Enforce per-task file restrictions in implement phase

.egg-state/agent-outputs/805-integrator-output.json

@@ -0,0 +1,74 @@
+{
+  "issue": 805,
+  "pipeline_id": "issue-805",
+  "phase": "implement",
+  "agent": "integrator",
+  "status": "pass",
+  "summary": "All 7076 tests pass. Three code review blocking issues were already fixed by coder in commit cf0b860fc. Integrator fixed lint (import ordering) and formatting (ruff format) issues in 3 files. All lint checks pass including ruff check, ruff format, mypy, shellcheck, and custom checks.",
+  "integration_commit": "ddc0f2ac2",
+  "test_results": {
+    "total": 7076,
+    "passed": 7076,
+    "failed": 0,
+    "skipped": 85,
+    "warnings": 4,
+    "duration_seconds": 78.87
+  },
+  "lint_results": {
+    "ruff_check": "pass",
+    "ruff_format": "pass",
+    "mypy": "pass",
+    "shellcheck": "pass",
+    "custom_checks": "pass"
+  },
+  "review_feedback_verification": {
+    "blocking_1_keyword_arg_mismatch": {
+      "status": "resolved",
+      "fix_commit": "cf0b860fc",
+      "description": "load_contract() call in container_spawner.py:113 now uses repo_root=Path(repo_path) matching the function signature at loader.py:60.",
+      "verified": true
+    },
+    "blocking_2_valueerror_handling": {
+      "status": "resolved",
+      "fix_commit": "cf0b860fc",
+      "description": "EGG_TASK_FILE_WARN_THRESHOLD int() parsing at gateway.py:915-918 is now wrapped in try/except (ValueError, TypeError) with fallback to 1.",
+      "verified": true
+    },
+    "blocking_3_strict_mode_hitl": {
+      "status": "resolved",
+      "fix_commit": "cf0b860fc",
+      "description": "Strict mode in session_request_file (gateway.py:3966-4024) now posts to orchestrator /api/v1/pipelines/{id}/decisions endpoint. Falls back to auto-approve with audit logging when orchestrator is unavailable.",
+      "verified": true
+    }
+  },
+  "issues_found": [
+    {
+      "severity": "low",
+      "component": "tests",
+      "description": "Import ordering violation (ruff I001) in gateway/tests/test_session_file_restriction_endpoints.py — import gateway was out of sort order.",
+      "fix": "Applied ruff --fix to sort imports.",
+      "files": ["gateway/tests/test_session_file_restriction_endpoints.py"]
+    },
+    {
+      "severity": "low",
+      "component": "formatting",
+      "description": "Ruff format violations in 3 files: gateway/gateway.py, gateway/tests/test_session_file_restriction_endpoints.py, orchestrator/tests/test_compute_allowed_files.py.",
+      "fix": "Applied ruff format to all 3 files.",
+      "files": ["gateway/gateway.py", "gateway/tests/test_session_file_restriction_endpoints.py", "orchestrator/tests/test_compute_allowed_files.py"]
+    },
+    {
+      "severity": "info",
+      "component": "push",
+      "description": "Push to remote blocked because branch contains .egg-state/ files from prior pipeline phases. Post-agent auto-commit will handle pushing code changes at container exit.",
+      "fix": "No action needed — gateway post-agent commit filters phase-restricted files.",
+      "files": []
+    }
+  ],
+  "files_changed_by_integrator": [
+    "gateway/gateway.py",
+    "gateway/tests/test_session_file_restriction_endpoints.py",
+    "orchestrator/tests/test_compute_allowed_files.py"
+  ],
+  "regressions": "none",
+  "integration_issues": "none"
+}

.egg-state/checks/805-implement-results.json

@@ -0,0 +1,20 @@
+{
+  "all_passed": true,
+  "checks": [
+    {
+      "name": "lint",
+      "passed": true,
+      "output": "==> Ruff check...\nAll checks passed!\n==> Ruff format check...\n439 files already formatted\n==> Mypy...\nSuccess: no issues found in 120 source files\n==> Shellcheck...\n==> Yamllint...\nSKIP: yamllint not installed\n==> Hadolint...\nSKIP: hadolint not installed\n==> Actionlint...\nSKIP: actionlint not installed\n==> Custom checks...\n  bin-symlinks...\nOK: All 2 bin/ symlinks are valid\n  claude-imports...\nWarning: host-services directory not found at /home/egg/repos/egg/host-services\n  container-host-boundary...\nOK: No forbidden host-services imports found in sandbox\n  container-paths...\nOK: No problematic sys.path patterns found\n  docker-and-claude-invocations...\nOK: No docker/claude invocation violations found\n  gh-cli-usage...\nWarning: host-services directory not found at /home/egg/repos/egg/host-services\n  hardcoded-ports...\nOK: No hardcoded port numbers found\n  llm-api-calls...\nOK: No direct LLM API usage found outside sandbox\n  model-versions...\nOK: No non-alias Claude model references found\n  reviewer-job-names...\nOK: All reviewer jobs use the required naming prefix\n  workflow-secrets...\nOK: No untrusted script execution with secrets found in workflows"
+    },
+    {
+      "name": "test",
+      "passed": true,
+      "output": "==> Running unit tests...\npytest tests/ gateway/tests/ orchestrator/tests/ -v\n7076 passed, 85 skipped, 4 warnings in 79.16s (0:01:19)"
+    },
+    {
+      "name": "security",
+      "passed": true,
+      "output": "==> Running security scan...\nSKIP: bandit not installed"
+    }
+  ]
+}

.egg-state/contracts/805.json

@@ -0,0 +1,103 @@
+{
+  "schemaVersion": "1.0",
+  "issue": {
+    "number": 805,
+    "title": "Issue #805",
+    "url": "https://github.com/jwbron/egg/issues/805"
+  },
+  "pipeline_id": null,
+  "current_phase": "refine",
+  "acceptance_criteria": [],
+  "phases": [],
+  "decisions": [],
+  "workflow_owner": null,
+  "audit_log": [],
+  "refine_review_cycles": 0,
+  "refine_review_feedback": "",
+  "plan_review_cycles": 0,
+  "plan_review_feedback": "",
+  "pr": null,
+  "feedback": null,
+  "phase_configs": null,
+  "agent_executions": [
+    {
+      "role": "coder",
+      "phase_id": null,
+      "status": "complete",
+      "started_at": "2026-02-25T06:40:18.726422Z",
+      "completed_at": "2026-02-25T06:46:02.309398Z",
+      "commit": null,
+      "checkpoint_id": null,
+      "outputs": {},
+      "error": null,
+      "retry_count": 0,
+      "conflicts": []
+    },
+    {
+      "role": "tester",
+      "phase_id": null,
+      "status": "complete",
+      "started_at": "2026-02-25T06:46:02.313406Z",
+      "completed_at": "2026-02-25T06:55:37.670191Z",
+      "commit": null,
+      "checkpoint_id": null,
+      "outputs": {},
+      "error": null,
+      "retry_count": 0,
+      "conflicts": []
+    },
+    {
+      "role": "documenter",
+      "phase_id": null,
+      "status": "complete",
+      "started_at": "2026-02-25T06:46:02.317594Z",
+      "completed_at": "2026-02-25T06:52:41.355056Z",
+      "commit": null,
+      "checkpoint_id": null,
+      "outputs": {},
+      "error": null,
+      "retry_count": 0,
+      "conflicts": []
+    },
+    {
+      "role": "integrator",
+      "phase_id": null,
+      "status": "complete",
+      "started_at": "2026-02-25T06:55:37.673886Z",
+      "completed_at": "2026-02-25T07:01:01.622612Z",
+      "commit": null,
+      "checkpoint_id": null,
+      "outputs": {},
+      "error": null,
+      "retry_count": 0,
+      "conflicts": []
+    },
+    {
+      "role": "reviewer_contract",
+      "phase_id": null,
+      "status": "complete",
+      "started_at": null,
+      "completed_at": "2026-02-25T07:07:53.289867Z",
+      "commit": null,
+      "checkpoint_id": null,
+      "outputs": {},
+      "error": null,
+      "retry_count": 0,
+      "conflicts": []
+    },
+    {
+      "role": "reviewer_code",
+      "phase_id": null,
+      "status": "complete",
+      "started_at": null,
+      "completed_at": "2026-02-25T07:07:58.082506Z",
+      "commit": null,
+      "checkpoint_id": null,
+      "outputs": {},
+      "error": null,
+      "retry_count": 0,
+      "conflicts": []
+    }
+  ],
+  "multi_agent_config": null
+}