Repository navigation
feat(delegation): TaskDelegationService — LocalTaskBackend byte-identical + RelayTaskBackend over agent-api (step 4, #1947) - #1956
Merged
qingyun-wu merged 23 commits intoJul 7, 2026
Conversation
The new header must be in confine_user_content's _HEADER_KEYS like every other header — otherwise a message body containing a literal 'interaction_type: ...' line survives into the task file undefanged and could forge the field under a full-scan reader. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…tests (step 3a) The Local Task Protocol's task-file half as pure stdlib functions (the result-marker half already lives in result_markers.py, #873): - schema constants: INTERACTION_TYPES (single source, asserted equal to the gateway whitelist), PRIORITIES, ACCESS_TIERS, KNOWN_HEADER_KEYS (from a 3.4k-file archive corpus survey) - valid_task_id — the filename/traversal gate for ids arriving in content - parse_task_headers — the safe stop-at-task: reader (PR #982 delimiter rule) - parse_task_headers_trusted — full-scan last-wins, for writers that neutralize bodies (_one_line strip or confine_user_content defang); last-wins is load-bearing for the gateway's access_tier-written-last defense - archive rules: month partitioning, find_archived_task candidate walk, iter_archived_tasks corpus sweep Writers untouched (read-side-first). The module docstring records the real shape taxonomy the corpus survey established: TS writers + agent-api /task are task-last; every Python bridge is task-mid — which means stop-at-task: readers under-read bridge files (e.g. parse_priority_from_text has never seen a bridge-written priority: field). Reader consolidation and writer convergence are follow-up steps with per-bridge byte-identical acceptance. Tests: 33 checks — per-shape fixtures (discord/gateway/voice/chat/phone- legacy/health/forged-body), id validation, archive rules, vocabulary parity with the gateway, plus a live-corpus sweep (3,397 archived files parse clean) that skips gracefully where no workspace exists (CI). R1 honored: stdlib-only, no I/O beyond the explicit archive helpers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The branch filter predates this staging branch — without it, refactor-step PRs (like this one) get zero CI. Same pattern staging-workspace-revamp used. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Same branch-filter gap as ci.yml — without it, refactor-step PRs with Python changes skip the 95% diff-coverage bar until the staging→main merge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… 3b, reader 1/3) parse_priority_from_text delegates header extraction to the protocol module's safe parser; the legacy blank/'---' stop is preserved locally as a documented pre-#982 quirk. Deliberate tightening: header keys are canonical lowercase at column 0 — asserted as the ONLY behavioral delta in the new invariance test, which dual-runs a verbatim copy of the legacy implementation against the new one over adversarial fixtures and the live corpus (3,399 archived files, zero verdict changes). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…_lenient (step 3b, reader 2/3) New protocol parser: parse_task_headers_lenient — full scan, FIRST occurrence per key wins. This is the shape-union reader: the archive proves producer field order changed across eras (May-2026 voice tasks are task-MID; today's are task-last), and _task_source classifies files of any age. The stricter stop-at-task: parser flips the DM-fallback verdict on 23 real archived voice tasks — caught by this commit's corpus dual-run, which now asserts extraction-identical over all 3,401 files. Known pre-existing first-wins spoofability (a body line can supply a key the file legitimately lacks) is documented at the parser and pinned by a fixture; hardening it changes historical verdicts and is an owner decision, not a read-side refactor. Gateway _valid_tid deliberately NOT switched: it is a remote-compat gate (any dot/dash id from older gateways), a different contract from the local task-id canon in valid_task_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ority tests/task-priority-stop-at-task-delimiter.test.py (and any other consumer) loads task_priority standalone via importlib without src/ on sys.path — the bare import broke it in CI, which also failed the coverage gate (suite dies under instrumentation before coverage is measurable). Same self-pathing pattern the bridges use. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
That refactor's staging branch merged 2026-06-01 (M0); the filter entry is dead config. Owner-requested cleanup alongside the staging-interaction-planes addition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ical, RelayTaskBackend over agent-api (step 4, #1947) The seam between delegation logic and where tasks/results live: - src/task-delegation.ts: TaskDelegationService interface (submit + result I/O primitives), LocalTaskBackend (today's exact file I/O), RelayTaskBackend (same ops over agent-api HTTP with bearer), selectBackend (boot-time probe: writable tasks/ → local; else CORE_API_URL → relay; else loud throw — the 2026-05-18 silent-drop lesson applied at the seam). - task-bridge.ts: workTool + writeChatTask submit via the backend (local mode = byte-identical writes). The LOCAL result watcher is untouched — in relay mode a separate loop covers the delegation-critical subset only: timeout sweep + results for tasks THIS process submitted (consuming other task-* results would steal them from core-host consumers; deliver-once). Core-host-only flows (voice-/question-/proactive-, context consolidation) stay core-host-only by design. - agent-api.py: 4 delegation endpoints (POST /delegation/tasks, GET /delegation/results[/name], POST /delegation/archive). Stricter auth than the rest of the API: a core with no SUTANDO_API_TOKEN refuses delegation outright (403) instead of the local-dev allow. Ids via local_task_protocol.valid_task_id; names via the CodeQL-shaped _safe_path (which appends .txt itself — callers pass stems); archive matches task-bridge's month-partitioned layout via archive_month_dir. Tests: tests/task-delegation.test.ts (5 — byte-identity, watcher-I/O mirror, probe order, loud-throw) and tests/agent-api-delegation.test.py (14-check E2E against a real HTTP server on an ephemeral port: auth both ways, byte-identical submit, traversal rejection, list/read round-trip, month-partitioned archive). Existing task-bridge suites green (8+10), tsc clean, full python suite unchanged. Cross-machine E2E (Air voice-agent → MBP core) needs the second machine — flagged in the PR for owner scheduling; the relay path is otherwise covered by the HTTP E2E above. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…the unmeasurable discord glue The coverage gate runs without a live workspace (corpus sweeps skip) and without discord.py (the bridge can't import under instrumentation): - find_archived_task / iter_archived_tasks now have fixture-based tests (candidate walk across live/processed/flat/month dirs, stray-dir and malformed-id gating) instead of relying on the live-corpus path. - the two _task_source glue lines get pragma: no cover with the rationale at the site — their semantics are pinned by the invariance test's corpus dual-run, but the module itself is unimportable in the gate env. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Coverage Gate✅ Diff coverage PASSES the 95% bar. Whole-tree (informational): 33%. Diff CoverageDiff: origin/staging-interaction-planes...HEAD, staged and unstaged changes
Summary
|
… reader (Codex blocker) The trusted/lenient parsers' body looked like the full work item but silently dropped continuation lines (health-check failure bullets, phone hint/transcript sections). A header scan cannot losslessly split task-mid continuation content from trailing headers, so stop pretending: - TaskHeaders.body is now DOCUMENTED per parser: full work item for the task-last safe parser; scalar first-task:-line value for trusted/lenient. - New task_body(text): the shape-independent lossless work-item reader — everything from the first task: line onward, verbatim. For task-mid files that includes trailing header lines; the honest trade is stated at the function. - Tests pin the contract: trusted body excludes the health bullet (scalar by contract, not by accident), task_body keeps health bullets and phone hint/transcript, equals safe-parser body on task-last shapes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…itive) The flagged token is the `kind: 'tasks' | 'results'` TYPE UNION on the injected archive callback — the module never resolves workspace paths itself; dirs are injected by task-bridge, which resolves via workspace_default. Rationale recorded in the allowlist entry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Collaborator
Author
|
Review result on Blocking findings:
Focused checks run in
Reviewed by Qingyun's Codex. |
…Codex P2s) Both P2s from the re-review, fixed as one coherent mechanism: 1. Parsers promote ONLY KNOWN_HEADER_KEYS to headers, and task_body_guard._HEADER_KEYS now IS that list (imported — single source of truth). Lockstep is the invariant: no key a parser would trust can survive undefanged in user-supplied content. Side benefit: junk key-shaped lines (transcript 'Caller: hi') can no longer masquerade as metadata. 2. With the vocabulary boundary in place, task-mid bodies become losslessly splittable: trusted/lenient body = the task: line's content plus every subsequent NON-vocabulary line — health-check bullets and phone transcript dialogue stay in body, trailing real headers are excluded. Every post-task: line lands in exactly one of headers/body. Tests: lockstep assertion (guard set == parser vocabulary), forged non-classic keys (instructions/hint/from/transcript/attempts) defanged, health bullets + transcript preserved in trusted body, and a corpus-wide body-fidelity sweep (3,415 archived files: no non-header line lost). Full suite: injection-guard, dm-fallback-guard, both invariance tests, interaction-type, gateway, priority — all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ct-call coverage The coverage gate's tracer misses handler-thread execution, so the HTTP E2E alone left the route bodies unattributed (77.5% on changed lines). The four delegation route bodies are now module-level (status, payload) functions — the handler is thin dispatch — and the test exercises them BOTH ways: HTTP round-trip for dispatch+auth, direct main-thread calls for the bodies (submit good/bad-id/empty, list, read good/404/traversal, archive move/already-gone/bad-tid). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
john-the-dev
approved these changes
Jul 7, 2026
john-the-dev
left a comment
john-the-dev
left a comment
Collaborator
There was a problem hiding this comment.
APPROVED. Step 4 of the interaction-planes refactor is clean.
Strengths:
LocalTaskBackend.submitTaskbyte-identical assertion is load-bearing and well-tested — this is the right guarantee to lock in before the write-side phaseKNOWN_HEADER_KEYSas single source of truth for parser + guard is the correct invariant lock; the task_priority.py self-test that verifies guard-defang-set == parser-vocabulary is a nice defensive additionvalid_task_id()as the path-traversal gate on delegation endpoints is correct (no slashes, no dots, bounded length)- Bearer-auth 403 on all delegation endpoints when
API_TOKENis unset — right default for a capability that accepts remote task submission os.replace()indelegation_archive_resultfor atomic move: good
One non-blocking note: delegation_read_result calls _safe_path(RESULT_DIR, stem) where stem is URL-decoded path after /delegation/results/. _safe_path's existing traversal check handles this, but the incoming URL component isn't valid_task_id-checked the way the write-side is. Functionally correct (_safe_path catches the traversal), just asymmetric with the submit endpoint. Fine to address in the write-side phase or a follow-up.
CI pending; assuming it lands green this LGTM for merge once the stack lands in order.
…r branch The coverage gate's tracer misses handler-THREAD execution, so even with the route bodies extracted, the thin dispatch lines stayed unattributed. Inverted the E2E threading: plain HTTPServer with a handle_request loop on the MAIN thread, requests issued from a worker thread — every handler line now runs traced. Also covers delegation_list_results' unreadable-dir branch. 25 checks green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Collaborator
|
Coverage gate raised 3 P1 design issues worth addressing before merge (coverage is at 93%, just below the 95% bar): [P1] Split-host mode is not a positive config path. [P1] [P1] My approval was on the architecture/structure; the P1s above make me think these should be addressed before this lands. Happy to re-review the updated diff. |
Collaborator
Author
|
Review result on The latest head fixes the local E2E harness/OSError coverage path, and the focused local tests now pass, but the three protocol/design blockers are still present in the current code. Blocking findings:
Status/tests:
Reviewed by Qingyun's Codex. |
Corrected diagnosis: the missed lines were never thread-attribution — they were the UNTAKEN guard branches (wrong-bearer on the GET/archive routes, malformed-JSON except paths, tokenless refusal on read/archive). Local repro under the gate's exact invocation (coverage run --rcfile=.coveragerc) now shows zero missing delegation lines. Also hardened the test client: the server may close the socket right after an error response, so reading the error body races ECONNRESET — status codes are what the assertions need; the body read is best-effort now. 32 checks green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Collaborator
Author
|
Thanks for the review! The non-blocking read-route symmetry note is tracked as a follow-up issue (see above / #1959) slated for the write-side phase. CI is fully green on this head (coverage gate included). |
Collaborator
Author
|
Review result on CI and the focused local checks are green now, but this head appears to add coverage for the existing delegation paths rather than fixing the three protocol/design blockers. The same unsafe behaviors are still present in the current code:
Focused checks run in
GitHub checks are green ( Reviewed by Qingyun's Codex. |
…chive ownership (Codex P1s) All three P1s from the re-review: 1. CORE_API_URL is now POSITIVE configuration: set → relay, regardless of local writability. The probe-first order made relay unreachable on any normal voice-host checkout (default workspace is <repo>/workspace — always writable), silently stranding delegated tasks locally. Local dirs are now created only on the local selection path, so a relay host grows no unused tasks/ + results/ dirs. Tests assert relay-wins-on-writable and no-local-dirs-in-relay-mode. 2. /delegation/tasks enforces identity coherence: the body's embedded id: header must equal the request id — a mismatched write would split task identity across result polling, dedupe, archive, and history. 3. /delegation/archive enforces ownership + no-clobber: the source name must be exactly <task_id>.txt (a relay client archives only ITS OWN result), and an occupied archive slot gets the epoch-suffixed name the bridges already use instead of overwriting history. Suites: 36 py E2E checks + 6 TS checks green; tsc clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
@cla-assistant check |
Collaborator
Author
|
All three P1s fixed on the new head:
Suites: 36 py E2E + 6 TS checks green, tsc clean. CI re-running. |
Collaborator
Author
|
No blocking findings on The prior P1s are addressed in this head:
Focused checks run in
GitHub checks are green: Reviewed by Qingyun's Codex. |
qingyun-wu
added a commit
that referenced
this pull request
Jul 7, 2026
…ice (steps 3+4 → main) (#1962) * feat(tasks): additive interaction_type header at every task producer (interaction-planes step 1) A task producer is a (source, interaction_type) pair, not a source alone. This stamps the pair at every write site — purely additive, old readers ignore the extra line, no consumer behavior changes: - message: slack/telegram/discord bridges, twilio SMS + voicemail, chat template - realtime_audio: voice work-tool (task-bridge.ts), phone work-tool (delegateTask) - tool_initiated: writeChatTask (Gemini inline tool), agent-api /task (agent-to-agent) - system_event: health-check --emit-task, context-drop (app + task-bridge), github-webhook, twilio incoming-call, phone call-end summary - remote-gateway-bridge: passes through the gateway's interaction_type when present, defaults to message (all current gateway traffic is Matrix room messages) tests/interaction-type-header.test.py sweeps every producer write site and fails if a source: serialization lacks the paired interaction_type within the write window — so new producers can't silently ship without it. First step of the interaction-planes refactor (snapshot: v0.5.0-pre-interaction-planes). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(tasks): harden gateway interaction_type + pair source: phone on delegateTask Round-2 improvements on the same PR: - remote-gateway-bridge: whitelist the pass-through against the six-value interaction-plane vocabulary — the gateway is outside the trust boundary, so an unknown remote value degrades to "message" instead of landing verbatim in the local task file. - conversation-server delegateTask: add the missing source: phone so the producer carries the full (source, interaction_type) pair. This activates two consumers that always listed "phone" but never matched because the writer predates the source header: task_priority phone→urgent, and discord-bridge DM_FALLBACK_SOURCES (a result landing after the call ended now DMs the owner instead of rotting unclaimed). - call-end summary writer deliberately does NOT get source: phone — its task instructions already have the core DM the owner, so the bridge fallback would deliver the same summary twice. Comment at the writer + a serialized- form-only test assertion guard the double-DM regression. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(gateway): unit-cover the interaction_type whitelist serialization The #1933 coverage gate (first PR through it) flagged the new remote-gateway-bridge lines as uncovered — the sweep test greps write sites but never executes them. This exercises _write_task directly: whitelisted pass-through, unknown-value degradation to message (trust boundary), absent-field default, full vocabulary round-trip, and the access_tier-last ordering guard. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(protocol): local_task_protocol — read-side module, golden corpus tests, reader switch-over (step 3) (#1954) * fix(task-body-guard): defang interaction_type in untrusted bodies The new header must be in confine_user_content's _HEADER_KEYS like every other header — otherwise a message body containing a literal 'interaction_type: ...' line survives into the task file undefanged and could forge the field under a full-scan reader. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(protocol): local_task_protocol read-side module + golden corpus tests (step 3a) The Local Task Protocol's task-file half as pure stdlib functions (the result-marker half already lives in result_markers.py, #873): - schema constants: INTERACTION_TYPES (single source, asserted equal to the gateway whitelist), PRIORITIES, ACCESS_TIERS, KNOWN_HEADER_KEYS (from a 3.4k-file archive corpus survey) - valid_task_id — the filename/traversal gate for ids arriving in content - parse_task_headers — the safe stop-at-task: reader (PR #982 delimiter rule) - parse_task_headers_trusted — full-scan last-wins, for writers that neutralize bodies (_one_line strip or confine_user_content defang); last-wins is load-bearing for the gateway's access_tier-written-last defense - archive rules: month partitioning, find_archived_task candidate walk, iter_archived_tasks corpus sweep Writers untouched (read-side-first). The module docstring records the real shape taxonomy the corpus survey established: TS writers + agent-api /task are task-last; every Python bridge is task-mid — which means stop-at-task: readers under-read bridge files (e.g. parse_priority_from_text has never seen a bridge-written priority: field). Reader consolidation and writer convergence are follow-up steps with per-bridge byte-identical acceptance. Tests: 33 checks — per-shape fixtures (discord/gateway/voice/chat/phone- legacy/health/forged-body), id validation, archive rules, vocabulary parity with the gateway, plus a live-corpus sweep (3,397 archived files parse clean) that skips gracefully where no workspace exists (CI). R1 honored: stdlib-only, no I/O beyond the explicit archive helpers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci: run CI on staging-interaction-planes PRs and pushes The branch filter predates this staging branch — without it, refactor-step PRs (like this one) get zero CI. Same pattern staging-workspace-revamp used. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci: run the coverage gate on staging-interaction-planes PRs too Same branch-filter gap as ci.yml — without it, refactor-step PRs with Python changes skip the 95% diff-coverage bar until the staging→main merge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(protocol): task_priority reads via local_task_protocol (step 3b, reader 1/3) parse_priority_from_text delegates header extraction to the protocol module's safe parser; the legacy blank/'---' stop is preserved locally as a documented pre-#982 quirk. Deliberate tightening: header keys are canonical lowercase at column 0 — asserted as the ONLY behavioral delta in the new invariance test, which dual-runs a verbatim copy of the legacy implementation against the new one over adversarial fixtures and the live corpus (3,399 archived files, zero verdict changes). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(protocol): discord _task_source reads via parse_task_headers_lenient (step 3b, reader 2/3) New protocol parser: parse_task_headers_lenient — full scan, FIRST occurrence per key wins. This is the shape-union reader: the archive proves producer field order changed across eras (May-2026 voice tasks are task-MID; today's are task-last), and _task_source classifies files of any age. The stricter stop-at-task: parser flips the DM-fallback verdict on 23 real archived voice tasks — caught by this commit's corpus dual-run, which now asserts extraction-identical over all 3,401 files. Known pre-existing first-wins spoofability (a body line can supply a key the file legitimately lacks) is documented at the parser and pinned by a fixture; hardening it changes historical verdicts and is an owner decision, not a read-side refactor. Gateway _valid_tid deliberately NOT switched: it is a remote-compat gate (any dot/dash id from older gateways), a different contract from the local task-id canon in valid_task_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(protocol): self-sufficient local_task_protocol import in task_priority tests/task-priority-stop-at-task-delimiter.test.py (and any other consumer) loads task_priority standalone via importlib without src/ on sys.path — the bare import broke it in CI, which also failed the coverage gate (suite dies under instrumentation before coverage is measurable). Same self-pathing pattern the bridges use. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci: retire staging-workspace-revamp from workflow branch filters That refactor's staging branch merged 2026-06-01 (M0); the filter entry is dead config. Owner-requested cleanup alongside the staging-interaction-planes addition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(protocol): cover the archive-walk helpers with fixtures; pragma the unmeasurable discord glue The coverage gate runs without a live workspace (corpus sweeps skip) and without discord.py (the bridge can't import under instrumentation): - find_archived_task / iter_archived_tasks now have fixture-based tests (candidate walk across live/processed/flat/month dirs, stray-dir and malformed-id gating) instead of relying on the live-corpus path. - the two _task_source glue lines get pragma: no cover with the rationale at the site — their semantics are pinned by the invariance test's corpus dual-run, but the module itself is unimportable in the gate env. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(protocol): define per-parser body contract + lossless task_body() reader (Codex blocker) The trusted/lenient parsers' body looked like the full work item but silently dropped continuation lines (health-check failure bullets, phone hint/transcript sections). A header scan cannot losslessly split task-mid continuation content from trailing headers, so stop pretending: - TaskHeaders.body is now DOCUMENTED per parser: full work item for the task-last safe parser; scalar first-task:-line value for trusted/lenient. - New task_body(text): the shape-independent lossless work-item reader — everything from the first task: line onward, verbatim. For task-mid files that includes trailing header lines; the honest trade is stated at the function. - Tests pin the contract: trusted body excludes the health bullet (scalar by contract, not by accident), task_body keeps health bullets and phone hint/transcript, equals safe-parser body on task-last shapes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(protocol): vocabulary-locked parsers + lossless task-mid bodies (Codex P2s) Both P2s from the re-review, fixed as one coherent mechanism: 1. Parsers promote ONLY KNOWN_HEADER_KEYS to headers, and task_body_guard._HEADER_KEYS now IS that list (imported — single source of truth). Lockstep is the invariant: no key a parser would trust can survive undefanged in user-supplied content. Side benefit: junk key-shaped lines (transcript 'Caller: hi') can no longer masquerade as metadata. 2. With the vocabulary boundary in place, task-mid bodies become losslessly splittable: trusted/lenient body = the task: line's content plus every subsequent NON-vocabulary line — health-check bullets and phone transcript dialogue stay in body, trailing real headers are excluded. Every post-task: line lands in exactly one of headers/body. Tests: lockstep assertion (guard set == parser vocabulary), forged non-classic keys (instructions/hint/from/transcript/attempts) defanged, health bullets + transcript preserved in trusted body, and a corpus-wide body-fidelity sweep (3,415 archived files: no non-header line lost). Full suite: injection-guard, dm-fallback-guard, both invariance tests, interaction-type, gateway, priority — all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * feat(delegation): TaskDelegationService — LocalTaskBackend byte-identical + RelayTaskBackend over agent-api (step 4, #1947) (#1956) * fix(task-body-guard): defang interaction_type in untrusted bodies The new header must be in confine_user_content's _HEADER_KEYS like every other header — otherwise a message body containing a literal 'interaction_type: ...' line survives into the task file undefanged and could forge the field under a full-scan reader. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(protocol): local_task_protocol read-side module + golden corpus tests (step 3a) The Local Task Protocol's task-file half as pure stdlib functions (the result-marker half already lives in result_markers.py, #873): - schema constants: INTERACTION_TYPES (single source, asserted equal to the gateway whitelist), PRIORITIES, ACCESS_TIERS, KNOWN_HEADER_KEYS (from a 3.4k-file archive corpus survey) - valid_task_id — the filename/traversal gate for ids arriving in content - parse_task_headers — the safe stop-at-task: reader (PR #982 delimiter rule) - parse_task_headers_trusted — full-scan last-wins, for writers that neutralize bodies (_one_line strip or confine_user_content defang); last-wins is load-bearing for the gateway's access_tier-written-last defense - archive rules: month partitioning, find_archived_task candidate walk, iter_archived_tasks corpus sweep Writers untouched (read-side-first). The module docstring records the real shape taxonomy the corpus survey established: TS writers + agent-api /task are task-last; every Python bridge is task-mid — which means stop-at-task: readers under-read bridge files (e.g. parse_priority_from_text has never seen a bridge-written priority: field). Reader consolidation and writer convergence are follow-up steps with per-bridge byte-identical acceptance. Tests: 33 checks — per-shape fixtures (discord/gateway/voice/chat/phone- legacy/health/forged-body), id validation, archive rules, vocabulary parity with the gateway, plus a live-corpus sweep (3,397 archived files parse clean) that skips gracefully where no workspace exists (CI). R1 honored: stdlib-only, no I/O beyond the explicit archive helpers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci: run CI on staging-interaction-planes PRs and pushes The branch filter predates this staging branch — without it, refactor-step PRs (like this one) get zero CI. Same pattern staging-workspace-revamp used. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci: run the coverage gate on staging-interaction-planes PRs too Same branch-filter gap as ci.yml — without it, refactor-step PRs with Python changes skip the 95% diff-coverage bar until the staging→main merge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(protocol): task_priority reads via local_task_protocol (step 3b, reader 1/3) parse_priority_from_text delegates header extraction to the protocol module's safe parser; the legacy blank/'---' stop is preserved locally as a documented pre-#982 quirk. Deliberate tightening: header keys are canonical lowercase at column 0 — asserted as the ONLY behavioral delta in the new invariance test, which dual-runs a verbatim copy of the legacy implementation against the new one over adversarial fixtures and the live corpus (3,399 archived files, zero verdict changes). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(protocol): discord _task_source reads via parse_task_headers_lenient (step 3b, reader 2/3) New protocol parser: parse_task_headers_lenient — full scan, FIRST occurrence per key wins. This is the shape-union reader: the archive proves producer field order changed across eras (May-2026 voice tasks are task-MID; today's are task-last), and _task_source classifies files of any age. The stricter stop-at-task: parser flips the DM-fallback verdict on 23 real archived voice tasks — caught by this commit's corpus dual-run, which now asserts extraction-identical over all 3,401 files. Known pre-existing first-wins spoofability (a body line can supply a key the file legitimately lacks) is documented at the parser and pinned by a fixture; hardening it changes historical verdicts and is an owner decision, not a read-side refactor. Gateway _valid_tid deliberately NOT switched: it is a remote-compat gate (any dot/dash id from older gateways), a different contract from the local task-id canon in valid_task_id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * wip(delegation): step-4 seam — backends, relay watcher, agent-api endpoints * fix(protocol): self-sufficient local_task_protocol import in task_priority tests/task-priority-stop-at-task-delimiter.test.py (and any other consumer) loads task_priority standalone via importlib without src/ on sys.path — the bare import broke it in CI, which also failed the coverage gate (suite dies under instrumentation before coverage is measurable). Same self-pathing pattern the bridges use. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci: retire staging-workspace-revamp from workflow branch filters That refactor's staging branch merged 2026-06-01 (M0); the filter entry is dead config. Owner-requested cleanup alongside the staging-interaction-planes addition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(delegation): TaskDelegationService — LocalTaskBackend byte-identical, RelayTaskBackend over agent-api (step 4, #1947) The seam between delegation logic and where tasks/results live: - src/task-delegation.ts: TaskDelegationService interface (submit + result I/O primitives), LocalTaskBackend (today's exact file I/O), RelayTaskBackend (same ops over agent-api HTTP with bearer), selectBackend (boot-time probe: writable tasks/ → local; else CORE_API_URL → relay; else loud throw — the 2026-05-18 silent-drop lesson applied at the seam). - task-bridge.ts: workTool + writeChatTask submit via the backend (local mode = byte-identical writes). The LOCAL result watcher is untouched — in relay mode a separate loop covers the delegation-critical subset only: timeout sweep + results for tasks THIS process submitted (consuming other task-* results would steal them from core-host consumers; deliver-once). Core-host-only flows (voice-/question-/proactive-, context consolidation) stay core-host-only by design. - agent-api.py: 4 delegation endpoints (POST /delegation/tasks, GET /delegation/results[/name], POST /delegation/archive). Stricter auth than the rest of the API: a core with no SUTANDO_API_TOKEN refuses delegation outright (403) instead of the local-dev allow. Ids via local_task_protocol.valid_task_id; names via the CodeQL-shaped _safe_path (which appends .txt itself — callers pass stems); archive matches task-bridge's month-partitioned layout via archive_month_dir. Tests: tests/task-delegation.test.ts (5 — byte-identity, watcher-I/O mirror, probe order, loud-throw) and tests/agent-api-delegation.test.py (14-check E2E against a real HTTP server on an ephemeral port: auth both ways, byte-identical submit, traversal rejection, list/read round-trip, month-partitioned archive). Existing task-bridge suites green (8+10), tsc clean, full python suite unchanged. Cross-machine E2E (Air voice-agent → MBP core) needs the second machine — flagged in the PR for owner scheduling; the relay path is otherwise covered by the HTTP E2E above. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(protocol): cover the archive-walk helpers with fixtures; pragma the unmeasurable discord glue The coverage gate runs without a live workspace (corpus sweeps skip) and without discord.py (the bridge can't import under instrumentation): - find_archived_task / iter_archived_tasks now have fixture-based tests (candidate walk across live/processed/flat/month dirs, stray-dir and malformed-id gating) instead of relying on the live-corpus path. - the two _task_source glue lines get pragma: no cover with the rationale at the site — their semantics are pinned by the invariance test's corpus dual-run, but the module itself is unimportable in the gate env. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(protocol): define per-parser body contract + lossless task_body() reader (Codex blocker) The trusted/lenient parsers' body looked like the full work item but silently dropped continuation lines (health-check failure bullets, phone hint/transcript sections). A header scan cannot losslessly split task-mid continuation content from trailing headers, so stop pretending: - TaskHeaders.body is now DOCUMENTED per parser: full work item for the task-last safe parser; scalar first-task:-line value for trusted/lenient. - New task_body(text): the shape-independent lossless work-item reader — everything from the first task: line onward, verbatim. For task-mid files that includes trailing header lines; the honest trade is stated at the function. - Tests pin the contract: trusted body excludes the health bullet (scalar by contract, not by accident), task_body keeps health bullets and phone hint/transcript, equals safe-parser body on task-last shapes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(state-paths): allowlist task-delegation.ts (type-union false positive) The flagged token is the `kind: 'tasks' | 'results'` TYPE UNION on the injected archive callback — the module never resolves workspace paths itself; dirs are injected by task-bridge, which resolves via workspace_default. Rationale recorded in the allowlist entry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(protocol): vocabulary-locked parsers + lossless task-mid bodies (Codex P2s) Both P2s from the re-review, fixed as one coherent mechanism: 1. Parsers promote ONLY KNOWN_HEADER_KEYS to headers, and task_body_guard._HEADER_KEYS now IS that list (imported — single source of truth). Lockstep is the invariant: no key a parser would trust can survive undefanged in user-supplied content. Side benefit: junk key-shaped lines (transcript 'Caller: hi') can no longer masquerade as metadata. 2. With the vocabulary boundary in place, task-mid bodies become losslessly splittable: trusted/lenient body = the task: line's content plus every subsequent NON-vocabulary line — health-check bullets and phone transcript dialogue stay in body, trailing real headers are excluded. Every post-task: line lands in exactly one of headers/body. Tests: lockstep assertion (guard set == parser vocabulary), forged non-classic keys (instructions/hint/from/transcript/attempts) defanged, health bullets + transcript preserved in trusted body, and a corpus-wide body-fidelity sweep (3,415 archived files: no non-header line lost). Full suite: injection-guard, dm-fallback-guard, both invariance tests, interaction-type, gateway, priority — all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(delegation): extract route bodies as module functions + direct-call coverage The coverage gate's tracer misses handler-thread execution, so the HTTP E2E alone left the route bodies unattributed (77.5% on changed lines). The four delegation route bodies are now module-level (status, payload) functions — the handler is thin dispatch — and the test exercises them BOTH ways: HTTP round-trip for dispatch+auth, direct main-thread calls for the bodies (submit good/bad-id/empty, list, read good/404/traversal, archive move/already-gone/bad-tid). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(delegation): serve the E2E on the main thread + cover the OSError branch The coverage gate's tracer misses handler-THREAD execution, so even with the route bodies extracted, the thin dispatch lines stayed unattributed. Inverted the E2E threading: plain HTTPServer with a handle_request loop on the MAIN thread, requests issued from a worker thread — every handler line now runs traced. Also covers delegation_list_results' unreadable-dir branch. 25 checks green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(delegation): exercise every guard branch — the real coverage gap Corrected diagnosis: the missed lines were never thread-attribution — they were the UNTAKEN guard branches (wrong-bearer on the GET/archive routes, malformed-JSON except paths, tokenless refusal on read/archive). Local repro under the gate's exact invocation (coverage run --rcfile=.coveragerc) now shows zero missing delegation lines. Also hardened the test client: the server may close the socket right after an error response, so reading the error body races ECONNRESET — status codes are what the assertions need; the body read is best-effort now. 32 checks green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(delegation): positive relay config + task-identity coherence + archive ownership (Codex P1s) All three P1s from the re-review: 1. CORE_API_URL is now POSITIVE configuration: set → relay, regardless of local writability. The probe-first order made relay unreachable on any normal voice-host checkout (default workspace is <repo>/workspace — always writable), silently stranding delegated tasks locally. Local dirs are now created only on the local selection path, so a relay host grows no unused tasks/ + results/ dirs. Tests assert relay-wins-on-writable and no-local-dirs-in-relay-mode. 2. /delegation/tasks enforces identity coherence: the body's embedded id: header must equal the request id — a mismatched write would split task identity across result polling, dedupe, archive, and history. 3. /delegation/archive enforces ownership + no-clobber: the source name must be exactly <task_id>.txt (a relay client archives only ITS OWN result), and an occupied archive slot gets the epoch-suffixed name the bridges already use instead of overwriting history. Suites: 36 py E2E checks + 6 TS checks green; tsc clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Step 4 of the interaction-planes refactor — TaskDelegationService (#1947, built under the architecture names per design R3). Base:
staging-interaction-planes; stacked on #1954 (useslocal_task_protocolfor id validation and archive rules).Decouples the voice-agent from the core host without costing co-located deployments anything: same-machine keeps today's exact behavior (the local backend's
submitTaskis the identicalwriteFileSync, asserted byte-for-byte in tests); only an off-host voice-agent takes the network hop, and only for the task hand-off — mic/TTS/Gemini stay local to the voice host.Design
TaskDelegationService— submit + the result-I/O primitives the watcher consumes (list/read/archive), so watcher semantics live in one place and backends only move bytes.LocalTaskBackend— today's file I/O, unchanged. The local result watcher code path is literally untouched (onemode === 'relay'guard at function entry is the entire diff to it).RelayTaskBackend— same operations over agent-api HTTP. In relay mode a separate, deliberately-narrow loop runs instead of the local watcher: timeout sweep + delivery of results for tasks this process submitted — nothing else, because consuming othertask-*results remotely would steal them from their real consumers on the core host (deliver-once). Core-host-only flows (voice-*push files,question-*, proactive, context consolidation) stay core-host-only; documented at the guard.tasks/→ local; elseCORE_API_URL→ relay; else loud throw (the 2026-05-18 context-drop silent-write lesson, applied at the seam). One boot log line states the mode.POST /delegation/tasks,GET /delegation/results[/name],POST /delegation/archive): stricter than the rest of the API — a core with noSUTANDO_API_TOKENrefuses delegation outright (403) rather than the local-dev allow-all, since remote submission is full-capability delegation. Ids gated bylocal_task_protocol.valid_task_id, filenames by the existing CodeQL-shaped_safe_path, archive destination identical to task-bridge's month-partitioned layout.Tests
tests/task-delegation.test.ts(5): submit byte-identity with the pre-seam write; result-primitive mirror; probe order both directions; loud-throw when neither backend is viable.tests/agent-api-delegation.test.py(14): E2E against a real HTTP server on an ephemeral port — wrong-bearer 401, tokenless-core 403 on every route, byte-identical submit landing, traversal rejection (ids and names), list/read round-trip, month-partitioned archive move.tsc --noEmitclean.Remaining for full #1947 acceptance
The cross-machine E2E (Air voice-agent → MBP core over
CORE_API_URL) needs the second machine — the relay path is covered by the HTTP E2E here, but the design's acceptance criterion includes the real two-host round-trip + mid-task network-kill behavior. Needs owner scheduling of the Air.cc @sutando-wu-air.agent for review (with #1954) per owner assignment.
🤖 Generated with Claude Code