fix(ci): restore core-decoupling ratchet to baseline — main is red after #549 - #553
Merged
Merged
Conversation
…ments The core-decoupling ratchet (#470) failed on this branch: 3303 -> 3306. All three new hits are doc comments, not code coupling: packages/harness-api-key-auth/src/apiKeyToken.ts (2) test/channelApi/apiKeyToken.test.ts (1) They cited `middleware/src/devplatform/jobToken.ts` and the `djr_` token prefix as the precedent for a hashed, constant-time-verified bearer credential. That precedent is correct, but naming it re-couples core to the Dev Platform, and the cited paths go stale the moment epic #470 extracts it into its own repository. Reworded to describe the pattern rather than point at the file. Baseline stays at 3303 -- not raised.
Weegy
enabled auto-merge (squash)
July 30, 2026 14:33
Weegy
added a commit
that referenced
this pull request
Jul 31, 2026
Weegy
added a commit
that referenced
this pull request
Jul 31, 2026
Weegy
added a commit
that referenced
this pull request
Jul 31, 2026
main lowered its own baseline to 3306 by dropping dev-platform cross-references from the API-key comments, so the W2-2 task-seam raise is +135, not +138. middleware/packages is set to 97 rather than main's 99: the generic task seam was scrubbed of implementor names, and that gain is locked in instead of being left as headroom. Conflicting doc comments in apiKeyToken.ts take main's wording (#553 rewrote that file deliberately).
Weegy
added a commit
that referenced
this pull request
Aug 12, 2026
…C5) (#554) * refactor(conductor): delete the dead dev-job step coupling (epic #470 C5) The Conductor's `dev.job` step was built in W3 and never wired: `conductor/index.ts` constructs `ConductorRunExecutor` without a `devJob` dep, so the dispatch branch was permanently false; the launch half had no implementation at all (`createConductorJob`, `setAwaitId`, `getAwaitId` existed only as interface members); `DevJobOutcomeEmitter.emit()` had no caller in `src/`; nothing scheduled the reconciliation sweep; and no bundled template referenced `dev.job` (which `listActions` rejects anyway). Per `specs/470-dev-platform-plugin/dormant-capabilities.md` §1 the verdict is DELETE, not genericise — nothing needs the generic version. Deleted whole: `conductor/devJobStepEffect.ts`, `devplatform/devJobConductorBridge.ts`, `test/conductorDevJobStep.test.ts`. Stripped from `runExecutor.ts`: both imports, the `devJob` field + ctor dep, `DevJobPortUnavailableError`, the dispatch branch, `resolveDevJobAwait`, `reconcileTerminalDevJobAwaits`, `openDevJobAwait`. `awaitStore.listWaiting` drops its `AND channel_type <> 'dev_job'` predicate outright rather than keeping a generic filter. `openHumanAwait` is now the single caller of `create`, so every await has a human holder by construction and the excluded set is provably empty; a filter whose complement no member can enter asserts an invariant in the wrong place, and a future non-human await kind would have to remember to add itself to survive it. New `test/conductorAwaitStore.test.ts` guards the channel-agnostic contract (mutation-checked: re-adding a channel predicate fails it). `dev_jobs.conductor_await_id` (migration 0024) is KEPT — migrations are forward-only here and a DROP is the one irreversible act. It is marked as an orphaned column so the schema is not misread as evidence of a live feature. Core-decoupling ratchet: 3303 -> 3164 (-139), no zone rose. * refactor(conductor): delete the dead dev-job step coupling (C5) First change in this epic that moves the decoupling count DOWN. 3,303 → 3,167 (−136): middleware/src −96, middleware/test −43. WHAT THIS IS NOT: the Conductor is a live feature — 31 files, ~6,200 LOC backend, 23 UI files, 7 migrations, its own spec. Runs, steps, human approval gates, templates, the Designer canvas are all untouched. All 204 conductor tests pass. WHAT WAS DEAD: one step type inside it. `dev.job` was meant to let a workflow launch a Dev Platform job, park the run, and resume on its terminal outcome. It was built and never wired: - conductor/index.ts constructs the executor with NO devJob dep, so the dispatch branch was permanently false — and `git log -S` shows it was never wired in ANY commit - the launch half had no implementation at all: createConductorJob, setAwaitId and getAwaitId existed only as interface members, and dev_jobs.conductor_await_id was never selected or written - DevJobOutcomeEmitter.emit() had no caller in src/ - nothing scheduled the reconciliation sweep - no bundled template referenced dev.job, and listActions never included it, so the step could not pass validation Removed: conductor/devJobStepEffect.ts (122 LOC), devplatform/ devJobConductorBridge.ts (113), test/conductorDevJobStep.test.ts (358), and every dev-job reference in runExecutor.ts (31 → 0), awaitStore.ts (6 → 0) and routes.ts (1 → 0). KEPT: migration 0024's conductor_await_id column. Migrations are forward-only here and dropping a column is the one irreversible act in this change; it is marked orphaned instead. THE SUBTLE PART: awaitStore's human-inbox query excluded `channel_type = 'dev_job'`. That predicate is now gone rather than genericised, because after the delete `openHumanAwait` is the sole writer of conductor_awaits — a filter whose complement no code path can populate asserts an invariant in the wrong place, and a channel allow/denylist would fail open for a future await kind that forgot to register itself. The compensating test needed a fix the review caught: its fixtures were teams/telegram/web, so restoring `<> 'dev_job'` would have left it green — it could not detect the exact regression it exists for. Added a dev_job fixture row and mutation-checked it: with the predicate restored 1 fail, without it 3 pass. Also propagates the decision into the specs, which still described the step as a capability the extraction must carry and H2 as a registry to build. H2 needed no mechanism after all — the coupling was dead, so deleting it was the whole fix. * chore(470): resync C5 with main (#549) — baseline 3,167 → 3,170 The channel-api work added 3 dev-platform references (test/packages). Fourth legitimate raise: main ADDED dev-platform code; core did not re-acquire a dependency. * chore(470): resync C5 with main (#552, #553) — baseline 3,167 * chore(470): resync C5 decoupling baseline with main — 3,448 → 3,312
Weegy
added a commit
that referenced
this pull request
Aug 12, 2026
…#470 C2a) (#555) * refactor(plugin-api): delete the unreachable ctx.devJobs plugin surface `ctx.devJobs` was a published plugin accessor that nothing ever provided. It resolved its host service lazily per call, so every invocation threw "dev-platform host service unavailable". No manifest in this repo, in the private byte5 plugin set, or in any sibling repo ever declared `permissions.devJobs`, so no consumer has ever existed. Per specs/470-dev-platform-plugin/dormant-capabilities.md section 2 this is a pure deletion of an unreachable surface. No permission gate is added to ctx.services: `provide("devJobs", ...)` exists nowhere, so both `ctx.devJobs` and `ctx.services.get("devJobs")` already yield nothing. Removing the accessor opens no hole. No package manifest, serviceRegistry or builder codegen is touched, and no installed plugin changes behaviour. Deleted: - plugin-api: the `devJobs?` field on PluginContext and the six types DevJobKind, DevJobStatus, DevJobDescriptor, DevJobCreateRequest, DevJobEventRecord, DevJobsAccessor - host pluginContext: the permissions gate, the context spread, DevJobsHostService and createPluginDevJobsAccessor - manifestLoader: the `permissions.devJobs` parse and its two summary fields - admin-v1: the dev_jobs / dev_jobs_repos_hint DTO fields - devRepoPluginGrantStore.ts and pluginDevJobsAccessor.test.ts (whole files) The descriptor/event view types survive core-locally in src/devplatform/devJobTypes.ts, which travels with the dev-platform tree when it moves. DevJobKind/DevJobStatus are re-exported from src/devplatform/types.ts rather than redefined. devJobsHostService survives for the chat surface but sheds everything that existed only for the plugin path: listGrantedRepoIds and the grants dep, the plugin-shaped createJob (and with it repoStore, resolveJobPlacement and mintRunnerToken), and cancelJob's requestedByPluginId creator check with its finalize dep. chatDevJobService only ever called getJob, listJobs and listJobEvents; it passed inert stubs for the rest. Migrations 0024 (dev_repo_plugin_grants) and 0025 (source='plugin') are kept - the migration set is forward-only - and are annotated as knowingly orphaned so a future reader does not read the schema as evidence of a live feature. Back-compat: a stale manifest still declaring `permissions.devJobs` installs and activates unchanged. Unknown permission keys are ignored today; that was implicit, and test/manifestDevJobsLegacyKey.test.ts now asserts it explicitly so a future strict-validation change cannot break stale manifests silently. * chore(470): lower the ratchet baseline to 3,220 after the ctx.devJobs deletion * chore(470): resync C2a with main (#552, #553) * fix(470): type-sound C2a legacy-manifest test + resync baseline The test/ typecheck ratchet (#573, landed after this branch was last touched) flags 4 errors in test/manifestDevJobsLegacyKey.test.ts: - `createPluginContext` gained two required options (notificationRouter, uiRouteCatalog). They are only dereferenced inside lazy accessors, so the test passed at runtime while being type-unsound. Stubbed both. - Three `as Record<string, unknown>` casts were unsound (TS2352). Two are unnecessary — `mcp` is a declared field on PluginPermissionsSummary. The key-absence checks now use `Object.hasOwn`, which asserts the key is absent rather than merely undefined. Ratchet baseline unchanged at 406: no new debt. Decoupling baseline resynced against current main, 3,448 -> 3,362. * chore(470): resync C2a baseline onto main after #554 — 3,312 -> 3,226 #554 (C5) landed, so the shared counter moved under this branch. Both PRs reduce disjoint sets of references: C2a still removes exactly 86, the same delta it removed against the pre-#554 main. Also fixes doc drift the merge exposed: README and acceptance.md both still quoted 3,167 on main while the committed baseline was already 3,312 — the number is in three places and #554 updated only the JSON. All three now read 3,226.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mainis currently red. PR #549 was auto-merged (squash,f437622e) while itscore decoupling ratchet (#470)check was failing, so the violation landed onmain— where it is now the only failing job on CI run30535047184.
What actually regressed
Nothing structural. All three new hits are doc comments, not code coupling:
middleware/packages/harness-api-key-auth/src/apiKeyToken.ts:7middleware/src/devplatform/jobToken.ts,dev-runnermiddleware/packages/harness-api-key-auth/src/apiKeyToken.ts:19djr_token prefixmiddleware/test/channelApi/apiKeyToken.test.ts:16test/devplatform/jobToken.test.tsThey cited the Dev Platform's one-time job token as the precedent for a bearer
credential that is hashed at rest and verified in constant time. The precedent
is real and the reasoning was sound — but naming it re-couples core to the Dev
Platform, and the cited paths go stale the moment epic #470 extracts it into its
own repository. So this was a latent documentation bug sitting on top of a
ratchet violation.
Fix
Reworded all three to describe the pattern rather than point at the file.
No source or test behaviour changes — the diff is comments only.
The baseline is not raised. It stays at 3303, which is the point: the
ratchet only ever goes down.
Verification
node scripts/check-core-decoupling.mjs→Dev Platform references held at 3303.(exit 0)npm run typecheck→ cleannpm run lint→ 0 errors (1 pre-existing warning in the untouchedharness-orchestrator/src/mcp/mcpClient.ts)npx tsx --test test/channelApi/*.test.ts test/auth/*.test.ts→ 147/147 passNeed help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.