diff --git a/CHANGELOG.md b/CHANGELOG.md index 6dde056..baadf39 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,11 @@ Please choose versions by [Semantic Versioning](http://semver.org/). * MINOR version when you add functionality in a backwards-compatible manner, and * PATCH version when you make backwards-compatible bug fixes. +## Unreleased + +- fix: `work-on-task-assistant` Phase 5.5's permission-mode precheck matched only command literals (`kubectl`, `make apply`, `helm install`), so it stayed silent on tasks whose subtasks describe cluster mutations in prose. Observed 2026-08-16 on the same task that motivated the v0.111.1 gating fix: every subtask on "Decommission MinIO on Hell" was an operator-run mutation — *"Remove `minio` and `minio-console` ingresses"*, *"Scale the Tenant to zero"*, *"Delete Tenant CR, StatefulSet, services, PVC"* — none containing a command string, and the session's first `kubectl delete` was denied by the auto-mode classifier. The precheck now also fires on a destructive verb applied to an infra noun. A literal matcher cannot see work not yet written as commands, which is the normal state of a task at planning time and exactly when the warning is worth giving. +- fix: `task-creator` wrote `goals:` into a new task's frontmatter but never added the task's checkbox to the goal file, leaving the link one-way. `vault-cli task complete` ticks that checkbox and warns when it is absent, so every goal-linked task emitted `checkbox not found for task in goal ` on completion and had to be patched by hand — and until then the goal's task list under-reported its own scope. The creator now appends `- [ ] [[]]` to each parent goal's `# Tasks` section, idempotently, and the self-audit checks for it. + ## v0.111.3 - fix: `session-close` Phase 8.6's link check searched only the vault owning the file, so every legitimate cross-vault wikilink read as broken. Observed 2026-08-16: a `Personal` task linking `[[Boss Memory]]` was flagged unresolved because the search covered only `Personal` and `Trading` — the page lives in the `Boss` vault and is referenced by 20+ files across two others. Both the orphan check and the broken-outbound-link check now search every path in `VAULT_CONFIG` and treat a hit in any vault as resolved. Also fixes a shell trap in the same snippet: the paths must be read into an **array**, because the shell here is often zsh, which does not word-split an unquoted `"$paths"` string — a bare `grep ... $ALL_VAULT_PATHS` passes every path as one argument, grep fails, stderr is swallowed, and the empty result is indistinguishable from a clean one. Added a sanity check to run before trusting a negative. diff --git a/agents/task-creator.md b/agents/task-creator.md index f5e20ef..727f3c6 100644 --- a/agents/task-creator.md +++ b/agents/task-creator.md @@ -168,6 +168,29 @@ Compose the full file content (frontmatter + body) and write it via the `Write` {vault.path}/{tasks_dir}/{filename} ``` +## 11b. Link the parent goal back + +`goals:` in the task's frontmatter is only half the link. `vault-cli task complete` ticks +the task's checkbox **in the goal file** and warns when it cannot find one, so the creator +must write that side too. + +For each entry in `goals:`, resolve `{vault.path}/{goals_dir}/{goal title}.md` and append +to its `# Tasks` section (create the section above `# Related` if absent): + +``` +- [ ] [[{task title}]] +``` + +Skip silently when the task has no parent goal, when the goal file does not exist, or when +a checkbox for this task is already present (re-runs must not duplicate). + +**Why.** Observed 2026-08-16: `Decommission MinIO on Hell` was created with +`goals: ['[[Eliminate MinIO EOL Risk]]']` and the goal was never touched. Completing it +emitted `failed to update goal [[Eliminate MinIO EOL Risk]]: checkbox not found for task +Decommission MinIO on Hell`, and the line had to be added by hand. Every goal-linked task +created by this agent hits the same warning, and a goal whose task list silently omits its +own tasks under-reports its own progress. + ## 12. Audit (interactive only) Run a light self-audit against the file: @@ -176,6 +199,7 @@ Run a light self-audit against the file: - Title file matches title-case rule - Body has Success Criteria + Tasks sections (or template body) - No accidental empty sections +- Every `goals:` entry has a matching `- [ ] [[{task title}]]` checkbox in the goal file (step 11b) Skip in MODE=non_interactive. diff --git a/agents/work-on-task-assistant.md b/agents/work-on-task-assistant.md index aa62f7b..9ad626d 100644 --- a/agents/work-on-task-assistant.md +++ b/agents/work-on-task-assistant.md @@ -170,6 +170,13 @@ workflow extracted in Phase 5, for operator-run mutations: `annotate`, `patch`, `rollout restart`, `scale`) · `helm install/upgrade` · ssh deploys · any prod runbook step. +**Match described intent, not only command literals.** Task bodies are written in prose +— "remove the ingresses", "scale the tenant to zero" — and frequently contain no command +string at all. Also fire when a destructive verb (remove · delete · drop · tear down · +scale · restart · cut over · reclaim · uninstall · apply · deploy) is applied to an infra +noun (ingress · namespace · deployment · statefulset · pod · PVC · PV · CRD · secret · +tenant · DNS record · cluster · node · release). + If any are present, append verbatim to the report: > 🔐 **Permission mode:** this task's ops commands need `accept edits` — switch @@ -187,6 +194,16 @@ wholesale, and the precheck never ran. Every `decommission` / `renew` / `rebuild while `deploy X` would have been covered. Keying on the task's own commands rather than on a code-task title heuristic is the fix. +**The same task then exposed the next layer (2026-08-16, v0.111.3).** With the gating +fixed, the precheck ran on "Decommission MinIO on Hell" and still emitted nothing — +because every subtask described a cluster mutation in prose and none contained a command +literal: *"Remove `minio` and `minio-console` ingresses"*, *"Scale the Tenant to zero"*, +*"Delete Tenant CR, StatefulSet, services, PVC"*. The first `kubectl delete` of the +session was then denied by the auto-mode classifier. A matcher keyed on command strings +cannot see work that has not been written as commands yet — which is the normal state of +a task at planning time, and precisely when this warning is worth giving. Hence the +verb-plus-noun rule above. + **Why the precheck exists at all.** Stating the operator/agent split is not enough. Observed 2026-08-16: the workflow block correctly said "the **operator** runs the cluster mutations", and the session still spent ~40 minutes handing back command