Skip to content

feat(plugins): kanban-home-cards — open home cards once at session start (t_13a135f5) - #968

Merged
Kyzcreig merged 3 commits into
mainfrom
daedalus/t_13a135f5-kanban-home-cards
Sep 24, 2026
Merged

Kyzcreig merged 3 commits into
mainfrom
daedalus/t_13a135f5-kanban-home-cards

Conversation

@Kyzcreig

@Kyzcreig Kyzcreig commented Sep 24, 2026 •

Copy link
Copy Markdown
Collaborator

Card t_13a135f5 · spec plans/2026-09-24_session-start-home-cards.md (t_5898253e, approved).

Bundled, opt-in plugin kanban-home-cards: one pre_llm_call hook. On the first turn of each (process, session) it adds a capped list of the session's OPEN home cards to the user message (api_content sidecar). It never touches the system prompt. Zero core diff.

  • I1: once per (process, session); the seen-mark is set before any DB work
  • I2: the one FROM tasks query filters on session_id IN home_ids(...)
  • I3: <=8 cards, <=180 chars/line, <=900 chars total; the overflow line is reserved so it can't be cut
  • I5: all boards scanned concurrently, 750 ms total budget, fail-open
  • I6: skipped for kanban workers, delegate children (ContextVar + env marker) and cron
  • I7: titles and comments are redacted; the header frames card text as data
  • I8: opened with mode=ro only, never immutable
  • R3: no re-inject while the header is in the last 20 user rows

Home is exact-id behind home_ids(). Lineage semantics come in a follow-up PR once #951's helper merges.

Verification:

  • tests/plugins/kanban_home_cards: 36 passed, including a real PluginManager loader test
  • 7 invariant mutants (I1, I2, I3, I6, I7, R3 x2 incl. the property sweep) all killed
  • Neighbour tests (test_plugins, test_plugin_manifest_v2, security-guidance): 126 passed
  • ruff clean
  • P0.1 A/B: the 1,400-char block costs 683 tokens on opus-5-5, which drove the 900-char cap
  • Phase 2 scratch-home: 23 separate process restarts on one session, block injected at T2 and T22 only; negative session gets 0 blocks

Do not enable on live profiles here. Phase 3 is Apollo's.


View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.

…on start

Bundled opt-in plugin, one pre_llm_call hook. First turn per (process, session)
adds a capped block (<=8 cards, <=900 chars) of the session's OPEN home cards
across all boards to the user message (api_content sidecar, never the system
prompt). Read-only mode=ro scan, 750 ms budget, fail-open; skips kanban workers,
delegate children, cron; redacts title/comment; R3 restart dedupe (K=20 user rows).
Home resolution is exact-id behind home_ids() until the #951 lineage helper lands.

Verified: tests/plugins/kanban_home_cards 36 passed; 7 invariant mutants killed;
plugin/manifest/security-guidance neighbours 126 passed; ruff clean; scratch-home
23-process restart proof (spec 3b). P0.1 measured 683 tok per 1,400 chars.
Spec: plans/2026-09-24_session-start-home-cards.md (t_5898253e). Card t_13a135f5.
…istory

The gateway's _build_replay_entry drops a user row's api_content sidecar
whenever replay rewrites the content; with gateway.message_timestamps
enabled that is every user row. R3 only scanned conversation_history, so
after every gateway restart it missed the block header and re-injected.

R3 now also reads the session's last DEDUPE_USER_ROWS persisted user rows
from the profile state.db (mode=ro, busy_timeout 0, progress-handler
deadline), inside the same 750 ms BUDGET_S; the board scan gets the
remainder. Missing state.db = inject; any other read error = skip (never a
duplicate). I1 unchanged.

Verified:
- tests/plugins/kanban_home_cards: 43 passed (36 prior + 7 new)
- new test_R3_gateway_replay_restart_does_not_reinject[True] goes through
  the real _build_gateway_agent_history(inject_timestamps=True): RED on
  94f0116 (block re-injected), green here; [False] arm green on both
- 4 hand mutants (LIMIT dropped, session filter dropped, error->inject,
  state.db check removed) each killed by the named test
- tests/gateway replay/timestamp/cached-history neighbours: 15 passed
- hermetic gateway-path restart run (timestamps ON, fresh process per
  turn): base re-injects every restart (1,2,3,4); fix stays at 1 over T2-T12
…ser rows

Argus r2 F3: the state.db scan counted undone/rewound rows, so a
rewind that removed the header from replay still suppressed the block
after restart. Filter on active = 1, the predicate
SessionDB.get_messages_as_conversation (gateway load_transcript) uses.
Per Apollo r3 ruling, any state.db ambiguity now fails open to INJECT.

Verified: 48/48 plugin tests, 63/63 with gateway neighbours, ruff clean.
New rewind/compaction/K-window tests + unreadable->inject RED on
20a6caa; dropping the active filter is killed by 3 tests.
@Kyzcreig

Copy link
Copy Markdown
Collaborator Author

🤖 merged-by: apollo · lane: discord · gate: BYPASS: FR paused by Ace ruling 09-22 (router deadlock t_3ae5ff8b); Argus 3-round review on record · why: kanban-home-cards plugin (t_13a135f5, spec t_5898253e): one pre_llm_call hook injects the session's open cards once per (process, session), all boards, 750ms fail-open, R3 restart-dedupe on active=1 rows. Argus PASS r3 @ cc97164, 48/48 tests, 4/4 mutants. Not enabled on any profile until the runtime redeploy with t_de1f0aa7 (Phase 3 = Apollo)

@Kyzcreig
Kyzcreig added this pull request to the merge queue Sep 24, 2026
Merged via the queue into main with commit 19d6b7b Sep 24, 2026
55 checks passed
@Kyzcreig
Kyzcreig deleted the daedalus/t_13a135f5-kanban-home-cards branch September 24, 2026 15:51
@Kyzcreig Kyzcreig added the fleetreview:post-merge Ask FleetReview to review this MERGED pull (merge commit vs first parent) label Sep 24, 2026
@ang-prism

ang-prism Bot commented Sep 27, 2026

Copy link
Copy Markdown

FleetReview

Review: post-merge · head 19d6b7b29d52 · duration 26m 43s
Profile: full recipe · policy: changed-lines>400
Roster: C-assert-xhigh → claude-code-opus-5-5 (anthropic), F → gpt-6-sol (openai), G → gpt-6-sol (openai)

Post-merge review (fleetreview:post-merge override): this reviewed the merge commit against its first parent — the bytes that already shipped. It is not a pre-merge gate pass.

Reviewed with 2 of 3 model families — xai unavailable.

Confidence: 2/5

Findings

  • P1 plugins/kanban-home-cards/__init__.py:119 — Redact board slugs as well as card text · agreed: C-assert-xhigh,F,G (anthropic, openai)
  • P1 plugins/kanban-home-cards/__init__.py:413 — Do not consume the one-shot injection on a multimodal first turn · agreed: C-assert-xhigh,F (anthropic, openai)
  • P1 plugins/kanban-home-cards/__init__.py:271 — Do not present a skipped board as a complete home · agreed: C-assert-xhigh,F,G (anthropic, openai)
  • P1 plugins/kanban-home-cards/__init__.py:173 — Include the configured kanban DB override in board discovery · agreed: C-assert-xhigh,F (anthropic, openai)
  • P1 website/docs/user-guide/features/built-in-plugins.md:145 — Gateway timestamp replay can drop the card block despite restart dedupe · agreed: C-assert-xhigh,F,G (anthropic, openai)
  • P1 plugins/kanban-home-cards/__init__.py:97 — Redact credential-bearing URLs before sending card text to the model · agreed: F (openai)
  • P1 website/docs/user-guide/features/built-in-plugins.md:147 — Overflow command does not list cards from all boards · agreed: F,G (openai)
  • P1 plugins/kanban-home-cards/__init__.py:103 — Credential-bearing URLs in cards bypass redaction · agreed: G (openai)
  • P1 plugins/kanban-home-cards/__init__.py:419 — A multimodal first turn permanently consumes the card injection · agreed: G (openai)
  • P1 plugins/kanban-home-cards/__init__.py:433 — A timed-out scan with no partial results silently suppresses all home cards · agreed: G (openai)

FleetReview provenance · models: B=gpt-6-sol, C=claude-code-opus-5-5, D=grok-4.6, F=gpt-6-sol · cost: $8.53 · duration: 26m 41s · rounds: 2 · files examined: 5

Kyzcreig pushed a commit that referenced this pull request Sep 27, 2026
)

* fix(security): Backfill C3 secret/PII exposure class (t_36b0277a)

- tools/tool_wait_watchdog: redact tool args (force + URL creds) before the
  240-char cut; long-wait log lines carried raw commands/tokens (#1012).
- tools/openrouter_client: one client per OpenRouter credential, not per process;
  a multiplexed gateway sent later profiles' MoA prompts under the first profile's
  key (#1238). mixture_of_agents_tool uses the scope-aware key check.
- plugins/kanban-home-cards: redact URL credentials in card text and redact the
  board slug, both injected into model context (#968).
- agent/fallback_events: persisted err_head redacts URL credentials (#1211).
- gateway/run.py: STT INFO line logs size+latency, not the user's words (#1064).
- agent/turn_handoff: tool args/results redacted before /resume-handoff (#813).

Verified: each new test fails on base and passes on head; test_turn_handoff (34),
test_voice_inbound_accounting + test_gateway_foreground_deafness (39),
test_kanban_home_cards + test_fallback_events_ledger (101),
test_secret_scope_tier1_migration (23 passed, 2 skipped).

* test: build fake URL credentials by concatenation (gitleaks generic-api-key) (t_36b0277a)

---------

Co-authored-by: ang-fleet-workers[bot] <333956806+ang-fleet-workers[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

fleetreview:post-merge Ask FleetReview to review this MERGED pull (merge commit vs first parent)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant