Add a matrix strategy to the unit_tests and integration_tests jobs in
ci.yml so that tests run against all Python versions listed in
SUPPORTED_PYTHONS in noxfile.py (currently ["3.13"]).
Changes:
- Add strategy.matrix.python-version to unit_tests and integration_tests
- Set fail-fast: false so all matrix versions run even if one fails
- Use matrix.python-version in the container image tag
- Invoke nox with the versioned session name (e.g. unit_tests-3.13)
- Scope uv cache keys per Python version to avoid cross-version pollution
- Remove the now-unused global PYTHON_VERSION env var
When SUPPORTED_PYTHONS is extended in noxfile.py, only the matrix list
in ci.yml needs updating to add the new version.
ISSUES CLOSED: #1539
Add explicit aiohttp>=3.13.4 dependency constraint to pyproject.toml to remediate CVE-2026-34515, a high-severity open redirect vulnerability. The lockfile already resolves aiohttp to 3.13.5 which satisfies the constraint.
Closes#1544
Consolidates all per-job uv cache key prefixes across CI workflow files into a single shared key, eliminating redundant package downloads. Also adds missing uv cache steps to the build job and nightly-quality.yml.
Closes#1535
Restores the working OpenCode server mode + curl-based async supervisor
launch functionality from commit 9bbec0e6 (2026-04-02) and updates it for
the current 13-supervisor architecture.
Changes applied to 7 agent files (938 insertions, 221 deletions):
1. product-builder.md: Restored from 9bbec0e6 and updated for 13 supervisors
- Full bash permissions for curl/sleep
- Server URL: http://localhost:4096
- Launch via POST /session + POST /session/:id/prompt_async
- Session resume (adopts existing [CA-AUTO] sessions)
- Added ca-test-infra-improver and ca-project-owner to launch sequence
- Updated concurrent worker calculations (~5N + ~8 singletons)
2. issue-implementor.md: Restored curl-based worker dispatch
- 10-second polling loop with bash sleep
- Worker sessions via prompt_async
- Session resume for existing workers
3. ca-continuous-pr-reviewer.md: Restored curl dispatch pattern
4. ca-uat-tester.md: Restored curl pool mode
5. ca-bug-hunter.md: Restored curl pool mode
6. ca-test-infra-improver.md: Added self-dispatch permission
7. ca-session-cleanup.md: Restored utility agent
Architecture: 5 pool supervisors (N workers each) + 8 singleton supervisors
= 13 total supervisors running async via prompt_async.
Replaces the broken prompt_async implementation from commit 074c472e that
removed supervisors from task permissions without working server launch.
To use: Start OpenCode with --port 4096, then launch product-builder.
Refs: commit 9bbec0e6 (working version), commit 074c472e (broken version)
Add explicit aiohttp>=3.13.4 dependency constraint to pyproject.toml to
remediate CVE-2026-34515, a high-severity open redirect vulnerability in
aiohttp that affects the A2A server HTTP transport, MCP tool source
fetching, and agent communication layers.
The uv.lock already resolves aiohttp to 3.13.5 which satisfies the
>=3.13.4 constraint. Adding the explicit constraint ensures vulnerable
versions (<3.13.4) cannot be installed even if upstream transitive
dependency constraints are loosened.
ISSUES CLOSED: #1544
- Add _EVENT_TYPE_TO_METHOD class-level mapping (ClassVar[dict[str, str]]) to
convert A2A event types to JSON-RPC 2.0 method names:
TaskStatusUpdateEvent → task/statusUpdate
TaskArtifactUpdateEvent → task/artifactUpdate
- Refactor SseEventFormatter.format() to produce JSON-RPC 2.0 notification
envelope: {"jsonrpc": "2.0", "method": "...", "params": {...}}
- Move event data fields into params object; include taskId (from plan_id)
in params when plan_id is present, per spec §Streaming Architecture
- Remove non-spec fields (event_id, event_type, timestamp, plan_id) from
the data payload; these remain in SSE envelope headers (event: and id:)
- Update BDD feature to verify JSON-RPC 2.0 structure for both event types,
events with/without plan_id, custom data in params, and exclusion of
non-spec fields
- Fix pre-existing type errors in step definitions: replace try/except
ImportError pattern with direct imports and use behave.runner.Context
for proper static typing (0 pyright errors)
ISSUES CLOSED: #1502
Move the large embedded `_BEHAVE_PARALLEL_CLI_SOURCE` string constant out of
noxfile.py and into a standalone `scripts/run_behave_parallel.py` module.
The `_install_behave_parallel()` helper now reads the script from disk via
`Path(__file__).parent / 'scripts' / 'run_behave_parallel.py'` instead of
embedding the source as a raw string literal. This allows ruff to lint and
type-check the runner independently, and makes noxfile.py significantly
shorter and easier to read.
No functional changes: the installed `behave-parallel` entry point is
identical to the previous embedded version. Parallel and sequential modes,
coverage integration, and the multiprocessing fork model are all preserved.
Fixed two SIM105 lint violations in the extracted script (replaced
try/except/pass with contextlib.suppress).
ISSUES CLOSED: #1538
Add missing provider: field to all actor examples in examples/actors/.
Fix llm_with_tools.yaml actor name from assistants/file_analyzer to
local/assistants-file_analyzer (custom actors must use local/ namespace
and cannot contain two slashes).
Add validate-all command to helper_actor_examples.py that uses ActorLoader
to validate all examples via business logic checks. Add integration test
Validate All Actor Examples Import Without Errors to actor_examples.robot
that confirms every example in examples/actors/ can be imported without
errors.
ISSUES CLOSED: #1504
Replace per-job cache key prefixes (uv-lint-, uv-typecheck-, uv-security-,
uv-quality-, uv-tests-, uv-coverage-) with a single shared key
uv-${{ hashFiles('pyproject.toml') }} across all jobs in ci.yml.
Also add a missing uv cache step to the build job and add uv caching
to nightly-quality.yml, which previously had no cache at all.
All jobs now share the same cache entry when pyproject.toml is unchanged,
eliminating redundant package downloads and reducing CI wall-clock time.
ISSUES CLOSED: #1535
- CHANGELOG: add Fixed entries for PRs #1574, #1570, #1569, #1547, #1548,
#1522, #1524, #1525, #1520, #1553 covering rich output panels for session,
actor, and plan commands, plus version commit SHA and provider fix
- docs/reference/session_cli.md: document new rich output panels for
session create (Settings, Actor Details), session list (Name column,
Summary panel), session show (Automation field), session delete
(Deletion Summary, Cleanup panels); update export to document --format md
- docs/reference/actor_cli.md: document new rich output panels for
actor remove (Actor Removed, Impact, Cleanup) and actor list (Summary panel)
- docs/reference/plan_cli.md: document new rich output for plan list
(Elapsed column, Filters panel, Summary panel)
- docs/reference/cli_system_commands.md: document commit SHA resolution
order (CLEVERAGENTS_COMMIT env var → git rev-parse → 'unknown')
ISSUES CLOSED: #1574#1570#1569#1547#1548#1522#1524#1525#1520#1553
The product-builder was ignoring prompt_async instructions and implementing
tickets directly because its identity was "autonomous product builder that
handles everything." The LLM absorbed this framing and defaulted to doing
the work itself rather than launching supervisors.
Root cause fix — two structural changes applied to product-builder AND all
5 pool supervisors:
1. IDENTITY REFRAME: The product-builder is now explicitly a "Supervisor
Launcher and Monitor" — not a "product builder." The opening section
states: "YOUR ONLY JOB: Launch 13 supervisor sessions via bash curl
and keep them alive." A prominent DO NOT list prohibits implementing
issues, creating PRs, writing code, or doing any work a supervisor
handles. The file was compressed from 975 to 312 lines — prerequisites
are brief, the supervisor launch is the first major section, and the
monitoring loop is the primary content.
2. WORKER AGENTS REMOVED FROM TASK PERMISSIONS: Every pool supervisor had
its worker agent in the task permissions, giving the LLM the choice to
use the Task tool instead of prompt_async. Now removed:
- issue-implementor: removed ca-issue-worker
- ca-continuous-pr-reviewer: removed ca-pr-self-reviewer, ca-pr-checker
- ca-uat-tester: removed ca-uat-tester (self-dispatch)
- ca-bug-hunter: removed ca-bug-hunter (self-dispatch)
- ca-test-infra-improver: removed ca-test-infra-improver (self-dispatch)
Each supervisor now has a prominent framing block at the top: "YOU ARE A
POOL SUPERVISOR. You dispatch workers via bash curl prompt_async. Worker
agents have been REMOVED from your task permissions."
Non-worker task permissions preserved (ca-ref-reader, ca-spec-reader,
ca-new-issue-creator, etc.) for legitimate one-shot subagent calls.
Implements issue #1548. The agents session show command now displays the Automation field and success message per specification.
Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Implements issue #1524. The agents actor remove command now displays the spec-required Actor Removed, Impact, and Cleanup panels, plus success message.
Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Implements issue #1525. The agents actor list command now displays the spec-required Summary panel with statistics and success message.
Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Implements issue #1552. Reorders the command synopsis in the specification to logically group validation commands separately from regular commands for better clarity.
Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Implements issue #1520. The version command now displays the actual git commit SHA to help identify which version of the code is running.
Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
The LangChainChatProvider class defined name and model_id as read-only
properties without setters, causing AttributeError when PlanService
attempted to set these properties after provider instantiation.
Root Cause:
- LangChainChatProvider.name and .model_id were @property without @setter
- PlanService._resolve_ai_provider_for_actor() attempts to mutate these
properties at lines 411 and 413
- This caused: AttributeError: property 'name' of 'LangChainChatProvider'
object has no setter
Solution:
Added property setters for both name and model_id:
@name.setter
def name(self, value: str) -> None:
self._name = value
@model_id.setter
def model_id(self, value: str) -> None:
self._model_id = value
This allows PlanService to correctly resolve provider names and model IDs
without raising AttributeError.
Impact:
- Fixes the agents build command crash when using agents tell
- No regression: existing functionality unchanged
- Properties remain type-safe (str -> str)
ISSUES CLOSED: #1553
Approved proposal: #1483
Pattern: workflow_fix — UAT supervisor creates 13+ separate issues for
progress reports instead of posting comments on a single tracking issue.
Evidence: 13 separate [UAT-SUPERVISOR] Progress Report issues created in
65 minutes during v3.7.0 session, polluting the issue tracker.
Fix: Create ONE tracking issue at startup, post all progress as comments.
Also reduces report frequency from every 2 cycles to every 10 cycles.
ISSUES CLOSED: #1483
- CHANGELOG: add [Unreleased] entries for TUI first-run experience (#1391),
session Markdown export (#1004), and UKO provenance/temporal versioning (#891)
- README: add first-run experience and Markdown transcript export bullets
- docs/api/tui.md: new TUI API reference covering first-run, persona system,
input routing, slash commands, session export/import, and widgets
- docs/api/index.md: add TUI entry to module index
- docs/api/resource.md: document DatabaseResourceHandler and DevcontainerHandler
full protocol implementations with method tables and examples
- docs/architecture.md: expand UKO section with provenance/temporal versioning
details; update TUI design decision summary
- mkdocs.yml: add TUI page to API Reference nav
ISSUES CLOSED: #1391#1004#891
Adds two new agent types to the autonomous system, bringing the total
from 11 to 13 supervisors launched by the product-builder via prompt_async.
New agents:
1. ca-test-infra-improver (12th supervisor — pool with N workers):
Dual-mode agent following the ca-bug-hunter pattern. In pool mode,
dispatches N parallel workers via prompt_async to analyze 8 aspects
of the testing infrastructure: CI execution time, coverage gaps, test
architecture (BDD quality), flaky tests, CI pipeline optimization,
test data quality, missing test levels (Behave/Robot/ASV per
CONTRIBUTING.md), and dependency security. Workers file actionable
Type/Testing or Type/Task issues. Hard constraint: never disables
or weakens existing checks — only proposes additions and optimizations.
Uses Gemini 2.5 Pro for large context. Follows all established patterns
(clone isolation, bash sleep, prompt_async dispatch, session resume,
bot signature).
2. ca-project-owner (13th supervisor — singleton, no pool):
Acts as autonomous project owner. Continuously triages State/Unverified
issues following CONTRIBUTING.md's 6-step triage process. Assigns
MoSCoW labels (Must Have / Should Have / Could Have) based on the
specification and milestone goals. Makes strategic priority decisions.
Tags specific developers with questions in Forgejo comments (discovers
expertise from git history and Forgejo assignments). Periodically
re-evaluates MoSCoW labels as the project evolves. Follows up on
unanswered questions after 48 hours. Single instance, not a pool —
one project owner is sufficient. Uses Opus for nuanced strategic
judgment. Launched via prompt_async like all other supervisors.
Modified files:
- product-builder.md: Updated from 11 to 13 supervisors in all locations
(architecture table, Phase C.2 launch list with entries #12 and #13,
validation count, checkpoint text, self-coordinate table). Added
test-infra-pool to pool supervisors list and project-owner to singletons.
- ca-human-liaison.md: Clarified MoSCoW responsibility split — the liaison
only adjusts MoSCoW labels when relaying explicit human feedback. The
ca-project-owner handles autonomous MoSCoW assignment.
Renames `plan lifecycle-list` to `plan list` and `plan lifecycle-apply` to `plan apply` to align with the specification's canonical command names. Removes legacy V2 plan commands that occupied those names.
- Renamed CLI command registrations from lifecycle-list/lifecycle-apply to list/apply
- Removed legacy V2 apply and list commands (~200 lines)
- Updated apply shortcut in main.py to delegate to v3 lifecycle
- Added defensive null check for plan existence in apply command
- Updated 63+ test, doc, and benchmark files for consistency
Closes#881
Co-authored-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Co-committed-by: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Mid-day refresh: 47 open PRs (+2), 289 open issues (+15 new UAT/refactor
issues in v3.7.0 backlog). v3.5.0 advanced to 78% (164/209, +2 closed).
v3.7.0 at 60% (36/60, +1 new issue). 50 open bugs stable.
Updated sections: Gantt chart update log, footer, risk register legend,
Current Status Summary, What Remains To Be Done, Day 53 schedule adherence
entry (task inventory with per-developer breakdown).
Add docs/api/ with per-module API documentation for core, a2a, actor,
skills, tool, mcp, resource, and config packages. Add docs/architecture.md
with a developer-oriented system overview including component map, layer
diagram, plan lifecycle, and key design decisions. Update mkdocs.yml nav
to expose both new sections.
ISSUES CLOSED: #N/A
The product-builder was ignoring the prompt_async instructions and falling
back to the Task tool for launching supervisors. It was also only launching
a few supervisors instead of all 11 because the pseudocode was too abstract.
Root cause: All 11 supervisor agents were listed in the task permissions,
so the LLM had a choice between Task (familiar, simpler) and bash curl
(correct but unfamiliar). It chose Task every time.
Fix — three changes:
1. REMOVED all 11 supervisor agents from task permissions. The product-
builder physically cannot invoke them via the Task tool anymore. Only
one-shot agents remain in task permissions (ca-epic-planner,
ca-session-persister, ca-product-verifier, ca-ref-reader, etc.).
2. REWROTE Phase C.2 as concrete curl command templates instead of
abstract pseudocode. The agent now has the exact curl pattern to
copy-paste for each supervisor, with clear variable placeholders.
Added a mandatory validation step: wc -l the tracking file and
confirm exactly 11 entries before proceeding.
3. ADDED aggressive warnings at three levels:
- Top of file: bold mandatory notice about prompt_async
- Phase C.2: large boxed warning block prohibiting the Task tool
- Coordination rules: explicit statement that supervisors are
removed from task permissions
- Monitoring loop: reminder to use bash curl for re-launches
Agents were failing when trying to run complex bash commands (curl with
pipes to python3, multi-command pipelines, etc.) because their bash
permissions were set to '"*": deny' with only specific simple patterns
allowed (e.g., "curl *": allow). Shell pipelines like:
curl -s http://localhost:4096/session | python3 -c "import json..."
don't match any single allow pattern and get denied.
Changed 17 agent files from restrictive bash permissions to '"*": allow'.
This includes all agents that need to:
- Run curl pipelines with python3 for prompt_async session management
- Create Forgejo dependency links via REST API curl calls
- Execute complex git operations with pipes
- Run bash sleep for polling loops
Only 3 truly read-only analysis agents remain restricted:
ca-difficulty-evaluator, ca-implementation-reviewer, ca-issue-analyzer.
These don't need bash access at all.
Issues and PRs created by agents were missing required labels, milestones,
and Forgejo dependency links per CONTRIBUTING.md. This commit adds explicit
API call instructions and a continuous compliance audit to fix the gaps.
Changes across 6 agent definitions:
- ca-new-issue-creator: Added curl bash permission. Added explicit
post-creation compliance steps: set labels (State/Unverified, Type/*,
Priority/*) via forgejo_add_issue_labels, set milestone via
forgejo_update_issue, create parent Epic dependency link via REST API
(POST /issues/{child}/blocks with parent Epic number — correct direction:
child blocks parent). Added compliance verification step.
- ca-epic-planner: Added curl bash permission. Added post-creation API
call checklists for both Epics (labels, Legendary link) and child issues
(labels, milestone, Epic dependency link, inter-issue dependency links).
Added compliance verification step.
- ca-backlog-groomer: Added curl and sleep bash permissions. Expanded
Pass 4 (Label Quality) to auto-fix missing labels (State, Type, Priority)
and milestones via Forgejo API. Added PR label/milestone compliance
checking. Added new Pass 9 (Dependency Link Compliance) to auto-fix
missing parent Epic links, PR-to-issue links, and wrong dependency
direction. Added new Pass 10 (Issue Body Compliance) to flag missing
Metadata, Subtasks, and Definition of Done sections.
- ca-pr-api-creator: Added curl bash permission. Replaced vague "add
dependency" instruction with explicit REST API curl call for creating
PR-blocks-issue dependency link. Added post-creation compliance
verification step.
- ca-agent-evolver: Added Priority/Backlog label and milestone assignment
to proposal issues.
- ca-spec-updater: Added Priority/Backlog label and milestone assignment
to proposal issues.
Both the spec-updater and agent-evolver previously skipped straight to
creating PRs with 'needs feedback' for proposed changes. The user needs
a two-step human-approval workflow:
Step 1: Agent creates a PROPOSAL ISSUE with 'needs feedback' label
describing what it wants to change and why. No branch, no code changes.
Step 2: Human reviews the issue and approves it (by removing 'needs
feedback', adding 'State/Verified', or commenting with approval).
Step 3: Agent detects approval, normalizes labels, creates branch + PR
(also with 'needs feedback') implementing the approved change.
Step 4: Human reviews the PR and merges it.
Changes across 3 agent definitions:
- ca-agent-evolver: Step 4 split into proposal issue creation (Step 4)
and approved-proposal implementation (Step 5). Added pending_proposals
and pending_prs state tracking. Approval detected via 3 signals:
label removal, State/Verified addition, or human approval comment.
- ca-spec-updater: Removed the minor/major classification and the
"commit directly to master" path. ALL spec changes now go through
proposal issues first (Step 6a creates issue, Step 7 monitors for
approval). Added pending_spec_proposals and rejected_proposals state.
Approval check runs every cycle before checking for new merged PRs.
- ca-human-liaison: Added Step 4 guard — issues with 'needs feedback'
label are NOT auto-verified. The liaison acknowledges them with a
comment but does not change state labels. Only issues WITHOUT 'needs
feedback' proceed to the normal auto-verify flow (now Step 5).
Add lifecycle management and sandbox support for MCP tools:
- McpClient: lazy start, configurable idle timeout with auto-stop, health monitoring with automatic restart
- McpRegistry: namespace-isolated tracking of multiple MCP servers
- SandboxPathRewriter: bi-directional file path rewriting between host and sandbox workspaces
- MCPCapabilityMetadata: structured exposure of full MCP server capabilities
- 26 BDD scenarios covering lifecycle, sandbox rewriting, and edge cases
ISSUES CLOSED: #938
freemo
arch-guard