/a6-core-automation-profile` -- [ ] Git [Jeff]: `git push origin --delete feature/a6-core-automation-profile` -- [ ] **COMMIT (Owner: Jeff | Group: A6.core | Branch: feature/a6-core-automation-profile) - Commit message: "feat(domain): add automation profile model and built-ins"** - [X] Code [Luis]: Add `AutomationLevel` enum (manual/review/full) in plan domain model. (completed by Luis as foundation) - [X] Code [Luis]: Add config setting + env var (`CLEVERAGENTS_AUTOMATION_LEVEL`) with precedence plan > session > global. (completed by Luis) - - [ ] Code [Jeff]: Add `AutomationProfile` model with threshold fields (phase transitions, decision autonomy, child plan spawn, self-repair, apply gating) and validation for 0.0-1.0 ranges. - - [ ] Code [Jeff]: Add built-in profiles (`manual`, `review`, `supervised`, `full-auto`, etc.) per spec with constant definitions and stable IDs. ->>>>>>> 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) + - [ ] Code [Jeff]: Add `AutomationProfile` model with **10 confidence thresholds + 3 boolean safety flags** per spec; validate 0.0–1.0 ranges and boolean types. + - [ ] Code [Jeff]: Add built-in profiles (`manual`, `review`, `supervised`, `cautious`, `trusted`, `auto`, `ci`, `full-auto`) with exact threshold values per spec and stable IDs. - [ ] Code [Jeff]: Add YAML schema for automation profiles under `docs/schema/automation_profile.schema.yaml` and loader helper. - [ ] Docs [Jeff]: Add `docs/reference/automation_profiles.md` describing built-ins and threshold semantics. - [X] Tests (Behave) [Luis]: Add scenarios for default and override precedence (24 scenarios in `features/automation_levels.feature`). @@ -1538,24 +1470,12 @@ Merge points and acceptance checks are tracked as checklist items under each mil - [ ] Git [Luis]: `git checkout -b feature/m4-automation-profiles-service` - [ ] Git [Luis]: `git push -u origin feature/m4-automation-profiles-service` - [ ] Git [Luis]: `git fetch origin && git merge origin/master` (run before final tests and before commit) -<<<<<<< HEAD - [ ] Forgejo PR [Luis]: Open PR from `feature/m4-automation-profiles-service` to `master`, wait for CI + review, merge in UI (no CLI merge) - [ ] Git [Luis]: `git branch -d feature/m4-automation-profiles-service` - [ ] Git [Luis]: `git push origin --delete feature/m4-automation-profiles-service` - [ ] **COMMIT (Owner: Luis | Group: A6.service | Branch: feature/m4-automation-profiles-service) - Commit message: "feat(service): resolve automation profiles with precedence"** -||||||| parent of 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) -- [ ] Forgejo PR [Luis]: Open PR from `feature/a6-service-automation-profile` to `master`, wait for CI + review, merge in UI (no CLI merge) -- [ ] Git [Luis]: `git branch -d feature/a6-service-automation-profile` -- [ ] Git [Luis]: `git push origin --delete feature/a6-service-automation-profile` -- [ ] **COMMIT (Owner: Luis | Group: A6.service | Branch: feature/a6-service-automation-profile) - Commit message: "feat(service): resolve automation profiles with precedence"** -======= -- [ ] Forgejo PR [Luis]: Open PR from `feature/a6-service-automation-profile` to `master`, wait for CI + review, merge in UI (no CLI merge) -- [ ] Git [Luis]: `git branch -d feature/a6-service-automation-profile` -- [ ] Git [Luis]: `git push origin --delete feature/a6-service-automation-profile` -- [ ] **COMMIT (Owner: Luis | Group: A6.service | Branch: feature/a6-service-automation-profile) - Commit message: "feat(service): resolve automation profiles with precedence"** - [X] Code [Luis]: Add `automation_level` handling to `use_action()` and auto transition logic for execute/apply. (completed by Luis) - [X] Code [Luis]: Add pause/resume behavior for review-before-apply mode. (completed by Luis) ->>>>>>> 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) - [ ] Code [Luis]: Add `AutomationProfileService` to resolve profiles with precedence (plan > action > project > global). - [ ] Code [Luis]: Add persistence table `automation_profiles` (namespaced name PK) and repository with list/show/update. - [ ] Code [Luis]: Add config key `core.automation_profile` and env var override for global default. @@ -1570,23 +1490,11 @@ Merge points and acceptance checks are tracked as checklist items under each mil - [ ] Git [Jeff]: `git checkout -b feature/m4-automation-profiles-cli` - [ ] Git [Jeff]: `git push -u origin feature/m4-automation-profiles-cli` - [ ] Git [Jeff]: `git fetch origin && git merge origin/master` (run before final tests and before commit) -<<<<<<< HEAD - [ ] Forgejo PR [Jeff]: Open PR from `feature/m4-automation-profiles-cli` to `master`, wait for CI + review, merge in UI (no CLI merge) - [ ] Git [Jeff]: `git branch -d feature/m4-automation-profiles-cli` - [ ] Git [Jeff]: `git push origin --delete feature/m4-automation-profiles-cli` - [ ] **COMMIT (Owner: Jeff | Group: A6.cli | Branch: feature/m4-automation-profiles-cli) - Commit message: "feat(cli): add automation-profile commands"** -||||||| parent of 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) -- [ ] Forgejo PR [Jeff]: Open PR from `feature/a6-cli-automation-profile` to `master`, wait for CI + review, merge in UI (no CLI merge) -- [ ] Git [Jeff]: `git branch -d feature/a6-cli-automation-profile` -- [ ] Git [Jeff]: `git push origin --delete feature/a6-cli-automation-profile` -- [ ] **COMMIT (Owner: Jeff | Group: A6.cli | Branch: feature/a6-cli-automation-profile) - Commit message: "feat(cli): add automation-profile commands"** -======= -- [ ] Forgejo PR [Jeff]: Open PR from `feature/a6-cli-automation-profile` to `master`, wait for CI + review, merge in UI (no CLI merge) -- [ ] Git [Jeff]: `git branch -d feature/a6-cli-automation-profile` -- [ ] Git [Jeff]: `git push origin --delete feature/a6-cli-automation-profile` -- [ ] **COMMIT (Owner: Jeff | Group: A6.cli | Branch: feature/a6-cli-automation-profile) - Commit message: "feat(cli): add automation-profile commands"** - [X] Code [Luis]: Add `--automation-level` to `plan use` and add `plan set-automation-level` command. (completed by Luis) ->>>>>>> 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) - [ ] Code [Jeff]: Implement `agents automation-profile add/remove/list/show` commands with YAML config input and schema version guard. - [ ] Code [Jeff]: Add `--update` behavior with clear conflict errors; preserve original created_at on update. - [ ] Code [Jeff]: Ensure `automation-profile list` supports `--namespace` and regex filters with deterministic ordering. @@ -2040,28 +1948,12 @@ Merge points and acceptance checks are tracked as checklist items under each mil - [ ] Git [Luis]: `git checkout -b feature/m2-sandbox-core` - [ ] Git [Luis]: `git push -u origin feature/m2-sandbox-core` - [ ] Git [Luis]: `git fetch origin && git merge origin/master` (run before final tests and before commit) -<<<<<<< HEAD - [ ] Forgejo PR [Luis]: Open PR from `feature/m2-sandbox-core` to `master`, wait for CI + review, merge in UI (no CLI merge) - [ ] Git [Luis]: `git branch -d feature/m2-sandbox-core` - [ ] Git [Luis]: `git push origin --delete feature/m2-sandbox-core` - [ ] **COMMIT (Owner: Luis | Group: B4.sandbox | Branch: feature/m2-sandbox-core) - Commit message: "feat(sandbox): add sandbox strategy interface and manager"** - - [ ] Code [Luis]: Add `SandboxStrategy` protocol, `SandboxRef`, `SandboxManager`, and `SandboxRegistry` with per-resource sandboxes. - - [ ] Code [Luis]: Implement lazy sandbox creation, cleanup hooks, and plan-scoped retention policy stubs. -||||||| parent of 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) -- [ ] Forgejo PR [Luis]: Open PR from `feature/b4-sandbox-core` to `master`, wait for CI + review, merge in UI (no CLI merge) -- [ ] Git [Luis]: `git branch -d feature/b4-sandbox-core` -- [ ] Git [Luis]: `git push origin --delete feature/b4-sandbox-core` -- [ ] **COMMIT (Owner: Luis | Group: B4.sandbox | Branch: feature/b4-sandbox-core) - Commit message: "feat(sandbox): add sandbox strategy interface and manager"** - - [ ] Code [Luis]: Add `SandboxStrategy` protocol, `SandboxRef`, `SandboxManager`, and `SandboxRegistry` with per-resource sandboxes. - - [ ] Code [Luis]: Implement lazy sandbox creation, cleanup hooks, and plan-scoped retention policy stubs. -======= -- [ ] Forgejo PR [Luis]: Open PR from `feature/b4-sandbox-core` to `master`, wait for CI + review, merge in UI (no CLI merge) -- [ ] Git [Luis]: `git branch -d feature/b4-sandbox-core` -- [ ] Git [Luis]: `git push origin --delete feature/b4-sandbox-core` -- [ ] **COMMIT (Owner: Luis | Group: B4.sandbox | Branch: feature/b4-sandbox-core) - Commit message: "feat(sandbox): add sandbox strategy interface and manager"** - [X] Code [Luis]: Add `SandboxStrategy` protocol, `SandboxRef`, `SandboxManager`, and `SandboxRegistry` with per-resource sandboxes. (protocol, factory, manager, NoSandbox, merge strategies, status enum all implemented) - [X] Code [Luis]: Implement lazy sandbox creation, cleanup hooks, and plan-scoped retention policy stubs. (completed by Luis) ->>>>>>> 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) - [ ] Code [Luis]: Add sandbox path rewriting helper for tool execution and MCP adapters. - [ ] Code [Luis]: Include `resource_id`, `plan_id`, and `sandbox_path` in `SandboxRef` for traceability in logs. - [ ] Docs [Luis]: Add `docs/reference/sandbox.md` describing lifecycle, APIs, and path rewriting rules. @@ -3888,25 +3780,11 @@ By Day 30, the system must be able to (all in LOCAL MODE, server connectivity is - [ ] Git [Luis]: `git checkout -b feature/m4-security-eval` - [ ] Git [Luis]: `git push -u origin feature/m4-security-eval` - [ ] Git [Luis]: `git fetch origin && git merge origin/master` (run before final tests and before commit) -<<<<<<< HEAD - [ ] Forgejo PR [Luis]: Open PR from `feature/m4-security-eval` to `master`, wait for CI + review, merge in UI (no CLI merge) - [ ] Git [Luis]: `git branch -d feature/m4-security-eval` - [ ] Git [Luis]: `git push origin --delete feature/m4-security-eval` - [ ] **COMMIT (Owner: Luis | Group: SEC1.eval | Branch: feature/m4-security-eval) - Commit message: "fix(security): remove eval-based config parsing"** - - [ ] Code [Luis]: Audit and remove all `eval`/`exec`/`compile` usage from production config paths. -||||||| parent of 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) -- [ ] Forgejo PR [Luis]: Open PR from `feature/sec1-eval` to `master`, wait for CI + review, merge in UI (no CLI merge) -- [ ] Git [Luis]: `git branch -d feature/sec1-eval` -- [ ] Git [Luis]: `git push origin --delete feature/sec1-eval` -- [ ] **COMMIT (Owner: Luis | Group: SEC1.eval | Branch: feature/sec1-eval) - Commit message: "fix(security): remove eval-based config parsing"** - - [ ] Code [Luis]: Audit and remove all `eval`/`exec`/`compile` usage from production config paths. -======= -- [ ] Forgejo PR [Luis]: Open PR from `feature/sec1-eval` to `master`, wait for CI + review, merge in UI (no CLI merge) -- [ ] Git [Luis]: `git branch -d feature/sec1-eval` -- [ ] Git [Luis]: `git push origin --delete feature/sec1-eval` -- [ ] **COMMIT (Owner: Luis | Group: SEC1.eval | Branch: feature/sec1-eval) - Commit message: "fix(security): remove eval-based config parsing"** - [X] Code [Luis]: Audit and remove all `eval`/`exec`/`compile` usage from production config paths. ->>>>>>> 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) - [ ] Code [Luis]: Replace any dynamic expression parsing with YAML/JSON parsing and explicit schema validation. - [ ] Code [Luis]: Add a hard error if config files contain inline Python or templating directives. - [ ] Code [Luis]: Add config scanner that flags disallowed tokens and reports file+line in errors. @@ -3915,13 +3793,7 @@ By Day 30, the system must be able to (all in LOCAL MODE, server connectivity is - [ ] Tests (Robot) [Luis]: Add `robot/security_eval.robot` smoke tests. - [ ] Tests (ASV) [Luis]: Add `asv/benchmarks/security_eval_bench.py` for config parsing baseline. - [ ] Quality [Luis]: Run `nox` (all default sessions, including benchmark). -<<<<<<< HEAD - - [ ] Quality [Luis]: Verify coverage >=97% via `nox -s coverage_report`. If coverage is <97% then review the current unit test coverage report at `build/coverage.xml` and use it to write new Behave based unit tests to improve code coverage. Specifically, write Behave style unit tests that are descriptively named and specifically improves coverage on whichever file has the most uncovered lines by writing tests that will target the uncovered lines in the report. Once that is done rerun `nox -s coverage_report` to verify all tests pass and coverage is above >=97%. Only mark this as complete once coverage is >=97%, if not repeat this task as many times as is needed until coverage reaches >=97%. -||||||| parent of 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) - - [ ] Quality [Luis]: Verify coverage >=97% via `nox -s coverage_report`. -======= - - [ ] Quality [Luis]: Verify coverage >=97% via `nox -s coverage_report`. (Code review by Brent still pending) ->>>>>>> 561f170 (feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening) + - [ ] Quality [Luis]: Verify coverage >=97% via `nox -s coverage_report`. If coverage is <97% then review the current unit test coverage report at `build/coverage.xml` and use it to write new Behave based unit tests to improve code coverage. Specifically, write Behave style unit tests that are descriptively named and specifically improves coverage on whichever file has the most uncovered lines by writing tests that will target the uncovered lines in the report. Once that is done rerun `nox -s coverage_report` to verify all tests pass and coverage is above >=97%. Only mark this as complete once coverage is >=97%, if not repeat this task as many times as is needed until coverage reaches >=97%. (Code review by Brent still pending) - [ ] Commit [Luis]: `git commit -m "fix(security): remove eval-based config parsing"`. **Parallel Group SEC2: Template Injection Prevention [Luis]**