37 Commits

Author	SHA1	Message	Date
Patrick Buckley	480a1426b3	Fail-closed history-commit handoff (#1005) ... * fix(session): fail-closed history-commit handoff (#981) The deleted-workstream discovery is now a terminal, ws_id-keyed latch: keyed conversation commits refuse admission once the durable parent is gone (convergence finalizers and force-abandon are exempt), history handoff refuses to mint a proof token so /history fails closed with a 503 instead of silently wiping the pane, and the SSE stream carries a workstream_gone resync reason. Discarded commits leave a forensic log of commit keys and roles, never content. Conversation rows gain a commit_key (migration 071): keyed saves are idempotent under retry, validated against the full commit identity, and refused when they would cross a workstream deletion. The prune orphan category now requires a NULL alias plus a two-hour updated grace, with cutoffs computed at discovery time and carried into both dialects' rechecks. The mid-turn interjection queue is owner-partitioned with no per-site mode flags: pops take the acting principal's and unowned rows, other participants' rows are structurally retained, and enforcement lives at queue admission plus the shared before_spawn gates. The retraction ledger is bounded by open pop windows: pops open a window atomically with the queue delete, restores close their ids atomically with the ledger consume, every other exit closes through one helper, and misses for unheld ids record nothing. The workstream-gone latch refuses unattended wakes at all three gates (watcher spawn, claim, delivery pre-pop), and the retry dispatcher regained its pre-envelope cancel/error convergence net. Persistence-state reporting derives through the session bound to each UI instead of a registry lookup by id that failed open to healthy during tombstone retention. The dashboard roster no longer re-inserts ghost entries from trailing activity events, the history tool-outcome scan tolerates interleaved non-turn rows, and the shared handoff-deadline handle owns its own retirement. Single-sourced across call sites: keyed-commit row values, attachment save wrappers, tail-truncation and conflict-resolution bodies for both storage dialects; worker-slot lifecycle field sets; the direct-commit admission frame; queued-row layout accessors; the string-aware comment stripper shared by every JS harness suite. Refs #981 #964 * fix(session): sweep handoff fixes to their sibling surfaces The interactive replay loop treated a system row as a tool-batch boundary, so every tool result after an interleaved row vanished from that pane while the coordinator rendered the same history correctly. Only a conversational turn ends the batch window now, matching the shared outcome index. Accepted user turns clear the composer's attachment chips on the same viewer policy that settles optimistic bubbles rather than on having matched a local bubble, so a workstream created with an upload no longer keeps a chip for an attachment the create dispatch already consumed. The coordinator's raced-Stop arm emits the stream-end hook it inherits alongside the idle state, leaving no unfinalized bubble or unflushed tool output. Ending a session surfaces a failure toast when the request never lands or answers with a non-JSON body. The per-second persistence reconcile now probes each session without blocking: a workstream whose generation and handoff locks are held is skipped until the next pass instead of contending the locks every commit needs. The one-shot repair that gates workstream creation at capacity keeps a definite probe — it has no next pass, and the sessions likeliest to be contended are the ones whose unresolved journals emptied its candidate list. Single-sourced: the attachment lane builds its conversation row through the shared commit-identity builder; the ordinary worker exit releases its slot through the lifecycle owner; both operator surfaces snapshot their counters through one non-consuming helper; the replay preamble loses its per-kind wrappers and its config hook; the browser harness suites share one brace walker; and each in-flight history attempt is one record carrying both its abort controller and its deadline. Refs #981 #964	2026-08-11 04:18:36 -07:00
Patrick Buckley	7a06f5e8bc	refactor(session): make ModelLane the provider boundary (#979) (#989) ... * refactor(session): make ModelLane the provider boundary (#979) ## Summary This closes the model-lane ownership gap left by #832: `ChatSession` no longer stores raw provider/client handles. `ResolvedModelBinding` now carries the provider, client, model, capabilities, registry generation, and backend-auth configuration as one coherent snapshot. - Atomically rebind existing sessions after model-registry changes while pinning each in-flight send, fallback, judge, output guard, task agent, title, compaction, perception, and voice operation to its initiating principal and binding. - Fence UI publication, canonical trajectory folds, durable writes, streams, retries, child scopes, and judge work by generation. Stop can hand off to a successor without accepting late state; cancelled tools retain typed effect receipts, and concurrent approval batches resolve by exact cycle or call. - Make create, fork, open, close, and delete race-safe with hidden `creating` reservations, incarnation-aware state tails, and an ACL-rechecked transaction that clones checkpoint-bounded history, configuration, project/persona state, and attachment references. - Extend REST/OpenAPI and Python/TypeScript SDK contracts for create/fork inputs, routed-create metadata, live-workstream probes, targeted approvals, and structured cancellation results. - Update architecture, storage, authentication, judge, channel, console, API, and SDK documentation, including regenerated architecture diagrams and OpenAPI artifacts. ## Validation - SQLite suite: 11,188 passed, 9 skipped, 10 deselected - PostgreSQL suite: 11,195 passed, 2 skipped, 10 deselected - Live backend: 3 passed - SSE recovery: 6 passed; browser recovery harness passed all scenarios - Ruff: clean; 595 files correctly formatted - mypy: 243 source files clean - TypeScript: typecheck/build and 35 tests passed - OpenAPI artifacts fresh; all 14 changed diagrams reproduce byte-for-byte - `git diff --check` and Git LFS integrity clean Closes #979. * fix(deps): update nanoid for GHSA-2v37-7h3g-55p8 Refresh the transitive lock entry admitted by PostCSS so the TypeScript security gate no longer resolves the vulnerable custom-generator implementation. Validation: - npm ci - npm audit --audit-level=moderate: 0 vulnerabilities - TypeScript typecheck and build - TypeScript tests: 35 passed * fix(test): assert canonical model registry URLs Replace prefix checks with exact canonical base URL assertions so the tests do not model incomplete URL validation. Validation: tests/test_model_registry.py (185 passed); Ruff check/format; mypy.	2026-08-08 16:13:35 -07:00
Patrick Buckley	b8dd5041c4	fix(session): force-cancel runs the abandon machinery before emitting idle ... The force branch cleared worker ownership and emitted idle from the route thread, while the abandon latch and the queue demote ran only in the stuck worker's own exception handler — a thread force-cancel abandons precisely because it is not making progress. Subscribers on the IDLE fan-out therefore saw an operator-forced idle with the latch unset: the idle observer's operator-Stop gate did not suppress advice, and wake-eligible entries survived un-demoted, so a nudge wake could resume a workstream seconds after the operator forced it to stop. The route now runs the session's abandon machinery first; the abandoned thread re-running it at its eventual death is idempotent.	2026-07-29 22:11:38 -07:00
Patrick Buckley	04c29c8ef5	test(authz): stop the retract test racing the drain's claim window ... test_persistently_crashing_entry_is_never_dropped_and_retract_frees_drain fired its DELETE off the attempt counter, which increments as the FIRST statement of the attempt. The counter therefore crossed 2 while the drain still held the entry CLAIMED — popped off _pending_sends, dispatch in flight. Retract only scans that list, and correctly answers not_found for a claimed entry, so the request was racing the crash path's re-insert and the assertion saw not_found instead of removed. Both sides of that race are the same order of magnitude, which is why it read as machine-specific rather than simply broken: the re-insert lands after an intervening log.exception, roughly 5ms under pytest's capture handlers against 0.05ms with none installed, and wait_until polls at 5ms. A fast idle machine loses the race; a slower or busier one wins it. Wait for the state the test is actually about — the entry back on the list, mid-crash-loop and retractable — rather than for the counter. That is also what the docstring already claims is under test. The contract still bites: dropping the entry on the crash path fails the new wait, and removing both retracted-purge sites leaves the drain spinning and fails teardown.	2026-07-25 01:07:30 -07:00
Patrick Buckley	c019ab41d7	feat(server): opt-in server.require_project gate ... Add an opt-in, default-off `server.require_project` setting. When an admin enables it, creating an interactive chat is refused unless it is filed under a project. The feature is inert and byte-identical when off, and can only ever fail toward "off" (a missing config store or unset key reads as disabled). - settings_registry: server.require_project (bool, default False, live read). - auth: require_project_enabled + require_project_denies_create predicates (service scope / coordinator token_source exempt; NOT admin.coordinator), plus REQUIRE_PROJECT_ERROR / REQUIRE_PROJECT_CODE. - node create gate via a declarative cfg.create_gate_require_project (wired True on the interactive mount only; coordinator spawns stay ungated). - fork/resume: a fork's project is structurally its source's. Any explicit project_id is discarded, so a fork can never be re-filed under an unrelated project (which would move its copied history across a tenancy boundary). Inaccessible / projectless / nonexistent sources are uniform on body and status, so there is no cross-tenant oracle. - console cluster-create proxy surfaces only the coded require_project 400 and masks every other node outcome (401/429/3xx/5xx, un-coded 400) to a sanitized 502, guarding both body reads. - list_projects advisory field + projects.js requireProject() (fail-open). - fresh-create project picker requires an explicit project choice under the flag (no silent auto-select); forks hide the picker (inheritance is server-enforced) and get an accurate refusal message. - tests: predicate matrix, resume-inheritance oracle discriminators, console masking, and end-to-end node-gate mount wiring.	2026-07-18 16:12:59 -07:00
Patrick Buckley	1e86f068cd	chore(compaction): review round 10 — cleanups from the first correctness-clean round ... - INTERJECTION_CAP_CHARS joins PENDING_SENDS_MAX in workstream.py: the 2000-char interjection cap was triplicated (queue_message's truncation, the defer-fidelity refusal, the test fake) and already drifting in measurement — the defer check deliberately measures RAW text (raw >= cleaned since parse_priority only strips, so it can only over-refuse into a full-fidelity fresh spawn, never admit a truncation), now stated in a comment. The four unrelated 2000s (notify tool, recall preview, summary formatting, agent step cap) stay deliberately unlinked — they are different contracts. - The changelog's ~110-line compaction bullet is split into six per-seam bullets matching house style, and the Breaking (1.8) compaction-event notice moved under "### Changed" where integrators scanning bullet heads will actually see it (cross-referenced both ways with the pre-1.8 embedder compat bullet). - SpawnMetricsHook takes (ui) only: the request parameter was threaded through the whole dispatch-attempt path solely to be ignored by both installed impls; the stale "coord wires None" claims in the rewritten comment blocks are corrected too. - The attachments tests' Mock-hardening block lives once in _harden_ws_mock() — deliberately excluding _worker_running, which each fixture chooses per scenario (one relies on the truthy auto-Mock). - Two hand-rolled poll loops become wait_until (file convention, diagnostic timeout) and the orphaned time import goes with them.	2026-07-17 11:28:44 -07:00
Patrick Buckley	d280db514e	fix(compaction): review round 9 — drain-exit ownership, missed-edge settle, pre-turn hook guard ... Three point-guards from the ceiling round (no primitive took a hit; correctness yield halved at identical review sensitivity): - The drain's clean-exit wake moved OUT of the function-level try: it runs after the drain has already retired its slot, so a raise out of the wake (the dispatcher re-raises Thread.start failures) could reach the last-resort handler and clear a slot this thread no longer owned — nulling a successor drain's live registration and letting two drains service one list. The wake now runs post-try under its own guard (mirroring _retry_pending_wake), only on the clean-exit path, and the last-resort slot-clear is identity-guarded like every sibling exit seam. The except arm needed a function-local threading import: the module-top import is TYPE_CHECKING-only, so the guard would have NameErrored inside the handler with strict mypy fully green. - The shared settle helper promotes a non-deferred chip that binds onto an already-idle pane: its only sweep fired mid-POST (unbound then) and no message_dispatched ever comes for non-deferred sends, so the chip stayed a permanently retractable "queued" bubble for a delivered message. Keyed on post-bind chip state (also catching a raced folded settle bind just reconciled) and skipping dismiss-in-flight chips — the sweep's own aria-busy discipline. Pinned behaviorally: the helper now executes under node (a 4-row missed-edge matrix), possible since the consumer-less window bridge is gone. - _claim_generation's on_generation_claimed emission is call-guarded: it sits on send()'s pre-turn path, before the user turn is appended and before the fatal handler's coverage, so a raising override degrades to a lost latch-break instead of silently dropping every user message on that session. Cleanups: /command's transport catch and status-less non-2xx bodies are loud now (threading {ok, status} through the parse — deliberately no throw-on-!ok pre-gate, since the busy and error arms ride 409/503); PENDING_SENDS_MAX lives in workstream.py and ChatSession._QUEUE_MAX aliases it (one backpressure bound, structurally incapable of diverging); the send handler's not-ok arm uses _queue_full_response(); the dead window.createQueueController bridge is deleted and the file header's consumer map corrected.	2026-07-17 11:28:44 -07:00
Patrick Buckley	1224b02d03	fix(compaction): review round 8 — seam obligations become primitives ... Eight rounds of findings against the defer-and-drain seam shared one generator: N sites each hand-copying M obligations (spawn discipline, the order-barrier pair, backpressure, best-effort emission, the client settle matrix), with every review finding an empty (site x obligation) cell. This round makes each obligation a single primitive: - The order barrier is Workstream.send_barrier_active() — one definition of the two-term pair (pending entries OR drain alive), consulted by the /send route, the coordinator adapter, and the queued-nudge wake gate, which previously carried only the list term and let a synthetic wake jump an acknowledged send during the claimed-entry window. _PendingSend moved to workstream.py beside the invariant that justifies the drain-alive term; the pending fields got precise types and worker_kind became a Literal, so a typo'd "command" comparison is now a type error instead of a silently never-firing defer guard. - _defer_send probes the barrier before constructing anything, bounds acceptance at 10 pending (the interjection queue's own backpressure contract — unbounded acceptance pinned message + attachment bytes per entry for a whole command window and then ran one unattended turn each), and spawns the drain with rollback: a Thread.start failure pops the just-accepted entry and answers the retryable queue_full instead of 500ing after registration (a phantom the client could neither see nor retract, dispatched later as duplicate turns). start() deliberately stays inside the lock, unlike session_worker's outside-lock discipline: this slot is is_alive()-gated, false for a constructed-but-unstarted thread, so an outside-lock start would open a double-drain window. - A /command whose worker never spawned answers 503 {"status": "error"} (spec + docs + a pane error arm) instead of the generic 200 ok that told SDK callers their /clear ran. - The compaction lifecycle emitter is raise-proof at its single dispatch tail: a raising duck-typed hook degrades to a lost render, never a lost end event — previously a raising on_error or a raising failed-end emit left every pane a frozen progress bar, and a raising SUCCESS end after the committed swap fabricated a failed end. - The client settle matrix lives once: composer_queue's settleSendResponse owns every /send response arm for both panes (the near-verbatim twins were already drifting), parsePriority is shared, and the busy stamp is centralized in setBusy(b, source) with "server" as the fail-safe default. Deferred sends release the composer (no worker exists for them; retracting the chip no longer strands the pane in Stop mode), queue_full on an idle-looking pane removes the optimistic bubble and restores busy (the refusal can now fire with no worker and no drain to ever emit a state event), and the pre-bind settle buffer is TTL-based — a burst of deferred dispatches parked this tab's own raced settle first, where the old size cap evicted exactly it. - The command backstop / console proxy timeout inequality is enforced by a test importing both named constants (both proxy_client constructions, startup and the mTLS re-create); the compaction card wears blue (magenta is reserved for the MCP surface); the redundant TerminalUI.on_compaction override is gone (the inherited protocol default is the policy site).	2026-07-17 11:28:44 -07:00
Patrick Buckley	fd5d3efb43	fix(compaction): review round 7 — drain crash/order/settle rows, protocol-default fallback, bool event-id guard ... Completes the defer-and-drain seam against the matrix rows round 6 never enumerated (the defer contract itself took no hits): - Crash row: a claimed entry survives a dispatch crash — the per-iteration handler re-inserts it at head (claim-flagged so a claim-section failure can't duplicate it), backs off ~1s, retries. The last-resort handler spawns no successor (Thread.start fails under the exact exhaustion that reaches it): the route's ensure-drain stays the single spawn site, so single-flight is structural and a dead drain revives on the next defer. - Order row: the pending list is the order authority. The /send route pre-checks pending/drain-alive under the same lock acquisition that appends (one _defer_send helper serves the barrier and command-window triggers); the coordinator adapter refuses via its return value; the queued-nudge wake gate yields to pending sends and is re-armed by the drain's clean exit — which covers lists emptied by pure retraction — as well as every deferred turn's exit; retry-after-rewind is a documented accepted overtake; init/create is fresh-ws-by-construction. - Client settle row: queued responses carry "deferred": true (SendResponse + regenerated openapi-server.json, status enumeration completed); bind(el, msgId, {deferred, attachedCount}) replaces the _deferredAttachments expando; the idle sweep skips deferred and unbound chips; the shared dispatch attempt emits pane-tier message_dispatched (folded: true for interjection fold-ins — the chip clears only its deferred flag and keeps a live x while DELETE still genuinely retracts); settles that beat bind() park in a bounded buffer; an idle-thinking pane retro-converts its optimistic bubble into a real queued chip instead of presenting a parked message as sent. Rejection polling waits on the slot flags — one dispatch attempt per slot-state change, not 4 Hz. - SessionUI.on_compaction's protocol stub became a real default body (the classic on_info rendering): explicit subclasses inherit protocol members as real methods, which defeated _compaction_event's getattr fallback for exactly the pre-1.8 embedders it serves. - _coerce_event_id() rejects bools (isinstance(True, int) is True) at all three duck-typed event-id coercions: the compaction marker stamp, on_system_turn's persisted return, and _ui_event_id. - Quick-command backstop 60s -> 25s, under the console proxy's 30s so the degraded "running" answer can traverse a proxied pane (which now surfaces it); /resume docs drop the fictional history SSE event (clear_ui + REST re-fetch is the contract); /send response docs match the wire.	2026-07-17 11:28:44 -07:00
Patrick Buckley	e99673eb0c	fix(compaction): review round 6 — defer-and-drain send windows, workstream-scoped notify, ERROR badge survives /compact ... Replace park-and-abandon /send semantics with defer-and-drain: a send landing in a command window is answered {status: queued, msg_id} immediately and dispatched full-fidelity by a per-workstream drain thread when the window closes. Parking encoded client disconnect as message retraction — true only for the composer's ✕-abort; every bounded caller (coordinator client and console proxy at timeout=30, SDKs, stock proxies) timed out and lost its message for the whole window, and the compensating client machinery was racy (one-shot sendAbortMs sample) and over-broad (_sendAbort fired on the interjection path, dispatching dismissed messages while showing a connection error). Dismissal is now uniformly bind() → DELETE, with a fall-through that retracts pending entries; retracting an attachment-bearing deferred send surfaces the discarded-attachments consequence. The drain claims entries under ws._lock immediately before dispatch (DELETE can never remove an in-flight message), refuses the truncating interjection fallback for oversized or attachment entries atomically inside the enqueue callback, and never gives up while the workstream lives; durability is documented as node-local at-most-once. sendAbortMs, _sendAbort, the 600s bound and the park loop are deleted; route and drain share one dispatch implementation (spawn metrics included). Also: the initial-send completion notify is un-gated from slot ownership (_fire_notify_targets has exactly one call site — successor turns never notify, so the round-5 guard prevented a duplicate that cannot exist while converting force-cancel into permanent notification loss for scheduled workstreams); /compact on an ERROR workstream restores the badge instead of stamping idle over it; duck-typed SessionUIs without on_compaction get the classic on_info lines back via a shared renderer (superseded OK ends included — a committed swap must never be silent; pre-1.8 SSE clients are deliberately not dual-emitted, documented as a 1.8 breaking change); failed-end notice suppression is computed once by the emitter as a notice bool on the end event (SDK py+ts), replacing the hand-synced cli/JS policy while the panes keep their pane-local card-ownership clause.	2026-07-17 11:28:44 -07:00
Patrick Buckley	1dbf7f410c	feat(compaction): lifecycle events, web progress card, history re-render ... Compaction becomes visible: a first-class 'compaction' SSE lifecycle (start/progress/end, compaction_id-correlated, superseded-flagged ends) replaces the loose info lines; both web panes render a progress-bar card that settles into a persistent result card, re-rendered after reload via the /history projection of the compaction marker row. Slash commands echo as command chips instead of fake user turns. The enabling rework: /command dispatches onto the workstream worker slot (the old inline path blocked the node's event loop for whole compactions and let /clear interleave with live turns). Busy refusals answer 409; quick commands are awaited loop-natively with a 60s backstop; /compact is fire-and-forget. Sends during a command window park in the /send route and dispatch full-fidelity afterwards — the interjection queue (length cap, cross-user guard, identity-swap hazards) is unreachable there — with a compaction-aware client abort bound shared by both panes. compact_now() carries send()'s full generation discipline; Stop aborts the in-flight summary HTTP stream via a generation-scoped cancel ref; force-abandoned compactions retire at their next checkpoint and their stragglers are fenced off every surface (panes, pill latch, CLI). Every session retry backoff is cancel-aware via one shared helper. Docs, OpenAPI spec, and both SDKs updated. Verified: 9457-test non-live suite, JS pin suites, headless-Chrome reducer harness; five unprimed multi-agent review rounds (correctness trend 15/6/6/4/4) with plan-level design passes on every fix round.	2026-07-17 11:28:44 -07:00
Patrick Buckley	36419a9809	fix: scope private-project workstream visibility to members, not admins ... Workstreams attached to a private project were visible -- including their conversation content -- to holders of admin.cluster.inspect / admin.coordinator (both default builtin-admin permissions), defeating the project's confidentiality boundary. Enforce that a private project's resources are visible only to people IN the project (owner, workstream creator, or an explicit member), even for admins. Surfaces closed: - WorkstreamProjectVisibility bypass narrowed to service scope only (node->console machine plumbing, re-filtered per-user at the console edge). No human principal bypasses; admin.cluster.inspect gates the inspect surfaces, not tenancy. This flows to /dashboard, session listings, the attachment row-gate, cluster_workstreams, cluster_node_detail, and cluster_snapshot/SSE. - cluster_ws_detail 404-masks a workstream in a private project the caller can't see; cluster_ws_live_bulk routes such ids to the denied list (no private-project oracle). - Coordinator operator verbs (history/export/detail/send/approve/set_title/open/ children/tasks/attachments) now enforce project tenancy: _coordinator_tenant_check on coord_endpoint_config, the gate in _resolve_coordinator_or_404 (children/tasks), the tenant_check now run in make_open_handler before rehydrate, and a project-visibility check in _coord_attachment_owner. admin.coordinator gates the surface cluster-wide, but a non-member is 404-masked. The tenant-check mirrors the manager-first + coordinator-kind ladder so kind-isolation is preserved. - service scope is no longer user-assignable: admin_create_token and both turnstone-admin CLI mint paths reject it via reject_unassignable_scopes, so an admin.users holder cannot self-mint a service token and restore the bypass. Service scope is minted only by ServiceTokenManager / the JWT secret. - The events/global node proxy (service-elevated cross-tenant firehose) is gated on admin.cluster.inspect so a plain authenticated user cannot reach it through the console proxy. Updates the OpenAPI description, the row-gate/tenancy-filter docstrings, and adds tests for every surface (visibility predicate + cluster detail/bulk + coordinator history/export/children/open/attachments + events/global proxy + scope-mint rejection); inverts the tests that pinned the old admin-bypass contract.	2026-07-06 19:16:09 -07:00
Patrick Buckley	7f0e0406b3	test(approvals): concurrency matrix + suite migration to the cycle model ... New regression matrix for the release blockers: cross-approval independence, lost-wakeup at gate entry, FIFO selector-less resolution, resolve-all sweep, double-resolution no-op, cards/legacy view tracking, and the generation-exactness set — stale delivery rejection, Smart-Approvals origin check, purge keep_origin, the purge-to-register window eviction, late cross-generation "superseded" stamping, concurrent smart+human gates, and the pre-delivered-verdict fast path. Plus sub-agent judge wiring (agent_gate off the main slot, close() firing all generations) and endpoint tests for cycle pinning and the Approve+Always race guard. Gate threads run under one shared mock-patch harness — mock.patch start/stop of the same target from concurrent threads corrupts the patcher's restore stack — with a sweep-until-dead teardown so the conftest leak guard can't trip. Existing suites migrate off the singleton fields to cycle assertions and the pending_approval_details wire shape.	2026-07-05 01:57:54 -07:00
Patrick Buckley	5d1d34cd82	fix(personas): close review findings across the envelope, resume, and RBAC lanes ... Provider search gating (replace-only): native web search now stands in for a client web_search def that survived the persona visibility filter — on both OpenAI surfaces and both injection lanes (web_search_options, the server_side_tools loop, and _convert_tools' capability lane). A scribe or any envelope hiding web_search stays search-free on search-capable models; coordinators and tool-less utility calls stop receiving search too. Resume stamp discipline: resume() loads config and parses the target's stamp BEFORE touching session identity/history, so a corrupt stamp raises with the session intact instead of half-adopting and then 'repairing' the target's stamp on the next config save. The MCP lever now follows the stamp on mid-session adoption: an MCP-off stamp drops the live surface in place (listeners deregistered, toolsets reset); adopting an MCP-on stamp into a session whose persona gated the client off is refused loudly (the surface cannot be rebuilt post-construction). The REPL /resume handler reports these errors instead of crashing the CLI. Fail-closed default lane: a FAILED default-persona lookup at create is a 503 (routes) / clear exit (CLI) instead of silently degrading to the unstamped stock envelope; a clean 'no default configured' still creates legacy. resolve_persona_for_kind reports storage-unavailable distinctly from unknown-persona. Soft-set governance: tool_search expansion under a persona visibility set recomposes the system prompt so tool-gated policy segments land with the tool they gate. MCP resource/prompt catalogs gate on read_resource / use_prompt visibility. Spawn judge/audit projections carry persona (the human approval header already did). Active-list rows carry persona like their project_id twin. RBAC catalogs: persona.{create,read,write} join _VALID_PERMISSIONS and the roles-editor sections, making the documented grant-outward path real. Storage hardening: default-persona invariants move to a shared _utils helper (validate + demote) with a pg advisory xact lock serializing promotions and a post-promote single-default assertion; create maps the unique-name race to the same ValueError as the pre-check; reads validate JSON shape loudly (naming the persona); serialize enforces size caps; field validation runs before invariant checks so malformed input is a 400, never a TypeError-500. org_id guards explicit null and caps at 64. Also: base_override='' means 'no override' at the compose boundary; persona tag flattened/capped before the spawn approval header; /creative redirect resolves the writer persona before advertising it; memory-nudge gating unified through _nudges_enabled. Provider/row-shape tests updated to the new contracts (the old ones pinned the injection hole and the pre-persona row shape).	2026-07-03 00:29:26 -07:00
Patrick Buckley	80b8997b88	fix(projects): full-suite findings — type-guard the visibility gate, bind acting user without breaking send stubs ... ws_visible only treats real strings as project links (a test double or corrupted value means no-project, not private-and-denied), the mgr-path project_id is coerced likewise, and the HTTP send path binds the acting user via a getattr-guarded bind_acting_user call inside the fresh-turn closure instead of a send() kwarg — per-kind session stubs with explicit send signatures keep working. Row-shape contract tests (interactive + coordinator twins) grow the intentional project_id key.	2026-07-01 18:01:50 -07:00
Patrick Buckley	110d44b07e	refactor(tools): remove man, math, and plan_agent built-in tools ... `man` and `math` duplicated capabilities already reachable through `bash`; `plan_agent` is better expressed as a `task_agent` running a planning skill, and carried a large amount of special-case machinery (plan-review gate, refinement loop, per-kind model routing). Removing all three shrinks the tool surface and cuts per-call token cost. Also removed, as dead-once-the-tools-are-gone: - the `math` sandbox executor (`turnstone.core.sandbox`) and its `[sandbox]` extra; the eval analyst now runs bash-only - the read-only `AGENT_TOOLS` sub-agent tool set and the `agent` tool-metadata key (`task_agent`/`TASK_AGENT_TOOLS` retained) - the plan-review protocol end to end: the `on_plan_review` UI hook, `resolve_plan`, `POST /v1/api/plan` + `POST /v1/api/route/plan`, the `plan_review`/`plan_resolved` SSE events, and their Python SDK / TypeScript SDK / OpenAPI / frontend / Discord+Slack bindings - the `model.plan_alias` / `model.plan_effort` settings and the registry `plan_model` / `plan_effort` routing fields TOOLS 31->28, TASK_AGENT_TOOLS 13->11; COORDINATOR_TOOLS unchanged. BREAKING CHANGE: removes the `man`, `math`, `plan_agent` tools, the plan-review SSE/HTTP/SDK surface, and the plan_* model-routing settings from the experimental 1.6 line.	2026-05-31 19:54:43 -07:00
Patrick Buckley	c80354880a	feat(api): enrich saved-workstream list with model/skill/context fields ... GET /v1/api/workstreams/saved returned only ws_id/alias/title/created/ updated/message_count — too little to drive the planned saved-list table redesign. Add seven fields, all sourced from already-persisted data (no migration): - state, kind, node_id: columns on the workstreams table - model_alias, launch_skill: from workstream_config via LEFT JOIN - child_count: COUNT of child workstreams via parent_ws_id - context_tokens: most recent usage_events prompt size for the workstream - context_ratio: context-window occupancy (context_tokens / model context window), computed in the handler so the NULL / zero-window cases stay explicit and identical across both storage backends context_window comes from a model_definitions join; aliases defined only in config.toml are absent there, so context_ratio degrades to 0.0 rather than reporting bogus occupancy. The Python SDK reuses the Pydantic model; the TypeScript SDK OpenAPI snapshot and hand-maintained interface are updated. Tests cover the new storage columns (including NULL-when-absent), the handler ratio math + zero-window degradation, and the SDK enriched round-trip.	2026-05-29 16:05:17 -07:00
Patrick Buckley	ee8dc7c1c3	refactor(history): project the /history wire shape server-side ... Collapse the three hand-synced "raw storage -> render shape" projections into one server-side projection. The projection previously lived in a test-only `_build_history` (SSE-era reference impl), a client-side JS normaliser (`history_normalize.js`, the transitional bridge), and coord's inline `init()` handling -- drifting silently with no parity test. Add `project_history_messages` to `history_decoration.py` and run it as the final step of the `make_history_handler` pipeline (load_messages -> decorate -> extract_reasoning -> project), so `GET /history` emits the canonical render shape directly: flat tool_calls (with verdict / output_assessment), top-level source / reminders / attachments, collapsed multipart content, derived denied / is_error / pending, reasoning, and advisories. Interactive `replayHistory` now consumes the payload verbatim. Close two gaps the JS bridge deferred: - list-content <tool_output> advisory extraction (decorate handles only string content; the projection extracts list-carrier advisories, then joins remaining text parts to the string the renderers require); - orphan->pending marks ONLY the last orphan tool-call turn, so a mid-conversation cancelled tool still renders instead of vanishing. Delete `history_normalize.js` (+ its <script> tag and node test) and the test-only `_build_history` (+ orphaned imports); retarget its direct tests onto the projection helpers. Update the WorkstreamHistoryResponse description and the Web UI Resilience architecture note to the projected shape. Coord's `init()` still reads the raw side-channels; migrating it to the projected shape is the next commit, browser-verified separately. Refs #549.	2026-05-28 17:14:50 -07:00
Patrick Buckley	0ad1ab7f6d	refactor(ui): converge interactive history delivery onto REST-first model ... Interactive fetched conversation history as an inline SSE `history` event on every (re)connect — a multi-MB payload — while coord fetches it once via REST `GET /history` and uses SSE for live deltas only. This converges interactive onto coord's model so both kinds share one history-delivery pattern, the prerequisite for lifting the `/command` (rewind/retry) verb to coord. Backend (server.py, core/session_routes.py): - `_interactive_events_replay` and the `/command` resume/rewind branches no longer emit the inline `history` SSE event; the open/create-resume paths emit `clear_ui` only. The `/events` stream no longer carries conversation history — REST `GET /history` is the source (acceptable on 1.6.0aN). - Removed the now-orphaned `events_replay_prepare` hook. - `_build_history` retained as the canonical wire-shape reference for the decoration/parity tests (no production callers post-convergence). Frontend (ui/static/app.js, ui/static/index.html): - `_loadHistoryThenConnect` fetches REST `/history`, renders, then opens SSE (mirrors coord's `init()` ordering); wired into the seven ws-assign sites. - `clear_ui` re-renders via a REST refetch and dispatches the edit-and-resend latch; `replay_truncated` re-syncs (skipped mid-stream so it cannot clobber an in-flight turn). The `case "history"` SSE handler is removed. New shared module (shared_static/history_normalize.js): - `normalizeHistoryMessages` converts the raw provider-native REST shape (nested tool_calls, `_source`/`_reminders`/`_attachments_meta` side-channels, multipart content, no derived flags) into the projected shape `replayHistory` renders. Pure/DOM-free and node-unit-tested. This is a transitional bridge — a server-side wire-shape unification (folding this projection back into the server so interactive, coord, and coord's inline raw-handling collapse onto one shape) is planned to replace it. Tests: backend replay-omits-history regression; a node-executed normalizer projection test (incl. the orphan->pending and denial-propagation edges); and REST-first wiring guards in test_app_js.py.	2026-05-28 15:53:25 -07:00
Patrick Buckley	d068366a61	rbac: builtin-role override editor + tighten under-enforced perm gates (#585) ... * feat(rbac): editable builtin role permissions via overlay layer Adds a ``role_permission_overrides`` table that stores per-(role_id, permission) grant/revoke deltas, applied on top of the immutable ``roles.permissions`` baseline at permission-load time. Builtin roles (``builtin-admin/operator/viewer``) become customizable through the admin Roles UI without losing the "reset to default" guarantee — every override is auditable and reversible. Motivating case: ``model.skills.write`` is deliberately default-ungranted on every role so operators must consciously opt in before a coordinator session can mutate the skill catalog. Until now there was no UX path to do that opt-in — the only options were dropping into SQL or running a fresh migration. The overrides editor closes that gap. Backend - Migration 057 + storage methods on both sqlite + postgresql backends - ``get_user_permissions`` merges baseline ∪ grants − revokes for builtin rows; custom rows pass through unchanged - ``GET /v1/api/admin/roles/{id}/effective`` for inspect - ``PUT /v1/api/admin/roles/{id}/overrides`` for write — admin.roles gated, audited, validates against ``_VALID_PERMISSIONS``, refuses non-builtin targets, strips no-op grants/revokes before persisting - Lockout guard: cannot revoke ``admin.roles`` if doing so would leave zero users with the permission (returns 409) - ``coordinator.trust.send`` added to ``_VALID_PERMISSIONS`` — was seeded into builtin-admin by migration 042 but never registered with the validator, so the very first round-trip through the editor 400'd on it. Drift-detection test guards future migrations from recreating the same gap Frontend - Roles tab redesign: chevron + permission-count chip replace the "..." truncation; expand-on-click drawer groups perms by namespace with baseline / grant (green +) / revoke (red −) chip variants - Edit modal opens for builtin rows ("Customize Built-in Role" title); toggles show baseline-default vs override state; submit diffs against the rendered toggle universe (not raw baseline) so future taxonomy drift can't silently strip unknown perms - "Modified +N/-N" pill on rows with active overrides; "Reset to default" drawer action clears the override set - ``_PERMISSION_SECTIONS`` brought up to date with all currently-seeded perms (admin.coordinator, admin.cluster.inspect, admin.models, admin.nodes, admin.prompt_policies, conversation.modify, coordinator.trust.send were missing) Tests - 7 storage tests covering set/list/clear/effective + overlay merge into ``get_user_permissions`` for both builtin and custom roles - 11 endpoint tests covering effective/overrides happy paths, validation, lockout guard, builtin-only restriction, no-op normalization, list enrichment * feat(rbac): enforce workstreams.{create,close} + tools.approve gates These three permissions were declared in ``_VALID_PERMISSIONS``, seeded into ``builtin-operator``'s baseline by migration 008/017, surfaced in the admin Roles UI as toggles, and documented in ``bootstrap.py`` as the operator role's capabilities — and never enforced anywhere. The audit that ran out of the overlay PR found zero ``require_permission`` sites for any of them; any authenticated user could create workstreams, close any workstream, or approve any pending tool regardless of role. Behaviour change for callers without the perms: - ``POST /v1/api/workstreams/new`` (node + console proxy variants) now 403 without ``workstreams.create`` - ``POST /v1/api/workstreams/{ws_id}/close`` (and ``/route/`` proxy) now 403 without ``workstreams.close`` - ``POST /v1/api/workstreams/{ws_id}/approve`` (and ``/route/`` proxy) now 403 without ``tools.approve`` The OR-fallback to ``admin.coordinator`` keeps coord sessions spawning interactive children unblocked without needing operator-style perms. Service-scoped inter-cluster calls bypass via the existing ``allow_service_bypass`` path on the new ``require_any_permission`` helper. Builtin admin and operator both already carry these perms; viewer correctly loses workstream create/close/approve (it already couldn't do those in spirit). Implementation - ``require_any_permission`` (core/auth.py) — OR-semantics variant of ``require_permission`` with per-conditional comments documenting the security policy at the choke point. 403 body names every accepted perm so operators get an actionable remediation - ``make_{create,close,approve}_handler`` (core/session_routes.py) accept ``fallback_permissions: tuple[str, ...]`` — checked only when ``cfg.permission_gate is None`` (interactive case). Coord's ``permission_gate=_require_admin_coordinator`` continues to take precedence on the coord-config side - Console-side ``create_workstream`` and ``route_create`` inline the same OR check before proxying — fail fast on a forbidden request without burning a cluster round-trip - ``route_proxy`` adds a verb-scoped gate on ``approve`` and ``close`` only; ``send``/``cancel``/``dequeue``/``command``/``plan`` remain authenticated-only (pre-existing, out of scope for this audit) Tests - New ``TestPermissionGatesOnLifecycle`` (4 tests) in test_server_authz pinning 403-without-perm + non-403-with-perm at the node lift sites - New ``TestRouteProxyPermissionGates`` (5 tests) in test_console_routing_proxy covering 403 paths, OR fallback via ``admin.coordinator``, and that ``send`` remains ungated - ``_make_jwt`` helpers in test_server_authz, test_close_reason_ persistence, test_server_attachments_on_create updated to embed operator-shaped perms by default so existing tests continue to exercise the post-gate logic rather than 403'ing on the new check Docs - ``bootstrap.py`` operator role line corrected to list every perm it actually carries (was missing ``tools.approve`` and ``conversation.modify``) * fix(rbac): close lockout + escalation gaps in role-overrides editor Three issues surfaced by /review of the overlay layer and gate uplift — all in the RBAC/auth surface, treated as zero-days. **F-1: lockout guard misses the grant-removal path.** PUT-replace semantics on ``set_role_overrides`` mean an existing grant of ``admin.roles`` (added via override to e.g. builtin-operator) is silently dropped when the new payload omits it. The previous guard short-circuited on ``"admin.roles" not in revokes`` and never noticed. Concrete cluster-bricking scenario: grant admin.roles to operator via override, unassign builtin-admin, click "Reset to default" on operator → all users lose admin.roles, recoverable only via SQL. The rewritten guard simulates the post-PUT effective set on the target role directly: if ``(baseline | new_grants) - new_revokes`` lacks admin.roles AND nobody holds it via another role, refuse the change. The "via another role" question is answered by one bulk query rather than the prior O(users × roles) round-trip loop. **F-3: lockout check blocked the event loop on moderate deployments.** The prior check called ``storage.list_user_roles`` per user and ``storage.effective_role_permissions`` per (user, role) pair — synchronous SQL inside an async handler. 200 users × 5 roles = 1000 connection cycles long enough to trip reverse-proxy timeouts on a permission revoke. Replaced with ``storage.users_with_permission(perm, *, exclude_role_id)`` — one join over ``user_roles ⋈ roles`` plus one IN fetch on overrides for the builtin role ids in the result, folded in-process. Two queries total, independent of cluster size. The whole check now runs under ``asyncio.to_thread`` so even the bulk read doesn't stall the loop. **F-2 reframed: admin_assign_role's subset check ignored the overlay.** The check at lines 6321-6328 reads ``target_role.get("permissions", "")`` (baseline column) when computing the perms it requires the caller to hold. After this branch, an admin.roles holder can grant e.g. ``model.skills.write`` to builtin-operator via override; an admin.users holder (who happens to NOT hold that perm) could then assign operator to a new user, silently escalating the assignee. The existing two-person-rule by perm split (admin.roles for catalog edits, admin.users for assignments) only holds if the assignment-time check considers the overlay. Switched ``target_perms`` to ``storage.effective_role_permissions(role_id)["effective"]``. Note: this PR retains the existing model where admin.roles is the catalog-edit superuser (admin_create_role, admin_update_role, and now admin_role_overrides all skip the caller-holds-grants check). The two-person rule against escalation lives at the assignment gate, which this fix reinforces. **F-7: delete_role left orphaned override rows.** No FK on ``role_permission_overrides.role_id`` (migration 057 omitted FKs to match the rest of the governance schema). Added explicit cleanup in both sqlite + postgresql ``delete_role`` implementations so a re-seeded role_id (deterministic for builtins on schema reseed) can't silently inherit stale overrides from the prior occupant. Tests - storage: ``test_users_with_permission_bulk`` exercises the new bulk helper including ``exclude_role_id`` and overlay folding - storage: ``test_delete_role_cleans_up_overrides`` pins the F-7 fix - endpoint: ``test_overrides_lockout_guard_blocks_grant_removal`` is the F-1 reproduction — operator-overlay grants admin.roles, builtin- admin has it removed, attempting to reset operator's overrides 409s - endpoint: ``test_assign_role_blocks_escalation_via_overlay_grant`` pins the F-2 reframed fix — overlay-poisoned operator can't be assigned by a caller missing the overlay perms * refactor(rbac): cleanup batch from /review (#584) Five non-security findings folded into one commit so the security batch stays focused. All consistent with the existing intent of ``feat/builtin-role-overrides``. **F-4: presence check on ``_effectivePerms``.** ``governance.js`` was guarding on ``Array.isArray(role.effective) && role.effective.length > 0``, falling through to splitting ``role.permissions`` (the baseline) when the array was empty. For a builtin role whose overrides legitimately revoke every baseline perm, that path silently rendered the baseline chips with no override indicators — the inspector lied about what the role can do. ``_enrich_role`` always sets ``effective: []``, so presence is the right sentinel. **F-5: JS-side drift detector.** Commit 1 added a Python-side test asserting ``_VALID_PERMISSIONS`` covers every baseline perm; the mirror invariant on the frontend went uncaught. A new perm added to ``_VALID_PERMISSIONS`` without a matching entry in ``_PERMISSION_SECTIONS`` becomes silently un-customizable through the admin UI (the only documented grant/revoke path). Test parses the JS const out via regex and asserts set-equality both directions — detects "missing in UI" and "extra in UI" so the toggle catalog and validator can't fork. **F-6: bulk enrich for ``admin_list_roles``.** Was ``1 + 2*builtin_count + 1*custom_count`` SELECTs per admin-tab open; collapsed to one ``IN``-filtered query via new ``storage.effective_role_permissions_bulk(role_ids)``. Implemented on both sqlite + postgresql backends following the existing ``effective_role_permissions`` shape. **F-8: rename ``fallback_permissions`` → ``accepted_permissions``.** The lift body uses ``if cfg.permission_gate / elif accepted_permissions`` — mutually exclusive — so when ``permission_gate`` is None this IS the primary gate, not a fallback to anything. The "fallback" name suggested a tier-2-after-tier-1 semantic that didn't exist. Renamed across ``make_{approve,close,create}_handler`` factories, the three call sites in ``turnstone/server.py``, and the docstrings. **F-9: positive lift-level tests for ``admin.coordinator``-only.** ``TestPermissionGatesOnLifecycle`` previously had a single positive test for ``workstreams.create`` alone, plus negative-403 tests for each verb without perms. The OR-fallback to ``admin.coordinator`` (which keeps coord sessions spawning interactive children unblocked) had no positive coverage at the lift code path — only at the proxy, which exercises a different verb-dict gate. Added three tests (create / close / approve) that pass ``admin.coordinator`` alone and assert non-403, so a future tightening of the accepted_permissions tuple can't silently regress coord-driven child workstreams. Out of scope: nit perf-4 (event-delegation refactor on ``_renderGovRoles``). ``setSafeHtml`` rebuild is the existing pattern across every admin tab; rewriting one tab's render path on this branch would be drive-by inconsistent with the surrounding codebase. Filed as a separate concern if the Roles tab grows past the scale where it bites. * fix(rbac-ui): aria-expanded + row-click on Roles drawer (#585) Two Copilot review findings on governance.js: - Expand button was missing aria-expanded — screen readers couldn't announce drawer state. Now reflects the row's expanded flag. - Comment said "row + chevron both work" but only the chevron was wired. Added data-expand-role to the row element too so the existing handler loop (querySelectorAll on the attribute) picks up both — clicking anywhere in the role row toggles the drawer. Edit/Delete handlers already stopPropagation so they aren't triggered by the row-level click. * fix(migrations): rebase role_permission_overrides to 058 PR #560 mitigation #1 landed 057_output_assessments_llm_judge.py on main in parallel; my migration claimed the same number, forking alembic's head and breaking postgres. Renumbered to 058 and re-pointed down_revision at 057 so the chain stays linear. No behaviour change — same DDL. Full sweep clean (6730 passed). * fix(migrations): update 058 revision strings to match filename Previous commit (ea86aefc) renamed 057_role_permission_overrides.py to 058_* but the in-file revision = "057" / down_revision = "056" strings stayed — leftover from when the file shipped as 057. Tests pass because alembic walks the chain by revision string, and the strings now correctly read revision = "058" / down_revision = "057" to make the chain linear with main's 057_output_assessments_llm_judge. Caught locally before re-running CI; my prior `git mv` + content edit landed as a staged rename + unstaged modification on the previous push.	2026-05-24 18:31:23 -07:00
Patrick Buckley	352a27915a	feat(coord): per-coordinator status bar + richer history replay ... Bring the coord dashboard toward parity with the interactive pane on two operator-visible surfaces: - Status bar pinned above the composer. Same four cells as the interactive pane (model, token / context-window usage with effort suffix, tool calls this turn, conversation turn) driven by the same on_status SSE events. ws-status-bar CSS hoisted from ui/static/style.css to shared_static/chat.css so both UIs read one copy. StatusBar.paint helper extracted to shared_static/status_bar.js; both Pane.prototype.updateStatus and the new coord updateStatusBar delegate to it so warn/danger thresholds, prefix glyphs, and effort-suffix rules can't drift. CTX_WARN_PCT / CTX_DANGER_PCT now named constants on a single line. - _coord_events_replay now yields the connected + status preamble via a shared session_replay_preamble helper in turnstone/core/session_replay.py. _interactive_events_replay routes through the same helper so a future field add lands once. Coord still skips conversation history in the SSE replay (the dashboard fetches it via GET /history); only the status preamble is shared. - History replay reconstructs tool calls. Pre-fix, an assistant turn that only dispatched tools rendered as an empty bubble followed by raw tool-result text — the call's intent and parameters were lost on reload. synthesizeHistoricalToolCall builds an appendToolCall-shaped item from the persisted function.name + function.arguments (special-casing bash so the shell line shows in the header). Tool result rows now resolve their label from the matching tool_call_id instead of always printing "tool". - onopen restores the tokens placeholder when no prior status was seen, so a transient SSE blip on a fresh coord doesn't leave the dim "Reconnecting…" copy stuck until the next live tick. Tests: 4 new tests for the shared replay preamble (connected first, status only when last_usage present, status payload shape, no-session fallthrough); existing approval/verdict ordering tests refactored through a shared make_replay_mocks helper in tests/_replay_helpers.py that both interactive and coord suites import.	2026-04-28 10:27:26 -07:00
Patrick Buckley	9b5096fe3c	fix(approve): visibility for child tool calls bypassing operator gate (#430) ... * fix(approve): visibility for child tool calls bypassing operator gate When a coord LLM spawns a child with `skill="X"`, the skill template's `allowed_tools` JSON list silently populates the child UI's `auto_approve_tools` set. Tool calls whose names are in that set short-circuit the approval gate without prompting the operator — matching the user-reported bug "tool calls of children occasionally getting approved instead of waiting for approve/deny". The auto-approve paths themselves are unchanged (Option C — visibility only). Surfaces: - Per-item annotations: each pending tool gets `auto_approved=True` + `auto_approve_reason` ("skill" / "always" / "policy" / "blanket" / "auto_approve_tools") at the four gate-bypass paths. - Per-ws ring buffer (cap 10) of recent bypasses, exposed via `/dashboard` and the cluster live-bulk projection so the coord- tree row can render an "auto-approved by ..." pill. - `tool.auto_approved` audit row per `approve_tools` call — forensic durability beyond the in-memory ring buffer. - Per-ws WebUI page: inline "auto: <reason>" badge next to each tool name, so an operator who clicks through from the coord tree to the child's page sees the same bypass signal. Persistence across UI rebuilds: - The ring buffer is in-memory only; a saved-workstream rehydrate / coord→node click-through / process restart all build a fresh UI. `replay_recent_auto_approvals_from_audit` runs at the end of `SessionUIBase.__init__` and re-seeds the buffer from recent `tool.auto_approved` audit rows scoped to this ws_id. - Adds `resource_id` filter to `list_audit_events` (protocol + SQLite + Postgres) so the replay is a single indexed query. Source provenance: - `_auto_approve_tools_source: dict[str, str]` per UI tracks which writer added each tool name to `auto_approve_tools` ("skill" at skill-template setup time, "always" on Approve+Always click). Lets the dashboard pill distinguish a skill-driven bypass from an explicit operator-Always click — those are very different signals that previously rendered the same. Magic-string drift mitigation: - `AutoApproveReason` constants in `core/session_ui_base.py` lift the five reason strings into a single source of truth. - `KNOWN_AUTO_APPROVE_REASONS` JS constant + validator render unknown reasons as "unknown" with a console.warn instead of rendering raw (a typo would otherwise silently desync wire ↔ pill). Recording-leak fixes (q-2 from review): - Policy `allow` partial-resolve now records the policy-tagged items at two previously-leaking branches: the early-return-on- deny path and the still_pending-non-empty fall-through to the prompt path. Other review fixes: - Heuristic verdict surfaces consistently as `heuristic_verdict` in both `_serialize_approval_items` and the dashboard serializer (was inconsistent: one emitted `verdict`, the other `heuristic_verdict`). app.js updated to read either key for mid-deploy compatibility. - `_tag_auto_approved` helper on SessionUIBase replaces the verbatim tag loops previously copy-pasted across WebUI and ConsoleCoordinatorUI. * fix(approve): apply Copilot review feedback on PR #430 - coordinator_ui: use ``approval_label or func_name`` for the ``auto_approve_tools`` subset check, matching WebUI. Pre-fix an "Approve + Always" entry whose approval_label differs from func_name (skill__name, mcp_resource__uri) wouldn't match on the coord page and the operator would be re-prompted. - _parse_audit_timestamp: treat naive ISO strings as UTC. Audit rows are written via ``datetime.now(UTC).strftime(...)`` with no timezone marker; ``datetime.fromisoformat`` returns a naive datetime, and ``.timestamp()`` on a naive datetime interprets it in the server's local timezone — wrong on any non-UTC server. Stamp UTC explicitly before converting. - server.py: drop the dead ``pending = []`` after the blanket tag — the function returns inside the same block without reading ``pending`` again. - _protocol.py: fix docstring reference from ``_replay_recent_auto_approvals`` to ``replay_recent_auto_approvals_from_audit`` (the actual method name).	2026-04-27 15:51:01 -07:00
Patrick Buckley	a23ef7306c	fix(approve): apply Copilot feedback + remove plan doc ... Copilot review on PR #424 flagged three items: 1. Schema drift on /v1/api/dashboard — DashboardWorkstream didn't declare the new pending_approval_detail field, so generated OpenAPI / typed clients were out of sync. Added PendingApprovalItem + PendingApprovalDetail Pydantic models and referenced PendingApprovalDetail from DashboardWorkstream. 2. deepcopy under _ws_lock in serialize_pending_approval_detail could extend lock hold under contention with on_intent_verdict (daemon judge thread) and per-token activity writes that also take _ws_lock. _llm_verdicts entries are only assigned/cleared, never mutated in place, so a snapped reference is stable after the lock drops. Snapshot refs under lock; deepcopy after release. 3. Plan doc removed from the branch — design docs are local-only working artifacts, same posture as PROGRESS.md.	2026-04-27 11:41:14 -07:00
Patrick Buckley	7e33fc68bb	fix(approve): apply /review feedback on inline child approvals ... Critical: - coordinator.js RISK_SEVERITY accepted 'crit' only; production emits 'critical' (per turnstone/core/judge.py:1556 + heuristic seeds). A risk_level=='critical' verdict ranked as 0 and rendered with .risk.low (green) styling, never triggering the crit-risk auto-expand. Now accepts both aliases. Unknown risk_level falls back to rank 2 ('high') so future schema drift fails *safe* (over-alert) instead of silently downgrading. Pill ternary handles both 'crit' and 'critical' alias to the existing .risk.crit class. Major: - Urgent live-badge flush now coalesces N urgent calls in the same JS tick into one bulk request via queueMicrotask, instead of firing N single-id fetches. The motivating 10-children- pending-bash scenario in the design doc now lands on one bulk /v1/api/cluster/ws/live request. - Test coverage gap: added test_session_ui_base.py cases for POLICY-BLOCKED (item.error + needs_approval=False) and judge-unavailable (no verdict + no judge_pending) matrix rows. Added literal-string assertions to the smoke list in test_coordinator_page.py so a refactor dropping either branch surfaces at test-time. Minor batch (4 coord.js + 1 CSS + 1 fake-divergence): - 409 stale-call_id path re-enables both buttons before return (urgent fetch is best-effort; could also fail). - judgePending pill no longer conflicts with a present heuristic verdict — guard changed from !judge to !verdict. - Empty <div class="approval-reasoning"> no longer appended when reasoning is absent but evidence is present (evidence still renders inside the disclosure). - Dead .ch-row .approval-pill.rec-* CSS rules removed (JS never combines those classes). Recommendation chip in the disclosure footer now has its own scoped rules so the chip is actually styled. - _FakeUI.serialize_pending_approval_detail call_id selection aligned to the real impl's "first non-empty" semantics. - liveBadgeCache reconnect cleanup now preserves permanent (403/404) entries — denied users no longer pay one wasted bulk fetch per denied id per reconnect. All 4465 non-live tests pass. Ruff + mypy clean. node --check OK.	2026-04-27 11:41:14 -07:00
Patrick Buckley	fbb9be27f9	feat(approve): expose pending_approval_detail on /dashboard + guard stale call_id ... Lays the server-side groundwork for inline approve/deny buttons + judge verdict on the coordinator children-tree UI. Two surgical changes: 1. SessionUIBase.serialize_pending_approval_detail() merges the active _pending_approval items[] with per-call_id verdicts from _llm_verdicts. The dashboard handler embeds this on every per-ws row so cluster live-bulk callers can render inline UI without an extra per-child round-trip. 2. make_approve_handler now returns 409 when the body sends a call_id that doesn't match any currently-pending item. Closes the stale call_id race where an operator clicks approve on a row showing call A while the child has rolled over to call B. Empty/missing call_id preserves backwards compatibility with CLI + channel adapters that don't track it. Cross-tenant exposure on /dashboard is consistent with the trusted-team posture already in place for activity / tokens — documented in the new method's docstring so the choice survives the next reviewer. Plan: docs/design/inline-child-approvals.md (chunk 1 of 4).	2026-04-27 11:41:14 -07:00
Patrick Buckley	ad0e7ce6eb	docs: mark 1.5.0 legacy URL surface removal ... CHANGELOG [Unreleased] / Removed (BREAKING — 1.5.0) block calling out the legacy URL family removal with the swap table. Doc passes on api-reference.md (per-endpoint sections rewritten with path parameters and slimmer body shapes), architecture.md (handler-list diagram and console-proxy URL example), console.md (URL-rewriting JS shim docstring + SSE proxy example), and the two PlantUML diagrams (11-console-data-flow, 16-channel-architecture). Also picks up two test-side stragglers from step 5 that referenced the legacy adapters in a docstring + a stale /v1/api/events SSE test: turn into path-keyed equivalents. OpenAPI JSON dump regenerated to reflect the catalog edits from step 3. After this commit: - 4557 tests passing under -m "not live" - ruff + mypy clean on turnstone/ tests/ sdk/ - grep for "/v1/api/send", "/v1/api/approve", "/v1/api/cancel", "/v1/api/workstreams/close" returns zero hits across turnstone/ sdk/ docs/ tests/ (excluding CHANGELOG.md, which intentionally documents the old shape). - grep for make_legacy_body_keyed_adapter, make_legacy_query_keyed_adapter, _make_method_dispatch, close_legacy returns zero hits.	2026-04-26 22:14:22 -07:00
Patrick Buckley	1358121d52	chore(tests): refresh fixtures for path-keyed URL family ... Mechanical updates across the test suite to swap legacy /v1/api/{send,approve,cancel,events,workstreams/close} URLs for the path-keyed equivalents under /v1/api/workstreams/{ws_id}/<verb>, and to drop ws_id from request bodies (the path provides it now). Per file: - test_session_routes.py: deletes test_close_legacy_mounts_when_handler_provided (the close_legacy slot is gone); test_send_mounts_post_and_delete_when_dequeue_provided (added in PR commit 1) stays. - test_openapi.py: expected-paths set swaps to path-keyed shape; test_send_endpoint_has_request_body now asserts the OpenAPI for /v1/api/workstreams/{ws_id}/send. - test_auth.py / test_auth_identity.py: required_scope and check_request fixtures swap to path-keyed shape; new tests cover write/approve/read scope assignment for the path-keyed verbs + the /node/* proxy mirror. - test_sdk_server.py / test_sdk_console.py: mock-transport URL keys swap; bodies drop ws_id. - test_server_attachments_endpoints.py: ~17 send sites migrated to /v1/api/workstreams/<ws>/send (a small Python script ran the bulk rewrite — body ws_id stripped, URL rebuilt). - test_server_authz.py: cross-tenant approve/close/cancel/events tests retargeted to path-keyed URLs; test_events_legacy_query_keyed_url_still_resolves_to_404_for_unknown_ws renamed to test_events_path_keyed_url_resolves_to_404_for_unknown_ws with the docstring updated to note the legacy adapter is gone. - test_close_reason_persistence.py: 7 close sites all swap. - test_console_routing_proxy.py: route-proxy tests swap to /v1/api/route/workstreams/{ws_id}/<verb>; the upstream-URL assertion now reads from .request (route_proxy uses client.request(method, url, ...) for method passthrough); _wire_proxy helper installs both .post and .request mocks for compatibility. - test_route_proxy_audit.py: parametrized URLs migrated; _make_proxy now also exposes a .request side-effect that delegates to .post for the same compatibility surface. - test_api_versioning.py: openapi.json path assertion swaps to the path-keyed shape. 4557 passing under -m "not live"; ruff + mypy clean.	2026-04-26 22:14:22 -07:00
Patrick Buckley	edf52016ac	refactor(core): lift list + saved verb bodies across both kinds (Stage 2 verb lift) ... New ``make_list_handler(cfg)`` and ``make_saved_handler(cfg)`` factories in ``turnstone/core/session_routes.py`` replace four pre-lift bodies (interactive ``list_workstreams`` + ``list_saved_workstreams``; coord ``coordinator_list`` + ``coordinator_saved``). Same factory + capability-flag pattern as the merged cancel / open / events / create lifts. Four new ``SessionEndpointConfig`` fields: - ``list_resolve_titles: ListResolveTitles | None`` — bulk lookup ``(ws_ids) -> {ws_id: title-or-None}``. Interactive wires ``get_workstream_display_names`` (new bulk helper added on the storage layer + memory.py); the lifted body resolves every active row in ONE ``SELECT ... WHERE ws_id IN (...)`` instead of the pre-lift N+1 (one SELECT per row). - ``list_kind: WorkstreamKind | None`` — explicit kind classifier for the saved-list storage filter. Replaces the initial draft's ``audit_action_prefix == "coordinator"`` string compare which would have silently leaked INTERACTIVE rows for any future kind whose audit prefix didn't match. Required when a kind mounts list/saved; misconfig surfaces as a 500 with a clear log line. - ``saved_state_filter: str | None`` — coord wires ``"closed"``; interactive wires ``None``. - ``saved_loaded_lookup: SavedLoadedLookup | None`` — coord-only defence-in-depth filter that excludes ws_ids in the warm pool. Behaviour changes (all observable in CHANGELOG): - **Active-list row shape converges on always-include** ``{ws_id, name, state, kind, parent_ws_id, user_id}``. Interactive renames ``id`` → ``ws_id``; both kinds populate every field (coord adds kind + parent_ws_id; interactive adds user_id). - **Top-level response key converges on ``"workstreams"``** on both endpoints. Coord ``coordinators`` key removed — coord is a 1.5.0aN-only surface (never shipped stable) so the convergence has no compat shim; SDK / frontend consumers swap once. - **Storage + manager-lock work moved off the event loop on interactive**. ``list_workstreams_with_history`` runs through ``asyncio.to_thread`` on both kinds (matches coord's pre-existing perf-2 pattern from the saved-coordinators review); ``mgr.list_all`` + per-row work also offloaded. - **N+1 storage round-trips on /v1/api/workstreams eliminated**. Pre-lift interactive resolved the alias for every active row in a separate SELECT (up to 50 round-trips per dashboard refresh on a saturated node). Lifted body issues one bulk SELECT. Pydantic schemas: ``WorkstreamInfo.id`` renamed → ``ws_id``, ``WorkstreamInfo.user_id`` field added. ``CoordinatorInfo`` and ``CoordinatorListResponse`` removed (folded into the unified ``WorkstreamInfo`` / ``ListWorkstreamsResponse``). OpenAPI spec snapshots regenerated. TS SDK types updated (``WorkstreamInfo`` interface gains ws_id + the always-include fields); TS test mock + assertion updated to match. ``GET /v1/api/dashboard`` is intentionally NOT in this PR's scope and still returns rows keyed on ``id``. Tracked as a separate cleanup PR (tombstone-note added at the dashboard handler). /review pipeline run; the four Major findings + one Minor + six nits all addressed in the same commit: - M1: TS SDK ``WorkstreamInfo`` interface stale (id: string) → renamed + fields added. - M2: TS SDK test masked the type-mismatch with stale mock → updated. - M3: N+1 alias resolution on active list → bulk ``get_workstream_display_names`` helper + ``list_resolve_titles`` bulk cfg hook. - M4: Missing interactive parity regression test for unified row shape → mirror of coord's added in test_server_authz.py. - Mi1: ``audit_action_prefix`` string-compare deriving kind → explicit ``cfg.list_kind: WorkstreamKind`` field. - Six nits: redundant inner asyncio import, forward-ref quotes on Awaitable, duplicated frontend comments, dashboard ``id`` field has no tombstone-note, empty-coord_mgr short-circuit on ``saved_loaded_lookup``. 4512 tests passing; ruff + mypy clean.	2026-04-26 13:11:07 -07:00
Patrick Buckley	577ad2824f	refactor(core): lift events verb body across both kinds (Stage 2 verb lift) (#415) ... * refactor(core): lift events verb body across both kinds (Stage 2 verb lift) The interactive ``GET /v1/api/events?ws_id=...`` and coord ``GET /v1/api/workstreams/{ws_id}/events`` SSE handlers now share one body via ``make_events_handler(cfg)``. Per-kind divergence captured by two new ``SessionEndpointConfig`` fields: * ``events_replay: EventsReplay | None`` — Protocol-typed callback that yields the kind-specific initial replay payload. Interactive wires ``_interactive_events_replay`` (connected + status + history + pending_approval + cached intent verdicts + pending_plan_review); coord wires ``_coord_events_replay`` (just pending_approval + pending_plan_review). The lifted body iterates the callback before starting the live event loop. * ``sse_executor_lookup: SseExecutorLookup | None`` — per-kind executor for the live loop's blocking ``client_queue.get``. Interactive returns the dedicated 200-thread ``sse_executor`` from app state so SSE polling stays isolated from every other ``asyncio.to_thread`` caller in the process; coord returns ``None`` and the lifted body falls through to the default executor. Also adds ``make_legacy_query_keyed_adapter(handler)`` (sister to ``make_legacy_body_keyed_adapter`` from earlier lifts): reads ``ws_id`` from the query string and splices into ``request.path_params`` before delegating to the lifted body. Preserves the ``GET /v1/api/events?ws_id=...`` legacy URL shape so any 1.x SDK consumer keeps working. Old ``events_sse`` (server.py) + ``coordinator_events`` (console/server.py) bodies deleted. Two convergence wins for coord: * **SSE connect/disconnect metrics** — pre-lift coord didn't record per-stream metrics; the lifted body always calls ``metrics.record_sse_connect()`` / ``record_sse_disconnect()``, giving the cluster dashboard the same per-stream observability interactive's had since 1.0. * **Both kinds now check ``request.is_disconnected()`` AND the ``ws_closed`` event** to terminate. Pre-lift interactive relied solely on ``ws_closed`` (which never fires if the client just goes away without closing the workstream); pre-lift coord relied solely on ``is_disconnected``. The lifted body uses both. One observable shape change for coord callers: the lifted body returns 409 ``"session has no UI"`` when ``ws.ui`` is missing (placeholder / build-failed UI), matching pre-lift coord. Pre-lift interactive returned 404 in this case; the lift converges on 409 because the workstream EXISTS (404 would imply it doesn't). Item #2 from § Post-P3 reckoning (rich ``ws_state`` payload parity for coord) split out during scoping — touches different files (``coordinator_ui.py`` + ``collector.py`` + ``session_ui_base.py``) with different reviewer concerns. Tracked as standalone follow-up ``feat/coord-rich-ws-state-payload``. Two /review fixes folded in: * **Dedicated SSE thread pool restored.** Initial draft used ``asyncio.to_thread`` (default executor, ~32 workers). Pre-lift interactive deliberately used a dedicated 200-thread ``sse_executor`` to avoid pool starvation; the ``sse_executor_lookup`` cfg field above restores that isolation. * **5s poll timeout restored.** Initial draft shortened to 1s, multiplying thread-wakeup rate 5x while the pool was already starving. ``is_disconnected()`` between polls covers cancel- detection latency. Plus minor cleanups: stale ``coordinator_events`` comment references in coordinator.js refreshed; ``TestInteractiveEventsLifted`` gets a ``_make_interactive_replay_mocks`` fixture so per-test intent stays clear; live-loop coverage gap documented in the test class docstring. Lint + mypy clean. 4497 tests passing (+8 new events tests). * fix(core): stream events replay from inside the generator instead of pre-building PR #415 review caught that ``make_events_handler`` pre-built the full replay payload (``connected`` + ``status`` + ``history`` + pending prompts) into a list before constructing the ``EventSourceResponse``. Two real costs: * **TTFB delay** — the client saw nothing until the heaviest replay event finished serialising (``_build_history`` on a long-running interactive workstream can take 10s of ms). With pre-build, the ``connected`` event was buried at the end of the materialisation pass instead of streaming first. * **Listener-queue accumulation** — registering the per-UI listener BEFORE building the replay let live events queue during the build window. On a chatty mid-generation workstream that window can fill the 500-slot listener queue and drop events before the live loop starts draining. Fix: iterate ``cfg.events_replay`` inside the async generator so each event ships as soon as the callback yields it. The observational-failure swallow semantics are preserved by wrapping the iteration in the same try/except + log.debug as before — partial replay is still acceptable; the live loop continues either way. Resolves the Copilot review thread on PR #415. Lint + mypy clean. 4497 tests passing (no test changes — the replay callbacks themselves are unchanged; only the lifted body's consumption pattern flipped from eager-build to lazy-stream).	2026-04-26 01:58:41 -07:00
Patrick Buckley	f9ed4d3071	refactor(core): lift open verb body across both kinds (Stage 2 verb lift) (#414) ... * refactor(core): lift open verb body across both kinds (Stage 2 verb lift) The interactive ``POST /v1/api/workstreams/{ws_id}/open`` and coord ``POST /v1/api/workstreams/{ws_id}/open`` handlers now share one body via ``make_open_handler(cfg, *, audit_emit=None)``. Per-kind divergence captured by two new ``SessionEndpointConfig`` fields: * ``open_resolve_alias: AliasResolver | None`` — interactive wires ``resolve_workstream`` so callers can pass user-friendly aliases in the path param. Coord wires ``None``. * ``open_post_load: OpenPostLoad | None`` — interactive wires ``_interactive_open_post_load`` (display-name sync + UI replay via ``clear_ui`` + history + handler-side ``ws_created`` enqueue onto the global SSE queue). Coord wires ``None`` and relies on the cluster collector fan-out from ``CoordinatorAdapter.emit_rehydrated``. Plus an optional ``audit_emit`` parameter (interactive wires ``_audit_workstream_opened``; coord wires ``None`` — coord doesn't audit open today). Old ``open_workstream`` (server.py) + ``coordinator_open`` (console/server.py) bodies deleted. **Load-bearing fix** (§ Post-P3 reckoning item #3 from the planning docs): pre-lift interactive's ``open_workstream`` called ``mgr.create(ws_id=resolved_id)`` + ``ws.session.resume(...)`` to rehydrate, bypassing ``mgr.open()`` entirely. After the lift both kinds route through ``mgr.open()`` — which makes ``InteractiveAdapter.emit_rehydrated`` reachable on interactive (it had been dead-by-routing) and gives the manager a single rehydrate code path to maintain. ``emit_rehydrated`` stays a documented no-op stub on the interactive adapter; the handler-side ``ws_created`` enqueue from the post-load callback is the load-bearing emission for the SSE consumers. Behaviour changes for interactive callers (documented in CHANGELOG): * **Cross-kind open returns 404** (was 400 with ``"Workstream is not an interactive kind"``). The lift consolidates on ``mgr.open()``'s single ``None``-return contract for missing / wrong-kind / tombstoned rows. Security boundary unchanged. * **Already-loaded response uses ``ws.name`` directly** (was ``get_workstream_display_name(resolved_id) or resolved_id``). The dashboard listing endpoint still resolves aliases on its own pass, so the user-visible name in the tab strip isn't affected. Two /review fixes folded in: * **Resume failures now return 5xx instead of broken-200.** ``SessionManager.open()`` previously caught and ``log.debug``- swallowed exceptions from ``ChatSession.resume``. Since ``ChatSession.resume`` assigns ``self.messages`` *before* the config-restore block, a partial-failure resume (corrupted ``workstream_config`` row, model-registry mismatch on a saved alias, malformed ``temperature`` / ``max_tokens``) would leave the session with history but with default config. Pre-lift the interactive open handler called ``ws.session.resume`` directly and let exceptions propagate as 500. Restored that behaviour: ``mgr.open()`` now re-raises resume exceptions after rolling back the slot (``cleanup_ui`` + ``_remove_locked``), so the lifted handler returns 500 with a correlation id and the storage row stays available for a retry. * **Bare ``except Exception`` documents intent.** A one-line rationale in the handler body explains why the catch is broad (no documented exception spec on ``adapter.build_session``; resume can propagate via the new contract above). Keeps a future contributor from narrowing it incorrectly. Test scaffolding: * ``tests/test_workstream_endpoints.py`` — fixture rebuilt to use ``make_open_handler`` + a minimal cfg with a lazy alias resolver so per-test ``@patch`` calls take effect. Added 5 new tests: already-loaded uses ws.name, alias resolution runs first, ``mgr.open`` is called (NOT ``mgr.create``), post-load callback fires with (request, ws) only on the load-from-storage path (not the already-loaded shortcut), post-load exception swallowed → 200. * ``tests/test_coordinator_endpoints.py`` — fixture imports updated to ``make_open_handler``. * ``tests/test_server_authz.py`` — ``TestOpenKindGate`` now expects 404 (not pre-lift's 400) for cross-kind open attempts. Docstring explains the consolidation. Two nit cleanups: dropped the unnecessary ``import secrets as _secrets`` aliasing in the exception handler; refreshed the stale ``open_workstream`` reference in the ``AliasResolver`` doc-comment. Lint + mypy clean. 4488 tests passing (was 4475; +13 new open tests). * fix(core): use cfg.audit_action_prefix for the per-kind noun in open's 500 error PR #414 review caught the hardcoded ``"failed to open workstream"`` in ``make_open_handler``'s 500 path: coord callers got misleading text (pre-lift coord said ``"failed to open coordinator"``). The fix derives the noun from ``cfg.audit_action_prefix`` ("workstream" interactive, "coordinator" coord) — a field both production lifespans already construct, and which the previous /review pipeline (q-5) flagged as dead config (set but read by no factory). Reusing it here both fixes the wording AND gives the field its first runtime reader. Pinned by a new test (``test_open_500_message_uses_kind_noun_from_cfg``) that wires a coord-shaped cfg, forces ``mgr.open`` to raise, and asserts the 500 body contains ``"failed to open coordinator"`` + the correlation id, without echoing the exception text. Lint + mypy clean. 4489 tests passing (+1 new).	2026-04-26 00:44:14 -07:00
Patrick Buckley	412c99f486	refactor(core): lift cancel verb body across both kinds (Stage 2 verb lift) (#413) ... * refactor(core): lift cancel verb body across both kinds (Stage 2 verb lift) The interactive ``/v1/api/cancel`` (body-keyed ws_id) and coord ``/v1/api/workstreams/{ws_id}/cancel`` (path-keyed) handlers now share one body via ``make_cancel_handler(cfg, *, audit_emit=None)`` in ``turnstone.core.session_routes``. Per-kind divergence captured by a new ``cancel_forensics: CancelForensics | None`` field on ``SessionEndpointConfig`` (interactive wires ``_capture_cancel_forensics``; coord wires ``None``) plus an optional ``audit_emit`` (coord wires ``_audit_cancel_coordinator``; interactive wires ``None`` — pre-lift interactive didn't audit cancel). Same factory + capability-flag pattern as P1.5's ``make_send_handler`` + make_attachment_handlers. Old ``cancel_generation`` body deleted from ``server.py``; old ``coordinator_cancel`` body deleted from ``console/server.py``. Behavior changes (documented in CHANGELOG): * **Coord gains the ``force`` flag.** Pre-lift coord ignored ``force``; the lifted body honours it on both kinds. Stuck-worker recovery becomes available on coord (parity gain — coord workers hang the same way interactive's can). * **Coord cancel response always includes ``"dropped"``.** Pre-lift returned bare ``{"status": "ok"}``; lifted returns ``{"status": "ok", "dropped": {}}``. Always-include parity with interactive so SDK consumers don't branch on kind. * **Coord cancel returns 400 ``"No session"``** on placeholder / build-failed workstreams (was a silent 200 no-op pre-lift). Parity with interactive's existing 400 branch. * **Coord ``coordinator.cancel`` audit detail now includes ``force``** so operator-driven recovery is distinguishable from routine cancels. Three /review fixes folded in: * **bug-1**: lifted body's ``resolve_approval`` is now gated on ``ui._pending_approval is not None``. Pre-fix, the unconditional call leaked a stale ``approval_resolved`` SSE event on every idle cancel — listener UIs that key on the event would dismiss prompts they didn't have. ``resolve_plan`` keeps its existing internal no-pending guard so the unconditional call is still safe there. * **bug-2**: force-cancel now clears ``_worker_running`` alongside ``worker_thread`` inside the same ``with ws._lock`` block. Prior half-state ``(_worker_running=True, worker_thread=None)`` routed follow-up sends through the queue-enqueue path onto the abandoned worker (whose cancel flag short-circuits the queue-drain seam, leaving messages orphaned until next spawn). Restores the ``(worker_thread, _worker_running)`` invariant ``session_worker.send`` documents. * **bug-3**: ``coordinator_stop_cascade._fanout_on_children`` now treats child cancel ``400 + "No session"`` as ``skipped`` (was ``failed``). Lifted coord cancel returns 400 on placeholder children; matches the pre-lift outcome where those children were silently no-op'd, so the cascade response's ``failed`` bucket stops firing spurious operator alerts. Test scaffolding: * ``tests/test_coordinator_endpoints.py`` — replace ``coordinator_cancel`` fixture with ``make_cancel_handler(...)`` wiring; add 6 new tests covering always-include shape, force-flag worker-abandon, 400-on-null-session, cancel_forensics swallowed-exception, audit_emit swallowed-exception, no-stale-approval-resolved-on-idle. * ``tests/test_server_authz.py`` — new ``TestInteractiveCancelLifted`` class with HTTP-level coverage of ``/v1/api/cancel`` for the dropped shape, force-flag + ``_worker_running`` clearing, and 400-on-null-session. Pre-lift ``cancel_generation`` had no HTTP-level test; this is the first. One observable change for interactive (pre-existing call site): ``resolve_approval`` / ``resolve_plan`` now run on every cancel regardless of ``was_running`` (was gated). Lifts coord's unconditional behaviour onto interactive — a stuck approval-pending state from a crashed worker can now be cleared via cancel without requiring close + rehydrate. Lint + mypy clean. 4484 tests passing (was 4475; +9 new cancel tests minus the moved one that became part of the new suite). * docs(core,changelog): correct cancel-lift behaviour description for resolve_approval Two review comments on PR #413 caught the same drift between the implementation and its documentation: my bug-1 fix gated ``resolve_approval`` on ``_pending_approval is not None`` (because it broadcasts ``approval_resolved`` unconditionally), but the ``make_cancel_handler`` docstring and the CHANGELOG entry still claimed both ``resolve_approval`` and ``resolve_plan`` "run on every cancel" and "the calls are idempotent and no-op when nothing is blocked". Reality: * ``resolve_plan`` does run on every cancel and its no-op-when- nothing-pending behaviour is real (the method has an internal ``_pending_plan_review is None`` short-circuit). * ``resolve_approval`` runs only when ``ui._pending_approval is not None``. Without the gate, every idle cancel would broadcast a stale ``approval_resolved`` SSE event and overwrite ``_approval_result``. Updated: * ``make_cancel_handler`` docstring (turnstone/core/session_routes.py in the "Behavior changes vs the pre-lift handlers" section) — splits the two methods into separate bullets, explains why ``resolve_approval`` is gated and ``resolve_plan`` isn't. * CHANGELOG.md ``[Stage 2 Verb Lift — cancel]`` entry — same split + rationale; the asymmetric coord pre-lift parity is still flagged as the recovery path that drove the lift. Docs-only change; lint + mypy clean; cancel test suite (59 tests) unchanged. * style(core): replace CancelForensics ellipsis stub with docstring github-code-quality bot flagged the ``...`` body of ``CancelForensics.__call__`` as "Statement has no effect". The ellipsis is the canonical Protocol method-body idiom (no real issue), but switching to a one-line docstring satisfies the bot AND adds a small piece of method-level documentation. The class- level rationale (why Protocol-typed instead of a plain Callable alias) moves from a wall of leading ``#`` comments into a proper class docstring at the same time. Style-only change; the Protocol semantics are identical.	2026-04-25 23:43:19 -07:00
Patrick Buckley	48c9ad2a40	refactor(core): split SessionKindAdapter Protocol into construction +… (#412) ... * refactor(core): split SessionKindAdapter Protocol into construction + emission (Stage 2 P3) The single ``SessionKindAdapter`` Protocol that ``SessionManager`` takes is split into two: * ``SessionKindAdapter`` — kind / build_ui / build_session / cleanup_ui. Required for every kind. The shared lifecycle manager always delegates here for construction + cleanup. * ``SessionEventEmitter`` — emit_created / emit_state / emit_rehydrated / emit_closed. **Optional**, wired through a new ``event_emitter: SessionEventEmitter | None = None`` kwarg on ``SessionManager``. Reserved for future kinds whose lifecycle transitions don't fan out anywhere; both production kinds wire one today. Both production adapters implement both Protocols. The interactive lifespan (``server.py``) and console lifespan (``console/server.py``) pass their adapter as both ``adapter`` and ``event_emitter`` — production behaviour is unchanged. Six lifecycle sites in ``SessionManager`` (create / open eviction / open rehydrate / close / set_state / close_idle / _reserve_and_install_locked unwind) now call ``self._event_emitter.emit_*(...)`` guarded by ``if self._event_emitter is not None``. InteractiveAdapter asymmetry preserved + documented: * ``emit_closed`` stays load-bearing — it's the **sole** transport path for ``ws_closed`` onto the process-wide global SSE queue (Stage 1 consolidated emission from the create handler here so there's exactly one emission point; ``name`` powers the frontend's eviction toast). * ``emit_created`` / ``emit_state`` / ``emit_rehydrated`` are documented no-op stubs (``del ws[, state]``). Those events fire from out-of-band paths — the create HTTP handler enqueues ``ws_created`` directly onto ``global_queue`` *after* attachment validation (so a rejected upload doesn't surface a phantom create→close pair); ``WebUI._broadcast_state`` emits the full ``ws_state`` payload (tokens + context_ratio + activity) via the ``SessionUI.on_state_change`` callback chain. The stubs exist solely to satisfy ``SessionEventEmitter`` Protocol so the adapter can be wired as the manager's ``event_emitter`` for the ``emit_closed`` path. Each stub has a 1-line inline rationale to match the in-repo convention (``coordinator_adapter.py:210``). Test scaffolding: * ``tests/test_session_manager.py`` — ``_make_manager`` and ``_make_with_writer`` wire ``FakeAdapter`` as both ``adapter`` and ``event_emitter`` for production parity; the standalone ``test_create_uses_configured_node_id`` does the same. ``FakeAdapter.emit_rehydrated`` now records as ``_Event("rehydrated", ...)`` rather than conflating with ``"created"``, and ``test_open_resurrects_closed_state`` asserts against ``events_of("rehydrated")`` so a regression where the manager fires the wrong call on the open path actually fails. * ``tests/_coord_test_helpers.py`` and ``tests/test_coordinator_end_to_end.py`` — wire ``CoordinatorAdapter`` as both args. * Six interactive test fixtures (``test_skills.py``, ``test_prompt_templates_runtime.py`` x2, ``test_model_registry.py``, ``test_server_authz.py``, ``test_server_attachments_on_create.py``) — wire ``event_emitter=adapter`` so they match the production wiring, removing the footgun where a future contributor adds a ``gq.get_nowait()`` assertion and silently loses the only ``ws_closed`` transport. * ``tests/test_interactive_adapter.py`` — drops the three tautological no-op-emit_* tests (``test_emit_created_is_noop``, ``test_emit_state_is_noop``, ``test_emit_rehydrated_is_noop``); keeps the four ``emit_closed`` tests (real behaviour). Lint + mypy clean. 4475 tests passing. * docs(core): correct SessionKindAdapter + SessionEventEmitter docstrings to match implementation Two Copilot review threads on PR #412 caught the same real discrepancy: my P3 docstrings on ``SessionKindAdapter`` and ``SessionEventEmitter`` described an *intent* — "interactive doesn't implement ``SessionEventEmitter``; the manager skips emit calls when no emitter is wired" — that doesn't match the actual wiring. ``InteractiveAdapter`` does implement both Protocols and ``server.py`` does pass it as ``event_emitter``; only the three no-op stubs (``emit_created`` / ``emit_state`` / ``emit_rehydrated``) are dead, while ``emit_closed`` is load-bearing. Updated both docstrings to: * State that both production adapters implement both Protocols. * Explain the asymmetry is in *which* emit methods carry real bodies (coord: 4; interactive: 1, with 3 documented stubs because the out-of-band paths — create handler ``ws_created`` after attachment validation, ``WebUI._broadcast_state`` carrying the richer ``ws_state`` payload — fire those events). * Clarify the ``if self._event_emitter is not None`` guard exists for the kwarg-omitted case (tests that don't care about events, reserved for future kinds whose transitions don't fan out anywhere). Docstring-only change. Lint + mypy clean; the 75 tests in test_session_manager + test_interactive_adapter + test_coordinator_adapter pass. Resolves the two Copilot review threads on PR #412 (commits PRRC_kwDORcMomM67VyPD, PRRC_kwDORcMomM67VyPI).	2026-04-25 22:52:39 -07:00
Patrick Buckley	c837e3fa6d	feat(core): Stage 1 SessionManager unification (#408) ... * feat(core): scaffold SessionManager + SessionKindAdapter Protocol Stage 1 step 1 — pure addition, no production wiring. Defines the shape later steps will port the shared mechanics onto: slot accounting, per-ws-id refcounted rehydrate locks, kind-agnostic lifecycle; kind-specific event transport + session construction on the adapter. Pruned from the earlier Protocol draft (see design brief): per-kind permission_scope (static handler map is simpler), allows_child_spawn / quota_policy (deleted in #403), on_child_spawned (coordinator tool owns children registry), allows_active_focus / active_id / switch (frontend owns the active-tab state). * feat(core): port shared session-lifecycle mechanics onto SessionManager Stage 1 step 2. Adds create / open / close / set_state / close_idle / get / list_all / count on top of the Step 1 scaffolding. Pure addition — still no production wiring; the new class doesn't replace any call sites yet. Concurrency shape is ported from CoordinatorManager (the more- complete side): single-phase slot reservation under the manager lock, per-ws refcounted open-lock to serialize concurrent lazy rehydrate, placeholder workstreams count toward max_active but can't evict each other. WSM's two-phase eviction outside the lock is not carried over; it had a window where a burst of creates could silently exceed max_active. Deletions (vs. the union of the two old managers): - "refuse to close last workstream" guard — handled by the dashboard; only existed to protect the now-deleted default startup workstream. - active_id / switch / get_active — frontend owns focus; server-side duplicate state is gone. - _active_coords presence cache — defer measurement to Step 4; if it pays for itself at realistic cluster sizes, the CoordinatorAdapter can maintain it by observing emit_* calls. - Children registry + reverse index — coordinator tool owns this, manager stays kind-agnostic. Skill resolution (name → template_id + applied_version) is now shared via SessionManager._resolve_skill, so WSM's pre-resolve-at- callsite pattern and CM's internal-lookup pattern converge. Callers pass the skill name; the manager does the lookup once. 26 smoke tests cover create eviction + overflow, concurrent-create cap, persist/session rollback, open for missing/deleted/wrong- kind/wrong-user rows, concurrent-open serialization, close unblocks UI + emits closed, set_state + storage + adapter observer, close_idle, list_all ordering, count, eviction fires adapter transport, node_id passthrough. * feat(core): add InteractiveAdapter for SessionManager Stage 1 step 3. Adapter that bridges SessionManager to the node's interactive transport: - emit_created/state/closed → pushes onto the process-wide SSE global_queue (same shape current server.py handlers produce inline) - cleanup_ui → ports WorkstreamManager._cleanup_ui body: unblock _approval_event / _plan_event / _fg_event, broadcast ws_closed to per-UI listener queues (with full-queue fallback), cancel + close the session - build_ui/build_session → delegate to injected factories (ui_factory builds WebUI, session_factory is the existing closure from server.py with judge_model + memory_config captures) Also extends SessionKindAdapter.build_session with **extra passthrough so interactive callers can pass judge_model per-call without polluting the manager API; and adds a reason= kwarg to emit_closed so the frontend's "evicted" special-case keeps working (frontend doesn't differentiate "idle" from "closed", so close_idle collapses into close()). 14 new adapter tests cover wire payload shape, queue.Full tolerance, cleanup_ui event unblocking + listener broadcast + queue-full fallback, session cancel+close, graceful handling of stub UIs / None session, and kwarg passthrough to the session factory. * feat(console): add CoordinatorAdapter for SessionManager Stage 1 step 4. Coordinator-side SessionKindAdapter implementation: - emit_created/state/closed → delegate to the existing ClusterCollector.emit_console_ws_* methods (same wire shape the old CoordinatorManager emitted inline) - cleanup_ui → ports the listener-queue + approval/plan event unblocks from CoordinatorManager._cleanup, with queue-full fallback so an unresponsive browser tab can't wedge close - build_ui/build_session → delegate to injected factories; session factory doesn't accept client_type so we strip it at the adapter boundary Collector emission exceptions are swallowed (same policy as today's inline fan-out — dashboard lag on one tick is preferable to breaking the lifecycle path). Intentionally out of scope: the children registry (_children / _child_to_coord) stays in the coordinator tool when wired in Step 5; the _active_coords lock-free presence cache is deferred pending a measurement at realistic cluster sizes. 10 new tests cover transport payloads, collector-exception tolerance, cleanup_ui event unblock + listener broadcast + queue-full eviction, construction passthrough. * feat(server): wire interactive server.py to SessionManager Stage 1 step 5a. Production-path swap: WorkstreamManager → SessionManager(InteractiveAdapter(...)). - Construction at server startup: build the adapter with the process-wide global_queue, a WebUI ui_factory closure, and the existing session_factory. SessionManager gets storage + max_active. - Default startup workstream wiring removed (the CLI-REPL leftover flagged in the handoff's "Convergence is also a pruning opportunity" section). --resume now lazily creates a workstream scoped to the resumed content; no workstream at all if --resume isn't given. The dashboard handles the 0-ws state. - HTTP handler mgr.create() calls switched to the new kw-only signature (user_id, name, model, skill, ws_id, client_type, judge_model, parent_ws_id). ui_factory/skill_id/skill_version/kind no longer threaded through — adapter handles UI construction and manager resolves skill internally. - Dropped the mgr.last_evicted block in the /new handler (adapter emits ws_closed:evicted automatically on capacity eviction). - mgr.max_workstreams → mgr.max_active. - Added active_id / switch / switch_by_index / get_active / index_of / eviction_count to SessionManager because turnstone/cli.py uses them extensively; the handoff's "delete unless there's a live caller" rule flips here — CLI is a live caller. Test fixtures across 9 files updated to build SessionManager + InteractiveAdapter rather than WorkstreamManager. test_workstream.py stays unchanged (it tests WSM directly; it'll be deleted in step 5d alongside the class itself). Full pytest: 4528 passed. Ruff + mypy clean. Next: 5b (console-side wiring, with the children-registry relocation to the coordinator tool). * feat(console): wire console server to SessionManager Stage 1 step 5b. Production-path swap: CoordinatorManager → SessionManager(CoordinatorAdapter(...)). - CoordinatorAdapter now owns the coord-specific bits that were bolted onto the old CoordinatorManager: the children registry (forward + reverse index), the lock-free active-coords presence cache, the cluster-event fan-out thread, and the worker-dispatch path (send / _spawn_worker). The shared SessionManager stays kind-agnostic. - Added CoordinatorAdapter.attach(mgr) for late-binding the owning manager (the manager's ctor takes the adapter, so the dependency has to break here). Used inside _rebuild_children_registry for the tenant- filtered SQL query, inside send/dispatch for mgr.get(ws_id), and inside the fan-out seed path for mgr.list_all(). - emit_created now seeds the children registry + active-coords slot AND calls _rebuild_children_registry (covers both create — empty query — and open/rehydrate, where the subtree is persisted). emit_closed drops both entries. Collapses the three old call-sites in CoordinatorManager's create/open/close into one per-event hook. - Console server.py builds the manager via: coord_adapter = CoordinatorAdapter(collector=..., ...) coord_mgr = SessionManager(coord_adapter, storage=..., max_active=..., node_id=ClusterCollector.CONSOLE_PSEUDO_NODE_ID) coord_adapter.attach(coord_mgr) ConsoleCoordinatorUI._coord_mgr = coord_mgr app.state.coord_adapter = coord_adapter - HTTP handler call-site updates: - coord_mgr.create drops initial_message; the handler now calls coord_adapter.send(ws.id, initial_message) after create so the worker spawn stays out of the shared manager. - coord_mgr.open_admin(ws_id) → coord_mgr.open(ws_id, user_id="", admin=True). Matches SessionManager.open's unified signature. - coord_mgr.list_for_user(uid) inlined as a list comp on list_all() (SessionManager doesn't expose the filter; two callers). - coord_mgr.children_snapshot / send → coord_adapter.*. - coord_mgr.cancel stays (now lives on SessionManager from 5a). - ConsoleCoordinatorUI.on_state_change now flows state transitions through ConsoleCoordinatorUI._coord_mgr.set_state, mirroring the WebUI pattern. The old _on_state_observer / _on_rename_observer closures the manager used to install are dead code now; leaving the fields in place for 5d cleanup. - Lifespan shutdown calls coord_adapter.shutdown() (was coord_mgr. shutdown()) and resets ConsoleCoordinatorUI._coord_mgr on teardown. Test fixture updates in _coord_test_helpers, test_coordinator_end_to_end, test_coordinator_endpoints, test_phase6_endpoints: build SessionManager + CoordinatorAdapter in _build_mgr, set app.state.coord_adapter, switch mgr.register_children / mgr.children_snapshot tests to mgr._adapter.*, and rewrite test_open_admin_uses_open_admin to assert the unified open(user_id="", admin=True) call shape. Full pytest: 4486 passed. Ruff + mypy clean. Next: 5d (remove CoordinatorManager + WorkstreamManager class bodies and their test files). * feat(core): delete WorkstreamManager + CoordinatorManager classes Stage 1 step 5c + 5d. Final step of the unification — the legacy classes and their test files go away now that every production caller has been ported. - Delete turnstone/console/coordinator.py entirely (CoordinatorManager class + the _enqueue_on_ui helper, which CoordinatorAdapter now hosts its own copy of). - Trim turnstone/core/workstream.py to just the Workstream dataclass + WorkstreamKind + WorkstreamState. ~385 lines of WorkstreamManager logic gone; the remaining shape is pure data types shared by both managers. - Delete tests/test_workstream.py (WSM-specific) and tests/test_coordinator_manager.py (CM-specific). - Wire turnstone/cli.py to SessionManager + InteractiveAdapter, same pattern as turnstone/server.py. The CLI's WorkstreamTerminalUI uses manager.set_state + manager.active_id — both preserved on SessionManager (CLI is a live caller that keeps the focus API honest, per the handoff's "delete unless it pulls its weight" rule). - Add an optional manager-level ``_on_state_change`` observer hook restored for the CLI's background-attention notification (the web path uses the adapter's emit_state; this hook covers callers that don't consume SSE). - Drop dead ``_on_state_observer`` / ``_on_rename_observer`` fields from ConsoleCoordinatorUI — the old CoordinatorManager installed them; SessionManager/CoordinatorAdapter handle fan-out directly. Vulture @ 80% confidence: zero unused symbols across the new SessionManager + adapter files. Ruff + mypy clean (170 files). Full pytest (excluding tests/live): 4414 passed. Net across the whole Stage 1 branch: one unified SessionManager + adapter Protocol replaces two ~500-line parallel managers + a ~600-line CoordinatorManager, and the interactive + coordinator transports stay cleanly separated at the adapter boundary. * refactor(auth): drop workstream row-level ownership gates Turnstone is a trusted-team tool (per #400). user_id stays as metadata for audit + display; it no longer rejects requests. Scope- level auth via admin.workstreams / admin.coordinator tokens is the only gate now. Solves sec-1 (cross-tenant delete via collision on caller-supplied ws_id, because the gate was half-implemented) and sec-2 (blank-sub JWT bypass on empty-owner rows). Net: 359 lines of defensive empty-string comparisons and admin=True bypass plumbing deleted. * fix(core): serialize set_state vs close + worker spawn Three concurrency fixes from the multi-stage review: - bug-3: set_state now looks up ws under self._lock and gates its storage write on ws._closed (a new tombstone flag). close() sets ws._closed=True and does its storage write under ws._lock. A set_state that acquires ws._lock after close sees the tombstone and skips its write instead of resurrecting the closed row. - bug-1: _spawn_worker wraps the check-and-spawn in ws._lock so two concurrent send() HTTP requests can't both observe "no live worker" and start duplicate worker threads on the same ChatSession. - bug-2: replaces Thread.is_alive() as the reuse gate with an explicit ws._worker_running flag. The flag is set before the worker thread starts and cleared in its finally block — both under ws._lock. Using is_alive() left a narrow window where the worker could exit between the check and a queue_message call, stranding the user's message with no consumer. perf-2 (lock-held-across-DB-write) is accepted as-is: per-ws serialization of state transitions behind a DB round-trip is real cost but bounded — a given ws's state flips happen sequentially on its worker thread anyway. Dropping ws._lock around the DB write would reintroduce the bug-3 race. Full pytest: 4401 passed. Ruff + mypy clean. * refactor(core): drop _resolve_skill from SessionManager Skill resolution (name → template_id + applied_version) moves out of the shared manager and back to the HTTP handlers that own the create request. The interactive handler already resolved skill_data + applied_skill_version for other purposes (model override, judge config, post-create session seed) and was passing the name to SessionManager which then redundantly re-resolved via get_skill_by_name + count_skill_versions — two wasted DB round-trips per create on a user-visible latency path. - SessionManager.create: accepts skill_id + skill_version as already-resolved kwargs; _resolve_skill helper deleted. - turnstone/server.py create_workstream: passes the skill_id / applied_skill_version it already computed. - turnstone/console/server.py coordinator_create: pre-resolves inline (parity with interactive) before calling coord_mgr.create. Fixes perf-1 (redundant skill queries per create), q-4 (divergent skill-version computation between manager and handler), q-5 (coordinator-specific lookup on the shared manager surface). Full pytest: 4401 passed. Ruff + mypy clean. * refactor(adapters): extract shared cleanup_ui + drop dead child-registry methods Both InteractiveAdapter.cleanup_ui and CoordinatorAdapter.cleanup_ui (plus their _broadcast_ws_closed_to_listeners helpers) were byte-identical. Pull them into turnstone/core/adapters/_ui_cleanup.py:cleanup_session_ui so the two adapters delegate to one implementation. Also drop CoordinatorAdapter.register_children (only test callers — now use _seed_children in tests/_coord_test_helpers.py) and _add_child (zero callers anywhere). * refactor(adapters): symmetric attach() + fail-loud on unattached manager Add InteractiveAdapter.attach(manager) + .manager property mirroring the coord-side pattern. CLI (cli.py) now uses cli_adapter.attach(manager) instead of the _mgr_ref list-ref late-binding hack; server.py picks up the same call for consistency. CoordinatorAdapter.send / _rebuild_children_registry / _prime_children_from_snapshot no longer silently return when self._manager is None — raise RuntimeError so a forgotten attach() at startup fails loud instead of dropping the whole fan-out. * docs: replace stale WorkstreamManager / CoordinatorManager references Both classes were deleted in 965e0b6; prose docstrings across the codebase still named them. Update to SessionManager (or describe the collapsed-into-one-class architecture where the distinction matters). Leaves the 'Ported from …' historical markers in session_manager.py / coordinator_adapter.py / interactive_adapter.py intact — those are deliberate pointers back to the pre-unification code. * fix(core): atomic close_if_idle + batch pop under one lock bug-5: SessionManager.close_idle re-checked ws.state == IDLE outside the lock, so a pending tool result could flip state IDLE→RUNNING between the snapshot and close() acquiring self._lock. Add _close_if_idle_locked that tests state + pops under self._lock. perf-5: drop the per-victim self._lock acquisition; collect + pop the whole batch in one acquisition, then run cleanup_ui / storage write / emit_closed outside the lock. * perf(coord): split emit_created / emit_rehydrated to skip storage query on fresh creates CoordinatorAdapter.emit_created was unconditionally calling _rebuild_children_registry (storage.list_workstreams with parent_ws_id=... limit=10001) on every create, even for fresh-create paths that provably have zero children. Add emit_rehydrated to the SessionKindAdapter Protocol. SessionManager .create still calls emit_created; .open (lazy rehydrate) now calls emit_rehydrated. CoordinatorAdapter.emit_created seeds the registry + fan-out but skips the rebuild; emit_rehydrated seeds + rebuilds + fans out. InteractiveAdapter.emit_rehydrated delegates to emit_created (no children-registry on the interactive transport). * perf(coord): fold _active_coords into _children_lock + mutate payload in place perf-4: _active_coords used a copy-on-write dict-swap pattern so the fan-out dispatch could read it lock-free, but _dispatch_child_event already re-validates the parent under _children_lock anyway — the lock-free snapshot was premature. Replace with a plain dict read+write both under _children_lock; install and remove collapse to one-liners. Value also drops the user_id half — dead after a46dab1 removed row-level ownership gates — so _active_coords is now just coord_ws_id → ui. perf-6: _enqueue_on_ui was doing {**payload, "ws_id": coord_ws_id} on every dispatch. The dispatch path owns payload and doesn't reuse it — mutate in place. * test(coord): add adapter tests for worker dispatch + children registry + fan-out Fills the coverage gap on CoordinatorAdapter — the review (q-3) flagged the coord-specific concurrency paths ported from the deleted CoordinatorManager as untested. Three new test classes: - TestCoordinatorAdapterWorkerDispatch: _spawn_worker reuse gate, queue.Full backpressure, concurrent-call bug-1 reproducer (two threads → exactly one worker via ws._lock + _worker_running), finally-clears-flag. - TestCoordinatorAdapterChildrenRegistry: registry seed on emit_created vs emit_rehydrated rebuild, _pop_coord_registry_locked reverse-index cleanup, _merge_child_ids_locked idempotency, _prime_children_from_snapshot merge. - TestCoordinatorAdapterDispatchChildEvent: unknown-parent drop, ws_created fan-out, cluster_state / ws_closed reverse-index routing, perf-6 in-place ws_id stamp. * fix: regressions flagged by ultrareview Verify stage of the cloud review surfaced 6 confirmed regressions from Stage 1's adapter layer. Fixing together since they share the same root cause (plumbing moved into adapters without retiring the old emission paths). - Interactive adapter emit_created / emit_state / emit_rehydrated become no-ops. The create_workstream HTTP handler still fires ws_created (after attachment validation, per the pre-Stage-1 "no phantom events on rejected upload" contract); WebUI _broadcast_state still fires ws_state with the full payload (tokens + context_ratio + activity). Firing from the adapter too was duplicating both events. Also closes the phantom-ws-created regression (adapter fired before attachment validation ran). - emit_closed Protocol gains a ``name`` kwarg; the adapter is the sole emitter for ws_closed on interactive now, and the frontend eviction toast needs the name. Manager passes ws.name from close() / create()+open() eviction / close_idle paths. - _idle_cleanup_thread stops firing its own reason="idle" ws_closed — close_idle already fires via the adapter with reason="closed", and the frontend never differentiated the two anyway. - close_workstream_endpoint fix: "Cannot close last workstream" 400 was a stale error (the guard went away with the default-startup workstream). Return 404 on close() == False (which now means the ws was already closed or unknown). Also switches the audit actor from _require_ws_access's stored owner to _auth_user_id — the stored owner is metadata post-#400, so attributing actions to it misrepresents who actually did them. - CLI /ws close mirrors the same stale-error fix. - SessionManager.close now calls storage.delete_workstream_override alongside update_workstream_state, same as the old WorkstreamManager.close did. Without it overrides leak until tombstone cleanup. close_idle does the same. - SessionManager._reserve_and_install_locked records the eviction on turnstone.core.metrics so the global eviction counter keeps working. Old WSM did this inline; the unification dropped it. - ConsoleCoordinatorUI.on_rename now fans out to the cluster collector via a new class attribute ``_collector`` (set at console startup alongside ``_coord_mgr``). The old ``_on_rename_observer`` plumbing went away with CoordinatorManager and the "adapter emit_console_ws_rename runs from whichever code path renames" comment was aspirational — nothing actually did it. Full pytest: 4375 passed (tests/live + test_server_live.py excluded; both pre-existing live-backend failures unrelated to this branch). Ruff + mypy clean. * refactor(ui): extract SessionUIBase for shared UI scaffolding Direct response to review feedback that the unification wasn't merging enough of the two workstream kinds. WebUI (node) and ConsoleCoordinatorUI (console) both: - Keep a per-UI list of SSE listener queues guarded by a lock - Block a worker thread on _approval_event / _plan_event - Fan enqueued events out with the same ws_id-stamping pattern - Resolve approvals / plans with the same broadcast-then-signal pattern All of that now lives once in turnstone/core/session_ui_base.py. Both UIs subclass SessionUIBase; kind-specific bodies (WebUI's per-UI metrics + _broadcast_state + intent-verdict bookkeeping, ConsoleCoordinatorUI's collector fan-out) stay in the subclasses. WebUI.resolve_approval still overrides the base (it adds intent- verdict updates) but now calls super() for the shared broadcast + event-set steps. Same shape as the other approval/plan hooks: subclasses extend, base provides skeleton. Net file-level: +156 LOC for the base, -144 LOC across the two subclasses. The raw number is unexciting — but there's now a single source of truth for the listener + blocking-gate machinery, and bugs (like the duplicate ws_created / ws_state events that prompted this refactor) can't arise from the two implementations drifting. Full pytest: 4375 passed. Ruff + mypy clean. * refactor(ui): move metrics + verdict bookkeeping into SessionUIBase Second pass at unifying the two UIs. Per-workstream metrics accumulators (token counts, tool-call counts, context ratio, activity tracking), intent-judge verdict cache + pending-decision list, and the verdict-persistence path all move to SessionUIBase. Before: WebUI tracked all of it; ConsoleCoordinatorUI tracked none of it (a comment on the old on_intent_verdict literally admitted the deferral — "skip the persistence + late-decision plumbing that WebUI does"). Coord sessions never got verdict rows in storage, never had a user_decision stamped, and the dashboard had no way to show coord token usage because the data wasn't captured. Now the base class captures the data and persists the rows for every kind. Kind-specific broadcast (WebUI's _broadcast_state with rich per-UI payloads) stays on WebUI; prometheus counters on the node (_metrics.record_judge_verdict) stay on WebUI's on_intent_verdict override. Everything else shared. Behaviour change worth flagging: coord sessions now write intent_verdicts and output_assessments rows for every judge call and every output-guard warning. Previously silent; the storage rows now exist and any future coord-dashboard surface can read them. Shape of the unification: - resolve_approval: was overridden on WebUI (intent-verdict decision propagation); now lives on the base. Both kinds inherit unchanged. - on_intent_verdict: WebUI overrides only to add _metrics.record_*; rest of the body is the base. - on_output_warning: was on both separately; fully base-shared now. Full pytest: 4375 passed. Ruff + mypy clean. * fix: regressions flagged by second-pass review Three confirmed findings with direct fixes + a dedicated test file for SessionUIBase (was previously uncovered). bug-1 — Coord approve_tools didn't reset _last_verdict_decision or clear _llm_verdicts between approval rounds. WebUI did (inline). Coord inherited SessionUIBase.on_intent_verdict which stamps via the decision flag, so after the first resolve every subsequent round's verdicts were stamped with the prior round's user_decision before the user had decided the new round. Fix: add SessionUIBase._reset_approval_cycle() clearing both under _ws_lock; call from the top of both subclass approve_tools methods. Single-source invariant — can't drift again. sec-1, sec-2 — delete_workstream_endpoint and open_workstream's rehydrate path recorded the audit row under the stored ws.user_id ("owner_uid") rather than the authenticated caller. With row-level ownership gating gone (a46dab1), any team member acting on a peer's workstream produced an audit row naming the victim as the actor. Fix: pass _auth_user_id(request) as the audit actor, matching the pattern close_workstream already follows. q-2 — SessionUIBase had no direct tests. The new tests/test_session_ui_base.py covers listener fan-out, approval + plan blocking gates, intent-verdict cache + FIFO eviction, verdict persistence paths, output-guard persistence, the reset-between-rounds invariant (bug-1 regression test), a cross-subclass test that verifies BOTH WebUI.approve_tools and ConsoleCoordinatorUI.approve_tools call _reset_approval_cycle (verified it fails without the fix), and a concurrent enqueue/register smoke. Full pytest: 4395 passed (+20 new). Ruff + mypy clean. * fix: PR #408 review findings from copilot + code-quality Three substantive fixes + mechanical side-effect-in-assert cleanup. Copilot findings: - session_ui_base.py: on_intent_verdict had a race with resolve_approval. Previously acquired _ws_lock twice (read decision → release → if unset, acquire again to append). resolve_approval could interleave between the two acquisitions, swap-and-clear the pending list and set the decision — our verdict then got appended to the fresh (empty) list and stamped with the NEXT round's decision on the following resolve. Fix: decision-check + append under ONE acquisition; storage UPDATE (if decision already set) runs outside the lock. New regression test counts lock acquisitions during on_intent_verdict and fails if the two-phase pattern returns. - server.py close_workstream_endpoint: comment said "treat as already-closed success" but handler returned 404. Comment rewritten to match the 404 behaviour ("the ws isn't tracked here" is the only reachable meaning for close() → False now). - test_session_ui_base.py concurrency smoke: the test ended with ``pytest.assume = lambda ...`` — a leftover that mutates pytest globals and can surprise other tests. Replaced with explicit ``not is_alive()`` assertions so the "threads completed cleanly" intent survives -O optimization stripping. Code-quality (assert side-effects): Six ``assert mgr.open(...)`` / ``assert mgr.close(...)`` in test_session_manager.py stripped under ``python -O``. Mechanical fix: extract to local before asserting. Ignored the two "Protocol method body is `...`" flags — that's the standard Protocol idiom; replacing with ``pass`` or ``NotImplementedError`` changes typing semantics. Full pytest: 4396 passed.	2026-04-24 14:28:51 -07:00
Patrick Buckley	4fe6e8678e	fix(server): trusted-team workstream visibility on listing endpoints (#400) ... * fix(server): trusted-team workstream visibility on listing endpoints The per-user filter on /v1/api/workstreams, /v1/api/dashboard, and /v1/api/workstreams/saved (PR #375's _visible_workstreams helper) was written for a multi-tenant SaaS threat model that doesn't match how turnstone gets deployed. In a self-hosted, trusted-team install the filter created friction without preventing the relevant threats — and hid the auto-created name="default" startup workstream from every web user, leaving fresh installs staring at a blank dashboard. Listing endpoints now return the cluster-wide set to any authenticated caller. Per-workstream MUTATIONS (/send, /close, /open, /title, /delete, /refresh-title) keep their independent ownership checks — the cross-tenant guards from PR #375 stay in force on those handlers (see TestCrossTenant{Delete,Approve,Close,Title,Open}). Listing only exposes metadata (name, state, kind, message_count); message history still requires the per-workstream gate on /history. Resuming a saved workstream still goes through /open's owner check, so the metadata-leak surface ends at "you can see workstream X exists" — not at any actionable cross-user capability. The console collector's service-scope is now load-bearing only for the SSE event stream gate (/v1/api/events/global); kept anyway as belt- and-braces. If turnstone is ever deployed as a true multi-tenant SaaS, the right boundary is a real ``tenant_id`` column with row-level filtering at the storage layer, not the empty-user_id heuristic this used to apply. Tests updated to assert the new contract: listing returns all owners; mutation gates unchanged. * fix(server): repair test mocks + tighten docstrings on listing endpoints - tests/test_auth.py: TestServerAuth + TestServerLogin mocks now set kind / parent_ws_id / user_id explicitly so /v1/api/workstreams JSON- serializes them. Bare MagicMock attributes return another MagicMock that fails json.dumps and surfaces as 500. - turnstone/server.py: list_saved_workstreams docstring corrected to describe what the endpoint actually returns (summary metadata, not history) and to spell out that ownerless persisted rows are claimable by any authenticated caller via /open — consistent with the trusted- team model the listing endpoints assume. Same callout added next to the open_workstream ownership-gate block. Comments throughout rewritten to be timeless (no "previously" / PR-number references). - tests/test_server_authz.py: TestSaved... docstring matches the actual /open behavior for orphan rows (claimable by any authenticated caller, not a separate admin path).	2026-04-23 18:44:46 -07:00
Patrick Buckley	334edbd580	fix(server,console): kind filter on saved-workstreams + closed coords on landing (#380) ... * fix(server,console): kind filter on saved-workstreams + closed coords on landing Two independent bugs folded into one hotfix: 1. Coordinators leaking into the interactive UI's "saved workstreams" sidebar. ``list_workstreams_with_history`` (SQLite + postgres) was kind-agnostic — every coordinator row with conversation history came back alongside interactive rows, and ``list_saved_workstreams`` serialized them uniformly with no kind field so the interactive UI rendered coordinators as regular interactive entries. Fix: add optional ``kind: WorkstreamKind | str | None = None`` kwarg on ``list_workstreams_with_history`` (storage protocol + both backends + the ``turnstone.core.memory`` helper). Pass ``kind=WorkstreamKind.INTERACTIVE`` from the /v1/api/workstreams/saved handler so the interactive surface only sees interactive rows. Default ``None`` preserves legacy all-kinds behaviour for any other caller that wants both. 2. Closed coordinators vanish from the console landing page. ``_coordinator_rows`` in console/server.py built dashboard rows exclusively from the in-memory ``CoordinatorManager`` registry, which pops rows on ``close()``. The persisted storage row stays (state='closed') but never reached the landing-page poller at /v1/api/cluster/workstreams?node=console. Fix: two-lane merge in ``_coordinator_rows``. The in-memory lane (manager) stays authoritative for live session state (model / model_alias / current state / tokens). A new persisted lane queries ``storage.list_workstreams(kind=COORDINATOR, user_id=uid, limit=200)`` and appends rows NOT already in the in-memory set — surfacing closed / error / deleted coordinators so the operator can still see them on the landing page. Ownership semantics unchanged — non-admin callers only see their own tenant, admin-bypass via admin.users/admin.roles honored on both lanes, empty-string defense-in-depth matches _check_row_owner_or_404. Tests: - tests/test_storage_sqlite.py — two new tests: kind filter excludes coordinators from the history list; string form of kind accepted (matches the memory.py forwarding shape). - tests/test_coordinator_endpoints.py — four new tests: - closed coordinators from storage surface alongside active ones. - in-memory row wins on ws_id dedup (live state authoritative). - persisted rows respect tenant filter (non-admin, admin bypass). - orphan rows (empty user_id) never leak to empty-sub callers. Gate: ruff + mypy + pytest -m "not live" (4315 passed) all clean. * fix(server,console): address Copilot review on PR #380 Three review comments folded in: 1. Tenancy leak in /v1/api/workstreams/saved — the handler called list_workstreams_with_history without a user_id filter, so any authenticated user could see every other user's saved workstream aliases / titles / names. Fix: - Add ``user_id: str | None = None`` kwarg to list_workstreams_with_history on the protocol + both backends (SQLite + postgres). Pushes the filter into SQL. - memory.py helper forwards the kwarg. - /v1/api/workstreams/saved reads ``_auth_scopes(request)``: a service-scoped caller gets cluster-wide visibility (None), a non-service caller with a blank ``sub`` returns an empty list, otherwise the SQL filter is scoped to the caller's uid. Matches the _visible_workstreams pattern used on /workstreams and /dashboard. 2. Loose type annotation on the memory.py helper — ``kind: Any`` tightened to ``WorkstreamKind | str | None`` so mypy catches invalid callers. WorkstreamKind was already imported in the module. 3. Brittle positional indexing in _coordinator_rows persisted-rows lane — ``row[10]`` for user_id encoded a column offset that would silently corrupt the projection on any future SELECT reorder. Drop the test-double fallback entirely; the storage-protocol contract already requires SQLAlchemy Row with _mapping, and every real caller (SQLite + postgres) provides it. Tests: - test_server_authz.py TestSavedWorkstreamsTenantScoping — four new regression tests covering: non-service caller sees only own rows, service scope sees cluster-wide, blank-sub non-service returns empty, and coordinator rows excluded even for service callers. Gate: ruff + mypy + pytest -m "not live" (4319 passed) all clean.	2026-04-18 03:10:19 -07:00
Patrick Buckley	c17eddbbd8	fix(console): service scope on collector token + surface upstream 4xx (#379) ... * fix(console): service scope on collector token + surface upstream 4xx CRITICAL: the console's ClusterCollector ServiceTokenManager was configured with only frozenset({"read"}) scope, but every upstream node's /v1/api/events/global hard-gates on "service" scope (added in PR #375 for cross-tenant authz hardening). Every console→upstream SSE connect 403'd, the collector never populated node state, and the failure was silent — node health, idle workstreams, and interactive- kind workstream rows all disappeared from the console dashboard with no user-visible error. The only surface was a log.debug line in the collector's _node_sse_task that operators had to opt into via DEBUG logging or browser DevTools. Fix: - Add "service" to the collector_token_mgr scopes (turnstone/console/server.py). Matches the proxy_token_mgr (which already has it) and the existing cli / admin / channel-gateway service tokens. Restores /v1/api/events/global SSE subscription and /v1/api/dashboard visibility (which silently tenant-filters non-service callers to zero rows). - Upgrade the 4xx path in _node_sse_task to log.warning with the status code + 200-char body preview, so configuration-level failures (scope misconfig, JWT secret mismatch, expired token) show up in operator logs instead of being masked by the generic except-block debug line. Keep transient network errors (CancelledError, ConnectError) at debug so the log doesn't flood during brief node restarts. - Add reachable_reason field to NodeSnapshot + surface via get_nodes / get_node_detail / get_snapshot (and the browser's buildNodeInfoFromSnapshot). Operators now see the failure cause on the cluster node list without tailing the log. Cleared on successful reconnect in _apply_snapshot. - Test coverage: test_server_authz.py TestGlobalEventsServiceGate gains a positive-path test asserting that a token with exactly the collector's scope set ({"read", "service"}) is accepted by /v1/api/events/global. Locks in the scope contract so any future rename breaks the test before it breaks the dashboard. Gate: ruff + mypy + pytest -m "not live" (4309 passed) all clean. * fix(console): address Copilot review on PR #379 Two review comments folded in: - collector.py — bounded body read for 4xx SSE error previews. The prior ``await source.response.aread()`` buffered the entire upstream error body into memory just to log a 200-char preview; a malicious / oversized upstream response (HTML error page, proxy- generated body) could have forced the collector to download an arbitrary amount of bytes. Iterate ``aiter_bytes()`` and stop once the preview cap (256 bytes, ~200 chars after UTF-8 decode) is satisfied. - test_server_authz.py — tighten the service-scope positive test. The prior ``assert resp.status_code != 403`` could pass on unrelated 500s AND left an SSE stream open indefinitely. Send ``?expected_node_id=definitely-wrong-node-id`` so the handler passes the scope gate, hits the post-auth node-identity check, and returns 409. Now ``assert resp.status_code == 409`` proves the scope contract precisely and terminates the request immediately. Gate: ruff + mypy + pytest -m "not live" (4309 passed) all clean.	2026-04-18 02:48:57 -07:00
Patrick Buckley	294d6f5766	fix(server): close cross-tenant authz gaps on interactive-ws handlers (#375) ... Second of three PRs addressing the retrospective review of the turnstone-server interactive-kind feature. The first (PR #374) put the structural pieces in place — WorkstreamKind enum + user_id kwarg on the storage protocol. This PR uses them to close the handler-level ownership gaps that shipped under the prior design. - sec-1: approve / plan_feedback / cancel_generation / command now call _require_ws_access before touching the target UI. Previously any authenticated user could resolve pending tool-approvals on another tenant's workstream — RCE-adjacent because the attacker could approve destructive operations the victim would have denied. - sec-2: /v1/api/workstreams/{ws_id}/delete now gates on ownership AND writes a workstream.deleted audit event. Previously any authenticated user could destroy any other tenant's workstream, conversations, and attachments in one call with no tamper-evident trail. - sec-3: /v1/api/events (per-ws SSE) gates before _register_listener so non-owners can't subscribe to another tenant's message / tool / approval stream. - sec-4 / sec-5: /v1/api/workstreams and /v1/api/dashboard filter to the caller's tenant view via a new _visible_workstreams helper; service-scoped tokens (cluster / routing proxy) keep the full view. - sec-6: /v1/api/events/global requires service scope. The global snapshot carries cross-tenant workstream inventory and was never intended for end-user browsers. - sec-7: /v1/api/workstreams/{ws_id}/open verifies the caller is the stored owner (or holds service scope) before rehydrating. Returns 404 on mismatch — existence isn't enumerable by response code. - sec-8 / sec-9: /workstreams/close, /refresh-title, /title all gate on ownership. Cross-tenant close aborts the victim's running generation; cross-tenant rename is a phishing / denial-of-use vector in list / dashboard responses. - sec-11: workstream.created / .deleted / .closed / .opened now land in the audit_events table with kind + parent_ws_id detail, so forensic review can reconstruct lifecycle even after the row is gone. - q-4: new tests/test_server_authz.py covers every gate above via TestClient, plus the PR #1 HTTP-boundary kind-validation branches that had no regression coverage (coordinator / unknown-kind / 400, cross-tenant parent_ws_id / 403, non-interactive open / 400). - q-3: test_workstream_kind.py now uses the conftest storage fixture so it runs against both SQLite and PostgreSQL under --storage-backend=postgresql, closing the sqlite↔postgres drift risk the prior review flagged. Added storage-edge ValueError and user_id SQL filter tests alongside. Tests, lint (ruff), typecheck (strict mypy) all green. Stacked on PR #374 — merges after that lands.	2026-04-17 22:22:03 -07:00