agentboard 0.2.0

data/app/javascript/agentboard/capture.js

@@ -0,0 +1,299 @@
+// AgentBoard capture widget — injected into the host app's pages by Agentboard::Capture::Middleware.
+// Select elements on any screen and turn them into an AgentBoard ticket. No dependencies.
+// Everything lives in a closed Shadow DOM so the host app's CSS and ours never collide.
+(() => {
+  if (window.__agentboardCapture) return
+  window.__agentboardCapture = true
+  const script = document.currentScript
+  const cfg = JSON.parse(script?.dataset.agentboardCapture || "{}")
+  const consoleErrors = []
+
+  // --- console error collection (messages only, capped) ----------------------------------
+  const push = (msg) => { consoleErrors.push(String(msg).slice(0, 500)); if (consoleErrors.length > 20) consoleErrors.shift() }
+  const origError = console.error
+  console.error = function (...args) { push(args.map(a => (a && a.message) || a).join(" ")); return origError.apply(this, args) }
+  window.addEventListener("error", e => push(`${e.message} @ ${e.filename || ""}:${e.lineno || ""}`))
+  window.addEventListener("unhandledrejection", e => push(`Unhandled rejection: ${e.reason && (e.reason.message || e.reason)}`))
+
+  // --- helpers ----------------------------------------------------------------------------
+  const cssEscape = (s) => (window.CSS && CSS.escape) ? CSS.escape(s) : String(s).replace(/[^\w-]/g, "\\$&")
+  function selectorFor(el) {
+    if (el.id) return `#${cssEscape(el.id)}`
+    const parts = []
+    let node = el
+    while (node && node.nodeType === 1 && parts.length < 5 && node !== document.body) {
+      const testid = node.getAttribute("data-testid") || node.getAttribute("data-test")
+      if (testid) { parts.unshift(`[data-testid="${testid}"]`); break }
+      if (node.id) { parts.unshift(`#${cssEscape(node.id)}`); break }
+      let part = node.tagName.toLowerCase()
+      const cls = [...node.classList].filter(c => !/^(is-|has-|active|hover|focus|ab-)/.test(c)).slice(0, 2)
+      if (cls.length) part += "." + cls.map(cssEscape).join(".")
+      const same = node.parentElement ? [...node.parentElement.children].filter(c => c.tagName === node.tagName) : []
+      if (same.length > 1) part += `:nth-of-type(${same.indexOf(node) + 1})`
+      parts.unshift(part)
+      node = node.parentElement
+    }
+    return parts.join(" > ")
+  }
+
+  // Rails' annotate_rendered_view_with_filenames wraps each template in
+  // <!-- BEGIN app/views/x.html.erb --> … <!-- END app/views/x.html.erb -->. Walk backwards
+  // through siblings and ancestors; the first BEGIN without a matching END encloses `el`.
+  function templateFor(el) {
+    const closed = new Set()
+    let node = el
+    while (node && node !== document) {
+      let sib = node.previousSibling
+      while (sib) {
+        if (sib.nodeType === 8) {
+          const text = sib.nodeValue.trim()
+          if (text.startsWith("END ")) closed.add(text.slice(4))
+          else if (text.startsWith("BEGIN ")) { const path = text.slice(6); if (!closed.has(path)) return path }
+        }
+        sib = sib.previousSibling
+      }
+      node = node.parentNode
+    }
+    return null
+  }
+
+  function htmlSnippet(el) {
+    const clone = el.cloneNode(true)
+    clone.querySelectorAll?.("input, textarea, select").forEach(i => { i.removeAttribute("value"); if (i.tagName === "TEXTAREA") i.textContent = "" })
+    if (clone.tagName === "INPUT") clone.removeAttribute("value")
+    return clone.outerHTML.slice(0, 2000)
+  }
+
+  const describe = (el) => {
+    const r = el.getBoundingClientRect()
+    return { el, selector: selectorFor(el), template: templateFor(el), text: (el.innerText || "").trim().slice(0, 300),
+             html: htmlSnippet(el), rect: { x: r.x + scrollX, y: r.y + scrollY, width: r.width, height: r.height } }
+  }
+
+  // --- UI ---------------------------------------------------------------------------------
+  const host = document.createElement("div")
+  host.setAttribute("data-agentboard-capture-root", "")
+  document.documentElement.appendChild(host)
+  const root = host.attachShadow({ mode: "closed" })
+  root.innerHTML = `
+  <style>
+    :host { all: initial; }
+    * { box-sizing: border-box; font-family: Inter, ui-sans-serif, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+    .fab { position: fixed; right: 20px; bottom: 20px; z-index: 2147483646; display: flex; align-items: center; gap: 8px; height: 42px; padding: 0 16px 0 12px;
+      border: 0; border-radius: 21px; cursor: pointer; color: #fff; font-size: 13.5px; font-weight: 650;
+      background: linear-gradient(120deg,#6d6aff,#a855f7 55%,#ec4899); box-shadow: 0 10px 30px rgba(109,106,255,.45), 0 0 0 1px rgba(255,255,255,.15) inset; }
+    .fab:hover { filter: brightness(1.08); }
+    .fab kbd { font-size: 10.5px; opacity: .8; border: 1px solid rgba(255,255,255,.4); border-radius: 4px; padding: 0 4px; }
+    .mark { width: 18px; height: 18px; border-radius: 5px; background: rgba(255,255,255,.25); display: grid; place-items: center; }
+    .hl { position: absolute; z-index: 2147483645; pointer-events: none; border: 2px solid #7c7aff; background: rgba(124,122,255,.12); border-radius: 4px; transition: all .06s; }
+    .hl.sel { border-color: #ec4899; background: rgba(236,72,153,.12); }
+    .hl .lbl { position: absolute; left: -2px; top: -24px; white-space: nowrap; font-size: 11px; font-weight: 600; color: #fff; background: #7c7aff; padding: 3px 7px; border-radius: 5px; font-family: ui-monospace, Menlo, monospace; }
+    .hl.sel .lbl { background: #ec4899; }
+    .bar { position: fixed; top: 16px; left: 50%; transform: translateX(-50%); z-index: 2147483646; display: flex; gap: 10px; align-items: center; padding: 8px 10px 8px 14px;
+      border-radius: 12px; background: #111118; color: #ededf2; font-size: 13px; box-shadow: 0 12px 40px rgba(0,0,0,.4); border: 1px solid #2a2a35; }
+    .btn { height: 32px; padding: 0 12px; border-radius: 8px; border: 1px solid #33333f; background: #1b1b24; color: #ededf2; font-size: 13px; font-weight: 600; cursor: pointer; }
+    .btn:hover { background: #24242f; }
+    .btn.primary { border: 0; color: #fff; background: linear-gradient(120deg,#6d6aff,#a855f7); }
+    .btn[disabled] { opacity: .5; cursor: default; }
+    .panel { position: fixed; top: 0; right: 0; bottom: 0; width: min(420px, 100vw); z-index: 2147483647; background: #101016; color: #ededf2; border-left: 1px solid #262630;
+      box-shadow: -20px 0 60px rgba(0,0,0,.45); display: flex; flex-direction: column; animation: slide .22s cubic-bezier(.2,.8,.2,1); }
+    @keyframes slide { from { transform: translateX(30px); opacity: 0 } }
+    .ph { display: flex; align-items: center; gap: 10px; padding: 16px 18px; border-bottom: 1px solid #262630; font-weight: 700; font-size: 15px; }
+    .ph .x { margin-left: auto; background: none; border: 0; color: #8d8d9c; font-size: 20px; cursor: pointer; }
+    .pb { padding: 16px 18px; overflow: auto; flex: 1; display: grid; gap: 14px; align-content: start; }
+    label { display: grid; gap: 6px; font-size: 12px; font-weight: 600; color: #a9a9b8; }
+    input, textarea, select { width: 100%; font-size: 14px; color: #ededf2; background: #17171f; border: 1px solid #2f2f3b; border-radius: 9px; padding: 9px 11px; }
+    textarea { min-height: 84px; resize: vertical; }
+    input:focus, textarea:focus, select:focus { outline: none; border-color: #7c7aff; box-shadow: 0 0 0 3px rgba(124,122,255,.25); }
+    .seg { display: flex; gap: 6px; }
+    .seg button { flex: 1; height: 32px; border-radius: 8px; border: 1px solid #2f2f3b; background: #17171f; color: #a9a9b8; font-size: 13px; font-weight: 600; cursor: pointer; }
+    .seg button.on { border-color: #7c7aff; color: #fff; background: rgba(124,122,255,.18); }
+    .chips { display: grid; gap: 8px; }
+    .chip { display: grid; grid-template-columns: 1fr auto; gap: 4px 8px; padding: 9px 10px; border-radius: 9px; background: #17171f; border: 1px solid #2a2a35; font-size: 12px; }
+    .chip code { font-family: ui-monospace, Menlo, monospace; color: #c4c3ff; word-break: break-all; }
+    .chip .tpl { grid-column: 1 / -1; color: #86efac; font-family: ui-monospace, Menlo, monospace; font-size: 11.5px; }
+    .chip .rm { background: none; border: 0; color: #8d8d9c; cursor: pointer; font-size: 15px; }
+    .meta { font-size: 12px; color: #8d8d9c; line-height: 1.6; }
+    .meta code { color: #c9c9d3; font-family: ui-monospace, Menlo, monospace; }
+    .check { display: flex; align-items: center; gap: 8px; font-size: 13px; color: #c9c9d3; font-weight: 500; }
+    .check input { width: auto; }
+    .shot { width: 100%; border-radius: 9px; border: 1px solid #2a2a35; }
+    .pro { font-size: 10px; font-weight: 800; padding: 1px 6px; border-radius: 5px; background: rgba(245,158,11,.18); color: #fbbf24; }
+    .pf { padding: 14px 18px; border-top: 1px solid #262630; display: flex; gap: 10px; }
+    .pf .btn { flex: 1; height: 40px; }
+    .toast { position: fixed; right: 20px; bottom: 74px; z-index: 2147483647; padding: 12px 14px; border-radius: 12px; background: #111118; color: #ededf2; font-size: 13.5px;
+      border: 1px solid #2a2a35; box-shadow: 0 12px 40px rgba(0,0,0,.4); max-width: 340px; }
+    .toast a { color: #a9a7ff; font-weight: 650; }
+    .err { color: #fda4af; font-size: 12.5px; }
+  </style>
+  <button class="fab" part="fab" title="Capture elements into an AgentBoard ticket (Alt+Shift+A)"><span class="mark">◎</span>AgentBoard <kbd>⌥⇧A</kbd></button>`
+  const fab = root.querySelector(".fab")
+  const state = { selecting: false, selected: [], hover: null, screenshot: null, kind: "bug" }
+  let hoverBox = null, bar = null, panel = null
+  const boxes = new Map()
+
+  function box(el, cls, label) {
+    const b = document.createElement("div")
+    b.className = "hl " + cls
+    const r = el.getBoundingClientRect()
+    Object.assign(b.style, { left: `${r.x + scrollX}px`, top: `${r.y + scrollY}px`, width: `${r.width}px`, height: `${r.height}px`, position: "absolute" })
+    b.innerHTML = `<span class="lbl"></span>`
+    b.querySelector(".lbl").textContent = label
+    root.appendChild(b)
+    return b
+  }
+  const labelFor = (el) => { const t = templateFor(el); return t ? t.replace(/^app\/views\//, "") : el.tagName.toLowerCase() }
+  const isOurs = (el) => el === host || host.contains(el)
+
+  function onMove(e) {
+    const el = document.elementFromPoint(e.clientX, e.clientY)
+    if (!el || isOurs(el) || el === state.hover) return
+    state.hover = el
+    hoverBox?.remove()
+    hoverBox = box(el, "", labelFor(el))
+  }
+  function onClick(e) {
+    if (isOurs(e.target)) return
+    e.preventDefault(); e.stopPropagation()
+    const el = state.hover || e.target
+    const existing = state.selected.findIndex(s => s.el === el)
+    if (existing >= 0) { boxes.get(el)?.remove(); boxes.delete(el); state.selected.splice(existing, 1) }
+    else { if (!e.shiftKey) clearSelection(); state.selected.push(describe(el)); boxes.set(el, box(el, "sel", labelFor(el))) }
+    renderBar()
+    if (!e.shiftKey && state.selected.length) openPanel()
+  }
+  const blockEvent = (e) => { if (!isOurs(e.target)) { e.preventDefault(); e.stopPropagation() } }
+  function clearSelection() { boxes.forEach(b => b.remove()); boxes.clear(); state.selected = [] }
+
+  function startSelecting() {
+    if (state.selecting) return
+    state.selecting = true
+    document.addEventListener("mousemove", onMove, true)
+    document.addEventListener("click", onClick, true)
+    ;["mousedown", "mouseup", "submit"].forEach(t => document.addEventListener(t, blockEvent, true))
+    document.documentElement.style.cursor = "crosshair"
+    bar = document.createElement("div"); bar.className = "bar"; root.appendChild(bar); renderBar()
+  }
+  function stopSelecting() {
+    state.selecting = false
+    document.removeEventListener("mousemove", onMove, true)
+    document.removeEventListener("click", onClick, true)
+    ;["mousedown", "mouseup", "submit"].forEach(t => document.removeEventListener(t, blockEvent, true))
+    document.documentElement.style.cursor = ""
+    hoverBox?.remove(); hoverBox = null; bar?.remove(); bar = null
+  }
+  function renderBar() {
+    if (!bar) return
+    bar.innerHTML = `<span>Click an element · <b>Shift</b>+click to add more · <b>Esc</b> to cancel</span>
+      <button class="btn primary" data-next ${state.selected.length ? "" : "disabled"}>Continue (${state.selected.length})</button>`
+    bar.querySelector("[data-next]").onclick = () => openPanel()
+  }
+
+  function openPanel() {
+    stopSelecting()
+    panel?.remove()
+    panel = document.createElement("div"); panel.className = "panel"
+    const route = cfg.route || location.pathname
+    panel.innerHTML = `
+      <div class="ph">New AgentBoard ticket<button class="x" title="Close">×</button></div>
+      <div class="pb">
+        <label>Title<input data-title maxlength="200" value=""></label>
+        <div class="seg">${["bug", "feature", "task"].map(k => `<button type="button" data-kind="${k}" class="${k === state.kind ? "on" : ""}">${k[0].toUpperCase() + k.slice(1)}</button>`).join("")}</div>
+        <label>What's wrong or what should change?<textarea data-desc placeholder="Describe the problem or the change you want…"></textarea></label>
+        <label>Expected result <span style="font-weight:400;color:#6e6e7c">(becomes an acceptance criterion)</span><input data-expected placeholder="e.g. The total shows 2 decimals"></label>
+        <label>Priority<select data-priority><option value="0">Urgent</option><option value="1">High</option><option value="2" selected>Medium</option><option value="3">Low</option></select></label>
+        <div><div class="meta" style="margin-bottom:8px">Selected elements</div><div class="chips" data-chips></div>
+          <button class="btn" type="button" data-more style="margin-top:8px">+ Select more</button></div>
+        <label class="check"><input type="checkbox" data-console ${consoleErrors.length ? "checked" : ""}> Include console errors (${consoleErrors.length})</label>
+        <div data-shot-area>${cfg.screenshots ? `<button class="btn" type="button" data-shot>Attach screenshot of the selection</button>` :
+          `<div class="meta">Screenshots of the selection <span class="pro">PRO</span></div>`}</div>
+        <div class="meta">Page <code>${location.pathname}</code> · route <code>${route}</code><br>${(cfg.templates || []).length} templates rendered on this page</div>
+        <div class="err" data-error></div>
+      </div>
+      <div class="pf"><button class="btn" data-cancel>Cancel</button><button class="btn primary" data-submit>Create ticket</button></div>`
+    root.appendChild(panel)
+    const first = state.selected[0]
+    panel.querySelector("[data-title]").value = first ? `${state.kind === "bug" ? "Fix" : "Change"} ${first.text ? `“${first.text.slice(0, 50)}”` : first.selector.split(" > ").pop()} on ${route}` : `Issue on ${route}`
+    renderChips()
+    panel.querySelectorAll("[data-kind]").forEach(b => b.onclick = () => { state.kind = b.dataset.kind; panel.querySelectorAll("[data-kind]").forEach(x => x.classList.toggle("on", x === b)) })
+    panel.querySelector(".x").onclick = panel.querySelector("[data-cancel]").onclick = close
+    panel.querySelector("[data-more]").onclick = () => { panel.remove(); panel = null; startSelecting() }
+    panel.querySelector("[data-submit]").onclick = submit
+    panel.querySelector("[data-shot]")?.addEventListener("click", takeScreenshot)
+    setTimeout(() => panel.querySelector("[data-desc]").focus(), 50)
+  }
+  function renderChips() {
+    const list = panel.querySelector("[data-chips]")
+    list.innerHTML = ""
+    state.selected.forEach((s, i) => {
+      const c = document.createElement("div"); c.className = "chip"
+      c.innerHTML = `<code></code><button class="rm" title="Remove">×</button><span class="tpl"></span>`
+      c.querySelector("code").textContent = s.selector
+      c.querySelector(".tpl").textContent = s.template ? `↳ ${s.template}` : "↳ template unknown (enable annotate_rendered_view_with_filenames)"
+      c.querySelector(".rm").onclick = () => { boxes.get(s.el)?.remove(); boxes.delete(s.el); state.selected.splice(i, 1); renderChips() }
+      list.appendChild(c)
+    })
+  }
+
+  // Pro: capture the current tab once (the browser asks for permission) and crop to the
+  // union of the selected elements.
+  async function takeScreenshot() {
+    const area = panel.querySelector("[data-shot-area]")
+    try {
+      panel.style.visibility = "hidden"; boxes.forEach(b => b.style.visibility = "hidden")
+      const stream = await navigator.mediaDevices.getDisplayMedia({ video: { displaySurface: "browser" }, preferCurrentTab: true, audio: false })
+      const video = document.createElement("video"); video.srcObject = stream; await video.play()
+      await new Promise(r => setTimeout(r, 250))
+      const scale = video.videoWidth / innerWidth
+      const rects = state.selected.map(s => s.el.getBoundingClientRect())
+      const pad = 16
+      const x = Math.max(0, Math.min(...rects.map(r => r.left)) - pad), y = Math.max(0, Math.min(...rects.map(r => r.top)) - pad)
+      const w = Math.min(innerWidth, Math.max(...rects.map(r => r.right)) + pad) - x, h = Math.min(innerHeight, Math.max(...rects.map(r => r.bottom)) + pad) - y
+      const canvas = document.createElement("canvas"); canvas.width = w * scale; canvas.height = h * scale
+      canvas.getContext("2d").drawImage(video, x * scale, y * scale, w * scale, h * scale, 0, 0, canvas.width, canvas.height)
+      stream.getTracks().forEach(t => t.stop())
+      state.screenshot = canvas.toDataURL("image/png")
+      area.innerHTML = `<img class="shot" alt="Screenshot of the selection"><button class="btn" type="button" data-unshot style="margin-top:8px">Remove screenshot</button>`
+      area.querySelector("img").src = state.screenshot
+      area.querySelector("[data-unshot]").onclick = () => { state.screenshot = null; openPanel() }
+    } catch (err) {
+      area.insertAdjacentHTML("beforeend", `<div class="err">Screenshot cancelled or not supported in this browser.</div>`)
+    } finally {
+      if (panel) panel.style.visibility = ""; boxes.forEach(b => b.style.visibility = "")
+    }
+  }
+
+  async function submit() {
+    const btn = panel.querySelector("[data-submit]"); btn.disabled = true; btn.textContent = "Creating…"
+    const payload = { capture: {
+      title: panel.querySelector("[data-title]").value, description: panel.querySelector("[data-desc]").value,
+      expected: panel.querySelector("[data-expected]").value, kind: state.kind, priority: panel.querySelector("[data-priority]").value,
+      url: location.href, route: cfg.route, viewport: { width: innerWidth, height: innerHeight }, user_agent: navigator.userAgent,
+      templates: cfg.templates || [], console_errors: panel.querySelector("[data-console]").checked ? consoleErrors : [],
+      elements: state.selected.map(({ el, ...rest }) => rest), screenshot: state.screenshot || undefined
+    } }
+    try {
+      const res = await fetch(cfg.endpoint, { method: "POST", credentials: "same-origin",
+        headers: { "Content-Type": "application/json", Accept: "application/json", "X-CSRF-Token": document.querySelector('meta[name="csrf-token"]')?.content || "" },
+        body: JSON.stringify(payload) })
+      const data = await res.json().catch(() => ({}))
+      if (!res.ok || !data.ok) throw new Error(data?.error?.message || `HTTP ${res.status}`)
+      close()
+      const t = document.createElement("div"); t.className = "toast"
+      t.innerHTML = `✓ Created <a target="_blank" rel="noopener"></a> in AgentBoard`
+      t.querySelector("a").textContent = data.key; t.querySelector("a").href = data.url
+      root.appendChild(t); setTimeout(() => t.remove(), 7000)
+    } catch (err) {
+      panel.querySelector("[data-error]").textContent = `Could not create the ticket: ${err.message}`
+      btn.disabled = false; btn.textContent = "Create ticket"
+    }
+  }
+
+  function close() { panel?.remove(); panel = null; stopSelecting(); clearSelection(); state.screenshot = null }
+
+  fab.addEventListener("click", () => state.selecting ? stopSelecting() : startSelecting())
+  document.addEventListener("keydown", (e) => {
+    if (e.key === "Escape" && (state.selecting || panel)) { e.preventDefault(); close() }
+    if (e.altKey && e.shiftKey && (e.key === "A" || e.key === "a" || e.code === "KeyA")) { e.preventDefault(); state.selecting ? stopSelecting() : startSelecting() }
+  }, true)
+})()

data/app/jobs/agentboard/application_job.rb

@@ -0,0 +1,4 @@
+module Agentboard
+  class ApplicationJob < ActiveJob::Base
+  end
+end

data/app/models/agentboard/acceptance_criterion.rb

@@ -0,0 +1,23 @@
+module Agentboard
+  class AcceptanceCriterion < ApplicationRecord
+    self.table_name = "agentboard_acceptance_criteria"
+    VERIFICATION_KINDS = %w[manual test command review].freeze
+    STATES = %w[pending verified failed waived].freeze
+
+    belongs_to :ticket
+    validates :description, presence: true
+    validates :verification_kind, inclusion: { in: VERIFICATION_KINDS }
+    validates :state, inclusion: { in: STATES }
+    validates :position, uniqueness: { scope: :ticket_id }
+
+    before_validation :assign_position, on: :create
+
+    def satisfied? = %w[verified waived].include?(state)
+
+    private
+
+    def assign_position
+      self.position ||= (ticket&.acceptance_criteria&.maximum(:position) || 0) + 1
+    end
+  end
+end

data/app/models/agentboard/agent_profile.rb

@@ -0,0 +1,16 @@
+module Agentboard
+  class AgentProfile < ApplicationRecord
+    belongs_to :project
+    has_many :executions, dependent: :nullify
+    validates :name, presence: true, uniqueness: { scope: :project_id }
+    validates :provider_key, presence: true
+
+    def provider = Agentboard::Providers.registry.fetch(provider_key)
+
+    def self.default_for(project, provider_key)
+      find_or_create_by!(project: project, name: "#{provider_key}-default") do |p|
+        p.provider_key = provider_key.to_s
+      end
+    end
+  end
+end

data/app/models/agentboard/agent_session.rb

@@ -0,0 +1,30 @@
+module Agentboard
+  # A provider coding conversation or process identity.
+  #
+  # trust_level:
+  #   "launched"    – started by the AgentBoard runtime (we own the process)
+  #   "hook"        – corroborated by a provider hook payload
+  #   "mcp_stdio"   – bound to a local MCP stdio process started by the user
+  #   "untrusted"   – label supplied by an agent; never authorizes anything
+  class AgentSession < ApplicationRecord
+    TRUST_LEVELS = %w[launched hook mcp_stdio untrusted].freeze
+
+    belongs_to :project
+    has_many :ticket_links, class_name: "Agentboard::SessionTicketLink", dependent: :destroy
+    has_many :tickets, through: :ticket_links
+    has_many :leases, class_name: "Agentboard::TicketLease", dependent: :nullify
+    has_many :executions, dependent: :nullify
+
+    validates :provider_key, presence: true
+    validates :trust_level, inclusion: { in: TRUST_LEVELS }
+
+    scope :active, -> { where(state: "active") }
+
+    def active_link = ticket_links.find_by(ended_at: nil)
+    def active_ticket = active_link&.ticket
+    def actor = Agentboard::Authorization.agent_actor(id, name: display_name)
+    def display_name = label.presence || "#{provider_key} #{(external_session_id || id)[0, 8]}"
+
+    def touch_seen! = update_column(:last_seen_at, Time.current)
+  end
+end

data/app/models/agentboard/application_record.rb

@@ -0,0 +1,13 @@
+module Agentboard
+  class ApplicationRecord < ActiveRecord::Base
+    self.abstract_class = true
+
+    before_validation :assign_uuid, on: :create
+
+    private
+
+    def assign_uuid
+      self.id ||= Agentboard::Ids.uuid if has_attribute?(:id)
+    end
+  end
+end

data/app/models/agentboard/approval.rb

@@ -0,0 +1,29 @@
+module Agentboard
+  # Human authorization bound to an exact action digest, code state (head SHA),
+  # execution, requester, expiry and required role (spec §28.5).
+  class Approval < ApplicationRecord
+    DECISIONS = %w[pending approved rejected expired invalidated].freeze
+    ACTION_KINDS = %w[
+      review_completion destructive_migration privileged_shell protected_branch_merge
+      credential_access production_deploy security_policy_change workflow_gate custom
+    ].freeze
+
+    belongs_to :project
+    belongs_to :execution, optional: true
+    validates :decision, inclusion: { in: DECISIONS }
+    validates :action_kind, inclusion: { in: ACTION_KINDS }
+    validates :action_digest, :requested_by, presence: true
+
+    scope :pending, -> { where(decision: "pending") }
+
+    def ticket = ticket_id && Agentboard::Ticket.find_by(id: ticket_id)
+    def expired?(now = Time.current) = expires_at.present? && expires_at <= now
+    def pending? = decision == "pending"
+
+    # Approved, unexpired, and still bound to the same action and code state.
+    def valid_for?(action_digest:, head_sha: nil, now: Time.current)
+      decision == "approved" && !expired?(now) &&
+        self.action_digest == action_digest && (self.head_sha.nil? || self.head_sha == head_sha)
+    end
+  end
+end

data/app/models/agentboard/artifact.rb

@@ -0,0 +1,11 @@
+module Agentboard
+  class Artifact < ApplicationRecord
+    KINDS = %w[commit diff log test_report pull_request summary context file link handoff capture screenshot].freeze
+
+    belongs_to :ticket
+    belongs_to :execution, optional: true
+    validates :kind, inclusion: { in: KINDS }
+    validates :uri, presence: true
+    validates :provenance, inclusion: { in: Event::PROVENANCE }
+  end
+end

data/app/models/agentboard/comment.rb

@@ -0,0 +1,9 @@
+module Agentboard
+  class Comment < ApplicationRecord
+    belongs_to :ticket
+    validates :body, presence: true, length: { maximum: 20_000 }
+    validates :actor_type, inclusion: { in: %w[human agent system] }
+
+    def agent? = actor_type == "agent"
+  end
+end

data/app/models/agentboard/event.rb

@@ -0,0 +1,37 @@
+module Agentboard
+  # Application-append-only event log (spec §11). Rows are never updated by the
+  # application; privacy retention is enforced separately.
+  class Event < ApplicationRecord
+    PROVENANCE = %w[confirmed provider_reported git_observed inferred].freeze
+    PROVENANCE_LABELS = {
+      "confirmed" => "Confirmed by AgentBoard",
+      "provider_reported" => "Reported by provider",
+      "git_observed" => "Observed in Git",
+      "inferred" => "Inferred"
+    }.freeze
+
+    validates :provenance, inclusion: { in: PROVENANCE }
+    validates :event_type, :aggregate_type, :aggregate_id, :source, :correlation_id, presence: true
+
+    before_update { raise ActiveRecord::ReadOnlyRecord, "events are append-only" }
+
+    scope :chronological, -> { order(:received_at, :id) }
+
+    def family = event_type.split(".").first
+
+    # Payload in the current schema version (upcast on read; the stored row is untouched).
+    def data = EventSchema.upcast(event_type, schema_version, payload)
+
+    def envelope
+      {
+        event_id: id, schema_version: EventSchema.current_version(event_type), type: event_type, source: source,
+        provenance: provenance, project_id: project_id, ticket_id: ticket_id,
+        execution_id: execution_id, session_id: session_id, correlation_id: correlation_id,
+        causation_id: causation_id, aggregate: { type: aggregate_type, id: aggregate_id, sequence: sequence },
+        occurred_at: occurred_at&.utc&.iso8601(3), received_at: received_at&.utc&.iso8601(3),
+        stored_schema_version: schema_version,
+        payload: data
+      }
+    end
+  end
+end

data/app/models/agentboard/execution.rb

@@ -0,0 +1,51 @@
+module Agentboard
+  # One AgentBoard-managed attempt to perform work. Execution state is independent of
+  # ticket state (ADR-004); retries create new rows with incremented `attempt`.
+  class Execution < ApplicationRecord
+    belongs_to :ticket
+    belongs_to :agent_profile, optional: true
+    belongs_to :agent_session, optional: true
+    belongs_to :workflow_step, optional: true
+    has_many :verification_results, -> { order(:started_at) }, dependent: :destroy
+    has_many :artifacts, dependent: :nullify
+    has_many :usage_records, dependent: :destroy
+    has_many :approvals, dependent: :nullify
+
+    validates :status, inclusion: { in: StateMachines::Execution::STATES }
+    validates :provider_key, presence: true
+    validates :attempt, uniqueness: { scope: :ticket_id }
+
+    scope :active, -> { where(status: StateMachines::Execution::ACTIVE) }
+    scope :terminal, -> { where(status: StateMachines::Execution::TERMINAL) }
+    scope :recent, -> { order(created_at: :desc) }
+
+    def terminal? = StateMachines::Execution.terminal?(status)
+    def active? = !terminal?
+    def short_id = id.to_s.split("-").last[0, 8]
+    def label = "#{ticket.key} · exec-#{attempt.to_s.rjust(3, "0")}"
+
+    def duration
+      return unless started_at
+
+      (finished_at || Time.current) - started_at
+    end
+
+    def events
+      Agentboard::Event.where(execution_id: id).order(:occurred_at, :sequence)
+    end
+
+    def log_tail(bytes: 64 * 1024)
+      return "" unless log_path && File.file?(log_path)
+
+      File.open(log_path, "rb") do |f|
+        size = f.size
+        f.seek([ size - bytes, 0 ].max)
+        f.read.to_s.force_encoding("UTF-8").scrub
+      end
+    end
+
+    def self.next_attempt_for(ticket)
+      (where(ticket_id: ticket.id).maximum(:attempt) || 0) + 1
+    end
+  end
+end

data/app/models/agentboard/idempotency_key.rb

@@ -0,0 +1,5 @@
+module Agentboard
+  class IdempotencyKey < ApplicationRecord
+    validates :scope, :key, :request_digest, presence: true
+  end
+end

data/app/models/agentboard/milestone.rb

@@ -0,0 +1,7 @@
+module Agentboard
+  class Milestone < ApplicationRecord
+    belongs_to :project
+    has_many :tickets, dependent: :nullify
+    validates :name, presence: true
+  end
+end

data/app/models/agentboard/outbox_message.rb

@@ -0,0 +1,11 @@
+module Agentboard
+  class OutboxMessage < ApplicationRecord
+    STATES = %w[pending delivered dead].freeze
+    MAX_ATTEMPTS = 8
+
+    belongs_to :event, class_name: "Agentboard::Event"
+    validates :state, inclusion: { in: STATES }
+
+    scope :due, ->(now = Time.current) { where(state: "pending").where("available_at <= ?", now).order(:available_at) }
+  end
+end

data/app/models/agentboard/project.rb

@@ -0,0 +1,43 @@
+module Agentboard
+  class Project < ApplicationRecord
+    has_many :tickets, dependent: :restrict_with_exception
+    has_many :milestones, dependent: :destroy
+    has_many :agent_profiles, dependent: :destroy
+    has_many :agent_sessions, dependent: :restrict_with_exception
+    has_many :workflow_definitions, dependent: :restrict_with_exception
+    has_many :approvals, dependent: :restrict_with_exception
+
+    validates :key, presence: true, uniqueness: true, format: { with: /\A[A-Z][A-Z0-9_]{0,15}\z/, message: "must be uppercase letters/digits, e.g. AB" }
+    validates :name, :root_path, :default_branch, presence: true
+
+    # Resolves (or bootstraps) the project for the configured repository root.
+    def self.current(root: Agentboard.config.root_path)
+      find_by(root_path: root.to_s) || first || bootstrap!(root: root)
+    end
+
+    def self.bootstrap!(root: Agentboard.config.root_path)
+      name = Agentboard.config.dig("project", "name") || File.basename(root.to_s).tr("_-", " ").split.map(&:capitalize).join(" ")
+      key = Agentboard.config.dig("project", "key") || derive_key(name)
+      branch = Agentboard::Git::Repository.new(root).default_branch rescue "main"
+      create!(name: name, key: key, root_path: root.to_s, default_branch: branch || "main")
+    rescue ActiveRecord::RecordNotUnique
+      find_by!(root_path: root.to_s)
+    end
+
+    def self.derive_key(name)
+      letters = name.to_s.scan(/[A-Za-z0-9]+/).map { |w| w[0] }.join.upcase
+      letters = name.to_s.gsub(/[^A-Za-z]/, "").upcase[0, 3] if letters.length < 2
+      letters = "AB" if letters.blank?
+      letters = "P#{letters}" unless letters.match?(/\A[A-Z]/)
+      letters[0, 6]
+    end
+
+    def repository = Agentboard::Git::Repository.new(root_path)
+
+    def next_ticket_number!
+      # Atomic counter increment; safe under concurrent creators.
+      self.class.where(id: id).update_all("ticket_counter = ticket_counter + 1")
+      reload.ticket_counter
+    end
+  end
+end

data/app/models/agentboard/repository_snapshot.rb

@@ -0,0 +1,5 @@
+module Agentboard
+  class RepositorySnapshot < ApplicationRecord
+    belongs_to :project
+  end
+end

data/app/models/agentboard/session_ticket_link.rb

@@ -0,0 +1,18 @@
+module Agentboard
+  class SessionTicketLink < ApplicationRecord
+    # Association precedence (spec §7): lower number wins; automatic sources never
+    # replace an explicit human choice.
+    SOURCES = { "mcp" => 1, "cli_attach" => 2, "dashboard" => 3, "branch_heuristic" => 4, "provider_metadata" => 5, "runtime" => 0 }.freeze
+    EXPLICIT = %w[mcp cli_attach dashboard runtime].freeze
+
+    belongs_to :agent_session
+    belongs_to :ticket
+    validates :source, inclusion: { in: SOURCES.keys }
+    validates :confidence, inclusion: { in: %w[confirmed probable needs_confirmation] }
+
+    scope :active, -> { where(ended_at: nil) }
+
+    def explicit? = EXPLICIT.include?(source)
+    def precedence = SOURCES.fetch(source)
+  end
+end