CTO Thread Onboarding -> Primary - #986
Merged
Merged
Conversation
… seed an opening turn The CTO thread is pinned to the project's primary lane and hidden from every session roster. Three consequences of that design were unhandled: Work landed on the primary worktree. The capability manifest instructed the CTO to "always default laneId to the CTO's current lane" — which is the primary lane — so every agent it launched ran against the primary worktree. The prompt now reserves the CTO's own lane for read-only inspection, and resolveCtoExecutionLane creates a dedicated lane when none is requested instead of falling back to the CTO's. It never re-targets primary on failure; the error surfaces to the caller. A hidden thread could ask silently. Being filtered out of every roster also filters the CTO out of terminalAttention and the dock badge, so a question from the CTO surfaced nowhere. getCtoAttention is a canonical, strictly read-only probe — it never calls ensureIdentitySession, which would materialize a lane and a session as a side effect of drawing a badge. Both transports (plain IPC and the cto_state action domain) delegate to it so they cannot drift. It feeds a dot on the CTO tab and the dock badge count. First run opened on a blank screen. seedCtoIntroTurn sends one real, visible first user turn when a CTO session is created. Visible rather than hidden or canned: ADE has no hidden-turn mechanism, and a fabricated assistant message would feed back into the model's context on every later turn. The once-only marker persists after the send succeeds, so an unauthenticated first run retries instead of burning its one shot. iOS previously replaced onboardingState wholesale when saving CTO setup, which would erase that marker and re-seed a duplicate intro turn; it now unions. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
|
Warning Review limit reached
Next review available in: 19 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (4)
📒 Files selected for processing (20)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
arul28
added a commit
that referenced
this pull request
Jul 31, 2026
…reach iOS Three follow-ups to #986, all rooted in the same fact: the CTO session is pinned to the project's PRIMARY lane. It does not have a lane of its own. Operator tools now execute. createCtoOperatorTools was only ever reached by previewSessionToolNames and the prompt manifest, so the CTO was told it had a tool surface it could not call. createCtoRuntimeToolMap now feeds all five provider transports: an `ade-cto` SDK MCP server for Claude (deliberately without the orchestration lead's allowManagedMcpServersOnly lockdown, which would strip the user's own MCP servers from a daily-driver chat), the `ade_cto` namespace inside Codex's single dynamic-tool refresher, and a second HTTP MCP lease for Cursor/Droid/OpenCode. buildCtoOperatorToolDeps is shared by the preview and runtime paths so the advertised and callable surfaces cannot drift. Mutating git tools no longer default their lane. resolveLaneId defaulted to the CTO's session lane, so an omitted laneId on gitCommit/gitPush/gitPull — or on gitUndo/gitRedo, which run `git reset --hard` — meant writing to the primary worktree, the exact thing lanes exist to prevent. Reads keep the default; mutations must name a lane. Enforced in code rather than trusting the model to have read the manifest rule. Attention reaches iOS. The dot was desktop-only because the phone talks to the CTO over sync commands, a third transport. cto.getAttention delegates to the same canonical getCtoAttention() and is registered as an OPTIONAL mobile capability — requiring it would flip every shipped brain to limited mode. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
arul28
added a commit
that referenced
this pull request
Jul 31, 2026
* feat(cto): make the operator tools real, keep mutations off primary, reach iOS Three follow-ups to #986, all rooted in the same fact: the CTO session is pinned to the project's PRIMARY lane. It does not have a lane of its own. Operator tools now execute. createCtoOperatorTools was only ever reached by previewSessionToolNames and the prompt manifest, so the CTO was told it had a tool surface it could not call. createCtoRuntimeToolMap now feeds all five provider transports: an `ade-cto` SDK MCP server for Claude (deliberately without the orchestration lead's allowManagedMcpServersOnly lockdown, which would strip the user's own MCP servers from a daily-driver chat), the `ade_cto` namespace inside Codex's single dynamic-tool refresher, and a second HTTP MCP lease for Cursor/Droid/OpenCode. buildCtoOperatorToolDeps is shared by the preview and runtime paths so the advertised and callable surfaces cannot drift. Mutating git tools no longer default their lane. resolveLaneId defaulted to the CTO's session lane, so an omitted laneId on gitCommit/gitPush/gitPull — or on gitUndo/gitRedo, which run `git reset --hard` — meant writing to the primary worktree, the exact thing lanes exist to prevent. Reads keep the default; mutations must name a lane. Enforced in code rather than trusting the model to have read the manifest rule. Attention reaches iOS. The dot was desktop-only because the phone talks to the CTO over sync commands, a third transport. cto.getAttention delegates to the same canonical getCtoAttention() and is registered as an OPTIONAL mobile capability — requiring it would flip every shipped brain to limited mode. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(cto): wire the last dead tools, fix the iOS probe, collapse the lease layer Findings from /quality and /test on this lane. The iOS attention probe could not fire for the case it exists for. refreshCtoAttentionIfNeeded() sat below a guard keyed on the roster signature, and the CTO is excluded from that roster by design — so a turn where only the CTO changed left the signature identical and the probe never ran. Once lit by an unrelated change, nothing cleared it either. Hoisted above the guard, and the previously-dead `force` parameter now drives the first probe after a (re)connect, when the host's command descriptors finally arrive. Four operator tools were still dead. steerChat, cancelSteer, listSubagents and approveToolUse were wired to `undefined`, so they were advertised in the prompt manifest and registered on every transport but could only answer "not available" — the exact defect this lane set out to remove, fixed for ~75 tools and left for these. They are now required deps, so a future caller cannot ship them unwired. handoffChat is deleted rather than wired: it targeted "a different agent identity", a subsystem that no longer exists. The headless agentChatService stub was missing three of them, which would have thrown a raw TypeError through `ade actions run chat.*` and the matching sync commands. Same bug class this lane already hit once with getCtoAttention. Structural: the HttpMcpToolSet union spent itself on four string-switch helpers and a duplicated session field. Replaced with a descriptor table and a single keyed lease record, which also collapsed the three transport call sites and the codex namespace fallback. closeOrchestrationHttpMcpServer closed both leases despite its name; it is closeHttpMcpServers now. Also: five mutating git tools still advertised laneId as optional while throwing at runtime, and two error messages named tools that do not exist; createTerminal relied on an invisible pty clamp instead of passing dimensions. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The CTO thread is pinned to the project's primary lane (it needs a lane for its cwd) and is filtered out of every session roster. Three consequences of that design were unhandled.
What changed
1. CTO-launched work no longer lands on the primary worktree.
buildCtoCapabilityManifest's operating rules told the CTO to "always default laneId to the CTO's current lane" — which is the primary lane — so every agent it launched ran against the primary worktree. The rules now reserve the CTO's own lane for read-only inspection, andresolveCtoExecutionLanecreates a dedicated lane when none is requested, honoring thefreshLaneName/freshLaneDescriptioncontractCtoOperatorToolDepsalready declared but never implemented. It never falls back to the CTO's lane; a creation failure surfaces to the caller rather than silently re-targeting primary.2. A hidden thread can no longer ask a question silently.
Being filtered from every roster also filters the CTO out of
terminalAttentionand the dock badge, so a CTO question surfaced nowhere.getCtoAttentionis a canonical, strictly read-only probe — it never callsensureIdentitySession, which would materialize a primary lane and a chat session as a side effect of drawing a badge. Both transports (plain IPC and thecto_stateaction domain) delegate to it so they cannot drift. It feeds a dot on the CTO tab and the dock badge count, and covers anade chat askhand-raise as well as chat-level waiters.3. First run no longer opens on a blank screen.
seedCtoIntroTurnsends one real, visible first user turn when a CTO session is created. Visible rather than hidden or canned: ADE has no hidden-turn mechanism, and a fabricated assistant message would feed back into the model's context on every later turn. The once-only marker persists only after the send succeeds, so an unauthenticated first run retries instead of burning its one shot.iOS: saving CTO setup replaced
onboardingStatewholesale, which erased the newintromarker and re-seeded a duplicate opening turn. It now unions.Known gap
The attention signal is desktop-only. iOS reaches the CTO over a third transport (sync commands) and this PR adds no
cto.getAttentionsync command, so on iOS the hidden CTO thread can still ask silently. Follow-up.Verification
/qualitydual-review: 0 Blockers; 8 findings auto-applied (incl. collapsing 3 copies of the attention derivation, an unfiltered event subscription that scanned 500 sessions per streaming delta, and a swallowed focus refresh). 2 findings rejected after verifying against the real code./test: pruned 0 (folder was clean), consolidated my own stray test file intoctoState.test.ts, added 3getCtoAttentioncontract tests incl. "reads must not create a session". Docs/mobile/CLI/TUI parity passes run.🤖 Generated with Claude Code