code-coordinator 0.5.328__tar.gz → 0.5.329__tar.gz

{code_coordinator-0.5.328 → code_coordinator-0.5.329}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.328
+Version: 0.5.329
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.328 → code_coordinator-0.5.329}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.328
+Version: 0.5.329
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.328 → code_coordinator-0.5.329}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.328",
+  "tag": "0.5.329",
   "distance": 0,
-  "node": "g96977c771489f05d7c30eb4cc2696206c872072b",
+  "node": "g620161040c983239a8258b25aa0e4e1fc5cf3c8a",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-31"

{code_coordinator-0.5.328 → code_coordinator-0.5.329}/coord/agent.py

@@ -4282,7 +4282,41 @@ exists. Any time the operator gives you a substantive fact about the \
 client, the users, or the scope, say back what you would record and ask \
 whether to record it. Keep the wording theirs, not your paraphrase — the \
 ledger is verbatim by design, and the narrative (which is regenerable) is \
-where summarizing belongs.\
+where summarizing belongs.
+
+**Confirming a decision on the operator's instruction (#2998).** The base \
+prompt above says never to run `coord portal decision confirm` — that rule \
+was written for a session with nobody to ask. You have someone to ask: the \
+operator sitting at this terminal, who is exactly who that command is \
+reserved for. What never changes, headless or attended, is that YOU may \
+never confirm your own proposal on your own initiative — inferring consent, \
+or treating agreement about something else as consent to confirm, is \
+exactly the self-approval the base rule exists to prevent.
+
+But when the operator gives you an EXPLICIT, PRESENT-TURN instruction to \
+confirm a specific decision ("confirm decision 8", "yes, confirm that"), you \
+MAY act on it, in this order:
+
+1. Quote the operator's instruction back, verbatim, so the transcript makes \
+unambiguous that this was ordered, not inferred.
+2. Record the attribution on the ledger BEFORE confirming, so a later \
+session (or a human reading the ledger) can see this was operator-\
+instructed rather than session-initiated:
+
+    coord portal note <submission_id> "Operator instructed: confirm decision #<seq> (\"<their exact words>\")"
+
+3. Only then run:
+
+    coord portal decision confirm <submission_id> <seq>
+
+Do not collapse this into one step, and do not run it on a vague or implied \
+go-ahead — if you are not sure which decision the operator means, ask for \
+the seq before running anything. This carve-out covers `decision confirm` \
+ONLY. Every other entry on the deny list stays forbidden in this session \
+exactly as it is headlessly (raw `gh` mutations, `git push`, `git commit`, \
+destructive git, `coord approve`, `coord merge`, `coord assign`) — an \
+operator being present changes who may authorize a RESERVED command, it \
+does not change whether a DANGEROUS one is safe.\
 """
 
 # Deny list applied to decomposition-chat workers (#2533; extended #2750
@@ -4296,6 +4330,13 @@ where summarizing belongs.\
 # confirm` (the OPERATOR's move, never this session's own — #2750's "Propose"
 # terminal move must not self-confirm), while every write path this session
 # actually needs is allowed by omission.
+#
+# This is the HEADLESS list — used verbatim by `default_worker_command`'s
+# `spec.type == "decomposition-chat"` branch below, where the session
+# genuinely has nobody to ask, so `decision confirm` stays hard-denied. The
+# `--interactive` posture has an operator in the room; see
+# DECOMPOSITION_CHAT_ATTENDED_DENY_COMMANDS below (#2998) for its own,
+# narrower carve-out of exactly this one entry.
 DECOMPOSITION_CHAT_DENY_COMMANDS: list[str] = [
     "Bash(gh issue edit *)",
     "Bash(gh issue create *)",
@@ -4324,6 +4365,23 @@ DECOMPOSITION_CHAT_DENY_COMMANDS: list[str] = [
     "Bash(coord portal decision confirm *)",
 ]
 
+# #2998: the ATTENDED counterpart to the list above — every entry the same
+# EXCEPT `coord portal decision confirm`. An attended session has an
+# operator sitting at the terminal, and `decision confirm` is RESERVED for
+# the operator (not DANGEROUS the way `git push`/`coord merge`/destructive
+# git are) — the question in that posture is who authorised it, not whether
+# it's safe. DECOMPOSITION_CHAT_ATTENDED_ADDENDUM spells out the condition
+# under which the session may actually run it (an explicit, present-turn
+# operator instruction, quoted back and attributed on the ledger via `coord
+# portal note` before confirming) — this list only stops blanket-denying it
+# so that addendum isn't fighting a FORBIDDEN COMMANDS entry telling the
+# session the opposite. Every genuinely dangerous entry stays denied,
+# unchanged, in both postures.
+DECOMPOSITION_CHAT_ATTENDED_DENY_COMMANDS: list[str] = [
+    cmd for cmd in DECOMPOSITION_CHAT_DENY_COMMANDS
+    if cmd != "Bash(coord portal decision confirm *)"
+]
+
 MOCK_AUTHOR_SYSTEM_PROMPT = """\
 You are an independent mock-author agent for Gate A of a milestone \
 (#930, docs/ORACLE_LOOP.md) — the pre-work architecture gate. You have \

{code_coordinator-0.5.328 → code_coordinator-0.5.329}/coord/commands/portal.py

@@ -723,7 +723,7 @@ def _run_decompose_chat_interactive(
     from coord.agent import (  # noqa: PLC0415
         AssignmentSpec as _AssignmentSpecDc,
         DECOMPOSITION_CHAT_ATTENDED_ADDENDUM,
-        DECOMPOSITION_CHAT_DENY_COMMANDS,
+        DECOMPOSITION_CHAT_ATTENDED_DENY_COMMANDS,
         DECOMPOSITION_CHAT_SYSTEM_PROMPT,
         build_deny_prompt,
     )
@@ -854,13 +854,21 @@ def _run_decompose_chat_interactive(
     # This session, by contrast, has a human in the pane: the addendum makes
     # its first turn confirm-then-write (#2742's absorbed half, which #2750
     # only ever wired into mode SELECTION, never into the posture itself).
+    #
+    # #2998: the deny list here is the ATTENDED one — identical to the
+    # headless DECOMPOSITION_CHAT_DENY_COMMANDS except it does not blanket-
+    # forbid `coord portal decision confirm`, because DECOMPOSITION_CHAT_
+    # ATTENDED_ADDENDUM spells out the (narrow, operator-instruction-gated)
+    # condition under which this session may run it. The headless path above
+    # keeps using the unmodified list, so a headless session still cannot
+    # confirm, self-confirm, or be talked into confirming.
     argv = provider.build_command(
         spec,
         resolved_model=resolved_model,
         system_prompt=(
             DECOMPOSITION_CHAT_SYSTEM_PROMPT
             + DECOMPOSITION_CHAT_ATTENDED_ADDENDUM
-            + build_deny_prompt(DECOMPOSITION_CHAT_DENY_COMMANDS)
+            + build_deny_prompt(DECOMPOSITION_CHAT_ATTENDED_DENY_COMMANDS)
         ),
         allowed_tools="Read,Bash",
     )

{code_coordinator-0.5.328 → code_coordinator-0.5.329}/tests/test_decomposition_chat.py

@@ -10,6 +10,7 @@ import pytest
 from coord import decomposition_chat
 from coord.agent import (
     AssignmentSpec,
+    DECOMPOSITION_CHAT_ATTENDED_DENY_COMMANDS,
     DECOMPOSITION_CHAT_DENY_COMMANDS,
     DECOMPOSITION_CHAT_SYSTEM_PROMPT,
     WRITE_CAPABLE_SPEC_TYPES,
@@ -1108,6 +1109,116 @@ def test_deny_list_blocks_self_confirming_a_proposal():
     assert "Bash(coord portal decision confirm *)" in DECOMPOSITION_CHAT_DENY_COMMANDS
 
 
+# ── #2998: attended sessions may confirm on explicit operator instruction ──
+
+
+def test_attended_deny_list_omits_only_decision_confirm():
+    """The attended deny list is the headless one minus exactly one entry —
+    `coord portal decision confirm`. Every genuinely dangerous entry (raw
+    `gh` mutations, `git push`/`commit`, destructive git, `coord approve`/
+    `merge`/`assign`) must stay denied in both postures."""
+    assert (
+        "Bash(coord portal decision confirm *)"
+        not in DECOMPOSITION_CHAT_ATTENDED_DENY_COMMANDS
+    )
+    removed = set(DECOMPOSITION_CHAT_DENY_COMMANDS) - set(
+        DECOMPOSITION_CHAT_ATTENDED_DENY_COMMANDS
+    )
+    assert removed == {"Bash(coord portal decision confirm *)"}
+    # Nothing was added that wasn't already on the headless list.
+    assert set(DECOMPOSITION_CHAT_ATTENDED_DENY_COMMANDS) <= set(
+        DECOMPOSITION_CHAT_DENY_COMMANDS
+    )
+
+
+def test_headless_deny_list_is_untouched_by_the_attended_carve_out():
+    """Acceptance bar: "the headless posture is unchanged" — the constant the
+    headless dispatch path actually uses still hard-denies confirm."""
+    assert "Bash(coord portal decision confirm *)" in DECOMPOSITION_CHAT_DENY_COMMANDS
+
+
+def test_attended_addendum_permits_confirm_on_explicit_operator_instruction():
+    from coord.agent import DECOMPOSITION_CHAT_ATTENDED_ADDENDUM
+
+    assert "#2998" in DECOMPOSITION_CHAT_ATTENDED_ADDENDUM
+    assert "coord portal decision confirm" in DECOMPOSITION_CHAT_ATTENDED_ADDENDUM
+    # Requires an explicit, present-turn instruction — never inferred assent.
+    assert "EXPLICIT, PRESENT-TURN instruction" in DECOMPOSITION_CHAT_ATTENDED_ADDENDUM
+    assert "own initiative" in DECOMPOSITION_CHAT_ATTENDED_ADDENDUM
+    # Attribution: a ledger note recorded BEFORE the confirm runs.
+    assert "coord portal note" in DECOMPOSITION_CHAT_ATTENDED_ADDENDUM
+    assert "Operator instructed" in DECOMPOSITION_CHAT_ATTENDED_ADDENDUM
+    confirm_section = DECOMPOSITION_CHAT_ATTENDED_ADDENDUM.split(
+        "Confirming a decision on the operator's instruction"
+    )[1]
+    assert confirm_section.index("coord portal note") < confirm_section.index(
+        "coord portal decision confirm <submission_id> <seq>"
+    )
+    # The dangerous entries are called out as staying forbidden regardless.
+    assert "coord approve" in confirm_section
+    assert "coord merge" in confirm_section
+    assert "git push" in confirm_section
+
+
+def test_cli_interactive_dry_run_permits_confirm_but_keeps_dangerous_entries_denied():
+    """The system prompt `_run_decompose_chat_interactive` actually builds
+    must not list `coord portal decision confirm` under FORBIDDEN COMMANDS
+    (the addendum, not a blanket deny, governs it) while every dangerous
+    entry stays listed."""
+    from click.testing import CliRunner
+
+    from coord.commands.portal import portal_group
+
+    runner = CliRunner()
+    local = _machine("here", ["api"])
+    cfg = Config(repos=[_repo("api")], machines=[local])
+    with patch("coord.commands.portal._load_config", return_value=cfg), patch(
+        "coord.decomposition_chat.resolve_approved_submission", return_value=SUBMISSION
+    ), patch("coord.test_orchestrator.local_machine", return_value=local), patch(
+        "coord.board_service.resolve", return_value=None
+    ), patch("coord.state.record_dispatched_assignment"), patch(
+        "coord.interactive.launch_human_attended_interactive"
+    ):
+        result = runner.invoke(
+            portal_group,
+            ["decompose-chat", "sub_2f6a1c", "--interactive", "--discuss", "--dry-run"],
+        )
+    assert result.exit_code == 0, result.output
+    forbidden_section = result.output.split("FORBIDDEN")[-1]
+    assert "coord portal decision confirm" not in forbidden_section
+    assert "coord approve" in forbidden_section
+    assert "coord merge" in forbidden_section
+    assert "git push" in forbidden_section
+    assert "rm -rf" in forbidden_section
+    # ...but the addendum's own gated carve-out is present elsewhere in the
+    # prompt, spelling out how confirm may be used.
+    assert "#2998" in result.output
+    assert "coord portal note" in result.output
+
+
+def test_default_worker_command_decomposition_chat_still_forbids_confirm():
+    """Headless-unchanged regression guard: the actual argv the headless
+    dispatch path builds still lists `coord portal decision confirm` under
+    FORBIDDEN COMMANDS, with no operator-instruction carve-out text at all
+    (that text lives only in DECOMPOSITION_CHAT_ATTENDED_ADDENDUM, which the
+    headless path never appends — see
+    test_headless_decomposition_chat_prompt_has_no_attended_posture)."""
+    spec = AssignmentSpec(
+        repo_name="r",
+        repo_path="/tmp/r",
+        issue_number=0,
+        issue_title="decomposition: sub_2f6a1c",
+        briefing="b",
+        type="decomposition-chat",
+    )
+    argv = default_worker_command(spec)
+    idx = argv.index("--system-prompt")
+    system_prompt = argv[idx + 1]
+    forbidden_section = system_prompt.split("FORBIDDEN")[-1]
+    assert "coord portal decision confirm" in forbidden_section
+    assert "#2998" not in system_prompt
+
+
 # ── #2750 (IL-4): `coord portal decompose-chat` CLI — --discuss/--interactive ──