feat: add durable role text over local and WebSocket connections #66

Merged

morten-olsen merged 11 commits from feat/c6a4b291-durable-conversations into main 2026-10-20 19:59:23 +02:00

Conversation 1 Commits 11 Files changed 82 +7125 -505

morten-olsen commented 2026-10-20 18:32:52 +02:00

Owner

• Copy link
• Copy Markdown

Summary

Roles now exchange durable text through one SQLite queue/history and shared delivery implementation. Local and WebSocket adapters share ordering, deduplication and permissions; only acknowledgements confirm acceptance. Replies are ordinary messages; forwarding selected text to a human is an explicit, locally authorized CLI action. The old ask/answer path is removed, preserving its historical human messages.

role CLI → SQLite sender queue → local | WebSocket → saved text + receiving work → ack
                                                          ↓
                                      existing RunHost + local runtime sponsor
Settings → pairing approvals → exposures / private grants → history and revocation

Six tables reuse Kysely and existing sealed-secret handling. A third run subject reuses the runtime host. Settings shares props-fed presentations with phone/desktop stories. agent connections discovers configured IDs/destinations and the caller's private send grants.

Evidence

• Before: role asks used human contexts and automatic answer forwarding; Settings had no connection setup. Migration tests preserve existing human messages, legacy role markers and run/event/transcript references.
• After: current PR pipeline #466 and push #465 passed at d438a759: 129 files / 862 tests, docs, deployment-tool checks and both server/agent image builds. Current targeted delivery and runtime regressions pass, including lost text/acks, file-backed restart, independent ordered pairs, token renewal, revocation, live destinations, safe pairing retry, real runtime-failure recovery and the full human → PA → peer → PA → explicit local human flow over both adapters. The peer history excludes the local human conversation ID.
• Four rebuilt phone/desktop Settings cases passed. Storybook built; browser checks exercised shared list, export/import approval, permissions/revocation and history presentations at both sizes. Screenshots/acceptance matrix are in the parent task. Independent self-review findings are resolved.
• Handwritten additions: 3,762 production (+4.5% above the 3,600 estimate after required presentation extraction), 1,903 tests/stories/fixtures; combined size remains inside the approved range. No additional feature outcome or transport. Native Android file sharing remains unverified; deployed delivery/Settings checks are recorded below.

Merge danger

Door: one-way
Migration 037 adds six tables and rebuilds runs for a third subject, preserving existing records. Destructive downgrade is refused. Morten approved migration/socket/release deployment and personally squash merged this PR. v0.49.0 is now deployed at 972bb75a through apps 0e5f8a41. The socket uses the existing private TLS gateway at wss://mission-control.olsen.cloud/api/agent-connections/socket. Security review found zero issues; the approved customized instruction is preserved and its three contexts rendered successfully live.

Blast radius: app
Task/human runs share the migrated table and runtime host. Durable acceptance is separate from subsequent agent work.

Rollback and verification

• Roll back: retain migration 037 in the registry, run-subject support and every text record in a compatible recovery image or forward fix. The pre-037 binary cannot open the new migration registry. Never drop tables, delete text or restore a database without Morten's approval.
• Verify after rollout: green server/agent release pipelines, Forgejo mirror, expected Argo revision and actual image digests/replicas/claims; then live setup, text/reply, disconnect/retry, history, authorized local human forwarding and existing human/task behavior.
• Reviews: Security Engineer completed review of d438a759: Standards 0 findings, Spec 0 findings; 40 independent focused tests passed. Morten approved the customized organizational instruction; its live hash matches. Morten must still approve migration 037 and the authenticated socket route at wss://mission-control.olsen.cloud/api/agent-connections/socket, plus stable release publication that triggers deployment. No Designer sign-off was requested.

Rollout evidence

• Main #467 and release #468 are green, including both images, automatic deployment and Android.
• Argo is Synced/Healthy at apps 0e5f8a41. Actual server digest f09bbb2a…, new agent digest df6207e5…, server1/1 ready, same Bound PVC. Every pre-migration captured record ID remains; schema037 and zero FK violations.
• Actual direct and private-TLS WebSocket text/reply, lost-ack single-copy acceptance, file-backed peer restart, token renewal, invalid/wrong-audience authentication, live destination rejection, offline retry, revocation and explicit authorized human forwarding passed. Phone/desktop Settings saves/history passed with no page errors. Isolated fixture connections are revoked and records retained.
• Live actors use scripted role CLI actions and the peer's ACP stand-in; the isolated deployed account correctly waits for a runtime configuration, with no real model credentials used. Full ACP human/PA flow over both adapters is also covered by the 862-test suite.
• Task evidence and screenshots. Native device file-sharing check proposed as b904b93f; delivery-path skill correction proposed as11ff6e9e.

## Summary Roles now exchange durable text through one SQLite queue/history and shared delivery implementation. Local and WebSocket adapters share ordering, deduplication and permissions; only acknowledgements confirm acceptance. Replies are ordinary messages; forwarding selected text to a human is an explicit, locally authorized CLI action. The old ask/answer path is removed, preserving its historical human messages. ```text role CLI → SQLite sender queue → local | WebSocket → saved text + receiving work → ack ↓ existing RunHost + local runtime sponsor Settings → pairing approvals → exposures / private grants → history and revocation ``` Six tables reuse Kysely and existing sealed-secret handling. A third run subject reuses the runtime host. Settings shares props-fed presentations with phone/desktop stories. `agent connections` discovers configured IDs/destinations and the caller's private send grants. ## Evidence - **Before:** role asks used human contexts and automatic answer forwarding; Settings had no connection setup. Migration tests preserve existing human messages, legacy role markers and run/event/transcript references. - **After:** [current PR pipeline #466](https://woodpecker.olsen.cloud/repos/32/pipeline/466) and [push #465](https://woodpecker.olsen.cloud/repos/32/pipeline/465) passed at `d438a759`: 129 files / 862 tests, docs, deployment-tool checks and both server/agent image builds. Current targeted delivery and runtime regressions pass, including lost text/acks, file-backed restart, independent ordered pairs, token renewal, revocation, live destinations, safe pairing retry, real runtime-failure recovery and the full human → PA → peer → PA → explicit local human flow over both adapters. The peer history excludes the local human conversation ID. - Four rebuilt phone/desktop Settings cases passed. Storybook built; browser checks exercised shared list, export/import approval, permissions/revocation and history presentations at both sizes. Screenshots/acceptance matrix are in the parent task. Independent self-review findings are resolved. - Handwritten additions: 3,762 production (+4.5% above the 3,600 estimate after required presentation extraction), 1,903 tests/stories/fixtures; combined size remains inside the approved range. No additional feature outcome or transport. Native Android file sharing remains unverified; deployed delivery/Settings checks are recorded below. ## Merge danger **Door:** one-way Migration 037 adds six tables and rebuilds `runs` for a third subject, preserving existing records. Destructive downgrade is refused. Morten approved migration/socket/release deployment and personally squash merged this PR. v0.49.0 is now deployed at `972bb75a` through apps `0e5f8a41`. The socket uses the existing private TLS gateway at `wss://mission-control.olsen.cloud/api/agent-connections/socket`. Security review found zero issues; the approved customized instruction is preserved and its three contexts rendered successfully live. **Blast radius:** app Task/human runs share the migrated table and runtime host. Durable acceptance is separate from subsequent agent work. ## Rollback and verification - **Roll back:** retain migration 037 in the registry, run-subject support and every text record in a compatible recovery image or forward fix. The pre-037 binary cannot open the new migration registry. Never drop tables, delete text or restore a database without Morten's approval. - **Verify after rollout:** green server/agent release pipelines, Forgejo mirror, expected Argo revision and actual image digests/replicas/claims; then live setup, text/reply, disconnect/retry, history, authorized local human forwarding and existing human/task behavior. - **Reviews:** [Security Engineer](https://code.olsen.cloud/ai/mission-control/pulls/66#issuecomment-4205) completed review of `d438a759`: Standards 0 findings, Spec 0 findings; 40 independent focused tests passed. Morten approved the customized organizational instruction; its live hash matches. Morten must still approve migration 037 and the authenticated socket route at `wss://mission-control.olsen.cloud/api/agent-connections/socket`, plus stable release publication that triggers deployment. No Designer sign-off was requested. ## Rollout evidence - Main [#467](https://woodpecker.olsen.cloud/repos/32/pipeline/467) and release [#468](https://woodpecker.olsen.cloud/repos/32/pipeline/468) are green, including both images, automatic deployment and Android. - Argo is Synced/Healthy at apps `0e5f8a41`. Actual server digest `f09bbb2a…`, new agent digest `df6207e5…`, server1/1 ready, same Bound PVC. Every pre-migration captured record ID remains; schema037 and zero FK violations. - Actual direct and private-TLS WebSocket text/reply, lost-ack single-copy acceptance, file-backed peer restart, token renewal, invalid/wrong-audience authentication, live destination rejection, offline retry, revocation and explicit authorized human forwarding passed. Phone/desktop Settings saves/history passed with no page errors. Isolated fixture connections are revoked and records retained. - Live actors use scripted role CLI actions and the peer's ACP stand-in; the isolated deployed account correctly waits for a runtime configuration, with no real model credentials used. Full ACP human/PA flow over both adapters is also covered by the 862-test suite. - [Task evidence and screenshots](https://mission-control.olsen.cloud/task/c6a4b291-685f-4ed6-86dc-bdb87b3f8fe2). Native device file-sharing check proposed as b904b93f; delivery-path skill correction proposed as11ff6e9e.

morten-olsen added 3 commits 2026-10-20 18:32:53 +02:00

feat(agent): persist text delivery across local and websocket transports 43d46a6fda

feat(app): configure agent connections and inspect durable history 4ffa12cb56

docs(agent): explain pairing permissions delivery and local forwarding 61b64dd33c

morten-olsen added 1 commit 2026-10-20 18:34:41 +02:00

test(agent): prove retry of text lost before acceptance f9f8fad2cc

morten-olsen added 1 commit 2026-10-20 18:39:48 +02:00

feat(cli): discover configured agent destinations and send grants 3440d7133c

morten-olsen added 1 commit 2026-10-20 18:41:34 +02:00

fix(agent): allow JSON expansion of bounded text frames 323bf9b269

morten-olsen added 1 commit 2026-10-20 18:44:25 +02:00

refactor(agent): keep authorization in services and CLI commands by noun eabb7b10da

morten-olsen added 1 commit 2026-10-20 18:46:50 +02:00

test(agent): keep human forwarding target local in runtime fixtures f105e85ed3

morten-olsen added 3 commits 2026-10-20 19:01:12 +02:00

fix(agent): retry failed receiving runs on new accepted work d97981e0fd

refactor(app): share agent connection presentations with device stories 170ee28f83

docs(cli): describe agent send and history delivery semantics d438a75980

morten-olsen reviewed 2026-10-20 19:13:19 +02:00

morten-olsen left a comment

• Copy link
• Copy Markdown

Security review at d438a759 against base 0a548350. Standards: no blocking or nonblocking findings; checked human-owner setup/configuration ACLs, secret sealing/rekey, serializers, image/privilege/RBAC scope and green Forgejo statuses for PR pipeline 466 and push 465. Spec: no blocking or nonblocking findings; traced invitation single use/exact replay, key pinning, mutual JWT purpose/issuer/audience/CID/expiry, authenticated rejection and permanent revocation, private grants/receiver exposure, bounded work, durable deduplication/ordered retry, local sponsor/run-token selection and explicit authorized human forwarding. Independently ran 40 tests in 7 files: all passed, including real sockets, both delivery contracts, restarts, runtime flow, API ACLs and migration preservation; diff check passed. Paired installation is the trust boundary for remote role authorship; selected text can invoke the exposed local role's existing authority. Live deployment remains 0.48.0; feature production behavior and native sharing unverified. Morten must still approve migration 037/socket exposure, and organizational compatibility blocker 65c2d692 remains. Software Engineer owns rollout and must verify approved endpoint/revision, pairing/text/forwarding/revocation live. Recovery must retain schema/registry/third-subject support and all durable text; incompatible pre-037 images and destructive down are unsuitable. Not deployment approval or risk acceptance. Full evidence recorded on security review task a6d915e0. Standards: 0 findings, worst none. Spec: 0 findings, worst none.

Security review at d438a759 against base 0a548350. Standards: no blocking or nonblocking findings; checked human-owner setup/configuration ACLs, secret sealing/rekey, serializers, image/privilege/RBAC scope and green Forgejo statuses for PR pipeline 466 and push 465. Spec: no blocking or nonblocking findings; traced invitation single use/exact replay, key pinning, mutual JWT purpose/issuer/audience/CID/expiry, authenticated rejection and permanent revocation, private grants/receiver exposure, bounded work, durable deduplication/ordered retry, local sponsor/run-token selection and explicit authorized human forwarding. Independently ran 40 tests in 7 files: all passed, including real sockets, both delivery contracts, restarts, runtime flow, API ACLs and migration preservation; diff check passed. Paired installation is the trust boundary for remote role authorship; selected text can invoke the exposed local role's existing authority. Live deployment remains 0.48.0; feature production behavior and native sharing unverified. Morten must still approve migration 037/socket exposure, and organizational compatibility blocker 65c2d692 remains. Software Engineer owns rollout and must verify approved endpoint/revision, pairing/text/forwarding/revocation live. Recovery must retain schema/registry/third-subject support and all durable text; incompatible pre-037 images and destructive down are unsuitable. Not deployment approval or risk acceptance. Full evidence recorded on security review task a6d915e0. Standards: 0 findings, worst none. Spec: 0 findings, worst none.

morten-olsen merged commit 972bb75a52 into main 2026-10-20 19:59:23 +02:00

morten-olsen deleted branch feat/c6a4b291-durable-conversations 2026-10-20 19:59:23 +02:00

morten-olsen referenced this pull request from a commit 2026-10-20 19:59:23 +02:00

feat: add durable role text over local and WebSocket connections (#66)

morten-olsen referenced this pull request from a commit 2026-10-21 07:17:58 +02:00

build: cli:install also builds the agent image

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

ai/mission-control!66

No description provided.