The dashboard topology is introspected from the compiled graph, but
_maximal_compiled() built it without confluence=True, so conf_draft/conf_gate/
conf_write never appeared on the pipeline map. Wire them in:
- topology.py: _maximal_compiled(confluence=True); NODE_META entries for the
three conf nodes (own 'docs'/Documentation tree, conf_gate kind=gate,
gated=True so the UI dims the opt-in lane); add the 'docs' tree; map the
CONF_* phases in PHASE_TO_NODE so a live task buckets onto its node.
- layout.ts: the conf_gate->conf_draft request-changes loop reads '↺ revised'.
Frontend renders the new lane automatically (generic dagre layout + dynamic
treeByNode). +2 topology tests; edge-classification test updated (intake is now
a conditional branch point: clarify vs conf_draft). Full suite 1616 passed;
frontend typecheck + 44 tests green.
Address the verifier's residual on the macro-loss fix: the guard was raw-count
based, so a body that DROPPED the real Mermaid macro while ADDING an unrelated
macro (equal count) could slip through. Replace count_storage_macros in the
guard with storage_macro_signature (per-ac:name multiset) and refuse if ANY
macro identity loses occurrences. +2 tests.
Resolve the security-review BLOCKER and the confirmed authz/info findings on
the Confluence-writer node:
- BLOCKER (data-loss): _page_has_macros fail-OPENed (real ConfluenceClient has
no page_has_macros/ADF methods) so every live write fell through to a
wholesale storage-body PUT that drops Mermaid macros — the page-1540098
diagram-loss class. Add count_storage_macros + a real ConfluenceClient
.page_has_macros (storage-body detection); make _page_has_macros FAIL CLOSED;
and add _assert_macros_preserved as the final backstop: refuse any storage
write whose body carries fewer macros than the live page.
- AUTHZ-CONF-01: add an opt-in AGENT_TEAM_CONFLUENCE_ALLOWED_PAGE_IDS allowlist
enforced server-side before a live update (model-derived page_id).
- AUTHZ-CONF-02: stop silently picking the first accessible Confluence site;
require CONFLUENCE_CLOUD_ID when multiple resolve.
- INFO: 'applied' now fail-honest (defaults False, not True) on a missing attr.
+10 regression tests; full suite 1612 passed; ruff clean.
ci-web's `test` (vitest run) globbed e2e/dashboard.smoke.spec.ts, which imports
@playwright/test (the Playwright runner, not vitest) and fails to load — "1 test
file failed" while the 44 unit tests passed. Restrict vitest's include to
src/**; Playwright keeps its own testDir (./e2e).
The host assertion used `url.startswith("https://seahaven.atlassian.net")`,
which CodeQL flags (incomplete URL substring sanitization — a spoofed host like
`...atlassian.net.evil.com` passes a prefix check). Parse the URL and compare
scheme+netloc exactly instead. (PR #66 review finding.)
Pins the invariant behind the CRITICAL gate-delivery gap this PR fixed: a new
interrupt kind added to the pending_questions CHECK without a coordinator branch
suspends the task forever (no Slack post, no ledger row). The guard parses the
allowed kinds from PENDING_QUESTIONS_DDL (source of truth) and asserts every
non-default kind has a graph.*_KIND constant referenced in coordinator.py.
Negative-checked: removing the confluence_approval branch fails the guard.
Apply review findings from mining PR #61/#63/#64 and the recent merged PRs:
- conf_draft_node: drop the agentic invoker config (max_turns=8 + Read/Grep/Glob
+ budget) that merged #61 reverted live (#60); use max_turns=4 tools-off like
the planner. The draft is a reasoning->JSON node — repo context is folded into
the prompt, never fetched via Claude tools (feedback_claude_sdk_single_shot).
Invert the test that pinned the old tools-on contract.
- confluence_writer: record the dedicated Phase.CONF_DRAFT/CONF_GATE/CONF_WRITE
values instead of borrowing VERIFY/REVIEW/BUILD, so the ledger/transitions/
dashboard show the real lane.
- invoker: note the allowed_tools seam is replicated from merged #61 (drop on a
future rebase; byte-equivalent default None->[]).
- dashboard: document that conf_* vertices need no _NODE_TO_STAGE remap (node id
== stage key, identity fallback resolves them).
Verified (no change needed): coordinator confluence gate shares the plan gate's
crash isolation (_emit never raises, ledger write fail-soft); confluence_* state
channels persist via declared PipelineState channels + checkpointer; Flow B edge
hooks VERIFY's approved terminus, orthogonal to #61's plan-gate-approve routing.
Full suite 1564 passed; ruff + format clean.
