Make recurring refresh prompts follow the live page contract - #59
Merged
Merged
Conversation
Merged
4 tasks
obsessixnv
added a commit
to ElcanoTek/fleet
that referenced
this pull request
Sep 15, 2026
…tes (#1505) ## What changed, and why A scheduled task could satisfy an explicit condition for taking no further action, then have the completion verifier demand an action from another branch. Fleet now passes bounded structural summaries of tool results, separately from requested arguments, and derives conditions, actions and prerequisites from the original task. For example, an inventory inspection that finds an existing item does not require creating it. No connector field allowlist or Pages-specific completion rules live in the engine. A successful completion audit can explicitly declare `critical_actions: []` without granting a mutation or clearing outstanding commitments. Terminal audit aborts retain their failed outcome and skip further driver reviews. The evidence projection supports arbitrary object fields and the standard MCP text wrapper. It applies shared secret redaction, omits credential-bearing subtrees, prose, URLs and bulk arrays, and bounds input, depth, traversal, fields and output bytes. Omitted evidence remains unknown; tool results cannot supply instructions or authorization. Prompt producers can also include a copyable `EXECUTION REQUIREMENTS (JSON):` block. Fleet checks the task/global network policy and the advertised native/MCP roster before model execution, so missing upload access or source tools fail with an actionable error before the run spends time processing data. Requirements never enable network, select credentials or widen tool permissions. The built-in scheduling guide and generated help copy explain the handoff. Operator action: after this and [Pages #59](ElcanoTek/pages#59) land, regenerate saved refresh prompts, select their required source/helper servers and connected accounts, and enable permitted HTTPS sandbox egress for uploads. Existing task settings and saved prompts are not changed automatically. Closes #1504. ## How you verified it - `make build`, full `make test` with isolated chat/scheduler databases, tagged `go vet`, `make lint` including actionlint/shellcheck, and `make govulncheck` passed. - Full Go tests, `make build`, `make lint` and focused race tests were rerun after generalization. Tests exercise arbitrary fields from inventory, repository and import workflows, exact numeric identifiers, redaction and projection limits, no-action audit permissions, dispatch prerequisites and explicit abort behavior. A driver regression verifies neither completion reviewer runs after terminal abort, while the task still returns `ErrAuditAborted`. - Web dependency audit, lint, typecheck, all 1,618 unit tests and the production build passed. One existing transcript test timed out during the initial resource-constrained run; it passed alone and in the complete rerun without a code change. - All 98 mocked Playwright tests passed against the production build on an isolated port, including the updated help guides. The initial attempt lacked the locally required Chromium build; it was installed before the complete passing run. ## Scope and deviations MCP catalogs, credentials, tool contracts and customer protocols remain in external config bundles. The prerequisite check is generic and runs at dispatch, not in the task creation UI. It checks the advertised roster, not actual endpoint reachability, source completeness or every later persona/account gate. The completion verifier remains a model-based check with its existing bounded invocation and error behavior. No customer page, source-grain migration, existing schedule, broker boundary or sandbox permission was changed. Generic provider-error retry changes are deferred: the exported report lacks a provider status that would justify changing retry classification safely. A design note documents the behavior; no invariant changes require an ADR. --- - [x] The title and description explain the change and operator action for release notes. - [x] Design note added: `docs/CONDITIONAL-TASK-COMPLETION.md`. - [x] Invariants preserved; no ADR change required. - [x] Diff scoped to conditional task completion and execution prerequisites.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Recurring refresh prompts now read the current published contract on each run, so a compatible page edit in Chat no longer invalidates a saved daily task solely because its schema hash changed.
get_page_data(include_data:false)returns the contract, profile and coverage without the large data payload; the default still returns complete data. Optimistic concurrency, approval gates and in-run schema/template checks remain in place, and incompatible source grain or mappings still block the update.The generated workflow separates successful
source_not_updated, blocked, and update branches. It embeds the execution prerequisites in the copied prompt, requires fresh source evidence, limits upload retries, and avoids large model-emitted payloads and fictitious audit commitments. The inline tool documentation now points to the existing upload path.Validation: 228 unit tests, 248 browser tests, the full throwaway-Postgres integration suite, production dependency audit at high severity, and shell syntax checks passed. MCP integration verifies compact/full read parity and that prompt preparation creates no page version.
Operator action after Pages and the companion Fleet changes land: regenerate saved refresh prompts, select the bound source/helper servers and connected accounts in Fleet, and enable the permitted sandbox network egress needed for HTTPS file upload. Existing scheduled prompts are not rewritten. Customer data-grain migrations are deferred.
Closes #58. Companion executor fix: Fleet #1505.