72 lines
3.1 KiB
YAML
72 lines
3.1 KiB
YAML
name: bug-ancestor-auto-advance
|
|
version: 1
|
|
description: >-
|
|
M43 demo — script-only auto-advance for a bug whose parent milestone carries
|
|
the opt-in tag. Functionally what R1 (bug-ai-resolve-seed) does today, minus
|
|
the per-bug tagging step: the trigger rule matches on the PARENT's tag
|
|
(match.ancestor, spec/workflow-triggers.md §3c), this workflow re-checks the
|
|
link in-band, tags the bug `ai-resolve` (so the existing R2 verify rule picks
|
|
it up), then transitions it to verify-pending. Zero LLM nodes.
|
|
runtime: script
|
|
input:
|
|
# A freshly-created bug has no flow_state yet, so eligibility sees its
|
|
# lifecycle state (ItemView.workflow_state = flow_state or state). Accept
|
|
# both lifecycle spellings seen across backends.
|
|
state: pending
|
|
tags_required: []
|
|
tags_forbidden: [blocked, paused, ai-resolve]
|
|
required_artifacts: []
|
|
escalation_input_states: [pending, open]
|
|
output:
|
|
state: verify-pending
|
|
scope_budget:
|
|
# Schema minimum is 1; no node here touches a repo, so these are nominal.
|
|
files_modified_max: 1
|
|
lines_diff_max: 1
|
|
wall_clock_seconds_max: 300
|
|
nodes:
|
|
# Gate: re-verify in-band that the parent milestone still carries the
|
|
# opt-in tag (the trigger's ancestor read may be up to 60s stale on the
|
|
# consumer path, WT-ANC-5). Fails closed — refuse_dispatch on a miss.
|
|
- id: parent-link-check
|
|
kind: script
|
|
cmd: scripts/workflow/parent-link-check
|
|
on_fail: refuse_dispatch
|
|
runtime_env:
|
|
CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
|
|
WORKFLOW_ITEM_UUID: "${item.uuid}"
|
|
PARENT_LINK_TAG: auto-resolve-bugs
|
|
PARENT_LINK_RELATION: parent
|
|
# Opt the bug into the existing verify pipeline (R2 bug-ai-resolve-verify
|
|
# requires tags_required: [ai-resolve]).
|
|
- id: tag-ai-resolve
|
|
kind: script
|
|
cmd: scripts/workflow/tag-set
|
|
depends_on: [parent-link-check]
|
|
on_fail: escalate
|
|
runtime_env:
|
|
CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
|
|
WORKFLOW_ITEM_UUID: "${item.uuid}"
|
|
TAG_SET_ADD: ai-resolve
|
|
# Advance the bug; R2 then dispatches bug-verify-sonnet@1 at verify-pending.
|
|
- id: state-tx
|
|
kind: script
|
|
cmd: scripts/workflow/state-tx
|
|
depends_on: [tag-ai-resolve]
|
|
on_fail: escalate
|
|
runtime_env:
|
|
CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
|
|
STATE_TX_NEW_STATE: verify-pending
|
|
# NOTE (script-node credentials, M43): kind: script nodes are harness-exempt
|
|
# (WF-COMP-6) but now carry the AU-51 internal-service bearer token by
|
|
# default — see spec/typed-workflows.md WF-COMP-26. The compiler emits
|
|
# `secrets_required: [CP_SERVICE_TOKEN]` and
|
|
# `runtime_env.CP_SERVICE_TOKEN_FILE=/run/secrets/CP_SERVICE_TOKEN` on
|
|
# every script node; the dispatcher's `_run_script_task` legacy-key
|
|
# branch mounts the dispatcher-process-env CP_SERVICE_TOKEN value as a
|
|
# file. All three nodes above read it via
|
|
# `open(os.environ["CP_SERVICE_TOKEN_FILE"]).read().strip()`. Each script
|
|
# still resolves its own actor identity (OIDC_IDENTITY_EMAIL or
|
|
# CP_Caller-Identity header — see scripts/workflow/tag-set and
|
|
# parent-link-check) for the write envelope.
|