alissa-tools-github-orcloop 0.18.2__tar.gz → 0.18.3__tar.gz

{alissa_tools_github_orcloop-0.18.2/src/main/alissa_tools_github_orcloop.egg-info → alissa_tools_github_orcloop-0.18.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-orcloop
-Version: 0.18.2
+Version: 0.18.3
 Summary: ALISSA-TOOLS-GITHUB-ORCLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_orcloop-0.18.2 → alissa_tools_github_orcloop-0.18.3}/src/main/alissa/tools/github/orcloop/alissa_client.py

@@ -1413,13 +1413,23 @@ class AlissaClient:
         and return the new task's opaque id -- all the create answers
         (`{"taskId": …}`; the number is a `get_task` away). The merge policy's
         validation floor (issue #116) is the one caller: the "Validate after
-        merge" task on the origin task, assigned to the origin's reporter.
+        merge" task on the origin task, OWNED BY THE CALLER -- the fleet
+        actor, the API's own default when `assign_to_actor_id` is left empty.
+
+        `assign_to_actor_id` seats another actor as owner and is subject to
+        the API's owner-assign gate: a caller that is not an admin of a team
+        the target belongs to (and does not pass `teamSlug`) is refused with
+        `HTTP 403 FORBIDDEN: {'error': 'FORBIDDEN', 'message': 'Only a team
+        admin can seat another member as owner; pass teamSlug'}`. The fleet
+        actor is a member, not an admin, so the floor never passes it (issue
+        #120); the parameter stays for a caller that can.
 
         `criteria` is the API's shape verbatim (`{id, type, description}`
         objects -- plain strings are refused with a 400). Permission is the
         parent's OWNER, which the daemon's token is on the tasks it released;
-        a refusal comes back as the base `AlissaError` and the caller decides
-        (the floor skips the merge)."""
+        a refusal comes back as an `AlissaError` subclass and the caller
+        decides (the floor skips the merge -- and escalates once when the
+        refusal is permanent)."""
         body: dict = {
             "title": title,
             "definitionOfDone": definition_of_done,

{alissa_tools_github_orcloop-0.18.2 → alissa_tools_github_orcloop-0.18.3}/src/main/alissa/tools/github/orcloop/merge.py

@@ -84,14 +84,24 @@ messages). The gate, in order:
 10. `dry_run` -> SKIPPED "would merge …", no writes -- the floor included.
 9b. The FLOOR (issue #116, L3), only for a merge the policy downgraded from
     an operator hold: BEFORE the merge call, once per (pr, head) (ledger
-    `merge:floor:<pr>:<head7>`), a comment on the origin Alissa task naming
-    the class and the reason, and a committed `Validate after merge`
-    downstream task owned by the origin's reporter. Either write failing ->
-    SKIPPED "floor not posted", retried next poll. Never a merge without
-    the page. Three rows keep the retry from repeating a write that landed:
-    the comment's, the task's (`merge:floor-task:<pr>:<head7>:<taskId>`,
-    written the moment the create returns, so a failed read-back or status
-    set never creates a second task), and the floor's.
+    `merge:floor:<pr>:<head7>`), a comment on the origin Alissa task saying
+    the policy IS MERGING past the gate (class and reason), and a committed
+    `Validate after merge` downstream task OWNED BY THE CALLING ACTOR -- the
+    fleet actor, the identity that owns every fed task (issue #120: the API's
+    owner-assign gate refuses the fleet actor seating the origin's reporter
+    as owner, so the reporter is reached through the origin task, which is
+    the parent of the floor task and carries the floor comment). A write
+    failing TRANSIENTLY (5xx, 429, transport) -> SKIPPED "floor not posted",
+    retried next poll. A write failing PERMANENTLY (a 4xx that is not
+    transient: 403, 404, 422) -> one escalation comment on the origin task
+    (`merge:floor-failed:<pr>:<head7>`) saying the PR needs a human merge
+    until the floor can be written, one WARNING (L4), and every later poll
+    on this head is a quiet SKIP that writes nothing; a new head is a new
+    episode. Never a merge without the page. Three rows keep the retry from
+    repeating a write that landed: the comment's, the task's
+    (`merge:floor-task:<pr>:<head7>:<taskId>`, written the moment the create
+    returns, so a failed read-back or status set never creates a second
+    task), and the floor's.
 11. Merge: `PUT /pulls/{n}/merge` with the configured method and
     `sha=head_sha` -- the guard that makes GitHub refuse (405/409) when the
     head moved between our reads and the merge; a refusal is SKIPPED and
@@ -133,7 +143,7 @@ from functools import lru_cache
 from typing import Callable, Sequence
 
 from . import loop_events
-from .alissa_client import AlissaClient, AlissaError
+from .alissa_client import AlissaClient, AlissaError, AlissaTransient
 from .config import MERGE_POLICY_YOLO, MERGE_READINESS_CLASSES, Config
 from .ghclient import (
     CheckSummary,
@@ -249,6 +259,18 @@ def policy_verdict(config: Config, klass: str | None) -> tuple[bool, str]:
     return (False, f"policy yolo holds class {klass} (in neither class list)")
 
 
+def floor_failure_is_permanent(exc: AlissaError) -> bool:
+    """Is this floor write refused for GOOD (issue #120) -- a 4xx that is not a
+    retry-later signal? 403 (the owner-assign gate, a missing role), 404 (the
+    origin task is gone or invisible), 422 (a payload the API refuses) do not
+    heal between polls; retrying them costs a WARNING and a refused write per
+    poll for as long as the head is approved. `AlissaTransient` (408/429/5xx
+    and transport failures, status 0) is excluded by CLASS, so the client's
+    taxonomy and this predicate cannot drift; a status-0 base error (the
+    create answered no `taskId`) is a malformed answer, retried too."""
+    return not isinstance(exc, AlissaTransient) and 400 <= exc.status < 500
+
+
 # --- hard-stop path globs ----------------------------------------------------
 #
 # `fnmatch` has no `**`: `*` there crosses `/`, so `**/migrations/**` and
@@ -358,11 +380,16 @@ HELD_KIND_PREFIX = MERGE_KIND_PREFIX + "held:"            # merge:held:<why>:<pr
 # a failed read-back or status set finishes THAT task instead of creating a
 # second (PR #117 round 1); the floor row is the one the merge reads. A
 # fourth, `floor-unmerged`, is the once-per-head correction the origin task
-# gets when the merge call it was paged about is then refused.
+# gets when the merge call it was paged about is then refused. A fifth,
+# `floor-failed` (issue #120), is the once-per-head escalation a floor write
+# that failed PERMANENTLY (a non-transient 4xx) leaves: its row is what keeps
+# every later poll on that head a quiet SKIP instead of a WARNING and a
+# refused write per poll.
 FLOOR_KIND_PREFIX = MERGE_KIND_PREFIX + "floor:"          # merge:floor:<pr>:<head7>
 FLOOR_COMMENT_KIND_PREFIX = MERGE_KIND_PREFIX + "floor-comment:"  # merge:floor-comment:<pr>:<head7>
 FLOOR_TASK_KIND_PREFIX = MERGE_KIND_PREFIX + "floor-task:"  # merge:floor-task:<pr>:<head7>:<taskId>
 FLOOR_UNMERGED_KIND_PREFIX = MERGE_KIND_PREFIX + "floor-unmerged:"  # merge:floor-unmerged:<pr>:<head7>
+FLOOR_FAILED_KIND_PREFIX = MERGE_KIND_PREFIX + "floor-failed:"  # merge:floor-failed:<pr>:<head7>
 
 # The hold reasons, as the short slugs the ledger kind and the event key carry.
 HOLD_OPERATOR = "operator"
@@ -422,10 +449,14 @@ MERGED_BY_POLICY_COMMENT = (
     "on {task_ref} as a comment and a `Validate after merge` task before the merge."
 )
 # The floor (issue #116, L3): what the origin task reads BEFORE the merge call
-# when the policy downgrades an operator hold. The wording is the issue's.
+# when the policy downgrades an operator hold. The wording is issue #120's: it
+# is posted before the merge call, so it says the merge IS HAPPENING -- the
+# earlier "merged" read false at posting time and stayed false whenever the
+# floor's second write then failed.
 FLOOR_TASK_COMMENT = (
-    "**Merge policy {policy} merged PR #{pr} with an open operator gate** — "
-    "{klass}: {reason}. Validate this before validating the task. ({url})"
+    "**Merge policy `{policy}` is merging PR #{pr} with an open operator gate** — "
+    "{klass}: {reason}. A `Validate after merge` task follows this comment; "
+    "validate that before validating this task. ({url})"
 )
 FLOOR_TASK_TITLE = "Validate after merge: {reason}"
 FLOOR_TASK_DOD = (
@@ -433,14 +464,31 @@ FLOOR_TASK_DOD = (
     "has been validated by a human after the merge, and the outcome is recorded "
     "on this task."
 )
+# Owner: the calling actor (issue #120). The API defaults the owner of a
+# downstream task to the caller, and the caller is the fleet actor -- the one
+# identity that owns every task the loop feeds. The origin's reporter is not
+# seated (the owner-assign gate refuses it) and does not need to be: the human
+# validates the ORIGIN task, which is this task's parent and carries the floor
+# comment; this row exists so the item cannot vanish.
 FLOOR_TASK_DESCRIPTION = (
-    "The orchestrator's merge edge merged {pr_url} under merge policy `{policy}` "
+    "The orchestrator's merge edge is merging {pr_url} under merge policy `{policy}` "
     "although the reviewer's approve read `Merge-Readiness: operator — {klass}: "
-    "{reason}`. The class is in `merge_yolo_merge_classes`, so the merge did not "
+    "{reason}`. The class is in `merge_yolo_merge_classes`, so the merge does not "
     "wait -- but the gate is still open: validate it before validating the origin "
-    "task.\n\nAlissa-Task: {task_ref}"
+    "task. Owner: the fleet actor; the human validates the ORIGIN task — this row "
+    "exists so the item cannot vanish.\n\nAlissa-Task: {task_ref}"
 )
 FLOOR_TASK_CRITERION = "The open operator gate ({klass}) has been validated by a human after the merge."
+# The escalation (issue #120): a floor write refused for good -- a 4xx that is
+# not transient, the owner-assign gate's 403 being the one that was seen in
+# production -- is not a next-poll retry. Once per (pr, head), on the origin
+# task, naming the HTTP error; the merge edge then leaves this head alone.
+FLOOR_FAILED_TASK_COMMENT = (
+    "**Merge policy `{policy}` cannot write the validation floor for PR #{pr} on "
+    "`{head7}`** — {detail}. This PR needs a human merge until the floor can be "
+    "written; the merge edge skips this head without retrying (a new head is a "
+    "new attempt). ({url})"
+)
 # The correction (PR #117 round 1): the floor is worded as the issue words it
 # and posted BEFORE the merge call, so a refused merge leaves the origin task
 # paged about a merge that did not happen. Once per (pr, head), best-effort.
@@ -941,10 +989,21 @@ class MergeEdge:
     ) -> "MergeDecision | None":
         """Page the origin task about the gate the policy is about to merge
         past: one comment, then one committed `Validate after merge`
-        downstream task owned by the origin's reporter -- BEFORE the merge
-        call, once per (pr, head). None when the floor stands (posted now or
-        on an earlier poll for this head); a SKIPPED decision when any write
-        failed, so this poll merges nothing and the next retries the floor.
+        downstream task owned by the calling actor (issue #120) -- BEFORE the
+        merge call, once per (pr, head). None when the floor stands (posted
+        now or on an earlier poll for this head); a SKIPPED decision when any
+        write failed: a TRANSIENT failure (5xx, 429, transport) is retried
+        next poll; a PERMANENT one (a 4xx that is not transient -- 403, 404,
+        422) is escalated once on the origin task and every later poll on
+        this head is a quiet SKIP (`_floor_failed`).
+
+        The task's owner is whoever the API defaults to -- the caller, i.e.
+        the fleet actor. `assign_to_actor_id` is deliberately NOT passed: the
+        owner-assign gate refuses the fleet actor seating another actor as
+        owner ("Only a team admin can seat another member as owner; pass
+        teamSlug"), which is what kept every yolo merge skipped forever
+        (issue #120). The reporter still sees the floor through the origin
+        task, this task's parent, which carries the floor comment.
 
         Three ledger rows: the comment's lands after the comment so a failed
         task create does not re-post it; the task's -- carrying the created
@@ -957,6 +1016,14 @@ class MergeEdge:
         floor_kind = f"{FLOOR_KIND_PREFIX}{pr.number}:{pr.head7}"
         if self.state.escalated(candidate.task_number, floor_kind):
             return None
+        failed_kind = f"{FLOOR_FAILED_KIND_PREFIX}{pr.number}:{pr.head7}"
+        if self.state.escalated(candidate.task_number, failed_kind):
+            # Escalated on an earlier poll: quiet, no write, no WARNING (L4).
+            return self._skipped(
+                candidate,
+                f"{pr.pr_slug}: floor failed for good on {pr.head7} (escalated on {ref}) — "
+                f"needs a human merge; a new head retries",
+            )
         if self.alissa is None:
             return self._skipped(
                 candidate,
@@ -973,15 +1040,7 @@ class MergeEdge:
                 self.state.record_escalation(candidate.task_number, comment_kind, at=now)
             task_id = self._floor_task_id(candidate, task_prefix)
             if task_id is None:
-                # The reporter owns the validation: read it off the origin
-                # task. A payload without one falls back to the calling actor
-                # (the API's own default) and says so in the log.
-                origin = self.alissa.get_task(ref)
-                if not origin.reporter_id:
-                    log.warning(
-                        "merge: %s carries no reporterId — the validation task defaults to the "
-                        "daemon's own actor", ref,
-                    )
+                # No owner override (issue #120): the API seats the caller.
                 task_id = self.alissa.create_downstream_task(
                     ref,
                     title=FLOOR_TASK_TITLE.format(reason=reason or klass)[:200],
@@ -995,7 +1054,6 @@ class MergeEdge:
                         "id": "vc-1", "type": "manual",
                         "description": FLOOR_TASK_CRITERION.format(klass=klass),
                     }],
-                    assign_to_actor_id=origin.reporter_id,
                 )
                 # The task exists from here on: its row lands BEFORE the
                 # read-back and the status set, so a failure in either
@@ -1010,6 +1068,8 @@ class MergeEdge:
             if created.status != "committed":
                 self.alissa.set_status(task_id, "committed")
         except AlissaError as exc:
+            if floor_failure_is_permanent(exc):
+                return self._floor_failed(candidate, now, exc=exc, kind=failed_kind)
             log.warning(
                 "merge: floor on %s for %s not posted (%s) — merge skipped this poll",
                 ref, pr.pr_slug, exc,
@@ -1037,6 +1097,38 @@ class MergeEdge:
         task_id = str(rows[0]["kind"])[len(task_prefix):]
         return task_id or None
 
+    def _floor_failed(
+        self, candidate: MergeCandidate, now: int, *, exc: AlissaError, kind: str,
+    ) -> MergeDecision:
+        """A floor write refused for good (issue #120): one escalation comment
+        on the origin task naming the HTTP error, one WARNING, the
+        `merge:floor-failed:<pr>:<head7>` row -- and SKIPPED. The row is what
+        makes every later poll on this head a quiet SKIP before any write
+        (`_floor`'s second check). The comment is best-effort in the same
+        sense as the correction: one that did not post leaves no row, so the
+        next poll escalates again (and re-tries the floor, which fails the
+        same way) until the page lands -- an escalation that never posted is
+        not an escalation."""
+        pr = candidate.pr
+        ref = candidate.ref
+        log.warning(
+            "merge: floor on %s for %s failed for good (%s) — escalated once, this head "
+            "needs a human merge; skipped quietly from here on",
+            ref, pr.pr_slug, exc,
+        )
+        posted = self._task_comment(candidate, FLOOR_FAILED_TASK_COMMENT.format(
+            policy=self.config.merge_policy, pr=pr.number, head7=pr.head7, detail=exc,
+            url=pr.url or pr.pr_slug,
+        ))
+        if posted:
+            self.state.record_escalation(candidate.task_number, kind, at=now)
+        return self._skipped(
+            candidate,
+            f"{pr.pr_slug}: floor failed for good on {ref} ({exc}) — escalated"
+            + ("" if posted else " (escalation comment pending — retries next poll)")
+            + ", needs a human merge; a new head retries",
+        )
+
     def _floor_unmerged(self, candidate: MergeCandidate, now: int, *, detail: str) -> None:
         """The correction the origin task gets when the merge call fails on a
         head it was paged about: once per (pr, head), best-effort (a comment

alissa_tools_github_orcloop-0.18.3/src/main/alissa/tools/github/orcloop/version

@@ -0,0 +1 @@
+0.18.3

{alissa_tools_github_orcloop-0.18.2 → alissa_tools_github_orcloop-0.18.3/src/main/alissa_tools_github_orcloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-orcloop
-Version: 0.18.2
+Version: 0.18.3
 Summary: ALISSA-TOOLS-GITHUB-ORCLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_orcloop-0.18.2/src/main/alissa/tools/github/orcloop/version

@@ -1 +0,0 @@
-0.18.2