Skip to content

release: promote dev to master for v1.0.0-beta.46 - #2279

Merged
jaylfc merged 25 commits into
masterfrom
release/promote-beta46
Aug 3, 2026
Merged

release: promote dev to master for v1.0.0-beta.46#2279
jaylfc merged 25 commits into
masterfrom
release/promote-beta46

Conversation

@jaylfc

@jaylfc jaylfc commented Aug 3, 2026

Copy link
Copy Markdown
Owner

Promote beta.46 to master (23 commits: decisions auth-before-validation #2268, observatory fleet view #2267, deploy-time agent registry identity #2266, lead card-edit #2244, doc-review reconciliation, plus test coverage).

Conflict resolution (both to dev's canonical version, verified):

Promote-tree-identity asserted: git diff origin/dev HEAD is EMPTY - master will be byte-identical to dev.

DELETED SYMBOLS, verified intentional (coverage INCREASED in every case, checked against dev before waiving):

Removes-Intentionally: tests/test_routes_knowledge.py:TestDeleteItem,tests/test_routes_knowledge.py:TestDeleteItem.test_delete_item_not_found,tests/test_routes_knowledge.py:TestGetItem,tests/test_routes_knowledge.py:TestGetItem.test_get_item_not_found,tests/test_routes_knowledge.py:TestGetItem.test_get_item_returns_item,tests/test_routes_knowledge.py:TestListItems,tests/test_routes_knowledge.py:TestListItems.test_list_items_returns_200_with_shape,tests/test_routes_knowledge.py:TestListItems.test_list_items_returns_seeded_items,tests/test_routes_knowledge.py:TestListRules,tests/test_routes_knowledge.py:TestListRules.test_list_rules_returns_200,tests/test_routes_knowledge.py:TestListRules.test_list_rules_returns_seeded_rules,tests/test_routes_projects_agent_tasks.py:TestAgentCanDriveOwnBoard.test_patch_task_is_session_only,tests/test_routes_taos_agent.py:app,tests/test_routes_taos_agent.py:client,tests/test_routes_taos_agent.py:tmp_data_dir

Summary by CodeRabbit

  • New Features

    • Added Project Files API documentation for uploads, directories, listings, downloads, statistics, and live change watching.
    • Added document-review permissions and improved agent registry identity handling.
    • Added scoped Observatory access for global and project-level visibility.
    • Lead agents can edit task titles, descriptions, labels, and priorities.
  • Bug Fixes

    • Authentication errors on decision requests are now returned before request validation.
    • Improved task-list reordering reliability and concurrent position handling.
    • Updated published hostnames to use the <subdomain>.taos.my format.
  • Documentation

    • Expanded guidance for agent permissions, Observatory access, and Project Files.

jaylfc added 24 commits August 2, 2026 23:15
…ollapse (PR 2240 remainder) (#2244)

* tsk-2bkd56  [OPEN]  Task PATCH route rejects the agent registry JWT, s

* tsk-b6ugu5  [OPEN]  Fold tsk-2bkd56: lead card-edit via project_tasks_

* docs: changelog + agent-coordination entries for project_tasks_update lead grant
…2252)

Remove local app/TestClient fixtures and use the shared async client
from conftest.py. Add missing endpoint coverage for GET settings,
attachment upload, and attachment serve. Replace direct app.state
assignments with monkeypatch.setattr on the transport app state.

Streaming happy path for POST /chat requires a live opencode server
and is skipped with a comment.
… at beta.45 promote (#2247)

* tsk-737pd7  [OPEN]  Reconcile doc-review (#1835) into dev: master-only

* feat(spa): port the doc-review FilesApp UI + projects.docReviews client

Completes the reconciliation: the backend port alone would have left the
SPA half master-only and the next promote's tree diff dirty. FilesApp hunks
are master's verbatim; the client block and types match the beta.45 promote
branch (master's redundant docReview singular block deliberately omitted).
SPA builds clean.

* fix: project_doc_review joins the canonical consent-flow scope vocabulary + changelog line

The scope-parity test rightly caught _ALLOWED_SCOPES diverging from
VALID_SCOPES; the doc-gate rightly demanded the changelog entry.
* test: add endpoint tests for routes/catalog

* test: restore real-backend catalog cases, keep the new validation/error paths

The rewrite had replaced store-backed happy paths with MagicMock-backed
ones - test_recent_respects_limit asserted len<=5 on a mocked empty list,
proving nothing. Combined file: all 22 original real-backend tests
restored verbatim + the 7 genuinely-new route-layer cases (422 validation,
500 mapping, found/not-found shapes) where mocking is the right tool.
29 pass locally.
…ering contract (#2256)

* test(base_store): pin SCHEMA-before-_post_init index ordering contract

* test: pin the red case to the actual failure mode (no such column: extra_col)

A bare raises(Exception) would pass if init() failed for an unrelated
reason; matching the message makes the pin assert the CLASS it documents.
Tests for _parse_size, read_btrfs_pool_size, read_bees_deduped_total, capacity_snapshot, and gpu_vram_snapshot covering happy paths, edge cases, and error conditions
Cover initial mount sync, empty fetch result, centreOpen refresh,
visibility change sync and polling, polling interval lifecycle,
and unmount cleanup.
…on (#2265)

* fix(lists): harden reorder scoping and atomic position allocation

reorder_entries now requires list_id, scopes UPDATE by list_id,
and returns False (rolling back) when any supplied entry id does
not belong to that list, preventing silent corruption of sibling
lists in the same project.

add_entry allocates position atomically inside the INSERT via
COALESCE((SELECT MAX(position)+1 ...), 0) when position is None,
eliminating the concurrent-duplicate-position race that occurred
when MAX(position)+1 was read in a separate query.

* test(lists): prove reorder rolls back a prior valid update on scope mismatch
…guard + fleet view for global-grant agents (#2267)

* tsk-y5oozq  [OPEN]  Observatory follow-ups from #2203 merge review: mi

* docs(changelog): observatory fleet view for global-grant agents
…y) (#2266)

* tsk-qdvfg4  [OPEN]  Deploy route registers deployed agents into agent_

* fix(deploy): always mint a fresh registry identity per deployed agent

Display names are not unique, so matching config.agents by display_name
could hand a second same-named agent the first agent's canonical_id -
one identity shared by two agents (JWT sub, memory namespace). Every
deploy creates a new agent entry, so every deploy mints. Reserved-name
rejections from the registry now return 400 instead of 500.

* docs(changelog): deploy-time agent registry identity
…ignal) (#2268)

* tsk-ge5bfa  [OPEN]  Decisions routes: run auth before body validation

* test(decisions): fold auth-before-validation repros into the agent routes suite

The repro and probe scratch files duplicated helpers that already exist in
test_routes_decisions_agent.py. The local-token probe asserted nothing;
pinned the real behavior instead (401 on both sides of the fix - admin
drives decisions via the session path, never a bearer).

* docs(changelog): decisions auth ordering fix
…ating (#2269)

The test asserted 201 for every request, so it passed whether or not the
rate limit existed. Add the missing assertion that a further admin post
after hitting the cap returns 429, while user2's first post still returns
201. This pair is the actual per-user scoping claim.
…domain language (#2270)

mesh_credentials.py docstring, mesh.py module docstring, and
taosgo-mesh-join-foundation.md all referenced <label>.<handle>.taos.my.
Per account-username-subdomain-model.md the subdomain namespace is
now a separate claimable namespace decoupled from the username, so
those references become <subdomain>.taos.my / claimed-subdomain
language. No code changes.
) (#2271)

Add docs/agent-manual/11-files-api.md covering multipart upload, listing,
fetch, stats and watch, plus the one-write principle (upload once and the file
is immediately fetchable, no second register step). Link it from the manual
index, rebuild docs/taos-agent-manual.md, and add a CHANGELOG line.

Raise the compiled-manual size guard (MAX_CHARS) from 16000 to 18000. The
manual sat at 15986 chars on dev with essentially zero headroom, so any docs
addition tripped test_compiled_size_under_limit -- this red on #2139.

Suite is green: 4 passed in test_agent_manual_compiled.py and 28 passed
across the agent-manual + project-files test set.
Docs-Reviewed: routine release version bump (pyproject/__init__/uv.lock to 1.0.0-beta.46 + CHANGELOG rollover); no CI, packaging, or contribution-rule change, so no contributor-skill/docs update is warranted.
Resolves the routes/__init__.py doc-review router registration to dev's
canonical single CSRF-protected mount (master carried a stale double
registration without CSRF from the beta.45 conflict residue).
@coderabbitai

coderabbitai Bot commented Aug 3, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

The release updates agent authentication and authorization, deploy-time registry identities, Observatory visibility, project-list transactions, API documentation, package versions, and broad desktop and backend test coverage.

Changes

Agent authorization and route behavior

Layer / File(s) Summary
Permission and route allowlists
tinyagentos/auth_middleware.py, tinyagentos/routes/projects.py, tinyagentos/routes/agent_registry.py, tinyagentos/routes/agent_auth_requests.py, tinyagentos/routes/__init__.py
Task PATCH fields are limited to title, body, labels, and priority. Document-review routes and scopes are registered and allowlisted.
Decisions authentication precedence
tinyagentos/routes/decisions.py, tests/test_routes_decisions_agent.py
Registry bearer tokens are authenticated before request-body validation. Project-scoped authorization remains enforced afterward.
Deploy-time registry identity
tinyagentos/routes/agents.py, tests/test_routes_agents.py
Deployments register agents, persist canonical registry IDs, and handle reserved-name and registry failures.
Observatory fleet visibility
tinyagentos/routes/observatory.py, tinyagentos/cli/taosctl/commands/observatory.py, tests/test_routes_observatory.py
Global and project-scoped observatory_control grants now determine fleet visibility.
Project list transactions
tinyagentos/projects/lists_store.py, tests/projects/test_lists_store.py
Position allocation and reorder operations are scoped to a list and roll back on mismatched entries.

Regression and integration coverage

Layer / File(s) Summary
Storage and route coverage
tests/test_base_store.py, tests/cluster/test_worker_capacity.py, tests/test_permissions.py, tests/test_routes_catalog.py, tests/test_routes_knowledge.py, tests/test_routes_skills.py, tests/test_routes_torrent.py
Tests cover schema initialization, CRUD operations, capacity snapshots, MCP permissions, catalog errors, knowledge routes, skills routes, and torrent settings.
Project coordination and restart coverage
tests/test_project_a2a.py, tests/test_restart_orchestrator.py
Tests cover A2A channel synchronization, lead and member reconciliation, restart preparation, resume notes, pending updates, and paused-agent recovery.
Desktop route and hook coverage
desktop/src/components/ui/__tests__/card.test.tsx, desktop/src/hooks/use-server-notifications.test.ts, tests/test_routes_taos_agent.py
Tests cover card components, notification polling and visibility changes, desktop settings, chat validation, and attachment handling.

Documentation and release metadata

Layer / File(s) Summary
API and mesh documentation
docs/agent-coordination.md, docs/agent-manual/11-files-api.md, docs/agent-manual/index.md, docs/taos-agent-manual.md, docs/design/taosgo-mesh-join-foundation.md, tinyagentos/taosnet/mesh.py, tinyagentos/taosnet/mesh_credentials.py
The documentation describes project file routes, agent scopes, and subdomain-based mesh publishing.
Beta release metadata
CHANGELOG.md, desktop/package.json, pyproject.toml, tinyagentos/__init__.py
Package versions move to 1.0.0-beta.46, with a matching changelog entry.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant DecisionsRoute
  participant AuthDependency
  participant Authorization
  Client->>DecisionsRoute: Send bearer token and request body
  DecisionsRoute->>AuthDependency: Authenticate before body parsing
  AuthDependency->>Authorization: Pass canonical agent identity
  Authorization-->>DecisionsRoute: Check project-scoped decisions_write
  DecisionsRoute-->>Client: Return decision or validation response
Loading

Possibly related PRs

  • jaylfc/taOS#2240: Related project-task PATCH authorization and field-whitelist changes.
  • jaylfc/taOS#2247: Related document-review scopes, route allowlists, router registration, and tests.
  • jaylfc/taOS#2268: Related Decisions route authentication-before-body-validation changes.
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 38.62% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the release promotion from dev to master for version 1.0.0-beta.46.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch release/promote-beta46

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@jaylfc
jaylfc enabled auto-merge August 3, 2026 12:01
@gitar-bot

gitar-bot Bot commented Aug 3, 2026

Copy link
Copy Markdown

Gitar is working

Gitar

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown

👋 Thanks for the PR! This one targets master, which is our
stable branch (it's what live installs track). Please retarget it to
dev — click Edit next to the PR title and change the base
branch dropdown from master to dev. Your commits and any review
carry over, nothing is lost.

See CONTRIBUTING.md for the branch model.

@qodo-code-review

Copy link
Copy Markdown

PR Summary by Qodo

Release promote dev → master for v1.0.0-beta.46

✨ Enhancement 🐞 Bug fix 🧪 Tests 📝 Documentation ⚙️ Configuration changes 🕐 40+ Minutes

Grey Divider

AI Description

• Promote dev to master for beta.46 and bump all package versions/changelog.
• Harden agent/auth + observatory access semantics and reconcile doc-review scope/router mounting.
• Expand backend + desktop test coverage across routes, stores, and orchestration utilities.
Diagram

graph TD
ui["Desktop UI"] --> api["FastAPI routers"] --> auth["Auth middleware"]
api --> reg[("Agent registry + grants")]
api --> stores[("Project stores")]
tests(("Test suite")) --> api
subgraph Legend
direction LR
_ui["UI"] ~~~ _svc["Service/module"] ~~~ _db[("DB/store")] ~~~ _t(("Tests"))
end
Loading
High-Level Assessment

For a release promote, this is the correct approach: master is aligned to dev’s canonical tree, including conflict resolutions that remove stale double doc-review router registration and ensure CSRF protection. Shipping behavior changes with explicit version/changelog updates and extensive regression tests is appropriate for a beta promotion.

Files changed (45) +4004 / -338

Enhancement (4) +84 / -21
agent_auth_requests.pyEnable project_doc_review as a requestable consent scope +4/-0

Enable project_doc_review as a requestable consent scope

• Adds project_doc_review to VALID_SCOPES so agents can request doc-review stamp access via the consent flow.

tinyagentos/routes/agent_auth_requests.py

agent_registry.pyAllow minting project_doc_review and refine seeded lead scopes +18/-14

Allow minting project_doc_review and refine seeded lead scopes

• Adds project_doc_review to the registry mint allowlist and updates seeded internal lead commentary/scopes to include project_tasks_update.

tinyagentos/routes/agent_registry.py

agents.pyRegister deployed agents in registry and store canonical_id +29/-0

Register deployed agents in registry and store canonical_id

• Extends /api/agents/deploy to register each deployed agent in the agent registry, minting a fresh canonical_id per deploy, mapping reserved-name errors to 400, and persisting registry_canonical_id into config.

tinyagentos/routes/agents.py

observatory.pyScope fleet visibility by global vs project-scoped grants +33/-7

Scope fleet visibility by global vs project-scoped grants

• Stores agent caller identity during authorization and updates fleet aggregation to allow global-grant agents to see all projects while project-scoped grants restrict visibility to granted project IDs.

tinyagentos/routes/observatory.py

Bug fix (5) +127 / -64
auth_middleware.pyAdd doc-review route allowlist for agent JWTs +21/-21

Add doc-review route allowlist for agent JWTs

• Defines an explicit allowlist for agent-accessible doc-review routes (including path segments containing slashes) and removes prior duplicated helper placement.

tinyagentos/auth_middleware.py

lists_store.pyMake list entry positioning atomic and reorder list-scoped +34/-15

Make list entry positioning atomic and reorder list-scoped

• Changes add_entry to compute positions in-SQL when unspecified, and updates reorder_entries to be list-scoped, rollback on mismatch, and return success/failure.

tinyagentos/projects/lists_store.py

__init__.pyMount doc-review router once with CSRF dependencies +1/-4

Mount doc-review router once with CSRF dependencies

• Removes a stale duplicate doc-review mount and ensures the remaining mount includes CSRF protection like other protected routers.

tinyagentos/routes/init.py

decisions.pyAuthenticate registry JWT before body parsing in decisions endpoints +57/-13

Authenticate registry JWT before body parsing in decisions endpoints

• Adds a FastAPI dependency that verifies bearer registry JWT identity before Pydantic body validation to prevent 422-based auth oracles; applies the pattern to the agent answer endpoint too.

tinyagentos/routes/decisions.py

projects.pyTighten agent PATCH mutation whitelist and require project_tasks_update +14/-11

Tighten agent PATCH mutation whitelist and require project_tasks_update

• Reduces agent-editable PATCH fields to title/body/labels/priority and returns 403 for non-whitelisted mutations, keeping human/admin behavior unchanged.

tinyagentos/routes/projects.py

Tests (22) +3667 / -240
card.test.tsxAdd Card UI component tests +367/-0

Add Card UI component tests

• Introduces a Vitest/RTL test suite for Card primitives, covering class composition, ref forwarding, events, and prop passthrough.

desktop/src/components/ui/tests/card.test.tsx

use-server-notifications.test.tsAdd useServerNotifications hook tests +228/-0

Add useServerNotifications hook tests

• Adds Vitest coverage for server-notification polling and visibilitychange handling, with mocked fetchServerNotifications and store merge assertions.

desktop/src/hooks/use-server-notifications.test.ts

test_worker_capacity.pyExpand worker capacity/unit coverage (incl. GPU VRAM snapshot) +128/-52

Expand worker capacity/unit coverage (incl. GPU VRAM snapshot)

• Refactors and expands tests for btrfs size parsing, error handling, capacity snapshot shape, and GPU VRAM snapshot behavior.

tests/cluster/test_worker_capacity.py

test_lists_store.pyAdd list reorder scoping + concurrency regression tests +77/-0

Add list reorder scoping + concurrency regression tests

• Updates reorder_entries call expectations and adds tests preventing sibling-list corruption and duplicate positions under concurrent add_entry calls.

tests/projects/test_lists_store.py

test_agent_internal_mint.pyPin seeded lead grant includes project_tasks_update +34/-4

Pin seeded lead grant includes project_tasks_update

• Updates internal seed assertions for @taOS-dev and adds a reseed test ensuring project_tasks_update remains bound and re-asserted idempotently.

tests/test_agent_internal_mint.py

test_agent_manual_compiled.pyRaise compiled manual size guard +1/-1

Raise compiled manual size guard

• Increases compiled manual MAX_CHARS to 18000 to accommodate new Files API docs.

tests/test_agent_manual_compiled.py

test_agent_registry.pyAssert allowed scopes include doc-review and observatory +11/-0

Assert allowed scopes include doc-review and observatory

• Adds tests ensuring project_doc_review and observatory_control are present in the registry mint allowlist.

tests/test_agent_registry.py

test_base_store.pyAdd BaseStore migration/index pattern and CRUD plumbing tests +306/-1

Add BaseStore migration/index pattern and CRUD plumbing tests

• Adds tests demonstrating index-creation ordering across schema/post-init, plus end-to-end CRUD tests via a minimal BaseStore subclass.

tests/test_base_store.py

test_feedback_route.pyExtend feedback rate-limit regression coverage +6/-0

Extend feedback rate-limit regression coverage

• Adds an explicit assertion that an additional admin feedback post over the limit returns 429.

tests/test_feedback_route.py

test_permissions.pyAdd MCP server permission tests +41/-0

Add MCP server permission tests

• Adds tests for MCPServerStore attachment-based permissions, covering grant/deny and revoke semantics.

tests/test_permissions.py

test_project_a2a.pyAdd tests for project A2A channel utilities +573/-0

Add tests for project A2A channel utilities

• Introduces a broad unit test suite for project A2A helpers (lookups, member resolution, ensure/backfill flows) using real tmp databases.

tests/test_project_a2a.py

test_restart_orchestrator.pyAdd restart orchestrator unit tests +587/-0

Add restart orchestrator unit tests

• Adds comprehensive tests for pending-restart flag persistence and orchestrator logic, with config writes/external calls mocked.

tests/test_restart_orchestrator.py

test_routes_agent_auth_requests.pyAdd scope validity test for observatory_control +4/-0

Add scope validity test for observatory_control

• Extends scope validation tests to ensure observatory_control is present in VALID_SCOPES.

tests/test_routes_agent_auth_requests.py

test_routes_agents.pyAdd deploy-time registry identity tests +174/-0

Add deploy-time registry identity tests

• Adds route tests asserting /api/agents/deploy registers in agent_registry, mints distinct canonical IDs per deploy, and maps reserved-name errors to 400 without mutating config.

tests/test_routes_agents.py

test_routes_catalog.pyAdd catalog route validation and error-path tests +73/-0

Add catalog route validation and error-path tests

• Adds coverage for 422 validation cases and 500/not-found mappings using mocked session_catalog methods where appropriate.

tests/test_routes_catalog.py

test_routes_decisions_agent.pyAdd regression tests for auth-before-body-validation in decisions API +52/-0

Add regression tests for auth-before-body-validation in decisions API

• Pins that garbage bearer tokens return 401 before Pydantic body parsing can return 422, preventing token-validity probing via response differences.

tests/test_routes_decisions_agent.py

test_routes_knowledge.pyRewrite/expand knowledge route tests using shared client fixture +474/-80

Rewrite/expand knowledge route tests using shared client fixture

• Reworks tests to use the shared async client fixture and adds extensive coverage across ingest/list/get/snapshots/search flows with mocked stores/pipeline/http_client.

tests/test_routes_knowledge.py

test_routes_observatory.pyAdd observatory fleet visibility tests for global vs scoped grants +55/-4

Add observatory fleet visibility tests for global vs scoped grants

• Adds tests asserting global observatory_control grants can see fleet across projects while project-scoped grants only expose granted project lanes.

tests/test_routes_observatory.py

test_routes_projects_agent_tasks.pyAdd agent PATCH tests gated by project_tasks_update +155/-9

Add agent PATCH tests gated by project_tasks_update

• Adds extensive tests verifying lead agents can PATCH only whitelisted fields with project_tasks_update and that project_tasks-only tokens cannot mutate fields.

tests/test_routes_projects_agent_tasks.py

test_routes_skills.pyAdd read-endpoint tests for skills routes +75/-0

Add read-endpoint tests for skills routes

• Introduces tests for listing skills, fetching known skills, 404 behavior, and compatible skill filtering with lazy store init.

tests/test_routes_skills.py

test_routes_taos_agent.pyRefactor/expand taos-agent route tests to shared client fixture +165/-89

Refactor/expand taos-agent route tests to shared client fixture

• Rewrites tests to use the conftest client, adds coverage for settings get/patch and attachment upload/serve, and uses monkeypatch for app.state injection.

tests/test_routes_taos_agent.py

test_routes_torrent.pyAdd torrent settings endpoint tests +81/-0

Add torrent settings endpoint tests

• Adds route tests for GET/PUT /api/torrent/settings including response shape, 503 when store missing, and 422 invalid body validation.

tests/test_routes_torrent.py

Documentation (9) +120 / -7
CHANGELOG.mdAdd beta.46 release notes +29/-0

Add beta.46 release notes

• Adds a 1.0.0-beta.46 entry describing decisions auth-order hardening, observatory fleet visibility rules, deploy-time registry identities, lead card editing scope, doc-review reconciliation, and expanded docs/tests.

CHANGELOG.md

agent-coordination.mdDocument project_tasks_update and project_doc_review scopes +10/-0

Document project_tasks_update and project_doc_review scopes

• Extends the scope table to describe project_tasks_update semantics and doc-review stamp routes/allowlist behavior.

docs/agent-coordination.md

11-files-api.mdAdd agent manual chapter for Project Files REST API +35/-0

Add agent manual chapter for Project Files REST API

• Adds a new agent-manual page describing authentication, the one-write principle, and Files API routes (upload/mkdir/list/fetch/stats/watch) with scope requirements.

docs/agent-manual/11-files-api.md

index.mdLink new Files API manual chapter +1/-0

Link new Files API manual chapter

• Adds the new 11-files-api.md entry to the agent manual index table.

docs/agent-manual/index.md

taosgo-mesh-join-foundation.mdUpdate mesh publish namespace language to subdomain model +4/-4

Update mesh publish namespace language to subdomain model

• Adjusts design doc terminology from <label>.<handle>.taos.my to claimed <subdomain>.taos.my and updates publish payload field naming.

docs/design/taosgo-mesh-join-foundation.md

taos-agent-manual.mdAdd Project Files API section to compiled manual +35/-0

Add Project Files API section to compiled manual

• Appends a Project Files API section to the compiled agent manual, mirroring the new agent-manual chapter content.

docs/taos-agent-manual.md

observatory.pyClarify observatory read auth requirements in CLI docs +2/-1

Clarify observatory read auth requirements in CLI docs

• Updates CLI module docs to reflect that observatory reads require admin session or an agent token holding observatory_control.

tinyagentos/cli/taosctl/commands/observatory.py

mesh.pyUpdate mesh join docs to claimed subdomain model +2/-1

Update mesh join docs to claimed subdomain model

• Updates module docstring to refer to claimed <subdomain>.taos.my addressing and links the namespace design doc.

tinyagentos/taosnet/mesh.py

mesh_credentials.pyUpdate mesh credential docs to claimed subdomain model +2/-1

Update mesh credential docs to claimed subdomain model

• Updates documentation describing publish namespace to claimed subdomains under .taos.my with a design-doc reference.

tinyagentos/taosnet/mesh_credentials.py

Other (5) +6 / -6
package-lock.jsonBump desktop lockfile version to beta.46 +2/-2

Bump desktop lockfile version to beta.46

• Updates the desktop package-lock version fields to align the release with v1.0.0-beta.46.

desktop/package-lock.json

package.jsonBump desktop version to beta.46 +1/-1

Bump desktop version to beta.46

• Updates the desktop package version to 1.0.0-beta.46.

desktop/package.json

pyproject.tomlBump Python project version to beta.46 +1/-1

Bump Python project version to beta.46

• Updates the tinyagentos package version to 1.0.0-beta.46 for the release promotion.

pyproject.toml

__init__.pyBump library version constant to beta.46 +1/-1

Bump library version constant to beta.46

• Updates __version__ to 1.0.0-beta.46 to match release metadata.

tinyagentos/init.py

uv.lockUpdate uv lock tinyagentos version to b46 +1/-1

Update uv lock tinyagentos version to b46

• Updates the uv.lock entry for tinyagentos to reflect 1.0.0b46.

uv.lock

@qodo-code-review

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📜 Skill insights (1)

Context used
✅ Compliance rules (platform): 35 rules

Grey Divider


Remediation recommended

1. Em dash in next_step_hint 📜 Skill insight ✧ Quality
Description
The new next_step_hint string contains an em dash (), which is disallowed in public-facing
text. This can leak into user-visible controller notes and violates the style requirement.
Code

tests/test_restart_orchestrator.py[415]

+            "controller-side fallback — agent framework did not implement /prepare-for-shutdown"
Relevance

●●● Strong

Repo has prior review enforcing “no em dashes” in public-facing text; similar finding raised in PR
#2122.

PR-#2122

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
PR Compliance ID 2212258 forbids em dashes in public-facing text. The added test line asserts a
next_step_hint containing controller-side fallback — ..., introducing an em dash in a
user-facing message path.

tests/test_restart_orchestrator.py[414-416]
Skill: taos-development-skill

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A newly added string uses an em dash (`—`) which is prohibited in public-facing text.

## Issue Context
The string is asserted in a test for controller note output (`next_step_hint`), so it likely reflects (and locks in) a user-visible message.

## Fix Focus Areas
- tests/test_restart_orchestrator.py[414-416]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools



Informational

2. Fleet query scales poorly 🐞 Bug ➹ Performance
Description
For project-scoped observatory callers, get_fleet loads all projects via
ProjectStore.list_projects(status=None) and then filters in Python by caller_project_ids. This makes
each fleet request O(total projects) and increases DB reads/latency as the number of projects grows.
Code

tinyagentos/routes/observatory.py[R365-367]

+    elif caller_project_ids:
+        all_projects = await pstore.list_projects(status=None)
+        projects = [p for p in all_projects if p.get("id") in caller_project_ids]
Relevance

●● Moderate

No clear historical evidence on optimizing list_projects filtering vs Python post-filtering in fleet
endpoints.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The new project-scoped path explicitly loads all projects and then filters in Python, and
ProjectStore.list_projects is implemented as a full-table SELECT without any id predicate; together
this proves the O(total projects) behavior.

tinyagentos/routes/observatory.py[337-369]
tinyagentos/projects/project_store.py[212-223]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`GET /api/observatory/fleet` currently calls `list_projects(status=None)` (which SELECTs all projects) and then filters the results in Python for project-scoped agent callers. This does unnecessary work proportional to total project count.

### Issue Context
- `ProjectStore.list_projects(status=None)` returns all projects (admin view, no filtering).
- `get_fleet` then performs an in-memory filter for project-scoped grants.

### Fix Focus Areas
- tinyagentos/routes/observatory.py[342-369]
 - Avoid fetching all projects just to filter.
- tinyagentos/projects/project_store.py[212-244]
 - Add a store method to fetch projects by an explicit set/list of ids (e.g., `list_projects_by_ids(ids, status=None)` using a SQL `IN (...)` query), and use it from `get_fleet` when `caller_project_ids` is non-empty.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


3. Deploy partial registration 🐞 Bug ☼ Reliability
Description
In deploy_agent_endpoint, agent_registry.register() failures return 400/500 after
tm_agents.register_agent(unique_slug) has already run, leaving taosmd with a registered agent name
but no corresponding controller config agent record. This breaks atomicity/idempotent retries
because the route exits before config mutation and does not perform any compensating cleanup of the
earlier registration side-effect.
Code

tinyagentos/routes/agents.py[R602-605]

+                err_body = {"error": f"Could not register agent in registry: {e}"}
+                if scoped_key and idempotency_cache is not None:
+                    idempotency_cache.set(scoped_key, err_body)
+                return JSONResponse(err_body, status_code=500)
Relevance

● Weak

Similar “avoid partial side effects/need rollback before returning” suggestions were rejected in PRs
#1531 and #1662.

PR-#1531
PR-#1662

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The route registers with taosmd before the newly-added agent registry registration, and the new code
returns early on registry errors; therefore, a registry failure can occur after taosmd registration
but before config mutation, leaving divergent state across subsystems.

tinyagentos/routes/agents.py[566-606]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`deploy_agent_endpoint` performs multiple durable side effects during agent deploy. This PR introduces a new failure point (`agent_registry.register`) after an earlier side effect (`tm_agents.register_agent`), and the error paths return without compensating cleanup, which can leave the system in an inconsistent “partially registered” state.

### Issue Context
- `tm_agents.register_agent(unique_slug)` is executed before the new agent-registry registration block.
- The new block returns early on `ValueError`/`Exception` without undoing the earlier registration and before writing the agent into `config.agents`.

### Fix Focus Areas
- tinyagentos/routes/agents.py[566-606]
 - Make the combined registration steps atomic from the caller’s perspective (e.g., reorder operations, or wrap with compensating rollback).
 - On `agent_registry.register` failure, attempt to undo the earlier side effect (if an unregister API exists) and/or record a deterministic cleanup task so retries don’t strand state.
 - Consider whether `agent_registry.register` should be moved to after config persistence, or ensure any registry record created can be cleaned up if later steps fail.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

To customize comments, go to the Qodo configuration screen, or learn more in the docs.

Qodo Logo

Comment thread tests/test_restart_orchestrator.py
Comment thread tinyagentos/routes/observatory.py
Comment thread tinyagentos/routes/observatory.py
Comment thread tinyagentos/projects/lists_store.py
Comment thread tinyagentos/projects/lists_store.py
Comment thread tests/projects/test_lists_store.py
@kilo-code-bot

kilo-code-bot Bot commented Aug 3, 2026

Copy link
Copy Markdown

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (0 files)

No code changes since previous review.

Previous Review Summary (commit 66a437a)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 66a437a)

Status: 4 Issues Found | Recommendation: Address before merge

Overview

Severity Count
WARNING 4
Issue Details (click to expand)

WARNING

File Line Issue
tinyagentos/routes/observatory.py 414 Project-scoped agents with observatory_control cannot see idle registered agents because registry.list_for_user(None) returns an empty list
tinyagentos/projects/lists_store.py 158 The new COALESCE-based position calculation still has a race condition for concurrent inserts without explicit positions
tinyagentos/projects/lists_store.py 261 reorder_entries signature changed from (project_id, entries) to (project_id, list_id, entries) — breaking API change
tests/projects/test_lists_store.py 300 test_concurrent_add_entry_distinct_positions monkeypatches _get_next_position which is no longer used by add_entry
Files Reviewed (43 files)
  • tinyagentos/routes/__init__.py
  • tinyagentos/auth_middleware.py
  • tinyagentos/routes/decisions.py
  • tinyagentos/routes/projects.py
  • tinyagentos/routes/agents.py
  • tinyagentos/routes/observatory.py
  • tinyagentos/projects/lists_store.py
  • tinyagentos/routes/agent_registry.py
  • tinyagentos/routes/agent_auth_requests.py
  • tinyagentos/cli/taosctl/commands/observatory.py
  • tinyagentos/taosnet/mesh.py
  • tinyagentos/taosnet/mesh_credentials.py
  • tests/test_routes_observatory.py
  • tests/test_routes_decisions_agent.py
  • tests/test_routes_projects_agent_tasks.py
  • tests/test_routes_taos_agent.py
  • tests/projects/test_lists_store.py
  • tests/test_agent_internal_mint.py
  • tests/test_agent_manual_compiled.py
  • tests/test_agent_registry.py
  • tests/test_base_store.py
  • tests/test_feedback_route.py
  • tests/test_permissions.py
  • tests/test_project_a2a.py
  • tests/test_restart_orchestrator.py
  • tests/test_routes_catalog.py
  • tests/test_routes_knowledge.py
  • tests/test_routes_skills.py
  • tests/test_routes_torrent.py
  • tests/cluster/test_worker_capacity.py
  • docs/agent-manual/index.md
  • docs/agent-manual/11-files-api.md
  • docs/taos-agent-manual.md
  • docs/agent-coordination.md
  • docs/design/taosgo-mesh-join-foundation.md
  • desktop/src/components/ui/__tests__/card.test.tsx
  • desktop/src/hooks/use-server-notifications.test.ts
  • CHANGELOG.md
  • desktop/package-lock.json
  • desktop/package.json
  • pyproject.toml
  • tinyagentos/__init__.py
  • uv.lock

Fix these issues in Kilo Cloud


Reviewed by step-3.7-flash · Input: 52.9K · Output: 3.9K · Cached: 188.9K

…iver

The gate reads github.event.pull_request.body from the event payload, so a
workflow re-run replays the ORIGINAL body and never sees a waiver added by
editing the PR afterwards. An empty commit raises a fresh synchronize event
carrying the current body; the tree is unchanged, so the promote-tree-identity
assertion (diff vs dev empty) still holds.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 9

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
tinyagentos/routes/agents.py (1)

566-634: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Do not register taosmd before a registry validation failure.

tm_agents.register_agent(unique_slug) runs before ar.register(...). A ValueError from ar.register() returns 400 after taosmd has already registered the unique slug, with no rollback. Move ar.register() before tm_agents.register_agent() so reserved-name rejections abort before any taosmd side effect.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tinyagentos/routes/agents.py` around lines 566 - 634, The deployment flow
currently calls tm_agents.register_agent before the agent registry validates the
name, leaving taosmd state behind when ar.register raises ValueError. In the
deployment handler, move the ar.register block and its error handling ahead of
tm_agents.register_agent, preserving canonical_id assignment and the existing
400/500 responses, so registry validation completes before any taosmd side
effect.
🧹 Nitpick comments (5)
tests/cluster/test_worker_capacity.py (1)

155-165: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Remove the duplicated unit-parsing test.

test_parse_size_handles_all_btrfs_units repeats the exact cases already asserted by test_parse_size_valid_gib, test_parse_size_valid_tib, test_parse_size_valid_mib, test_parse_size_valid_kib, and test_parse_size_valid_b. Keep one form. A single @pytest.mark.parametrize test covers all units and reports the failing unit by name.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/cluster/test_worker_capacity.py` around lines 155 - 165, Remove the
redundant test_parse_size_handles_all_btrfs_units test and retain the existing
parametrized coverage in test_parse_size_valid_gib, test_parse_size_valid_tib,
test_parse_size_valid_mib, test_parse_size_valid_kib, and
test_parse_size_valid_b, consolidating those cases into a single
pytest.mark.parametrize test if needed.
tests/test_base_store.py (2)

48-55: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Narrow the swallowed exception in both _post_init overrides.

except Exception: pass hides any failure of the ALTER TABLE, including programming errors in the fixture itself. Catch only the duplicate-column case so a real failure surfaces.

♻️ Proposed change
     async def _post_init(self) -> None:
-        try:
-            await self._db.execute(
-                "ALTER TABLE items ADD COLUMN extra_col TEXT"
-            )
-            await self._db.commit()
-        except Exception:
-            pass
+        try:
+            await self._db.execute(
+                "ALTER TABLE items ADD COLUMN extra_col TEXT"
+            )
+            await self._db.commit()
+        except sqlite3.OperationalError as exc:
+            if "duplicate column" not in str(exc):
+                raise

Also applies to: 67-74

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_base_store.py` around lines 48 - 55, The `_post_init` overrides
currently swallow every database error; narrow their exception handling to
ignore only the expected duplicate-column error from `ALTER TABLE items ADD
COLUMN extra_col TEXT`. Update both `_post_init` implementations, while allowing
all other exceptions to propagate.

Source: Linters/SAST tools


210-219: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Assert the concrete exception type for the bad-index regression.

pytest.raises(Exception, ...) accepts any exception. The failure mode under test is a SQLite no such column: extra_col during executescript. Assert sqlite3.OperationalError so an unrelated error does not make the test pass. Also make the pattern a raw string to satisfy Ruff RUF043.

♻️ Proposed change
-            with pytest.raises(Exception, match="extra_col|no such column"):
+            with pytest.raises(sqlite3.OperationalError, match=r"extra_col|no such column"):
                 await store.init()
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_base_store.py` around lines 210 - 219, Update
test_schema_index_on_post_init_column_fails_on_old_db to expect
sqlite3.OperationalError instead of Exception, and make the match pattern a raw
string while preserving the existing no-such-column assertion.

Source: Linters/SAST tools

tests/test_permissions.py (1)

18-23: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add coverage for the tool and resource allowlist branches.

The tests set allowed_tools=["read"] but never pass tool or resource to check_permission. The tool not in allowlist and resource pattern mismatch branches in tinyagentos/mcp/permissions.py stay untested. Add two cases: tool="read" allowed, and tool="write" denied with that reason.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_permissions.py` around lines 18 - 23, Extend
test_granted_agent_has_access or add focused cases around check_permission to
pass tool="read" and assert access is allowed, then pass tool="write" and assert
access is denied with the expected denial reason. Keep the existing server,
attachment, and allowed_tools=["read"] setup so both tool allowlist branches are
covered.
tests/test_routes_torrent.py (1)

10-13: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Extract the store wiring into a fixture.

Lines 10-13, 20-23, and 47-50 repeat the same three-line setup and reach through two private attributes (download_manager._torrent_settings_store) to obtain the store. A rename of either private attribute breaks three tests. Move the lookup and the monkeypatch.setattr into one fixture and request it from the three tests that need the store.

♻️ Proposed change
+@pytest.fixture
+def settings_store(client, monkeypatch):
+    store = client._transport.app.state.download_manager._torrent_settings_store
+    monkeypatch.setattr(
+        client._transport.app.state, "torrent_settings_store", store, raising=False
+    )
+    return store
+
+
 `@pytest.mark.asyncio`
-async def test_get_torrent_settings_returns_200(client, monkeypatch):
-    store = client._transport.app.state.download_manager._torrent_settings_store
-    monkeypatch.setattr(
-        client._transport.app.state, "torrent_settings_store", store, raising=False
-    )
+async def test_get_torrent_settings_returns_200(client, settings_store):
     resp = await client.get("/api/torrent/settings")
     assert resp.status_code == 200
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_routes_torrent.py` around lines 10 - 13, Extract the repeated
store lookup and monkeypatch wiring from the affected tests into a shared
fixture, using the existing client and monkeypatch fixtures to obtain the store
through the current private attributes and assign torrent_settings_store. Update
the three tests that currently duplicate this setup to request the new fixture,
removing their inline wiring while preserving the same store behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@desktop/src/hooks/use-server-notifications.test.ts`:
- Around line 212-227: Rename the test case around useServerNotifications to
accurately describe that fetchSpy runs once at mount and once more when
centreOpen starts true, while leaving its setup, comment, and assertion
unchanged.

In `@docs/agent-manual/11-files-api.md`:
- Around line 28-32: Add test coverage for the Files API routes covering nested
file retrieval through the path parameter and the SSE response from the watch
endpoint. Ensure the tests exercise the watch route before the catch-all file
path route, validate nested upload paths and directory listings, and assert the
expected SSE stream behavior.

In `@docs/design/taosgo-mesh-join-foundation.md`:
- Around line 122-126: Update the publish-contract description near the
Authorization payload to use subdomain consistently: replace the reference to
label with subdomain, or explicitly document label as a UI-only alias mapped to
subdomain.

In `@tests/test_restart_orchestrator.py`:
- Around line 403-417: Update test_writes_note_file in TestWriteControllerNote
to compare data["paused_at"] against the current epoch time using a small
tolerance rather than exact equality, preventing failures across a one-second
wall-clock boundary while retaining validation that the timestamp was captured
near the assertion.

In `@tests/test_routes_catalog.py`:
- Around line 183-192: Strengthen both not-found tests in
tests/test_routes_catalog.py at lines 183-192 and 205-212 by storing the GET
response, asserting its status_code is 404, and then asserting "detail" exists
in resp.json(); apply the same change to both session-context variants.

In `@tests/test_routes_skills.py`:
- Around line 15-18: The test helper _init_real_skills currently initializes
app.state.skills without ensuring it is closed. Add teardown handling for the
initialized SkillStore, using a fixture or local cleanup that calls
store.close() after each test exercising the helper, while preserving reuse of
already-initialized stores.

In `@tests/test_routes_taos_agent.py`:
- Around line 33-41: The _init_desktop_settings autouse fixture should stop
accessing the private client._transport and ds._db attributes. Use the test
suite’s public app fixture or patch the store’s app directly, then initialize
and close desktop_settings through that public access while preserving the
existing setup and teardown behavior.

In `@tests/test_routes_torrent.py`:
- Around line 46-62: Update test_put_torrent_settings_happy_path to use an
isolated TorrentSettingsStore backed by tmp_path instead of the shared
download-manager store. Patch the app state with this temporary store and
preserve the existing request and assertions, preventing the written
seed_enabled, upload_rate_limit_kbps, and max_active_seeds values from leaking
into other tests.

In `@tinyagentos/routes/projects.py`:
- Around line 813-823: Update the agent PATCH validation around the is_agent
field whitelist to compare the incoming labels’ claimable presence with the
task’s stored labels and return 403 when they differ, while allowing other label
edits. Add a regression test covering a non-lead agent editing its own task and
attempting to add or remove claimable, confirming both requests are rejected.

---

Outside diff comments:
In `@tinyagentos/routes/agents.py`:
- Around line 566-634: The deployment flow currently calls
tm_agents.register_agent before the agent registry validates the name, leaving
taosmd state behind when ar.register raises ValueError. In the deployment
handler, move the ar.register block and its error handling ahead of
tm_agents.register_agent, preserving canonical_id assignment and the existing
400/500 responses, so registry validation completes before any taosmd side
effect.

---

Nitpick comments:
In `@tests/cluster/test_worker_capacity.py`:
- Around line 155-165: Remove the redundant
test_parse_size_handles_all_btrfs_units test and retain the existing
parametrized coverage in test_parse_size_valid_gib, test_parse_size_valid_tib,
test_parse_size_valid_mib, test_parse_size_valid_kib, and
test_parse_size_valid_b, consolidating those cases into a single
pytest.mark.parametrize test if needed.

In `@tests/test_base_store.py`:
- Around line 48-55: The `_post_init` overrides currently swallow every database
error; narrow their exception handling to ignore only the expected
duplicate-column error from `ALTER TABLE items ADD COLUMN extra_col TEXT`.
Update both `_post_init` implementations, while allowing all other exceptions to
propagate.
- Around line 210-219: Update
test_schema_index_on_post_init_column_fails_on_old_db to expect
sqlite3.OperationalError instead of Exception, and make the match pattern a raw
string while preserving the existing no-such-column assertion.

In `@tests/test_permissions.py`:
- Around line 18-23: Extend test_granted_agent_has_access or add focused cases
around check_permission to pass tool="read" and assert access is allowed, then
pass tool="write" and assert access is denied with the expected denial reason.
Keep the existing server, attachment, and allowed_tools=["read"] setup so both
tool allowlist branches are covered.

In `@tests/test_routes_torrent.py`:
- Around line 10-13: Extract the repeated store lookup and monkeypatch wiring
from the affected tests into a shared fixture, using the existing client and
monkeypatch fixtures to obtain the store through the current private attributes
and assign torrent_settings_store. Update the three tests that currently
duplicate this setup to request the new fixture, removing their inline wiring
while preserving the same store behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 19abe35a-0c5e-43ee-b4af-f22dcdd97610

📥 Commits

Reviewing files that changed from the base of the PR and between 7c30c32 and 8f71b43.

⛔ Files ignored due to path filters (2)
  • desktop/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json
  • uv.lock is excluded by !**/*.lock, !**/uv.lock
📒 Files selected for processing (43)
  • CHANGELOG.md
  • desktop/package.json
  • desktop/src/components/ui/__tests__/card.test.tsx
  • desktop/src/hooks/use-server-notifications.test.ts
  • docs/agent-coordination.md
  • docs/agent-manual/11-files-api.md
  • docs/agent-manual/index.md
  • docs/design/taosgo-mesh-join-foundation.md
  • docs/taos-agent-manual.md
  • pyproject.toml
  • tests/cluster/test_worker_capacity.py
  • tests/projects/test_lists_store.py
  • tests/test_agent_internal_mint.py
  • tests/test_agent_manual_compiled.py
  • tests/test_agent_registry.py
  • tests/test_base_store.py
  • tests/test_feedback_route.py
  • tests/test_permissions.py
  • tests/test_project_a2a.py
  • tests/test_restart_orchestrator.py
  • tests/test_routes_agent_auth_requests.py
  • tests/test_routes_agents.py
  • tests/test_routes_catalog.py
  • tests/test_routes_decisions_agent.py
  • tests/test_routes_knowledge.py
  • tests/test_routes_observatory.py
  • tests/test_routes_projects_agent_tasks.py
  • tests/test_routes_skills.py
  • tests/test_routes_taos_agent.py
  • tests/test_routes_torrent.py
  • tinyagentos/__init__.py
  • tinyagentos/auth_middleware.py
  • tinyagentos/cli/taosctl/commands/observatory.py
  • tinyagentos/projects/lists_store.py
  • tinyagentos/routes/__init__.py
  • tinyagentos/routes/agent_auth_requests.py
  • tinyagentos/routes/agent_registry.py
  • tinyagentos/routes/agents.py
  • tinyagentos/routes/decisions.py
  • tinyagentos/routes/observatory.py
  • tinyagentos/routes/projects.py
  • tinyagentos/taosnet/mesh.py
  • tinyagentos/taosnet/mesh_credentials.py

Comment thread desktop/src/hooks/use-server-notifications.test.ts
Comment thread docs/agent-manual/11-files-api.md
Comment thread docs/design/taosgo-mesh-join-foundation.md
Comment thread tests/test_restart_orchestrator.py
Comment thread tests/test_routes_catalog.py
Comment thread tests/test_routes_skills.py
Comment thread tests/test_routes_taos_agent.py
Comment thread tests/test_routes_torrent.py
Comment thread tinyagentos/routes/projects.py
@jaylfc

jaylfc commented Aug 3, 2026

Copy link
Copy Markdown
Owner Author

Resolving the carried-over bot review threads to unblock this promote (master requires conversation resolution). Each adjudicated, NOT blanket-dismissed - and two were RIGHT:

ACTIONED (carded tsk-a3er4a, fix-forward on dev - both already merged, so neither blocks a dev->master sync):

ACTIONED (correction added to existing card tsk-x7l76a):

  • kilo, observatory.py:414: correct, and it corrected ME. For an agent caller request.state.user_id is None, so list_for_user(...) if user_id else [] yields [] - project-scoped observatory agents see NO idle registered agents. A gap, not the cross-project leak I described from the audit pass.

ADJUDICATED NOISE (verified, no action):

  • kilo, lists_store.py:158 'COALESCE still races': SQLite serialises writers on a single connection and the INSERT-with-subquery is one statement; the claimed two-transaction interleave does not apply.
  • kilo, lists_store.py:261 'breaking signature change': verified zero production callers of reorder_entries on dev.
  • qodo observatory fleet-query scaling + coderabbit test-maintainability nit: informational.

This PR is a mechanical dev->master promote with tree identity asserted (diff vs dev EMPTY); the findings live on dev and are fixed forward there, not by diverging master.

@jaylfc
jaylfc merged commit 6099c5d into master Aug 3, 2026
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant