relay-flow 0.1.0-alpha.0

package/internal/server/server.go

@@ -0,0 +1,342 @@
+// Package server runs the central relay-flow process: one long-lived `serve`
+// command hosting any number of submitted workflows, each polling in its
+// own goroutine. Workflows arrive via `submit`, agent outcomes arrive via
+// `report` — both over a unix socket. The tracker remains the only
+// cross-process state.
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net"
+	"net/http"
+	"strings"
+	"sync"
+
+	"github.com/rajpopat27/relay-flow/internal/config"
+	"github.com/rajpopat27/relay-flow/internal/daemon"
+	"github.com/rajpopat27/relay-flow/internal/discovery"
+	"github.com/rajpopat27/relay-flow/internal/runner"
+	"github.com/rajpopat27/relay-flow/internal/acli"
+	"github.com/rajpopat27/relay-flow/internal/tasks"
+	"github.com/rajpopat27/relay-flow/internal/tasks/jira"
+
+	_ "github.com/rajpopat27/relay-flow/internal/runner/orca" // built-in adapters self-register
+)
+
+// Deps injects side-effecting operations so tests never call orca/acli or
+// spawn real poll loops.
+type Deps struct {
+	// ResolveRepo maps a repo path to (repoID, displayName).
+	ResolveRepo func(path string) (string, string, error)
+	// ValidateConfig probe-validates adapter-visible names (tracker
+	// states, assignee) in the YAML; returns invalid names.
+	ValidateConfig func(yamlBytes []byte) ([]string, error)
+}
+
+// ProdDeps wires Deps to the real implementations.
+func ProdDeps(dryRun bool) Deps {
+	return Deps{
+		ResolveRepo:    discovery.RepoFromPath,
+		ValidateConfig: validateConfigProd,
+	}
+}
+
+type entry struct {
+	cfg    *config.Config
+	tk     tasks.Tasks
+	d      *daemon.Daemon
+	cancel context.CancelFunc
+	repoID string
+}
+
+type Server struct {
+	mu      sync.Mutex
+	entries map[string]*entry
+	deps    Deps
+	dryRun  bool
+
+	ln           net.Listener
+	closed       chan struct{}
+	shutdownOnce sync.Once
+}
+
+func New(dryRun bool, deps Deps) *Server {
+	return &Server{
+		entries: map[string]*entry{},
+		deps:    deps,
+		dryRun:  dryRun,
+		closed:  make(chan struct{}),
+	}
+}
+
+func (s *Server) handler() http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/submit", methodGuard("POST", s.handleSubmit))
+	mux.HandleFunc("/report", methodGuard("POST", s.handleReport))
+	mux.HandleFunc("/shutdown", methodGuard("POST", s.handleShutdown))
+	return mux
+}
+
+// Serve accepts HTTP on ln (a unix socket) until Shutdown. Blocks.
+func (s *Server) Serve(ln net.Listener) error {
+	s.ln = ln
+	err := (&http.Server{Handler: s.handler()}).Serve(ln)
+	select {
+	case <-s.closed:
+		return nil
+	default:
+	}
+	return err
+}
+
+// Shutdown stops the HTTP listener and every workflow's poll loop.
+// Idempotent: the /shutdown handler and process signal handlers may both
+// invoke it.
+func (s *Server) Shutdown() {
+	s.shutdownOnce.Do(func() {
+		close(s.closed)
+		if s.ln != nil {
+			s.ln.Close()
+		}
+		s.mu.Lock()
+		defer s.mu.Unlock()
+		for name, e := range s.entries {
+			e.cancel()
+			delete(s.entries, name)
+		}
+	})
+}
+
+type submitRequest struct {
+	RepoPath string `json:"repoPath"`
+	YAML     string `json:"yaml"`
+}
+
+func (s *Server) handleSubmit(w http.ResponseWriter, r *http.Request) {
+	var req submitRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil || req.YAML == "" || req.RepoPath == "" {
+		writeError(w, 400, "submit requires {repoPath, yaml}")
+		return
+	}
+	// 1. YAML must parse and validate structurally. The workflow's
+	//    identity is the `name` field inside the YAML.
+	cfg, err := config.Parse("submit", []byte(req.YAML))
+	if err != nil {
+		writeError(w, 400, "invalid config: %v", err)
+		return
+	}
+	// 2. Name must be free: two workflows with the same name would share
+	//    claim labels and double-dispatch tickets.
+	s.mu.Lock()
+	_, dup := s.entries[cfg.Name]
+	s.mu.Unlock()
+	if dup {
+		writeError(w, 409, "workflow %q already running; stop serve and resubmit to update", cfg.Name)
+		return
+	}
+	// 3. Repo must resolve (submitted from a directory inside the repo).
+	repoID, repoName, err := s.deps.ResolveRepo(req.RepoPath)
+	if err != nil {
+		writeError(w, 400, "resolve repo %s: %v", req.RepoPath, err)
+		return
+	}
+	// 4. Tracker-visible names (states, assignee) must probe-validate.
+	if bad, err := s.deps.ValidateConfig([]byte(req.YAML)); err != nil {
+		writeError(w, 400, "config validation: %v", err)
+		return
+	} else if len(bad) > 0 {
+		writeError(w, 400, "invalid tracker names: %v", bad)
+		return
+	}
+	// 5. Build adapters + daemon and start the poll loop. Stateless:
+	//    restart means resubmit.
+	e, err := s.buildEntry(cfg, repoID, repoName)
+	if err != nil {
+		writeError(w, 400, "start workflow: %v", err)
+		return
+	}
+	s.mu.Lock()
+	s.entries[cfg.Name] = e
+	s.mu.Unlock()
+	log.Printf("submit %s: started (repo=%s)", cfg.Name, repoID)
+	writeJSON(w, 200, map[string]any{"ok": true, "name": cfg.Name})
+}
+
+// buildEntry wires one workflow: tasks adapter → runner adapter → daemon
+// + poll goroutine.
+func (s *Server) buildEntry(cfg *config.Config, repoID, repoName string) (*entry, error) {
+	tk, err := buildTasks(cfg, repoName)
+	if err != nil {
+		return nil, err
+	}
+	rn, err := runner.New(cfg.Runner.Type, cfg.Runner.Config)
+	if err != nil {
+		return nil, err
+	}
+	if wr, ok := rn.(interface{ WithRepo(string, string, bool) }); ok {
+		wr.WithRepo(repoID, repoName, s.dryRun)
+	}
+	d := daemon.New(cfg, tk, rn, repoID, repoName, s.dryRun)
+	ctx, cancel := context.WithCancel(context.Background())
+	go d.PollLoop(ctx)
+	return &entry{cfg: cfg, tk: tk, d: d, cancel: cancel, repoID: repoID}, nil
+}
+
+// buildTasks constructs the tasks adapter, injecting the machine-config
+// assignee for jira in distributed mode (centralized assigneeIsAgent
+// skips it). Adapter-specific because only jira consumes an assignee.
+func buildTasks(cfg *config.Config, repoName string) (tasks.Tasks, error) {
+	assignee := ""
+	if cfg.Tasks.Type == "jira" {
+		jc, err := jira.UnmarshalConfigForValidation(cfg.Tasks.Config)
+		if err != nil {
+			return nil, err
+		}
+		if !jc.AssigneeIsAgent {
+			mc, err := config.LoadMachineConfig()
+			if err != nil {
+				return nil, err
+			}
+			assignee = mc.Assignee
+		}
+	}
+	return tasks.New(cfg.Tasks.Type, cfg.Tasks.Config, cfg.Name, cfg.Nodes, assignee, repoName)
+}
+
+// handleShutdown replies first, then stops the server (listener + every
+// workflow's poll loop). Process exit releases the flock.
+func (s *Server) handleShutdown(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, 200, map[string]any{"ok": true})
+	log.Printf("shutdown requested via socket")
+	go s.Shutdown()
+}
+
+type reportRequest struct {
+	Workflow string `json:"workflow"`
+	Ticket   string `json:"ticket"`
+	Node     string `json:"node"`
+	Outcome  string `json:"outcome"`
+	Summary  string `json:"summary"`
+}
+
+func (s *Server) handleReport(w http.ResponseWriter, r *http.Request) {
+	var req reportRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil ||
+		req.Workflow == "" || req.Ticket == "" || req.Node == "" || req.Outcome == "" || req.Summary == "" {
+		writeError(w, 400, "report requires {workflow, ticket, node, outcome, summary}")
+		return
+	}
+	if req.Outcome != "success" && req.Outcome != "failure" {
+		writeError(w, 400, "outcome must be success or failure, got %q", req.Outcome)
+		return
+	}
+	s.mu.Lock()
+	e, ok := s.entries[req.Workflow]
+	s.mu.Unlock()
+	if !ok {
+		writeError(w, 404, "no running workflow %q", req.Workflow)
+		return
+	}
+	node, ok := e.cfg.Nodes[req.Node]
+	if !ok {
+		writeError(w, 400, "workflow %q has no node %q", req.Workflow, req.Node)
+		return
+	}
+	target := node.OnSuccess
+	if req.Outcome == "failure" {
+		target = node.OnFailure
+	}
+	tk := tasks.Ticket{Key: req.Ticket, Node: req.Node, ClaimedBy: req.Workflow}
+	if err := e.tk.Report(tk, req.Outcome, target, req.Summary); err != nil {
+		log.Printf("report %s/%s: %v", req.Workflow, req.Ticket, err)
+		writeJSON(w, 200, map[string]any{"ok": true, "action": "error", "detail": err.Error()})
+		return
+	}
+	// Report moved the ticket: re-arm the bounce nudge marker for the
+	// next node visit.
+	e.d.ClearNudged(req.Ticket)
+	action := "transitioned"
+	if e.cfg.Nodes[target].When != "" && stringsEqualFoldNode(e.cfg, req.Node, target) {
+		action = "commented"
+	}
+	log.Printf("report %s/%s: node=%s outcome=%s → %s (%s)", req.Workflow, req.Ticket, req.Node, req.Outcome, target, action)
+	writeJSON(w, 200, map[string]any{"ok": true, "action": action, "detail": target})
+}
+
+// stringsEqualFoldNode reports whether two nodes share the same tracker
+// state (self-loop: comment only, no transition).
+func stringsEqualFoldNode(cfg *config.Config, a, b string) bool {
+	wa, wb := cfg.Nodes[a].When, cfg.Nodes[b].When
+	if wa == "" || wb == "" {
+		return false
+	}
+	return strings.EqualFold(wa, wb)
+}
+
+func methodGuard(method string, h http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != method {
+			writeError(w, 405, "method %s not allowed, use %s", r.Method, method)
+			return
+		}
+		h(w, r)
+	}
+}
+
+func writeJSON(w http.ResponseWriter, code int, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(code)
+	json.NewEncoder(w).Encode(v)
+}
+
+func writeError(w http.ResponseWriter, code int, format string, args ...any) {
+	writeJSON(w, code, map[string]any{"ok": false, "error": fmt.Sprintf(format, args...)})
+}
+
+
+// validateConfigProd probe-validates tracker-visible names at submit:
+// every node's `when` status against the project (jira), plus the machine
+// assignee when in distributed mode.
+func validateConfigProd(yamlBytes []byte) ([]string, error) {
+	cfg, err := config.Parse("submit", yamlBytes)
+	if err != nil {
+		return nil, err
+	}
+	if cfg.Tasks.Type != "jira" {
+		return nil, nil // only the jira adapter has probeable states today
+	}
+	jc, err := jiraConfigOf(cfg)
+	if err != nil {
+		return nil, err
+	}
+	projectKey, err := jira.ProjectKeyFromQuery(jc.Query)
+	if err != nil {
+		return nil, err
+	}
+	ac := acli.New()
+	bad, err := jira.ValidateStates(ac, cfg.Nodes, projectKey)
+	if err != nil {
+		return nil, err
+	}
+	if !jc.AssigneeIsAgent {
+		mc, err := config.LoadMachineConfig()
+		if err != nil {
+			return nil, err
+		}
+		if err := ac.ValidateAssignee(mc.Assignee); err != nil {
+			bad = append(bad, "assignee: "+mc.Assignee)
+		}
+	}
+	return bad, nil
+}
+
+func jiraConfigOf(cfg *config.Config) (jira.JiraConfig, error) {
+	jcAny, err := jira.UnmarshalConfigForValidation(cfg.Tasks.Config)
+	if err != nil {
+		return jira.JiraConfig{}, err
+	}
+	return jcAny, nil
+}

package/internal/server/server_test.go

@@ -0,0 +1,195 @@
+package server
+
+import (
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/rajpopat27/relay-flow/internal/config"
+	"github.com/rajpopat27/relay-flow/internal/runner"
+	"github.com/rajpopat27/relay-flow/internal/tasks"
+)
+
+const goodYAML = `
+name: testFlow
+tasks:
+  type: faketasks
+  config: {}
+runner:
+  type: fakerunner
+closeOn: [done]
+nodes:
+  coding:
+    agent: build
+    when: "In Progress"
+    onSuccess: done
+    onFailure: coding
+  done:
+    when: "Done"
+`
+
+// registerFakes installs test adapters (unique names per process via init
+// in server package tests would collide across files — register once here).
+var fakesOnce = registerFakes()
+
+var (
+	lastFakeTasks  *fakeTasks
+	lastFakeRunner *fakeRunner
+)
+
+func registerFakes() bool {
+	tasks.Register("faketasks", tasks.Factory{
+		UnmarshalConfig: func(m map[string]any) (any, error) { return m, nil },
+		New: func(cfg any, wfName string, nodes map[string]config.Node, assignee, repoName string) (tasks.Tasks, error) {
+			lastFakeTasks = &fakeTasks{}
+			return lastFakeTasks, nil
+		},
+	})
+	runner.Register("fakerunner", runner.Factory{
+		UnmarshalConfig: func(m map[string]any) (any, error) { return m, nil },
+		New: func(cfg any) (runner.Runner, error) {
+			lastFakeRunner = &fakeRunner{}
+			return lastFakeRunner, nil
+		},
+	})
+	return true
+}
+
+type fakeTasks struct{ reports []string }
+
+func (f *fakeTasks) List() ([]tasks.Ticket, error) { return nil, nil }
+func (f *fakeTasks) Claim(t tasks.Ticket) error    { return nil }
+func (f *fakeTasks) Report(t tasks.Ticket, outcome, targetNode, summary string) error {
+	f.reports = append(f.reports, fmt.Sprintf("%s:%s:%s:%s", t.Key, outcome, targetNode, summary))
+	return nil
+}
+
+type fakeRunner struct{}
+
+func (f *fakeRunner) Spawn(t tasks.Ticket, node, agent, prompt string, env map[string]string) error {
+	return nil
+}
+func (f *fakeRunner) Find(t tasks.Ticket, node string) (runner.Session, bool, error) {
+	return runner.Session{}, false, nil
+}
+func (f *fakeRunner) Nudge(s runner.Session, prompt string) error { return nil }
+func (f *fakeRunner) Close(t tasks.Ticket) error                  { return nil }
+
+func testServer(t *testing.T) *Server {
+	t.Helper()
+	_ = fakesOnce
+	s := New(true, Deps{
+		ResolveRepo:    func(path string) (string, string, error) { return "repo-1", "repo:xyz", nil },
+		ValidateConfig: func(y []byte) ([]string, error) { return nil, nil },
+	})
+	return s
+}
+
+func post(t *testing.T, s *Server, path string, body string) (int, map[string]any) {
+	t.Helper()
+	req := httptest.NewRequest("POST", path, strings.NewReader(body))
+	rec := httptest.NewRecorder()
+	s.handler().ServeHTTP(rec, req)
+	var out map[string]any
+	json.NewDecoder(rec.Body).Decode(&out)
+	return rec.Code, out
+}
+
+func TestSubmitStartsWorkflow(t *testing.T) {
+	s := testServer(t)
+	code, out := post(t, s, "/submit", `{"repoPath":"/x","yaml":`+jsonStr(goodYAML)+`}`)
+	if code != 200 || out["ok"] != true {
+		t.Fatalf("code=%d out=%v", code, out)
+	}
+	if s.entries["testFlow"] == nil {
+		t.Fatal("entry not registered")
+	}
+	if lastFakeTasks == nil || lastFakeRunner == nil {
+		t.Fatal("adapters not constructed")
+	}
+	// Duplicate name → 409.
+	code, _ = post(t, s, "/submit", `{"repoPath":"/x","yaml":`+jsonStr(goodYAML)+`}`)
+	if code != 409 {
+		t.Errorf("dup submit code=%d, want 409", code)
+	}
+	s.Shutdown()
+}
+
+func TestSubmitRejectsBadYAML(t *testing.T) {
+	s := testServer(t)
+	defer s.Shutdown()
+	code, _ := post(t, s, "/submit", `{"repoPath":"/x","yaml":"name: \"\""}`)
+	if code != 400 {
+		t.Errorf("code=%d", code)
+	}
+}
+
+func TestSubmitRejectsInvalidStatuses(t *testing.T) {
+	s := New(true, Deps{
+		ResolveRepo:    func(path string) (string, string, error) { return "r", "n", nil },
+		ValidateConfig: func(y []byte) ([]string, error) { return []string{"DO Done"}, nil },
+	})
+	defer s.Shutdown()
+	code, out := post(t, s, "/submit", `{"repoPath":"/x","yaml":`+jsonStr(goodYAML)+`}`)
+	if code != 400 || !strings.Contains(fmt.Sprint(out["error"]), "DO Done") {
+		t.Errorf("code=%d out=%v", code, out)
+	}
+}
+
+func TestReportSuccessTransitions(t *testing.T) {
+	s := testServer(t)
+	post(t, s, "/submit", `{"repoPath":"/x","yaml":`+jsonStr(goodYAML)+`}`)
+	code, out := post(t, s, "/report",
+		`{"workflow":"testFlow","ticket":"XYZ-1","node":"coding","outcome":"success","summary":"did it"}`)
+	s.Shutdown()
+	if code != 200 || out["action"] != "transitioned" {
+		t.Fatalf("code=%d out=%v", code, out)
+	}
+	if len(lastFakeTasks.reports) != 1 || lastFakeTasks.reports[0] != "XYZ-1:success:done:did it" {
+		t.Errorf("reports = %v", lastFakeTasks.reports)
+	}
+}
+
+func TestReportSelfLoopActionCommented(t *testing.T) {
+	s := testServer(t)
+	post(t, s, "/submit", `{"repoPath":"/x","yaml":`+jsonStr(goodYAML)+`}`)
+	code, out := post(t, s, "/report",
+		`{"workflow":"testFlow","ticket":"XYZ-1","node":"coding","outcome":"failure","summary":"broke"}`)
+	s.Shutdown()
+	if code != 200 || out["action"] != "commented" {
+		t.Fatalf("self-loop must be commented: code=%d out=%v", code, out)
+	}
+	if lastFakeTasks.reports[0] != "XYZ-1:failure:coding:broke" {
+		t.Errorf("reports = %v", lastFakeTasks.reports)
+	}
+}
+
+func TestReportValidation(t *testing.T) {
+	s := testServer(t)
+	post(t, s, "/submit", `{"repoPath":"/x","yaml":`+jsonStr(goodYAML)+`}`)
+	defer s.Shutdown()
+	cases := []struct{ name, body string }{
+		{"bad outcome", `{"workflow":"testFlow","ticket":"XYZ-1","node":"coding","outcome":"done","summary":"x"}`},
+		{"unknown node", `{"workflow":"testFlow","ticket":"XYZ-1","node":"nope","outcome":"success","summary":"x"}`},
+		{"unknown workflow", `{"workflow":"nope","ticket":"XYZ-1","node":"coding","outcome":"success","summary":"x"}`},
+		{"missing fields", `{"workflow":"testFlow"}`},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			code, _ := post(t, s, "/report", tc.body)
+			if code != 400 && code != 404 {
+				t.Errorf("code=%d", code)
+			}
+		})
+	}
+}
+
+func jsonStr(s string) string {
+	b, _ := json.Marshal(s)
+	return string(b)
+}
+
+var _ = net.Dial // keep net import if unused later

package/internal/tasks/jira/README.md

@@ -0,0 +1,69 @@
+# tasks/jira — Jira adapter
+
+Implements `tasks.Tasks` over the [acli](https://github.com/acli) CLI. Jira
+statuses are node states (`when`); claim labels `wf:<workflow>` are Jira
+labels.
+
+## Config (tasks.config)
+
+| Field | Required | Meaning |
+|---|---|---|
+| `query` | yes | JQL fragment, e.g. `project = ABCD`. Must not contain `issuetype`, `assignee`, or `ORDER BY` — the adapter appends those. |
+| `issueTypes` | yes | Scalar or list, e.g. `[Task, Story]`. Rendered as `AND issuetype IN (...)`. |
+| `assigneeIsAgent` | no | Centralized mode: no assignee clause (org server owns the queue). Default false → `AND assignee = "<machine config>"` is appended. |
+
+Built JQL: `(query) AND issuetype IN (...) AND component = "<repo displayName>" [AND assignee = "..."] ORDER BY updated`.
+The repo displayName (resolved by the server from the submitter's cwd) scopes
+the poll to one repo's tickets.
+
+## Behavior
+
+- **List** — one search per poll; maps each ticket's status → node via `when`
+  (unmapped → `Node: ""`, daemon skips); first `wf:*` label → `ClaimedBy`.
+- **Claim** — adds `wf:<name>` label (labels are never removed; they're the
+  cross-restart mutex).
+- **Report** — transitions to the target node's `when` status + posts the
+  summary comment (`[wf] KEY (agent: x, node: y) reported outcome → target`).
+  Self-loop (target status == current) → comment only; acli FAILURE envelopes
+  (exit-0 failures) are detected and returned as errors.
+
+## Submit-time validation
+
+`ProjectKeyFromQuery` + `ValidateStates` probe every `when` status against the
+project — Jira's JQL parser rejects unknown statuses, so typos fail at submit
+instead of silently matching nothing.
+
+## Writing a new tasks adapter (beads, Linear, GitHub, ...)
+
+1. Create `internal/tasks/<name>/` with:
+   ```go
+   func init() {
+       tasks.Register("<name>", tasks.Factory{
+           UnmarshalConfig: unmarshalConfig, // strict-decode tasks.config into your struct
+           New: func(cfg any, wfName string, nodes map[string]config.Node, assignee, repoName string) (tasks.Tasks, error) {
+               // build your adapter; use nodes[..].When as the tracker-state map,
+               // wfName for claim labels, assignee/repoName if your tracker scopes by them
+           },
+       })
+   }
+   ```
+2. Implement the interface:
+   ```go
+   type Tasks interface {
+       List() ([]tasks.Ticket, error)                       // Node + ClaimedBy filled
+       Claim(t tasks.Ticket) error                          // attach wf:<name> marker
+       Report(t tasks.Ticket, outcome, targetNode, summary string) error
+   }
+   ```
+   `Ticket{Key, Summary, Node, ClaimedBy}` — you fill `Node` by reverse-mapping
+   the ticket's tracker state through `nodes[*].When`, and `ClaimedBy` from
+   your tracker's equivalent of claim markers (labels, assignments, ...).
+3. Strictly validate your `tasks.config` in `UnmarshalConfig` (unknown fields
+   must error — core can't see inside).
+4. Import your package for side effects (`_ "relay-flow/internal/tasks/<name>"`)
+   in `internal/server/server.go`, next to the jira import.
+5. Table-driven tests with a fake for your tracker's client seam (see
+   `jira_test.go` and the `aclier` interface for the pattern).
+
+External adapters (out of tree): fork the repo, add your package + import —
+the registry is deliberately in-process (no .so loading, YAGNI).

package/internal/tasks/jira/component_test.go

@@ -0,0 +1,16 @@
+package jira
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestJQLIncludesComponent(t *testing.T) {
+	j, err := newJira(JiraConfig{Query: "project = XYZ", IssueTypes: []string{"Task"}}, "wf", testNodes, "Jane Doe", "xyz-repo", nil)
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	if !strings.Contains(j.jql, `component = "xyz-repo"`) {
+		t.Errorf("JQL missing component filter: %q", j.jql)
+	}
+}

package/internal/tasks/jira/decode.go

@@ -0,0 +1,24 @@
+package jira
+
+import (
+	"bytes"
+	"fmt"
+
+	"gopkg.in/yaml.v3"
+)
+
+// strictDecode re-marshals the opaque config map and decodes it into v
+// with KnownFields(true), so unknown YAML keys in tasks.config are
+// rejected just like top-level ones.
+func strictDecode(m map[string]any, v any) error {
+	if m == nil {
+		m = map[string]any{}
+	}
+	b, err := yaml.Marshal(m)
+	if err != nil {
+		return fmt.Errorf("re-marshal config: %w", err)
+	}
+	dec := yaml.NewDecoder(bytes.NewReader(b))
+	dec.KnownFields(true)
+	return dec.Decode(v)
+}