Tiered worker allocation: implementors get full N workers, PR reviewers
N//2, and discovery agents (UAT, bug hunter, test-infra) N//4 to prevent
issue creation from outpacing implementation throughput.
Dead PR cleanup: PR reviewer now auto-closes stale, superseded,
unmergeable, and orphaned PRs every 5 cycles.
Post-merge issue closure: PR reviewer and self-reviewer now verify that
linked issues actually close after merge, removing satisfied dependency
links that block closure. Backlog groomer scans last 24h of merged PRs
and repairs open PR dependency health (reversed links, stale deps).
Closed-item guards: agents no longer wastefully modify closed issues/PRs.
Human liaison still responds to new human comments on closed items but
efficiently without re-triage. Backlog groomer prioritizes open items
first. System watchdog detects and flags closed-item interaction waste.
Scope control: non-critical findings from UAT testers and bug hunters now
route to backlog (no milestone + Priority/Backlog) instead of inflating
active milestones. Epic planner and issue creator skip converging
milestones. Project owner monitors and alerts on scope creep.
The Forgejo blocks/dependencies REST API requires the IssueMeta schema
with owner, repo, and index fields — not the undocumented dependency_id
field that was previously used. All 10 curl examples across 6 agent
definitions were using {"dependency_id": N} which returns a 404
IsErrRepoNotExist error. Updated to the correct format:
{"owner": "<owner>", "repo": "<repo>", "index": N}
Files updated:
- ca-new-issue-creator.md (2 occurrences)
- ca-pr-api-creator.md (1 occurrence)
- ca-state-reconciler.md (1 occurrence)
- ca-project-owner.md (1 occurrence)
- ca-backlog-groomer.md (2 occurrences)
- ca-epic-planner.md (3 occurrences)
ISSUES CLOSED: #2750
BREAKING CHANGE: Supervisors can no longer use Task tool to launch workers
Major refactor of the permission model for product-builder and all 15
continuous supervisors to enforce strict separation: supervisors MUST use
curl/prompt_async via bash to launch workers, and CANNOT use the Task tool.
Key Changes:
1. Product-Builder Permissions (product-builder.md):
- Removed ALL Task permissions for supervisors (previously had 17)
- Kept Task permissions ONLY for 7 one-shot agents:
ca-project-bootstrapper, ca-ref-reader, ca-issue-finder,
ca-session-persister, ca-product-verifier, ca-milestone-reviewer,
ca-final-reporter
- Restricted bash to: echo, curl, sleep, jq only
- Removed Phase B (Architecture) and Phase C.1 (Planning)
- Updated to launch 15 supervisors (up from 13)
2. New Continuous Supervisors:
- ca-architect: Converted from one-shot to continuous supervisor
Monitors for spec needs, new milestones, ambiguities
- ca-epic-planner: Converted from one-shot to continuous supervisor
Monitors for milestones without issues, incomplete epics
3. All 15 Supervisors - Standardized Permissions:
- Removed ALL Task permissions for launching workers
- Workers MUST be launched via curl to OpenCode Server prompt_async API
- Added 'jq *' for JSON parsing (replacing python3)
- Restricted bash to specific commands only (deny all, allow specific)
- Git commands restricted to specific operations (clone*, fetch*, etc.)
- Directory operations (cd, mkdir, rm -rf) only where needed
4. Supervisor-Specific Updates:
- issue-implementor: Removed ca-issue-worker task permission
- ca-continuous-pr-reviewer: Added git + directory ops, removed worker tasks
- ca-uat-tester: Added read-only file/git commands, removed self-dispatch
- ca-bug-hunter: Restricted git to read-only, removed self-dispatch
- ca-test-infra-improver: Added read-only commands, removed self-dispatch
- ca-human-liaison: Removed ca-epic-planner/ca-architect task permissions
- ca-agent-evolver: Added git + directory operations
- ca-architecture-guard: Added read-only + git clone operations
- ca-spec-updater: Added git + directory operations
- ca-backlog-groomer: Removed ca-epic-planner task permission
- ca-docs-writer: Added git + directory operations
- ca-timeline-updater: Added git + directory operations
- ca-project-owner: Minimal permissions (curl, jq, sleep only)
Impact:
- Proper separation of concerns: supervisors orchestrate, workers execute
- No possibility of supervisors blocking on Task tool calls
- True fire-and-forget worker launching via prompt_async
- Consistent permission model across all 15 supervisors
- Maximum parallelism with proper isolation
Architecture now enforces: Product-builder → 15 supervisors → N workers
All launched via curl/prompt_async, NO Task tool for supervisors.
Agents were failing when trying to run complex bash commands (curl with
pipes to python3, multi-command pipelines, etc.) because their bash
permissions were set to '"*": deny' with only specific simple patterns
allowed (e.g., "curl *": allow). Shell pipelines like:
curl -s http://localhost:4096/session | python3 -c "import json..."
don't match any single allow pattern and get denied.
Changed 17 agent files from restrictive bash permissions to '"*": allow'.
This includes all agents that need to:
- Run curl pipelines with python3 for prompt_async session management
- Create Forgejo dependency links via REST API curl calls
- Execute complex git operations with pipes
- Run bash sleep for polling loops
Only 3 truly read-only analysis agents remain restricted:
ca-difficulty-evaluator, ca-implementation-reviewer, ca-issue-analyzer.
These don't need bash access at all.
Issues and PRs created by agents were missing required labels, milestones,
and Forgejo dependency links per CONTRIBUTING.md. This commit adds explicit
API call instructions and a continuous compliance audit to fix the gaps.
Changes across 6 agent definitions:
- ca-new-issue-creator: Added curl bash permission. Added explicit
post-creation compliance steps: set labels (State/Unverified, Type/*,
Priority/*) via forgejo_add_issue_labels, set milestone via
forgejo_update_issue, create parent Epic dependency link via REST API
(POST /issues/{child}/blocks with parent Epic number — correct direction:
child blocks parent). Added compliance verification step.
- ca-epic-planner: Added curl bash permission. Added post-creation API
call checklists for both Epics (labels, Legendary link) and child issues
(labels, milestone, Epic dependency link, inter-issue dependency links).
Added compliance verification step.
- ca-backlog-groomer: Added curl and sleep bash permissions. Expanded
Pass 4 (Label Quality) to auto-fix missing labels (State, Type, Priority)
and milestones via Forgejo API. Added PR label/milestone compliance
checking. Added new Pass 9 (Dependency Link Compliance) to auto-fix
missing parent Epic links, PR-to-issue links, and wrong dependency
direction. Added new Pass 10 (Issue Body Compliance) to flag missing
Metadata, Subtasks, and Definition of Done sections.
- ca-pr-api-creator: Added curl bash permission. Replaced vague "add
dependency" instruction with explicit REST API curl call for creating
PR-blocks-issue dependency link. Added post-creation compliance
verification step.
- ca-agent-evolver: Added Priority/Backlog label and milestone assignment
to proposal issues.
- ca-spec-updater: Added Priority/Backlog label and milestone assignment
to proposal issues.
Four changes in one commit across 27 agent files:
1. POOL SUPERVISOR PROMPT_ASYNC: All 4 pool supervisors (issue-implementor,
ca-continuous-pr-reviewer, ca-uat-tester, ca-bug-hunter) now dispatch
their internal workers via the OpenCode Server's prompt_async endpoint
instead of the Task tool. This eliminates the wait_for_all bottleneck
at the supervisor level — workers run independently, and a 10-second
polling loop detects completions and immediately refills vacant slots.
Added curl/sleep bash permissions where needed. Each supervisor keeps
N workers running at all times with zero idle slots.
2. SESSION RESUME INSTEAD OF CLEANUP: The product-builder and all 4 pool
supervisors now RESUME existing sessions from a previous interrupted
run instead of aborting them. Phase C.0 queries the server for sessions
titled "[CA-AUTO] supervisor:*" and adopts any that are still active
into the monitoring loop. Pool supervisors similarly adopt existing
"[CA-AUTO] worker-*" sessions. This enables "continue where you left
off" — restarting the product-builder reconnects to running supervisors
and workers rather than duplicating them.
3. DEDICATED CLEANUP AGENT: New ca-session-cleanup.md primary agent for
explicit fresh-start cleanup. Run this BEFORE the product-builder when
you want to abort all previous sessions and start completely fresh. It
finds all "[CA-AUTO]" sessions, aborts them, and deletes them. This is
the ONLY way to kill old sessions — the product-builder never does it
automatically.
4. BOT SIGNATURES: All 26 agents that post content to Forgejo now include
a mandatory "Bot Signature" section requiring every comment, issue body,
PR description, and review to end with:
---
**Automated by CleverAgents Bot**
Supervisor: <category> | Agent: <agent-name>
24 agents have hardcoded categories. 2 shared agents (ca-new-issue-creator,
ca-epic-planner) use a parameter-based category from their caller's prompt.
freemo
