Bug hunt: middleware and agent — prove defects with red-first tests #67

New issue

Closed

opened 2026-10-07 20:35:02 +02:00 by gotoi-agent · 5 comments

gotoi-agent commented 2026-10-07 20:35:02 +02:00

Collaborator

Copy link

Goal

Find real defects in middleware/ (Bun/Fastify) and agent/ (Go) — not style issues — prove each
one with a failing test or a minimal repro, fix the high-confidence small ones, report the rest.

Hunt areas (priority order)

1. Execution lifecycle (middleware/src/executions.ts): claim/start/result/expire races —
   double-claim, lease expiry mid-run (safety.ts LeaseTable), timeout vs late result ordering,
   circuit-breaker half-open re-entry.
2. Persistence (db/persist.ts): flush gaps — a mutate path that bypasses the in-memory Maps,
   hydrate/flush tearing under concurrent writes, dirty-sweep vs onSend ordering.
3. Tenancy/authz (tenancy.ts, access.ts, authorization.ts): cross-org reads/writes by
   id (IDOR-shaped logic bugs), filterVisible leaking in list endpoints, instance-operator vs
   org-role confusion.
4. Webhooks/pipeline (webhooks.ts, pipeline.ts, decision.ts): dedupe window edge cases,
   kill-switch/circuit fail-open paths (any must be fail-closed), enqueue double-fire.
5. Agent (agent/): job-poll long-poll correctness, result POST retry/idempotency, capability
   reporting, install/upgrade path error handling (no daemon tests against real systemd).
6. Control plane (control-agent.ts): dispatcher error paths, session expiry handling.

Method

• A finding needs: file:line, a failing bun test / go test you add (red first), the fix, then
  green. No finding without a repro.
• Fix only what fits one branch cleanly: one defect (or one tightly-coupled cluster) per commit.
• Everything else → findings table in the issue comment, no speculative fixes.
• Watch the two known pre-existing reds (UC-OP-02 /metrics endpoint, UC-MW-19 plan survives a second buildApp) — they are not yours; do not chase or "fix" them by weakening.

Constraints

• Never delete, skip or weaken a test. Never .skip. Regression tests are mandatory with fixes.
• No new dependencies. Refs #<N> only — no closing keywords.
• Race findings must state how you forced the interleaving (deterministic test, not "it happened
  once").

## Goal Find real defects in `middleware/` (Bun/Fastify) and `agent/` (Go) — not style issues — prove each one with a failing test or a minimal repro, fix the high-confidence small ones, report the rest. ## Hunt areas (priority order) 1. **Execution lifecycle** (`middleware/src/executions.ts`): claim/start/result/expire races — double-claim, lease expiry mid-run (`safety.ts` LeaseTable), timeout vs late result ordering, circuit-breaker half-open re-entry. 2. **Persistence** (`db/persist.ts`): flush gaps — a mutate path that bypasses the in-memory Maps, hydrate/flush tearing under concurrent writes, dirty-sweep vs onSend ordering. 3. **Tenancy/authz** (`tenancy.ts`, `access.ts`, `authorization.ts`): cross-org reads/writes by id (IDOR-shaped logic bugs), `filterVisible` leaking in list endpoints, instance-operator vs org-role confusion. 4. **Webhooks/pipeline** (`webhooks.ts`, `pipeline.ts`, `decision.ts`): dedupe window edge cases, kill-switch/circuit fail-open paths (any must be fail-closed), enqueue double-fire. 5. **Agent** (`agent/`): job-poll long-poll correctness, result POST retry/idempotency, capability reporting, install/upgrade path error handling (no daemon tests against real systemd). 6. **Control plane** (`control-agent.ts`): dispatcher error paths, session expiry handling. ## Method - A finding needs: file:line, a failing `bun test` / `go test` you add (red first), the fix, then green. No finding without a repro. - Fix only what fits one branch cleanly: one defect (or one tightly-coupled cluster) per commit. - Everything else → findings table in the issue comment, no speculative fixes. - Watch the two known pre-existing reds (`UC-OP-02 /metrics endpoint`, `UC-MW-19 plan survives a second buildApp`) — they are not yours; do not chase or "fix" them by weakening. ## Constraints - Never delete, skip or weaken a test. Never `.skip`. Regression tests are mandatory with fixes. - No new dependencies. `Refs #<N>` only — no closing keywords. - Race findings must state how you forced the interleaving (deterministic test, not "it happened once").

gotoi-agent added the

ai-assist

label 2026-10-07 20:35:02 +02:00

gotoi-agent added reference issue/67-bug-hunt 2026-10-07 22:06:46 +02:00

gotoi-agent commented 2026-10-07 22:09:25 +02:00

Author

Collaborator

Copy link

Claimed — branch issue/67-bug-hunt. Doing: red-first hunt across execution lifecycle, persistence, tenancy/authz, pipeline/webhooks, agent, control plane; fix high-confidence small defects with regression tests.

Claimed — branch `issue/67-bug-hunt`. Doing: red-first hunt across execution lifecycle, persistence, tenancy/authz, pipeline/webhooks, agent, control plane; fix high-confidence small defects with regression tests.

gotoi-agent commented 2026-10-07 22:16:26 +02:00

Author

Collaborator

Copy link

Issue #67 — Bug hunt: middleware + agent, red-first

Restated goal

Find real defects (not style) in middleware/ and agent/, prove each with a failing test or a
minimal repro, fix the high-confidence small ones on branch issue/67-bug-hunt with a regression
test each, and report the rest as a findings table. "Done" for the operator: the middleware suite is
green except the two known pre-existing reds, every commit carries a red-first regression test, and
the issue thread holds the plan + outcome so a human can review without opening the worktree.

Scope

Will change (confirmed so far):

• middleware/src/routes/agent-api.ts — /agent/:id/:token/result continues into trust/circuit/
  incident/rollback side effects even when applyResult reports already_done (UC-OP-04 / UC-AG-10
  say a duplicate report must not change state).
• middleware/tests/uc-mw-122-execution-lifecycle.test.ts (or the cluster file that already covers
  UC-OP-04) — new regression test.

Will not touch: middleware/src/app.ts route registration, plans/ (product content),
dashboard/, agent/ unless a scout finding is proven; the two known pre-existing reds
(UC-OP-02 /metrics, UC-MW-19 second buildApp) — reported, never weakened.

UC decision

No new UC. The defect is a violation of two existing UCs:

• UC-OP-04 (idempotent /result) — "Second POST … without rewriting exec.steps"; Postconditions:
  "Execution remains at the terminal status from the first apply."
• UC-AG-10 (lost-ack retry is safe) — "Execution status and steps are unchanged by the retry."
• and UC-MW-74 (circuit breaker) — a duplicate success report currently calls recordSuccess,
  which clears a tripped key (fail-open).

Implementation cite: middleware/src/routes/agent-api.ts (POST /agent/:id/:token/result).
Tests cite: existing middleware/tests/uc-mw-cluster3-agent.test.ts (UC-AG-10) +
middleware/tests/uc-mw-cluster5-ops.test.ts (UC-OP-04); new regression assertions live there.
UC versions bumped only if behaviour text drifts (it does not — the code is the thing that is wrong).

Evidence (already reproduced, red-first)

middleware/tests/zz-red-probe.test.ts (throwaway) against buildApp({ seed: true }):

before streak 5 3
after 1       6 4     # first POST /result, status remediated
r2 200 { ok: true, status: "already_done" }
after 2       7 5     # <- DUPLICATE POST still mutated plan trust counters

So the "no-op" retry is not a no-op. Same code path also calls
circuit.recordSuccess('plan:…'|'host:…') on the duplicate, which deletes a tripped circuit key
(fail-open), and enqueueRollback / scheduleRecheck are reachable again on the retry.

Ordered tasks

1. Red test. Add regression assertions to the existing UC-OP-04 / UC-AG-10 cluster files:
   duplicate POST /result must leave plan.verifiedStreak, plan.totalVerified and
   stores.circuit.tripped() unchanged. Verify: cd middleware && bun test tests/uc-mw-cluster5-ops.test.ts tests/uc-mw-cluster3-agent.test.ts → red.
2. Fix. In routes/agent-api.ts, return early on outcome.status === 'already_done' (before any
   plan/trust/circuit/rollback/incident side effect). Verify: same command → green.
3. Scout findings triage. Fold in whichever of the three scout findings reproduce; each gets its
   own commit. Verify per finding with the targeted test file.
4. Gates for the touched surface: _check.py, check-ai-headers.py, check-type-mirror.py,
   cd middleware && bun test (expect the two known reds), rg 'Showing lines'.
5. Report + issue comments (Claim / Plan / Done).

Independent commands are batched; one logical change per commit.

Open questions (assumption taken)

• Q: should a duplicate result be rejected (409) or accepted as a no-op? Assumption: no-op with
  { ok: true, status: 'already_done' } — that is what UC-OP-04 and UC-AG-10 already state and what
  the agent's retry loop (UC-AG-54) requires; only the side effects are the bug.
• Q: do agent-side findings need a new UC? Assumption: no — reuse the existing UC-AG-* the scout
  finding maps to; only add a UC if the behaviour is genuinely new.

Risk

• Risk: early-returning on already_done could skip a legitimately needed side effect (e.g. an
  incident evidence attach that a retry was meant to repair). Fallback: scope the early return to
  the trust/circuit/rollback/recheck block only, leaving purely additive idempotent writes alone.
• Risk: middleware suite has known pre-existing reds → do not treat them as mine; report them.
• Risk: touching agent-api.ts prompt strings would force uc-mw-115-control-chat.test.ts; this
  change touches no strings, but run that file anyway if the diff grows into it.

# Issue #67 — Bug hunt: middleware + agent, red-first ## Restated goal Find *real* defects (not style) in `middleware/` and `agent/`, prove each with a failing test or a minimal repro, fix the high-confidence small ones on branch `issue/67-bug-hunt` with a regression test each, and report the rest as a findings table. "Done" for the operator: the middleware suite is green except the two known pre-existing reds, every commit carries a red-first regression test, and the issue thread holds the plan + outcome so a human can review without opening the worktree. ## Scope **Will change (confirmed so far):** - `middleware/src/routes/agent-api.ts` — `/agent/:id/:token/result` continues into trust/circuit/ incident/rollback side effects even when `applyResult` reports `already_done` (UC-OP-04 / UC-AG-10 say a duplicate report must not change state). - `middleware/tests/uc-mw-122-execution-lifecycle.test.ts` (or the cluster file that already covers UC-OP-04) — new regression test. **Will not touch:** `middleware/src/app.ts` route registration, `plans/` (product content), `dashboard/`, `agent/` unless a scout finding is proven; the two known pre-existing reds (`UC-OP-02 /metrics`, `UC-MW-19 second buildApp`) — reported, never weakened. ## UC decision No new UC. The defect is a violation of two existing UCs: - `UC-OP-04` (idempotent `/result`) — "Second POST … without rewriting `exec.steps`"; Postconditions: "Execution remains at the terminal status from the first apply." - `UC-AG-10` (lost-ack retry is safe) — "Execution status and steps are unchanged by the retry." - and `UC-MW-74` (circuit breaker) — a duplicate *success* report currently calls `recordSuccess`, which clears a tripped key (fail-open). Implementation cite: `middleware/src/routes/agent-api.ts` (`POST /agent/:id/:token/result`). Tests cite: existing `middleware/tests/uc-mw-cluster3-agent.test.ts` (UC-AG-10) + `middleware/tests/uc-mw-cluster5-ops.test.ts` (UC-OP-04); new regression assertions live there. UC versions bumped only if behaviour text drifts (it does not — the code is the thing that is wrong). ## Evidence (already reproduced, red-first) `middleware/tests/zz-red-probe.test.ts` (throwaway) against `buildApp({ seed: true })`: ``` before streak 5 3 after 1 6 4 # first POST /result, status remediated r2 200 { ok: true, status: "already_done" } after 2 7 5 # <- DUPLICATE POST still mutated plan trust counters ``` So the "no-op" retry is not a no-op. Same code path also calls `circuit.recordSuccess('plan:…'|'host:…')` on the duplicate, which deletes a tripped circuit key (fail-open), and `enqueueRollback` / `scheduleRecheck` are reachable again on the retry. ## Ordered tasks 1. **Red test.** Add regression assertions to the existing UC-OP-04 / UC-AG-10 cluster files: duplicate `POST /result` must leave `plan.verifiedStreak`, `plan.totalVerified` and `stores.circuit.tripped()` unchanged. Verify: `cd middleware && bun test tests/uc-mw-cluster5-ops.test.ts tests/uc-mw-cluster3-agent.test.ts` → red. 2. **Fix.** In `routes/agent-api.ts`, return early on `outcome.status === 'already_done'` (before any plan/trust/circuit/rollback/incident side effect). Verify: same command → green. 3. **Scout findings triage.** Fold in whichever of the three scout findings reproduce; each gets its own commit. Verify per finding with the targeted test file. 4. **Gates** for the touched surface: `_check.py`, `check-ai-headers.py`, `check-type-mirror.py`, `cd middleware && bun test` (expect the two known reds), `rg 'Showing lines'`. 5. **Report** + issue comments (Claim / Plan / Done). Independent commands are batched; one logical change per commit. ## Open questions (assumption taken) - Q: should a duplicate result be rejected (409) or accepted as a no-op? Assumption: no-op with `{ ok: true, status: 'already_done' }` — that is what UC-OP-04 and UC-AG-10 already state and what the agent's retry loop (`UC-AG-54`) requires; only the *side effects* are the bug. - Q: do agent-side findings need a new UC? Assumption: no — reuse the existing UC-AG-* the scout finding maps to; only add a UC if the behaviour is genuinely new. ## Risk - Risk: early-returning on `already_done` could skip a legitimately needed side effect (e.g. an incident evidence attach that a retry was meant to repair). Fallback: scope the early return to the trust/circuit/rollback/recheck block only, leaving purely additive idempotent writes alone. - Risk: middleware suite has known pre-existing reds → do not treat them as mine; report them. - Risk: touching `agent-api.ts` prompt strings would force `uc-mw-115-control-chat.test.ts`; this change touches no strings, but run that file anyway if the diff grows into it.

gotoi-agent commented 2026-10-07 23:08:35 +02:00

Author

Collaborator

Copy link

DONE (partial fix set) — Refs #67

Branch issue/67-bug-hunt, 2 commits, local only (not pushed).

Commits

• 1f81996 fix(result): duplicate /result report is a true no-op
• 30fa4e2 fix(tenancy): gate bulk group ops and plan child collections on row scope

Defect 1 — duplicate POST /agent/:id/:token/result ran the whole tail.
applyResult returned {ok:true,status:'already_done'} but the handler continued into recordOutcome, verifiedStreak=0, circuit.recordSuccess (= state.delete(key), so a duplicate of a successful result cleared a tripped circuit key), enqueueRollback, scheduleRecheck, incidents.applyOutcome. Now early-returns for already_done. Tests: tests/uc-mw-cluster5-ops.test.ts (2 regressions, red-first).

Defect 2 — cross-org leaks.

• POST /agents/bulk group-add/group-remove checked only the agent rows → any operator could rewrite another org's group hostnames. Now gated on the group row with assertEdit(...,'group').
• GET /plans/:id/{executions,compatibility,health} returned sibling-org rows for shared plans (disk-cleanup) — leaked organizationId/host/agentId/stepCount. Now filtered via the existing makeVisibility/executionVisible/filterVisible. Tests: tests/uc-mw-142-ownership.test.ts (2 regressions, red-first, verified RED with git stash -- middleware/src).

Gates (one line each)

• python3 docs/use-cases/_check.py — exit 0 (358 files conform)
• python3 scripts/check-ai-headers.py — exit 0 (573 ok, 0 missing, 0 malformed)
• python3 scripts/check-type-mirror.py — exit 0 (3 informational lines)
• rg -n 'Showing lines' --glob '!node_modules' --glob '!.git' — only docs quoting the command; no footers in source
• cd middleware && bun test --timeout 20000 tests/uc-mw-cluster5-ops.test.ts tests/uc-mw-cluster3-agent.test.ts — 24 pass / 0 fail
• cd middleware && bun test --timeout 20000 tests/uc-mw-114-agents-bulk.test.ts — 1 pass / 0 fail
• cd middleware && bun test --timeout 20000 tests/uc-mw-142-ownership.test.ts — 6 pass / 1 fail; the failure (viewer invite can read but not write, line 136, 500≠403) is pre-existing, proved by re-running with the src fix stashed (3 pass / 4 fail). Not chased.
• agent/ and dashboard/ untouched → their gates not run.

Reported, not fixed (full table in meta/issue-67.report.md): assertEdit double-send (access.ts:104, ~20 call sites → 500 instead of 403/404) · incidents.ts:98 evidence clobber · safety.ts:145 half-open latch (UC-MW-74 step 4) · tripsFor global key at plans.ts:1186 · pipeline.ts:183/incidents.ts:79 attempt counting · pipeline.ts:35 repeat-resolved webhook ignores transition · agent/main.go:1055 repo-job allowlist no-op · agent/exec timeout vs process group · agent/cmd.go unguarded Client mutation + flat backoff.

Known reds left alone: UC-OP-02 /metrics, UC-MW-19 second buildApp. Bun's default 5s timeout is the source of the PGlite is closed / writeHead cascade — always --timeout 20000. Report: meta/issue-67.report.md.

DONE (partial fix set) — Refs #67 Branch `issue/67-bug-hunt`, 2 commits, local only (not pushed). **Commits** - `1f81996` fix(result): duplicate /result report is a true no-op - `30fa4e2` fix(tenancy): gate bulk group ops and plan child collections on row scope **Defect 1 — duplicate `POST /agent/:id/:token/result` ran the whole tail.** `applyResult` returned `{ok:true,status:'already_done'}` but the handler continued into `recordOutcome`, `verifiedStreak=0`, `circuit.recordSuccess` (= `state.delete(key)`, so a duplicate of a successful result **cleared a tripped circuit key**), `enqueueRollback`, `scheduleRecheck`, `incidents.applyOutcome`. Now early-returns for `already_done`. Tests: `tests/uc-mw-cluster5-ops.test.ts` (2 regressions, red-first). **Defect 2 — cross-org leaks.** - `POST /agents/bulk` `group-add`/`group-remove` checked only the agent rows → any operator could rewrite another org's group hostnames. Now gated on the group row with `assertEdit(...,'group')`. - `GET /plans/:id/{executions,compatibility,health}` returned sibling-org rows for shared plans (`disk-cleanup`) — leaked `organizationId`/`host`/`agentId`/`stepCount`. Now filtered via the existing `makeVisibility`/`executionVisible`/`filterVisible`. Tests: `tests/uc-mw-142-ownership.test.ts` (2 regressions, red-first, verified RED with `git stash -- middleware/src`). **Gates (one line each)** - `python3 docs/use-cases/_check.py` — exit 0 (358 files conform) - `python3 scripts/check-ai-headers.py` — exit 0 (573 ok, 0 missing, 0 malformed) - `python3 scripts/check-type-mirror.py` — exit 0 (3 informational lines) - `rg -n 'Showing lines' --glob '!node_modules' --glob '!.git'` — only docs quoting the command; no footers in source - `cd middleware && bun test --timeout 20000 tests/uc-mw-cluster5-ops.test.ts tests/uc-mw-cluster3-agent.test.ts` — 24 pass / 0 fail - `cd middleware && bun test --timeout 20000 tests/uc-mw-114-agents-bulk.test.ts` — 1 pass / 0 fail - `cd middleware && bun test --timeout 20000 tests/uc-mw-142-ownership.test.ts` — 6 pass / 1 fail; the failure (`viewer invite can read but not write`, line 136, 500≠403) is **pre-existing**, proved by re-running with the src fix stashed (3 pass / 4 fail). Not chased. - `agent/` and `dashboard/` untouched → their gates not run. **Reported, not fixed** (full table in `meta/issue-67.report.md`): `assertEdit` double-send (`access.ts:104`, ~20 call sites → 500 instead of 403/404) · `incidents.ts:98` evidence clobber · `safety.ts:145` half-open latch (UC-MW-74 step 4) · `tripsFor` global key at `plans.ts:1186` · `pipeline.ts:183`/`incidents.ts:79` attempt counting · `pipeline.ts:35` repeat-resolved webhook ignores `transition` · `agent/main.go:1055` repo-job allowlist no-op · `agent/exec` timeout vs process group · `agent/cmd.go` unguarded Client mutation + flat backoff. Known reds left alone: `UC-OP-02 /metrics`, `UC-MW-19` second `buildApp`. Bun's default 5s timeout is the source of the `PGlite is closed` / `writeHead` cascade — always `--timeout 20000`. Report: `meta/issue-67.report.md`.

gotoi-agent commented 2026-10-07 23:22:16 +02:00

Author

Collaborator

Copy link

REVIEW: FIXED 1 — Refs #67

Verdict FIXED 1 (1 review finding found, 1 fixed). Full report: meta/issue-67.review-report.md.

Verified true of the tree

• Both implementer defects real and red-first: routes/agent-api.ts:299-302 (already_done early return, 1f81996) and routes/agents.ts:123-125 + routes/plans.ts:657-660,1163,1170-1171 (30fa4e2). Red-first confirmed by merge-base source comparison: at b64f46a the result handler has no already_done branch, the bulk group block has no assertEdit, and the child queries are unfiltered.
• Re-ran every test file the report cites green: uc-mw-cluster5-ops + uc-mw-cluster3-agent → 24 pass / 0 fail; uc-mw-114-agents-bulk → 1 pass / 0 fail; uc-mw-142-ownership → 6 pass / 1 fail.
• The uc-mw-142 red (viewer invite can read but not write, 500≠403) fails in isolation and the diff touches no POST /plans path → pre-existing, by isolation + diff reasoning (no merge-base run; worktree-free constraint).
• Checkers: _check.py 0, check-ai-headers.py 0 (573 ok), check-type-mirror.py 0, rg 'Showing lines' = 9 doc-only matches. Plan Scope honoured: no app.ts, plans/, dashboard/, agent/, known reds untouched. Tests additive only, no .skip, Refs #67 only, nothing pushed.

Fix (review commit)

• 0372b9b review(middleware): assert zero cross-org rows in shared-plan child collections — the new compatibility guard was counted <= 1 (passes while one sibling-org agent leaks) and /plans/:id/health, also changed by 30fa4e2, had no assertion; now pinned to rows.length === 0, counted === 0, health.executions === 0. Suite still 6 pass / 1 fail (same pre-existing red).

Findings (mine)

• MINOR 30fa4e2 bundles two defects in one commit — accepted as a tightly-coupled cluster (same class, same scout origin).
• MINOR report cites plans.ts:1186; after its own diff that line is plans.ts:1190.
• MINOR F3 is overstated: safety.ts:144-155 matches UC-MW-74 step 4 ("exactly one half-open execution"); the real gap is that a probe that never reports blocks the key until POST /ops/circuit/reset.
• OBSERVATION persistence (db/persist.ts) and control plane (control-agent.ts) yielded zero findings — unexamined, not proven clean.

UNFIXED: F1 access.ts:104 assertEdit double-send → 500 instead of 403/404 (~20 return; callers) · F2 incidents.ts:98 evidence clobber · F3 half-open probe has no timeout · F4 pipeline.ts:183/incidents.ts:79 attempt counting · F5 plans.ts:1190 global tripsFor leak · F6 pipeline.ts:35 repeat-resolved ignores transition · F7 agent/main.go:1055 repo-job allowlist no-op · F8 agent/exec/exec.go:39 timeout spares grandchildren · F9 agent/cmd.go:765/827 unsynchronised Client + flat backoff · persistence/control-plane areas unexamined.

REVIEW: FIXED 1 — Refs #67 Verdict **FIXED 1** (1 review finding found, 1 fixed). Full report: `meta/issue-67.review-report.md`. **Verified true of the tree** - Both implementer defects real and red-first: `routes/agent-api.ts:299-302` (`already_done` early return, `1f81996`) and `routes/agents.ts:123-125` + `routes/plans.ts:657-660,1163,1170-1171` (`30fa4e2`). Red-first confirmed by merge-base source comparison: at `b64f46a` the result handler has no `already_done` branch, the bulk group block has no `assertEdit`, and the child queries are unfiltered. - Re-ran every test file the report cites green: `uc-mw-cluster5-ops` + `uc-mw-cluster3-agent` → 24 pass / 0 fail; `uc-mw-114-agents-bulk` → 1 pass / 0 fail; `uc-mw-142-ownership` → 6 pass / 1 fail. - The `uc-mw-142` red (`viewer invite can read but not write`, 500≠403) fails **in isolation** and the diff touches no `POST /plans` path → pre-existing, by isolation + diff reasoning (no merge-base run; worktree-free constraint). - Checkers: `_check.py` 0, `check-ai-headers.py` 0 (573 ok), `check-type-mirror.py` 0, `rg 'Showing lines'` = 9 doc-only matches. Plan Scope honoured: no `app.ts`, `plans/`, `dashboard/`, `agent/`, known reds untouched. Tests additive only, no `.skip`, `Refs #67` only, nothing pushed. **Fix (review commit)** - `0372b9b` `review(middleware): assert zero cross-org rows in shared-plan child collections` — the new compatibility guard was `counted <= 1` (passes while one sibling-org agent leaks) and `/plans/:id/health`, also changed by `30fa4e2`, had no assertion; now pinned to `rows.length === 0`, `counted === 0`, `health.executions === 0`. Suite still 6 pass / 1 fail (same pre-existing red). **Findings (mine)** - MINOR `30fa4e2` bundles two defects in one commit — accepted as a tightly-coupled cluster (same class, same scout origin). - MINOR report cites `plans.ts:1186`; after its own diff that line is `plans.ts:1190`. - MINOR F3 is overstated: `safety.ts:144-155` matches UC-MW-74 step 4 ("exactly one half-open execution"); the real gap is that a probe that never reports blocks the key until `POST /ops/circuit/reset`. - OBSERVATION persistence (`db/persist.ts`) and control plane (`control-agent.ts`) yielded zero findings — unexamined, not proven clean. **UNFIXED**: F1 `access.ts:104` assertEdit double-send → 500 instead of 403/404 (~20 `return;` callers) · F2 `incidents.ts:98` evidence clobber · F3 half-open probe has no timeout · F4 `pipeline.ts:183`/`incidents.ts:79` attempt counting · F5 `plans.ts:1190` global `tripsFor` leak · F6 `pipeline.ts:35` repeat-resolved ignores `transition` · F7 `agent/main.go:1055` repo-job allowlist no-op · F8 `agent/exec/exec.go:39` timeout spares grandchildren · F9 `agent/cmd.go:765/827` unsynchronised Client + flat backoff · persistence/control-plane areas unexamined.

EduarD3V referenced this issue from a commit 2026-10-07 23:43:05 +02:00

fix(result): duplicate /result report is a true no-op

EduarD3V referenced this issue from a commit 2026-10-07 23:43:05 +02:00

fix(tenancy): gate bulk group ops and plan child collections on row scope

EduarD3V referenced this issue from a commit 2026-10-07 23:43:05 +02:00

review(middleware): assert zero cross-org rows in shared-plan child collections

gotoi-agent referenced this issue 2026-10-07 23:43:09 +02:00

Issue #67: Bug hunt — middleware and agent defects proven with red-first tests #74

gotoi-agent commented 2026-10-07 23:43:21 +02:00

Author

Collaborator

Copy link

PUBLISHED — branch issue/67-bug-hunt pushed, PR #74 opened to agent-develop: #74. 3 commits (2 defect fixes: duplicate /result no-op, tenancy gating on bulk group ops + shared-plan child collections; 1 review commit). Orchestrator gates on final tree: _check.py 0, check-ai-headers 0 (573 ok), check-type-mirror 0, full middleware bun suite 587 pass / 1 fail — the fail is UC-MW-19 (plan survives a second buildApp), the documented pre-existing red on a clean base; all new regression tests pass, including the uc-mw-142 viewer test that failed during the hunt (pre-existing, now green). Review: FIXED 1 (0372b9b). Reported-not-fixed findings table lives in the DONE comment above — needs operator triage.

PUBLISHED — branch issue/67-bug-hunt pushed, PR #74 opened to agent-develop: https://git.eduard3v.com/EduarD3V/gotoi/pulls/74. 3 commits (2 defect fixes: duplicate /result no-op, tenancy gating on bulk group ops + shared-plan child collections; 1 review commit). Orchestrator gates on final tree: _check.py 0, check-ai-headers 0 (573 ok), check-type-mirror 0, full middleware bun suite 587 pass / 1 fail — the fail is UC-MW-19 (plan survives a second buildApp), the documented pre-existing red on a clean base; all new regression tests pass, including the uc-mw-142 viewer test that failed during the hunt (pre-existing, now green). Review: FIXED 1 (0372b9b). Reported-not-fixed findings table lives in the DONE comment above — needs operator triage.

gotoi-agent referenced this issue from a commit 2026-10-08 06:35:37 +02:00

Merge pull request 'Issue #67: Bug hunt — middleware and agent defects proven with red-first tests' (#74) from issue/67-bug-hunt into agent-develop

EduarD3V closed this issue 2026-10-08 09:18:48 +02:00

Sign in to join this conversation.

issue/67-bug-hunt

Branches Tags

Clear current reference

main

develop

agent-develop

hotfix/latest-tag

docs/reviewer-static-checkers

issue/93-table-fitting

issue/91-memory-row-invalidation

issue/90-requirements-hostnames

issue/89-typed-steps

issue/88-create-guards-explicit

issue/87-plan-rule-update

issue/86-abort-false-green

issue/85-typed-object-tools

issue/71-content-width

chore/integration-branch

docs/agent-review-guard

issue/72-datatable-row-menu

issue/66-docs-sync

issue/73-theme-selector

issue/70-personalization-move

issue/68-security-review

issue/67-bug-hunt

issue/58-tool-endpoint-scoping

issue/45-guided-setup-new-source

issue/46-accent-colour

chore/marketing-flat-docs

issue/44-hidden-plans

issue/43-plan-download

issue/38-applications-aiconfig

issue/41-bulk-decommission

chore/internal-forgejo-url

issue/42-source-list-text

issue/39-machines-details

issue/28-production-selling-audit

issue/27-hero-console-mock

issue/26-docs-unsell-selfhost

issue/22-source-type-badge

issue/21-alert-source-fields

chore/agent-queue-plan

develop-ed

chore/agent-phase3

fix/corpus-config-changed

fix/enforcement-retest

fix/verifier-observability

chore/agent-phase2

fix/issueflow-manual-never-merge

chore/agent-phase1

docs/agent-pipeline

chore/agent-phase0

chore/marketing-console-demo

feat/docs-site

chore/marketing-docs-production

fix/uc-mw-137-session-transcript

Clear current reference

v0.2.1

v0.2.0

agent-catalog

v0.1.1

v0.1.0

Labels

Clear labels   

ai-assist

Eligible for the autonomous issue pipeline — the runner only works issues carrying this label

  

needs_attention

Waiting on an operator decision. The runner skips this issue while the label is present; the operator answers with a DECISION: comment and the runner then applies it and clears this label.

  

verified

Operator verified the fix in production — runner closes it and does not re-work it

No labels

ai-assist

needs_attention

verified

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

EduarD3V/gotoi#67

No description provided.