c7a20eccd0
CI / load-versions (pull_request) Successful in 31s
CI / push-validation (pull_request) Successful in 37s
CI / lint (pull_request) Successful in 44s
CI / typecheck (pull_request) Successful in 1m10s
CI / security (pull_request) Successful in 1m24s
CI / build (pull_request) Successful in 36s
CI / quality (pull_request) Successful in 1m22s
CI / helm (pull_request) Successful in 2m7s
CI / unit_tests (pull_request) Successful in 7m55s
CI / docker (pull_request) Successful in 2m54s
CI / integration_tests (pull_request) Successful in 12m23s
CI / coverage (pull_request) Successful in 14m4s
CI / status-check (pull_request) Successful in 3s
The previous refactor routed list_invariants through _resolve_scope, which silently changed the no-flags behavior: _resolve_scope returns (GLOBAL, "system") when no flag is given (the `add` default), so `agents invariant list` filtered to only global+system invariants instead of returning every active invariant. InvariantService.list_invariants documents scope=None / source_name=None as "all scopes" / "all sources"; the listing CLI must preserve that contract. Inline the mutual-exclusion check in list_invariants and restore the if/elif chain that leaves scope/source_name=None when no flag is set, while keeping `agents invariant add` defaulting to global. Tests added: - "List invariants with no flags passes no scope filter" verifies the service is called with scope=None, source_name=None. - "List invariants with conflicting scope flags rejected" covers the new BadParameter raise path. ISSUES CLOSED: #11049