diff --git a/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/CHUNK_MAP.md b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/CHUNK_MAP.md new file mode 100644 index 00000000..5e7c784b --- /dev/null +++ b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/CHUNK_MAP.md @@ -0,0 +1,17 @@ +# Chunk Map: WS-QUAL-002 Behavior Ownership Catalogue + +| Chunk | Purpose | Dependency | Risk | State | +|---|---|---|---|---| +| `WS-QUAL-002-01` | Catalogue schema, inventory, generator, validation foundation | none | L1 | proposed | +| `WS-QUAL-002-02` | Coverage-context candidate evidence and runtime calibration | 01 | L1 | pending | +| `WS-QUAL-002-03A` | AUTH, actors, API controls, audit ownership | 01, 02 | L1 | pending | +| `WS-QUAL-002-03B` | Artifacts, storage, extraction, external adapters ownership | 01, 02 | L1 | pending | +| `WS-QUAL-002-03C` | Projects, tasks, checkers, reviews, contribution ownership | 01, 02 | L1 | pending | +| `WS-QUAL-002-03D` | Core, DB, async execution, scripts, remaining shared ownership | 01, 02 | L1 | pending | +| `WS-QUAL-002-04` | Completeness/staleness gate and contributor preparation command | 03A-D | L1 | pending | +| `WS-QUAL-002-05` | Changed-line-aware mutation reactivation and AUTH workflow proof | 04 | L1 | pending | + +Population chunks `03A` through `03D` may run concurrently in separate +branches after `01` and `02` merge. Their scopes come exclusively from the +machine-readable target partition committed by `01`; each target belongs to +exactly one population chunk. diff --git a/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/DECISIONS.md b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/DECISIONS.md new file mode 100644 index 00000000..023a66ef --- /dev/null +++ b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/DECISIONS.md @@ -0,0 +1,18 @@ +# Decisions: WS-QUAL-002 Behavior Ownership Catalogue + +## Accepted human direction + +Pre-create behavior ownership for the whole codebase so AUTH and other +contributors do not pause during implementation to rediscover mutation claims. + +## Planning decisions + +- Durable catalogue and transient PR selection are separate concepts. +- Ordinary PR mutation remains changed-scope. +- Candidate automatic mappings are not blocking authority until reviewed. +- AUTH is the first subsystem proof, but catalogue scope is repository-wide. +- The 05M workflow remains retired; only a fresh, explicitly approved, + changed-line-aware workflow may reactivate mutation enforcement. +- Callable groups enumerate exact AST members and never widen exact-callable selection. +- Foundation assigns every eligible target to one population group before concurrent work. +- Coverage-context calibration is local/manual and cannot add a workflow or required check. diff --git a/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/DISCOVERY.md b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/DISCOVERY.md new file mode 100644 index 00000000..1c948e47 --- /dev/null +++ b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/DISCOVERY.md @@ -0,0 +1,68 @@ +# Discovery: WS-QUAL-002 Behavior Ownership Catalogue + +## Repository facts + +- Eligibility is defined by `ELIGIBLE_PREFIXES` in + `backend/scripts/mutation_policy.py`. +- Exact changed callables are derived by `changed_callables()` using Git + merge-base hunks and AST spans. +- `build_selection()` currently requires changed targets and claimed callables + to match exactly. +- Claim schema v1 is in `scripts/behavior-claim.schema.json`; it permits at most + eight targets, 24 callables per target, and 12 exact pytest nodes per target. +- Backend semantic ownership is process-level, not production ownership: + `backend/scripts/run_test_lanes.py` assigns all 66 test modules to five lanes. +- The current hosted Backend run proves all lane nodes and combines coverage, + but it does not emit callable-to-test context ownership. + +## Scope inventory + +- 168 eligible implementation/script modules excluding `__init__.py`. +- 66 top-level backend test modules. +- High-risk groups include authorization/actors/auth, artifacts/storage, + projects/tasks/checkers/reviews, audit/outbox, async job runtimes, and CI scripts. +- Existing behavior claims cover mutation-policy calibration only; they are not + a repository ownership catalogue. + +## Existing evidence that can be reused + +- Exact AST callable mapping in `mutation_policy.py`. +- Exact test collection and lane custody in `run_test_lanes.py`. +- Combined coverage and protected subsystem floors in `coverage_policy.py` and + the Backend workflow. +- Current schema vocabulary for outcomes and real boundaries. +- `pytest-cov`/coverage support test contexts, which can provide candidate + callable-to-test evidence without inventing ownership from imports. + +## Gaps + +- No canonical target/callable ownership registry. +- No deterministic command to prepare ownership before implementation. +- No context-coverage artifact mapping executed lines to exact pytest nodes. +- No completeness check covering every eligible module. +- No stale-node check proving catalogue tests still collect. +- No bounded rule for modules whose owning test would exceed mutation runtime. + +## Dependencies and integrations + +The solution touches mutation policy, test collection/coverage evidence, +repository schemas, contributor documentation, and the mutation workflow. It +must use protected-base authority and cannot trust PR-head catalogue changes +without validation. + +## Risks + +- Static import inference can overclaim behavior ownership. +- Coverage contexts show execution, not assertion strength; mutation remains + the assertion-sensitivity proof. +- A single test module can be too broad for bounded mutation. +- Catalogue population is data-heavy and must be split by subsystem. +- Renames/deletions require explicit fail-closed catalogue reconciliation. + +## Unknowns to resolve during the prototype + +- Hosted size/runtime cost of per-test coverage contexts. +- Whether exact test functions or stable test groups are the best stored unit. +- How many eligible modules contain no executable callable and should be typed + `structural_only` rather than mutation-owned. +- Which existing broad integration tests need smaller owning behavior tests. diff --git a/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/INTENT.md b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/INTENT.md new file mode 100644 index 00000000..9248a4c8 --- /dev/null +++ b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/INTENT.md @@ -0,0 +1,83 @@ +# Intent: WS-QUAL-002 Behavior Ownership Catalogue + +## Problem being solved + +The retired 05M mutation gate required exact changed-callable ownership, but +contributors had to discover and author that ownership during each PR. AUTH +paused implementation to build mutation metadata, while callable-wide mutation +also evaluated unchanged executable lines. PR #289 retired that blocking +workflow. Durable ownership and changed-line selection are both required before +mutation enforcement can safely return. + +## Why this work matters + +Humans and agents should begin implementation with known owning tests and +boundaries. Mutation should verify changed behavior, not force every contributor +to rediscover the repository's test architecture. + +## Current behavior + +- 168 non-`__init__` Python modules are eligible under `backend/app/` and + `backend/scripts/`. +- 66 backend test modules exist. +- Only the historical `04M` and `05M` behavior claims exist. +- The hosted mutation workflow is retired; Backend lanes, coverage, lint, + review, and human merge remain active. + +## Target behavior + +Main contains reviewed behavior ownership for every eligible module. A local +command derives exact changed executable lines and their containing callables +from Git and generates bounded PR selection automatically. Contributors update +ownership only for new or materially remapped behavior. + +## Design chosen + +Create a canonical ownership catalogue separate from transient PR selection. +Catalogue records bind targets and callable ownership to exact tests, observable +outcomes, and required real boundaries. Generation and validation are +deterministic. Any future mutation engine is changed-line-aware, never mutates +unchanged executable lines, and never runs the whole repository on an ordinary +PR. + +## Alternatives considered + +- One permanent giant claim: rejected; it violates exact changed-scope custody + and would create excessive mutation runtime. +- One generated claim based only on filenames/imports: rejected; imports do not + prove behavior ownership. +- Full-repository mutation on every PR: rejected for cost and review noise. +- Disable mutation for AUTH: rejected; subsystem pressure must improve the + workflow, not weaken evidence. + +## Boundaries preserved + +- Global 78-percent and protected 90-percent coverage floors remain unchanged. +- Existing Backend semantic lanes and full-suite custody remain authoritative. +- GitHub permissions and human merge remain contribution authority. +- No product, authorization, payment, reputation, migration, or API behavior + changes. + +## Expected risks + +False ownership is worse than missing ownership. Automatically inferred +mappings must remain candidates until deterministic coverage evidence and human +engineering review confirm them. Large test modules may exceed mutation runtime if mapped +too broadly. + +## What must not change + +No arbitrary skips, survivor allowlists, score thresholds, PR-controlled gate +authority, or whole-repository mutation. + +## How this will be proven + +Schema and generator tests, exact Git-delta tests, catalogue completeness and +staleness checks, coverage-context evidence, subsystem review, an AUTH pilot, +and final hosted changed-line mutation evidence before reactivation. + +## Human decisions required + +Approve the staged plan and first contract. Later mutation reactivation requires +a separate human checkpoint after AUTH proves that normal work no longer pauses +for manual claim construction and unchanged lines cannot enter selection. diff --git a/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/PLAN.md b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/PLAN.md new file mode 100644 index 00000000..3524e149 --- /dev/null +++ b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/PLAN.md @@ -0,0 +1,92 @@ +# Plan: WS-QUAL-002 Behavior Ownership Catalogue + +## Approach + +1. Define a versioned catalogue schema and read-only inventory/generation CLI. +2. Produce coverage-context candidates and validate them against collected + pytest nodes and current AST callables. +3. Pilot reviewed ownership for AUTH/actors first because it is active and + security-sensitive. +4. Populate remaining catalogue groups in independent data PRs. +5. Require catalogue completeness and staleness checks without reactivating + hosted mutation. +6. Add a fresh changed-line-aware mutation workflow using protected-base + catalogue ownership, requiring changed catalogue data only for new/remapped + behavior. +7. Prove normal AUTH work can generate selection without pausing and that + unchanged executable lines never enter mutation selection. + +## Catalogue model + +One record per eligible target. Records distinguish mutation-owned callables +from typed structural-only modules. Each owned callable binds exact collected +pytest nodes, observable outcomes, and real boundaries. A callable group is +only a storage and review convenience: it must enumerate every exact AST +callable member, and Git-delta selection still resolves and validates each +changed executable line and containing callable independently. Wildcards, +module-wide ownership, and implicit +group membership are forbidden. Candidate evidence and reviewed test ownership +are separate states; candidate inference can never satisfy the blocking gate. + +The catalogue is engineering QA and mutation evidence only. It does not create +or modify Workstream product authority, review decisions, ContributionRecords, +payment, reputation, or lifecycle truth. + +## Protected authority + +For existing behavior, ordinary PRs use the catalogue read from protected base. +New or remapped callables require an additive changed record validated from PR +head. PR-head data cannot delete, narrow, downgrade, or replace protected-base +reviewed ownership. Exact Git delta remains the source of changed callables. + +Each reviewed behavior has an immutable `behavior_id`; its current location is +the exact `(target_path, AST-qualified callable name)` binding. A remap record +names `supersedes_behavior_id`, is admitted only when the exact Git delta proves +the protected location is absent or renamed and the PR-head location exists, +and carries forward every protected owning test, outcome, and real boundary +unless a separately reviewed ownership change adds stronger evidence. Effective +selection first requires globally unique `behavior_id` values across protected +records and a one-to-one `supersedes_behavior_id` mapping: one remap may +supersede one protected identity, and a protected identity may be superseded by +at most one admitted remap. Duplicate reviewed owners, duplicate behavior +identities, mapping collisions, or remaps whose protected identity lookup does +not resolve exactly once fail closed before mutation input. After resolving the +superseded binding, selection must yield exactly one reviewed owner for every +changed executable line; zero or multiple effective owners also fail closed. + +## Verification strategy + +- JSON Schema and path/custody validation. +- Exact eligible-module completeness and no-orphan checks. +- A deterministic target-to-population-group manifest that assigns every + eligible target to exactly one of `auth`, `artifacts`, `lifecycle`, or + `shared` before concurrent population begins. +- Exact collected-node existence and no skip/deselect weakening. +- Context-coverage candidate reconciliation. +- Negative tests for missing, narrowed, stale, renamed, deleted, duplicated, + unsafe, and overly broad ownership. +- Focused 90-percent coverage for new catalogue tooling. +- AUTH pilot and final hosted mutation evidence within the existing job cap. + +## Rejected architecture + +No monolithic claim, import-only mapping, mutable runtime registry, generic +plugin discovery, global mutation score, or full-repository ordinary-PR run. + +## Rollout boundary + +The 05M workflow remains retired. Mutation enforcement may return only through +the final human-approved changed-line-aware reactivation chunk after hosted +evidence proves the catalogue path and excludes unchanged lines. Population work +may proceed concurrently only after both the schema/generator foundation with +its target partition (`01`) and observational context evidence (`02`) merge. +The observational context prototype is local/manual and adds no workflow; +chunk `05` is the first chunk allowed to add a new workflow or reactivate +mutation enforcement. + +Before reactivation, a blocking repository scan covers active workflows, +scripts, and configuration and rejects references to the retired workflow, +callable-wide selectors, or historical claim authority. Historical planning and +review evidence may name the retirement; executable or active configuration may +not. The retired state remains authoritative until this scan and all hosted +evidence pass on the exact proposed head. diff --git a/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/RISKS.md b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/RISKS.md new file mode 100644 index 00000000..a1db1fbf --- /dev/null +++ b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/RISKS.md @@ -0,0 +1,13 @@ +# Risks: WS-QUAL-002 Behavior Ownership Catalogue + +| Risk | Impact | Mitigation | +|---|---|---| +| Inferred execution is mistaken for assertion ownership | Vacuous catalogue | Keep candidates non-authoritative; engineering review and future mutation evidence confirm ownership | +| Retired callable-wide behavior returns under a new name | Contributor blocking and false survivors | Require exact changed-line selection and negative proof that unchanged executable lines never enter mutation | +| Broad test nodes make mutation slow | Contributor latency | Calibrate contexts and require bounded owning nodes/groups | +| Protected ownership is narrowed by PR data | Gate bypass | Protected-base merge semantics and explicit additive remap validation | +| Catalogue becomes stale after renames | False failures or escapes | Exact AST, target, collected-node, rename, and deletion checks | +| 168-module population is unreviewable | Review failure | Four subsystem data chunks with focused reviewers | +| Context coverage is too slow or produces oversized artifacts | Contributor latency | Keep it local/manual; accept only at no more than two minutes and 10 MiB per artifact | +| Structural modules hide executable behavior | Gate bypass | Machine-checkable AST criteria, a required reviewer rationale, and negative tests | +| Concurrent population overlaps or omits targets | Stale review and merge conflicts | Commit one exact target-to-group partition before population; make population PRs data-only | diff --git a/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/STATUS.md b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/STATUS.md new file mode 100644 index 00000000..5522592a --- /dev/null +++ b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/STATUS.md @@ -0,0 +1,22 @@ +# Status: WS-QUAL-002 Behavior Ownership Catalogue + +Planning is complete and internally reviewed. PR #289 retired the 05M hosted +mutation workflow; Backend lanes and coverage remain authoritative. No +catalogue implementation or mutation reactivation has started. + +The first proposed chunk is `WS-QUAL-002-01`. Stop after planning review and +human approval; do not start implementation automatically. + +## Plan review + +- Architecture: PASS +- CI integrity: PASS WITH LOW RISKS +- Security: PASS +- QA: PASS WITH LOW RISKS +- Senior engineering: PASS WITH LOW RISKS +- Product/operations: PASS WITH LOW RISKS +- Documentation: PASS +- Reuse/deduplication: PASS WITH LOW RISKS + +All blocking findings were resolved in the planning artifacts. Remaining low +risks are implementation review focuses, not approval blockers. diff --git a/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-01-catalogue-foundation.md b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-01-catalogue-foundation.md new file mode 100644 index 00000000..51f1ee22 --- /dev/null +++ b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-01-catalogue-foundation.md @@ -0,0 +1,111 @@ +# Chunk Contract: WS-QUAL-002-01 — Behavior Ownership Catalogue Foundation + +## Parent initiative + +`WS-QUAL-002` — Behavior Ownership Catalogue + +## Goal + +Add the versioned catalogue contract, exact eligible-module inventory, and a +deterministic read-only generator/validator without changing mutation CI. + +## Why this chunk exists + +All population chunks need one reviewed format and toolchain. This foundation +prevents four subsystem branches from inventing incompatible ownership data. + +## Approved plan reference + +- INTENT: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/CHUNK_MAP.md` + +## Risk class + +L1. + +## SLA + +P2. + +## Allowed files + +```text +.ci/behavior-ownership/README.md +.ci/behavior-ownership/partition.v1.json +.ci/behavior-ownership/examples/** +scripts/behavior-ownership.schema.json +backend/scripts/behavior_ownership.py +backend/tests/test_behavior_ownership.py +CONTRIBUTING.md +docs/operations_backend_testing.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/STATUS.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-01-catalogue-foundation.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/reviews/WS-QUAL-002-01-* +``` + +## Not allowed + +```text +.github/workflows/** +backend/app/** +backend/alembic/** +backend/scripts/mutation_policy.py +scripts/behavior-claim.schema.json +coverage thresholds, lane membership, skips, deselection, survivor exemptions +authoritative inferred ownership without reviewed catalogue state +``` + +## Acceptance criteria + +- [ ] Schema distinguishes reviewed ownership, candidates, and strict structural-only records. +- [ ] The schema defines `structural_only` as a machine-readable status with a required non-empty reason and forbids callable and test fields for that status; executable records require callable and test fields. +- [ ] Validation and `--run-owned-tests` exclude valid `structural_only` records, reject mixed structural/executable fields, and test the no-executable-callable completeness case from `DISCOVERY.md`. +- [ ] Inventory deterministically enumerates every eligible non-`__init__` module. +- [ ] Eligibility, safe-path checks, callable spans, changed-callable derivation, observable outcomes, and real-boundary vocabulary delegate directly to the existing `mutation_policy.py` definitions; parity tests fail on drift rather than maintaining a second implementation. +- [ ] The sole partition artifact is `.ci/behavior-ownership/partition.v1.json` with schema identity `workstream.behavior-ownership-partition.v1`; it assigns every eligible target to exactly one of `auth`, `artifacts`, `lifecycle`, or `shared`. +- [ ] Partition custody binds its protected-base commit and digest; validation rejects missing, relocated, duplicated, branch-local, or modified copies. +- [ ] Callable groups enumerate exact AST callable members; changed-callable selection remains exact, and wildcards or implicit membership fail closed. +- [ ] Validator rejects unsafe paths, duplicates, missing targets/callables/tests, stale nodes, narrowing, and malformed records. +- [ ] Remap records require immutable `behavior_id` and `supersedes_behavior_id`, exact-Git-delta proof that the protected location is absent or renamed, and an existing PR-head location. +- [ ] Remap validation carries forward all protected tests, outcomes, and real boundaries unless stronger reviewed evidence is added; deletion, narrowing, replacement, invalid ancestry, and zero or multiple effective owners fail closed. +- [ ] Every referenced pytest node collects, and the validator can run the exact nodes referenced by a record or population group. +- [ ] `structural_only` is allowed only for imports, constants, type-only declarations, protocols/interfaces, and declarative metadata with no executable functions, validators, I/O, SQL, external calls, branching, mutation, or runtime side effects; every record includes a reviewed rationale and executable counterexamples fail validation. +- [ ] Generator emits deterministic candidates and a precise unresolved report; it never promotes candidates to reviewed. +- [ ] Empty initial catalogue is allowed only with an explicit completeness report because mutation reactivation is not active. +- [ ] New tooling has at least 90-percent focused coverage. +- [ ] Retired mutation enforcement remains inactive; the Backend workflow and coverage floors are unchanged. +- [ ] Negative tests cover missing/duplicate/wrong-group targets, stale nodes, overbroad groups, executable behavior mislabeled `structural_only`, invalid remap ancestry/location, missing carry-forward evidence, protected-owner replacement, and zero/multiple effective owners. + +## Verification commands + +```bash +(cd backend && .venv/bin/python -m pytest -q tests/test_behavior_ownership.py --cov=scripts.behavior_ownership --cov-fail-under=90) +(cd backend && .venv/bin/ruff check scripts/behavior_ownership.py tests/test_behavior_ownership.py) +python3 scripts/check_markdown_links.py +python3 scripts/check_stale_workstream_wording.py +git diff --check origin/main...HEAD +``` + +## Required reviewers + +- [ ] architecture +- [ ] senior engineering +- [ ] QA/test +- [ ] security/auth +- [ ] product/ops +- [ ] CI integrity +- [ ] docs +- [ ] reuse/dedup +- [ ] test delta + +## Human review focus + +Confirm that candidate inference cannot become blocking authority, the format +can represent all subsystems, and this PR does not alter current CI behavior. + +## Stop conditions + +Stop if workflow/mutation reactivation becomes necessary, ownership must be guessed +as reviewed, active Backend, coverage, lint, or review gates must weaken, or the schema cannot represent a +subsystem without free-form exemptions. diff --git a/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-02-context-evidence.md b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-02-context-evidence.md new file mode 100644 index 00000000..bda596c5 --- /dev/null +++ b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-02-context-evidence.md @@ -0,0 +1,51 @@ +# Chunk Contract: WS-QUAL-002-02 — Coverage-Context Candidate Evidence + +## Parent initiative +`WS-QUAL-002` — Behavior Ownership Catalogue +## Goal +Emit non-authoritative callable-to-test candidates from exact local coverage contexts and measure cost without adding CI infrastructure. +## Why this chunk exists +Imports do not prove behavior ownership. +## Approved plan reference +- INTENT: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/CHUNK_MAP.md` +## Risk class +L1. +## SLA +P2. +## Allowed files +```text +backend/scripts/behavior_ownership.py +backend/scripts/run_test_lanes.py +backend/tests/test_behavior_ownership.py +backend/tests/test_ci_test_lanes.py +backend/pyproject.toml +docs/operations_backend_testing.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/STATUS.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-02-context-evidence.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/reviews/WS-QUAL-002-02-* +``` +## Not allowed +```text +backend/app/**; .github/workflows/**; reviewed catalogue population; mutation reactivation; coverage or test weakening; any required-check or blocking-gate change +``` +## Acceptance criteria +- [ ] Context evidence binds exact head, callable lines, and collected nodes. +- [ ] Test discovery, collection, and completion evidence reuse `run_test_lanes.py` rather than introducing a parallel collector. +- [ ] Candidate output cannot satisfy reviewed ownership. +- [ ] The prototype is a local/manual command only and adds no workflow or required check. +- [ ] Added local runtime is at most two minutes and each generated artifact is at most 10 MiB; exceeding either limit stops adoption and triggers redesign. +- [ ] Artifacts contain only commit SHAs, lane identity, collection/completion status, skip/deselect status, target paths, callable spans, collected node IDs, line-coverage metadata, and an artifact digest or immutable canonical-lane manifest reference; they never contain environment values, secrets, tokens, request payloads, logs, or database values. +- [ ] Validation rejects stale-head, partial, incomplete, skipped, deselected, digest-mismatched, or overwritten evidence as candidate input. +## Verification commands +```bash +(cd backend && .venv/bin/python -m pytest -q tests/test_behavior_ownership.py tests/test_ci_test_lanes.py) +git diff --check origin/main...HEAD +``` +## Required reviewers +Architecture, QA, security, CI integrity, reuse/dedup, and test delta. +## Human review focus +Candidate-only custody, no added CI infrastructure, and local cost. +## Stop conditions +Stop if contexts destabilize Backend or require PR-controlled authority. diff --git a/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-03A-auth-ownership.md b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-03A-auth-ownership.md new file mode 100644 index 00000000..452bb7d9 --- /dev/null +++ b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-03A-auth-ownership.md @@ -0,0 +1,50 @@ +# Chunk Contract: WS-QUAL-002-03A — AUTH And Audit Ownership + +## Parent initiative +`WS-QUAL-002` — Behavior Ownership Catalogue +## Goal +Review ownership for auth, actors, authorization, API controls, and audit. +## Why this chunk exists +AUTH is active and security-sensitive. +## Approved plan reference +- INTENT: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/CHUNK_MAP.md` +## Risk class +L1. +## SLA +P1. +## Allowed files +```text +.ci/behavior-ownership/auth/** +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/STATUS.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-03A-auth-ownership.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/reviews/WS-QUAL-002-03A-* +``` +## Not allowed +```text +backend/app/**; workflows; mutation policy; authorization behavior; unreviewed promotion +``` +## In-scope eligible targets +Exactly the targets whose `group` is `auth` in the machine-readable partition +committed by `WS-QUAL-002-01`. The validator must reject records outside that +closed set; no prose inference or overlapping fallback scope is allowed. +The validator reads the versioned partition only from protected base or the +approved foundation commit, verifies its digest, and rejects any population-PR +partition change, relocation, or shadow copy. +## Acceptance criteria +- [ ] Every target assigned to `auth` by the foundation partition is reviewed-owned or strictly structural-only; no other target is changed. +- [ ] Exact collected tests and context evidence support mappings. +- [ ] The validator collects and runs every exact pytest node referenced by changed records. +- [ ] AUTH selection generates without hand-authoring existing ownership. +## Verification commands +```bash +(cd backend && .venv/bin/python -m scripts.behavior_ownership validate --group auth --run-owned-tests) +git diff --check origin/main...HEAD +``` +## Required reviewers +Architecture, QA, security, product/ops, docs, and test delta. +## Human review focus +Denial, admin, lineage, audit, and service-identity mappings. +## Stop conditions +Stop if bounded owning tests or real boundaries are missing. diff --git a/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-03B-artifact-ownership.md b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-03B-artifact-ownership.md new file mode 100644 index 00000000..ad5f29e5 --- /dev/null +++ b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-03B-artifact-ownership.md @@ -0,0 +1,51 @@ +# Chunk Contract: WS-QUAL-002-03B — Artifact And Adapter Ownership + +## Parent initiative +`WS-QUAL-002` — Behavior Ownership Catalogue +## Goal +Review ownership for artifacts, storage, extraction, materialization, and adapters. +## Why this chunk exists +These behaviors span filesystem, S3/MinIO, archive, and background-execution boundaries. +## Approved plan reference +- INTENT: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/CHUNK_MAP.md` +## Risk class +L1. +## SLA +P2. +## Allowed files +```text +.ci/behavior-ownership/artifacts/** +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/STATUS.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-03B-artifact-ownership.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/reviews/WS-QUAL-002-03B-* +``` +## In-scope eligible targets +Exactly the targets whose `group` is `artifacts` in the machine-readable +partition committed by `WS-QUAL-002-01`. The validator must reject records +outside that closed set; no prose inference or overlapping fallback scope is allowed. +The validator reads the versioned partition only from protected base or the +approved foundation commit, verifies its digest, and rejects any population-PR +partition change, relocation, or shadow copy. +## Not allowed +```text +backend/app/**; provider behavior; workflows; test weakening +``` +## Acceptance criteria +- [ ] Every target assigned to `artifacts` by the foundation partition is reviewed or structural-only; no other target is changed. +- [ ] Storage, archive, scratch, and background-execution boundaries are explicit. +- [ ] Every applicable provider-owned record cites real filesystem, S3/MinIO, archive, or external-adapter contract evidence; mocked-only tests cannot establish a real boundary. +- [ ] Owning nodes remain bounded. +- [ ] The validator collects and runs every exact pytest node referenced by changed records, including real-provider boundary nodes where declared. +## Verification commands +```bash +(cd backend && .venv/bin/python -m scripts.behavior_ownership validate --group artifacts --run-owned-tests) +git diff --check origin/main...HEAD +``` +## Required reviewers +Architecture, QA, security, product/ops, reuse/dedup, and test delta. +## Human review focus +Immutable artifact and real-provider ownership. +## Stop conditions +Stop if real-provider proof must weaken. diff --git a/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-03C-lifecycle-ownership.md b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-03C-lifecycle-ownership.md new file mode 100644 index 00000000..d93de77e --- /dev/null +++ b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-03C-lifecycle-ownership.md @@ -0,0 +1,51 @@ +# Chunk Contract: WS-QUAL-002-03C — Product Lifecycle Ownership + +## Parent initiative +`WS-QUAL-002` — Behavior Ownership Catalogue +## Goal +Review projects, tasks, checkers, reviews, contributions, compensation, and outbox ownership. +## Why this chunk exists +These modules establish Workstream lifecycle truth. +## Approved plan reference +- INTENT: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/CHUNK_MAP.md` +## Risk class +L1. +## SLA +P2. +## Allowed files +```text +.ci/behavior-ownership/lifecycle/** +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/STATUS.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-03C-lifecycle-ownership.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/reviews/WS-QUAL-002-03C-* +``` +## In-scope eligible targets +Exactly the targets whose `group` is `lifecycle` in the machine-readable +partition committed by `WS-QUAL-002-01`. The validator must reject records +outside that closed set; no prose inference or overlapping fallback scope is allowed. +The validator reads the versioned partition only from protected base or the +approved foundation commit, verifies its digest, and rejects any population-PR +partition change, relocation, or shadow copy. +## Not allowed +```text +backend/app/**; lifecycle states; review decisions; payment behavior; workflows +``` +## Acceptance criteria +- [ ] Every target assigned to `lifecycle` by the foundation partition is reviewed or structural-only; no other target is changed. +- [ ] State, denial, idempotency, revision, and concurrency outcomes are explicit. +- [ ] Every applicable persistence-owned record cites real PostgreSQL and outbox evidence for transaction, idempotency, revision, and concurrency behavior; mocked-only tests cannot establish those boundaries. +- [ ] Engineering ownership does not redefine product decisions. +- [ ] The validator collects and runs every exact pytest node referenced by changed records. +## Verification commands +```bash +(cd backend && .venv/bin/python -m scripts.behavior_ownership validate --group lifecycle --run-owned-tests) +git diff --check origin/main...HEAD +``` +## Required reviewers +Architecture, QA, security, product/ops, and test delta. +## Human review focus +End-to-end lifecycle boundaries. +## Stop conditions +Stop on product-semantic drift or unbounded owning nodes. diff --git a/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-03D-shared-ownership.md b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-03D-shared-ownership.md new file mode 100644 index 00000000..ec5f21ed --- /dev/null +++ b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-03D-shared-ownership.md @@ -0,0 +1,52 @@ +# Chunk Contract: WS-QUAL-002-03D — Shared Runtime And Script Ownership + +## Parent initiative +`WS-QUAL-002` — Behavior Ownership Catalogue +## Goal +Review core, DB, interfaces, composition, async execution, and remaining scripts. +## Why this chunk exists +Completeness requires shared operational ownership without mixing product reviews. +## Approved plan reference +- INTENT: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/CHUNK_MAP.md` +## Risk class +L1. +## SLA +P2. +## Allowed files +```text +.ci/behavior-ownership/shared/** +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/STATUS.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-03D-shared-ownership.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/reviews/WS-QUAL-002-03D-* +``` +## In-scope eligible targets +Exactly the targets whose `group` is `shared` in the machine-readable partition +committed by `WS-QUAL-002-01`. The validator must reject records outside that +closed set; no prose inference or overlapping fallback scope is allowed. +The validator loads `.ci/behavior-ownership/partition.v1.json` only from the +protected base or the approved foundation commit and verifies its digest before +reading population records. A population PR that changes, relocates, or shadows +the partition fails before ownership validation. +## Not allowed +```text +backend/app/**; runtime behavior; DB behavior; workflows; test weakening +``` +## Acceptance criteria +- [ ] Every target assigned to `shared` by the foundation partition is reviewed or structural-only; no other target is changed. +- [ ] Composition, DB, lock, async-execution, and script boundaries are explicit. +- [ ] No target appears in multiple groups. +- [ ] The validator collects and runs every exact pytest node referenced by changed records. +- [ ] Shared population uses the foundation's schema-locked `structural_only` status only where its AST criteria prove no executable callable. +## Verification commands +```bash +(cd backend && .venv/bin/python -m scripts.behavior_ownership validate --group shared --run-owned-tests) +git diff --check origin/main...HEAD +``` +## Required reviewers +Architecture, senior engineering, QA, security, CI integrity, reuse/dedup, and test delta. +## Human review focus +Composition roots, DB/locks, async execution, and scripts. +## Stop conditions +Stop if structural-only hides executable behavior. diff --git a/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-04-completeness-preparation.md b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-04-completeness-preparation.md new file mode 100644 index 00000000..8d018895 --- /dev/null +++ b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-04-completeness-preparation.md @@ -0,0 +1,50 @@ +# Chunk Contract: WS-QUAL-002-04 — Catalogue Completeness And PR Preparation + +## Parent initiative +`WS-QUAL-002` — Behavior Ownership Catalogue +## Goal +Require current catalogue data and provide one-command PR preparation. +## Why this chunk exists +Ownership must be machine-visible before implementation review. +## Approved plan reference +- INTENT: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/CHUNK_MAP.md` +## Risk class +L1. +## SLA +P2. +## Allowed files +```text +backend/scripts/behavior_ownership.py +backend/tests/test_behavior_ownership.py +scripts/test_lightweight_agent_gates.py +scripts/workstream_agent_gate.py +CONTRIBUTING.md +docs/operations_backend_testing.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/STATUS.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/reviews/WS-QUAL-002-04-* +``` +## Not allowed +```text +mutation reactivation; backend/app/**; coverage weakening; administrator approval gates +``` +## Acceptance criteria +- [ ] All current eligible targets reconcile exactly. +- [ ] Tests collect and candidates cannot satisfy completeness. +- [ ] One command reports ready selection or precise new/remapped gaps. +- [ ] The contributor interface remains `python3 scripts/workstream_agent_gate.py`; its structured output adds a `behavior_ownership` result containing `ready`, exact selected callables, and typed new/remapped gaps while preserving all existing gate findings. +## Verification commands +```bash +(cd backend && .venv/bin/python -m pytest -q tests/test_behavior_ownership.py) +PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -m pytest -q scripts/test_lightweight_agent_gates.py +python3 scripts/workstream_agent_gate.py --base origin/main --head HEAD +git diff --check origin/main...HEAD +``` +## Required reviewers +Architecture, QA, security, CI integrity, docs, reuse/dedup, and test delta. +## Human review focus +No admin action and precise contributor repair. +## Stop conditions +Stop if unrelated work is blocked ambiguously. Changes to this contract require +parent-initiative approval and are outside the chunk's own write authority. diff --git a/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-05-mutation-reactivation.md b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-05-mutation-reactivation.md new file mode 100644 index 00000000..f7ebe715 --- /dev/null +++ b/.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-05-mutation-reactivation.md @@ -0,0 +1,65 @@ +# Chunk Contract: WS-QUAL-002-05 — Changed-Line-Aware Mutation Reactivation + +## Parent initiative +`WS-QUAL-002` — Behavior Ownership Catalogue +## Goal +Reactivate mutation through protected catalogue ownership and exact changed-line +selection, then prove AUTH no longer pauses. +## Why this chunk exists +This delivers reusable ownership without restoring retired callable-wide mutation. +## Approved plan reference +- INTENT: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/INTENT.md` +- PLAN: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/PLAN.md` +- CHUNK_MAP: `.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/CHUNK_MAP.md` +## Risk class +L1. +## SLA +P1. +## Allowed files +```text +backend/scripts/mutation_policy.py +backend/tests/test_mutation_policy.py +backend/scripts/behavior_ownership.py +backend/tests/test_behavior_ownership.py +.github/workflows/behavior-mutation.yml +CONTRIBUTING.md +docs/operations_backend_testing.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/STATUS.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/chunks/WS-QUAL-002-05-mutation-reactivation.md +.agent-loop/initiatives/WS-QUAL-002-behavior-ownership-catalogue/reviews/WS-QUAL-002-05-* +``` +## Not allowed +```text +backend/app/**; migrations; global or callable-wide mutation; scores; exemptions; PR authority for existing ownership; test weakening; .github/workflows/mutation-pilot.yml +``` +## Acceptance criteria +- [ ] Existing callables resolve from the catalogue physically loaded from the exact protected base SHA, never from PR head, without manual claims. +- [ ] The selection contract adds exact changed executable line/span data beside each containing callable, and the mutation runner consumes those spans—not callable names alone—when constructing final mutation input. +- [ ] Selection contains only changed executable spans and their exact containing callables; unchanged executable lines fail closed if selected. +- [ ] Negative tests prove that a one-line executable change selects only that line, never unchanged executable sibling lines in the same callable. +- [ ] Negative tests inspect the runner's final mutation input and reject unchanged executable lines, callable-wide/full-callable selectors, and any new workflow reference to the retired `mutation-pilot.yml`. +- [ ] A blocking pre-reactivation scan rejects active workflow, script, or configuration references to retired callable-wide workflow paths, selectors, or claim authority. +- [ ] New/remapped callables require additive validated PR-head records and cannot replace protected records. +- [ ] Effective selection resolves each validated `supersedes_behavior_id` before building mutation input and yields exactly one reviewed owner for every changed executable span; zero or multiple owners fail closed. +- [ ] Selection tests reject remaps with missing protected absence/rename proof, nonexistent PR-head locations, narrowed carry-forward evidence, or attempts to delete or replace protected ownership. +- [ ] PR data that deletes, narrows, downgrades, changes tests/outcomes/boundaries, or otherwise replaces existing protected reviewed ownership fails closed. +- [ ] Negative tests prove forged PR-head ownership cannot affect protected-base selection and exact callable custody remains authoritative. +- [ ] AUTH rehearsal and hosted mutation pass within the current cap. +- [ ] The retired `mutation-pilot.yml` workflow remains absent and unreferenced. +- [ ] Historical `.ci/behavior-claims/**` data remains inactive; no workflow, selector, or contributor command reads it as mutation authority. +- [ ] The new workflow emits one stable PR check on every pull request, has no workflow-level path filter, and resolves unrelated changes through an internal `not_applicable` preflight before mutation dependencies install or execute. +- [ ] Human explicitly approves mutation reactivation. +## Verification commands +```bash +(cd backend && .venv/bin/python -m pytest -q tests/test_behavior_ownership.py tests/test_mutation_policy.py) +PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -m pytest -q scripts/test_lightweight_agent_gates.py +git diff --check origin/main...HEAD +``` +## Required reviewers +Architecture, senior engineering, QA, security, product/ops, CI integrity, docs, reuse/dedup, and test delta. +## Human review focus +Protected engineering-gate custody, changed-line selection, additive flow, AUTH +usability, and hosted runtime. +## Stop conditions +Stop if catalogue is incomplete, AUTH still needs routine claims, unchanged +lines enter selection, or the retired 05M workflow would be restored.