Gitinbox/OpenOPC
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ui): enforce durable org identity for runtime followups

Browse Source
This commit is contained in:
cgycorey
2026-08-02 17:20:34 +01:00
parent 734a2d5969
commit 15ab07cba2
9 changed files with 943 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
opc/engine.py
+76 -15
View File
@@ -37,6 +37,7 @@ from opc.core.config import (
company_org_path,
get_opc_home,
get_project_workplace,
validate_organization_id,
)
from opc.core.events import EventBus
from opc.core.models import (
@@ -3563,6 +3564,13 @@ class OPCEngine:
return False
return bool(dict(getattr(task, "metadata", {}) or {}).get("shared_role_session", False))
@staticmethod
def _normalize_durable_org_id(value: Any) -> str:
try:
return validate_organization_id(value)
except ValueError:
return ""
@staticmethod
def _runtime_org_id_for_identity(
decision: RouterDecision | None,
@@ -3583,7 +3591,6 @@ class OPCEngine:
getattr(decision, "org_id", None),
task_metadata.get("org_id"),
task_metadata.get("organization_id"),
getattr(org_config, "organization_id", None),
):
normalized = str(candidate or "").strip()
if normalized:
@@ -3628,6 +3635,12 @@ class OPCEngine:
root_session: bool = False,
) -> Task:
assert self.store and self.memory
runtime_company_profile = str(
getattr(decision, "company_profile", "")
or (work_item.metadata or {}).get("company_profile", "")
or getattr(getattr(self.config, "org", None), "company_profile", "")
or ""
).strip().lower()
runtime_org_id = self._runtime_org_id_for_identity(
decision,
getattr(work_item, "metadata", None),
@@ -3685,7 +3698,39 @@ class OPCEngine:
set_linked_work_item_id(existing, work_item.work_item_id)
existing.session_id = session_id
existing.metadata = dict(existing.metadata or {})
if runtime_org_id:
if runtime_company_profile == "custom":
persisted_org_id = self._normalize_durable_org_id(getattr(existing, "org_id", None))
incoming_org_id = self._normalize_durable_org_id(runtime_org_id)
if persisted_org_id and incoming_org_id and persisted_org_id != incoming_org_id:
from opc.plugins.office_ui.services.models import ServiceError
raise ServiceError(
"org_id_conflict",
"org_id_conflict",
{
"project_id": self.project_id or "default",
"task_id": str(getattr(work_item, "work_item_id", "") or ""),
"persisted_org_id": persisted_org_id,
"incoming_org_id": incoming_org_id,
"reason": "custom_company_run_org_id_conflict",
},
)
resolved_org_id = persisted_org_id or incoming_org_id
if not resolved_org_id:
from opc.plugins.office_ui.services.models import ServiceError
raise ServiceError(
"org_id_required",
"org_id_required",
{
"project_id": self.project_id or "default",
"task_id": str(getattr(work_item, "work_item_id", "") or ""),
"reason": "custom_company_run_requires_durable_org_id",
},
)
runtime_org_id = resolved_org_id
existing.org_id = resolved_org_id
existing.metadata["org_id"] = resolved_org_id
existing.metadata["organization_id"] = resolved_org_id
elif runtime_org_id:
existing.org_id = runtime_org_id
existing.metadata["org_id"] = runtime_org_id
existing.metadata["organization_id"] = runtime_org_id
@@ -3730,6 +3775,17 @@ class OPCEngine:
)
await self.store.save_task(existing)
return existing
if runtime_company_profile == "custom" and not runtime_org_id:
from opc.plugins.office_ui.services.models import ServiceError
raise ServiceError(
"org_id_required",
"org_id_required",
{
"project_id": self.project_id or "default",
"task_id": str(getattr(work_item, "work_item_id", "") or ""),
"reason": "custom_company_run_requires_durable_org_id",
},
)
employee_assignment = dict(topology_seat.get("employee_assignment", {}) or {})
if not employee_assignment and self.org_engine and role_id:
preferred_employee_id = str(topology_seat.get("employee_id", "") or "").strip() or None
@@ -3780,12 +3836,6 @@ class OPCEngine:
owner_execution_copy = build_work_item_owner_execution_copy(work_item)
owner_execution_copy.setdefault("delegation_role_session_id", role_session_id)
owner_execution_copy["work_kind"] = work_item_turn_type
runtime_company_profile = str(
getattr(decision, "company_profile", "")
or (work_item.metadata or {}).get("company_profile", "")
or getattr(getattr(self.config, "org", None), "company_profile", "")
or ""
).strip().lower()
runtime_identity_metadata = (
{
"org_id": runtime_org_id or "",
@@ -12704,7 +12754,12 @@ class OPCEngine:
seen_employee_ids.add(employee_id)
history = ""
if self.memory:
organization_id = str(getattr(getattr(self.config, "org", None), "organization_id", "") or "").strip()
organization_id = str(
getattr(delivery_task, "org_id", "")
or (delivery_task.metadata or {}).get("org_id")
or (delivery_task.metadata or {}).get("organization_id")
or ""
).strip()
history = self.memory.employee_evolution.build_employee_delta_context(
employee_id,
project_id=task.project_id,
@@ -13246,13 +13301,19 @@ class OPCEngine:
await self._mark_company_runtime_checkpoint_status(checkpoint, status="invalid")
return "Could not run self-evolution because the runtime task set could not be restored."
from opc.plugins.office_ui.execution_identity import resolve_delivery_task_org_identity
organization_id, identity_error = resolve_delivery_task_org_identity(
waiting_task,
payload=payload,
active_org_id=getattr(getattr(self.config, "org", None), "organization_id", ""),
default_org_id=DEFAULT_ORGANIZATION_ID,
)
if identity_error:
await self._mark_company_runtime_checkpoint_status(checkpoint, status="invalid")
return f"Could not run self-evolution because {identity_error}."
plan = deserialize_company_work_item_runtime_plan(payload.get("company_work_item_plan") or payload.get("plan", {}))
organization_id = str(
getattr(waiting_task, "org_id", "")
or payload.get("organization_id")
or getattr(getattr(self.config, "org", None), "organization_id", "")
or DEFAULT_ORGANIZATION_ID
).strip() or DEFAULT_ORGANIZATION_ID
root_role_id = str(
getattr(plan, "final_decider_role_id", "")
or plan.metadata.get("final_decider_role_id", "")
opc/layer2_organization/company_mode.py
+31 -3
View File
@@ -22,7 +22,11 @@ from opc.core.active_task_runs import (
ActiveTaskRunAdmissionClosed,
ActiveTaskRunRegistry,
)
from opc.core.config import DEFAULT_EXTERNAL_AGENT_STARTUP_TIMEOUT_SECONDS, DEFAULT_ORGANIZATION_ID
from opc.core.config import (
DEFAULT_EXTERNAL_AGENT_STARTUP_TIMEOUT_SECONDS,
DEFAULT_ORGANIZATION_ID,
validate_organization_id,
)
from opc.core.models import (
AdaptiveRoleProfile,
AdaptiveSignalSpec,
@@ -1326,6 +1330,26 @@ class CompanyRuntimeSpecBuilder(CompanyRuntimeWorkItemHelper):
or "corporate"
).strip() or "corporate"
org_config = getattr(self.org_engine.config, "org", None)
selected_org_id = ""
if profile == "custom":
try:
selected_org_id = validate_organization_id(getattr(decision, "org_id", None))
except ValueError:
selected_org_id = ""
if not selected_org_id:
# A custom-organization run must carry a durable org_id on the
# decision. Never derive it from the process-wide active
# config; fail closed before any work items are created.
from opc.plugins.office_ui.services.models import ServiceError
raise ServiceError(
"org_id_required",
"org_id_required",
{
"company_profile": profile,
"reason": "custom_company_run_requires_durable_org_id",
},
)
decision.org_id = selected_org_id
metadata: dict[str, Any] = {
"source": "work_item_runtime",
"execution_mode": "company_mode",
@@ -1333,7 +1357,11 @@ class CompanyRuntimeSpecBuilder(CompanyRuntimeWorkItemHelper):
"runtime_model": "multi_team_org",
"work_item_driven": True,
"company_profile": profile,
"organization_id": str(getattr(org_config, "organization_id", "") or "").strip(),
"organization_id": (
selected_org_id
if profile == "custom"
else str(getattr(org_config, "organization_id", "") or "").strip()
),
"organization_name": str(getattr(org_config, "organization_name", "") or "").strip(),
"organization_config_file": str(getattr(org_config, "organization_config_file", "") or "").strip(),
"original_request": original_message,
@@ -1341,7 +1369,7 @@ class CompanyRuntimeSpecBuilder(CompanyRuntimeWorkItemHelper):
"domains": list(getattr(decision, "domains", []) or []),
"preferred_agent": getattr(decision, "preferred_agent", None),
"requested_sub_tasks": list(getattr(decision, "sub_tasks", []) or []),
"org_id": getattr(decision, "org_id", None),
"org_id": selected_org_id if profile == "custom" else getattr(decision, "org_id", None),
}
return CompanyRuntimeSpec(
profile=profile,
opc/layer2_organization/custom_runtime.py
+15 -1
View File
@@ -64,8 +64,22 @@ class CustomRuntimeRunner:
) -> str:
from opc.engine import OPCEngine
from opc.layer2_organization.phase_hooks import unregister_dispatcher_wake
from opc.plugins.office_ui.services.models import ServiceError
org_config, resolved_org_id = self._build_org_config(org_id)
normalized_org_id = str(org_id or "").strip()
if not normalized_org_id:
# Isolated org mode must carry a durable org_id; resolving the
# active index here would silently route the run to whichever
# organization is currently loaded.
raise ServiceError(
"org_id_required",
"org_id_required",
{
"project_id": project_id or self.parent.project_id or "default",
"reason": "custom_company_run_requires_durable_org_id",
},
)
org_config, resolved_org_id = self._build_org_config(normalized_org_id)
normalized_project_id = str(project_id or self.parent.project_id or "default").strip() or "default"
shared_store = getattr(self.parent, "store", None)
runtime = OPCEngine(
opc/plugins/office_ui/execution_identity.py
+44 -1
View File
@@ -14,7 +14,7 @@ for that identity:
from __future__ import annotations
from dataclasses import dataclass
from typing import Any
from typing import Any, Mapping
from opc.core.config import validate_organization_id
from opc.layer2_organization.company_runtime_identity import is_company_runtime_task
@@ -198,3 +198,46 @@ def execution_identity_from_task(
default_preferred_agent=default_preferred_agent,
explicit_exec_mode=explicit,
)
def resolve_delivery_task_org_identity(
task: Any | None,
*,
payload: Mapping[str, Any] | None = None,
active_org_id: Any = "",
default_org_id: Any = "",
) -> tuple[str, str]:
"""Validate the org identity of a delivery self-evolution task.
Returns ``(organization_id, error)`` with at most one non-empty. Prefers
``Task.org_id``, then task metadata org fields; conflicting sources are
rejected. Checkpoint-payload org fields are a last-resort legacy fallback
and never override task/metadata identity. The active configuration org
is only consulted for a confirmed corporate task; custom-org deliveries
without a durable org id fail closed.
"""
metadata = task_metadata(task)
candidates: list[str] = []
for value in (
getattr(task, "org_id", None),
metadata.get("org_id"),
metadata.get("organization_id"),
):
normalized = normalize_org_id(value)
if normalized and normalized not in candidates:
candidates.append(normalized)
if len(candidates) > 1:
return "", "the delivery task org identity conflicts across task and metadata sources"
task_org_id = candidates[0] if candidates else ""
if task_org_id:
return task_org_id, ""
payload_org_id = normalize_org_id(
(payload or {}).get("org_id")
or (payload or {}).get("organization_id")
)
if payload_org_id:
return payload_org_id, ""
identity = execution_identity_from_task(task)
if identity.is_company:
return normalize_org_id(active_org_id) or normalize_org_id(default_org_id), ""
return "", "the custom-organization delivery task has no durable org identity"
opc/plugins/office_ui/ws_handler.py
+10
View File
@@ -7854,6 +7854,16 @@ class WSHandler:
parent_task = await run_engine.store.get_task(parent_task_id)
except Exception:
logger.opt(exception=True).debug("failed to load parent task for delivery feedback reply")
if parent_task is None:
raise ServiceError(
"org_id_required",
"org_id_required",
{
"project_id": pid,
"task_id": parent_task_id,
"reason": "delivery_feedback_requires_durable_parent_task",
},
)
session_exec_mode = self._normalize_session_exec_mode(self._exec_mode)
session_company_profile = self._normalize_session_company_profile(self._company_profile)
session_org_id = ""
tests/test_company_recruiter.py
+4
View File
@@ -2072,6 +2072,7 @@ class CompanyRecruiterFlowTests(unittest.IsolatedAsyncioTestCase):
decision = RouterDecision(
mode=ExecutionMode.COMPANY_MODE,
company_profile="custom",
org_id="test-org",
domains=[],
)
runtime_spec = engine.company_runtime_spec_builder.build_spec(
@@ -2140,6 +2141,7 @@ class CompanyRecruiterFlowTests(unittest.IsolatedAsyncioTestCase):
decision = RouterDecision(
mode=ExecutionMode.COMPANY_MODE,
company_profile="custom",
org_id="test-org",
domains=[],
)
runtime_spec = engine.company_runtime_spec_builder.build_spec(
@@ -2199,6 +2201,7 @@ class CompanyRecruiterFlowTests(unittest.IsolatedAsyncioTestCase):
decision = RouterDecision(
mode=ExecutionMode.COMPANY_MODE,
company_profile="custom",
org_id="test-org",
domains=[],
)
runtime_spec = engine.company_runtime_spec_builder.build_spec(
@@ -2312,6 +2315,7 @@ class CompanyRecruiterFlowTests(unittest.IsolatedAsyncioTestCase):
decision = RouterDecision(
mode=ExecutionMode.COMPANY_MODE,
company_profile="custom",
org_id="test-org",
domains=[],
)
runtime_spec = engine.company_runtime_spec_builder.build_spec(
tests/test_company_runtime_identity.py
+149
View File
@@ -260,6 +260,155 @@ def test_work_item_chat_resume_uses_canonical_ui_anchor_as_engine_origin() -> No
asyncio.run(scenario())
def test_company_suspend_reply_routes_selected_org_to_engine() -> None:
async def scenario() -> None:
_tasks, checkpoint = _runtime_records()
handler = WSHandler.__new__(WSHandler)
handler._exec_mode = "task"
handler._company_profile = "corporate"
handler._shutting_down = False
handler._active_runtime_children = {}
handler._session_to_task = {}
handler._task_bg_context = {}
handler._company_suspend_reply_locks = {"runtime-session": asyncio.Lock()}
handler.chat_store = None
handler._set_company_runtime_control = AsyncMock()
handler._normalize_session_exec_mode = MagicMock(return_value="task")
handler._normalize_session_company_profile = MagicMock(return_value="corporate")
handler._resolve_task_session_config = MagicMock(return_value=("org", "custom"))
handler._resolve_task_org_id = MagicMock(return_value="selected-org")
handler._extract_checkpoint_metadata = AsyncMock(return_value=None)
handler._sync_task_transcript_messages = AsyncMock()
handler.on_kanban_changed = AsyncMock()
handler._flush_progress = AsyncMock()
run_engine = SimpleNamespace(
project_id="project-a",
process_message=AsyncMock(return_value="resumed"),
)
target = {
"ui_anchor_task_id": "ui-anchor",
"config_task": SimpleNamespace(
metadata={"exec_mode": "org", "company_profile": "custom"},
org_id="selected-org",
),
}
await handler._process_company_suspend_reply(
ui_task_id="final-decider",
runtime_session_id="runtime-session",
content="continue",
attachment_refs=None,
message_metadata={"ui_force_resume": True},
user_message_id=None,
user_message_created_at=None,
run_engine=run_engine,
run_project_id="project-a",
target=target,
checkpoint=checkpoint,
lock=handler._company_suspend_reply_locks["runtime-session"],
)
call = run_engine.process_message.await_args
assert call.kwargs["org_id"] == "selected-org"
asyncio.run(scenario())
def test_delivery_feedback_reply_fails_closed_without_durable_parent_task() -> None:
async def scenario() -> None:
handler = WSHandler.__new__(WSHandler)
handler._exec_mode = "task"
handler._company_profile = "corporate"
handler._shutting_down = False
handler._active_runtime_children = {}
handler._session_to_task = {}
handler._task_bg_context = {}
handler._company_delivery_feedback_reply_locks = {}
handler.chat_store = None
handler._store_is_ready = MagicMock(return_value=True)
handler._normalize_session_exec_mode = MagicMock(return_value="task")
handler._normalize_session_company_profile = MagicMock(return_value="corporate")
handler._resolve_task_session_config = MagicMock(return_value=("org", "custom"))
handler._resolve_task_org_id = MagicMock(return_value="")
handler._chat_store_is_ready = MagicMock(return_value=False)
handler._flush_progress = AsyncMock()
run_engine = SimpleNamespace(
project_id="project-a",
store=SimpleNamespace(get_task=AsyncMock(return_value=None)),
run_company_delivery_self_evolution_checkpoint=AsyncMock(return_value="ran"),
)
await handler._process_company_delivery_feedback_reply(
parent_task_id="delivery-task",
parent_session_id="delivery-session",
reply_channel_id="session:delivery-task",
content="approved",
attachment_refs=None,
message_metadata=None,
user_message_id=None,
user_message_created_at=None,
run_engine=run_engine,
run_project_id="project-a",
checkpoint=SimpleNamespace(checkpoint_id="cp-delivery", payload={}),
waiting_task_id="delivery-task",
lock=asyncio.Lock(),
)
run_engine.run_company_delivery_self_evolution_checkpoint.assert_not_awaited()
handler._resolve_task_org_id.assert_not_called()
asyncio.run(scenario())
def test_delivery_feedback_reply_proceeds_with_durable_parent_task() -> None:
async def scenario() -> None:
handler = WSHandler.__new__(WSHandler)
handler._exec_mode = "task"
handler._company_profile = "corporate"
handler._shutting_down = False
handler._active_runtime_children = {}
handler._session_to_task = {}
handler._task_bg_context = {}
handler._company_delivery_feedback_reply_locks = {}
handler.chat_store = None
handler._store_is_ready = MagicMock(return_value=True)
handler._normalize_session_exec_mode = MagicMock(return_value="task")
handler._normalize_session_company_profile = MagicMock(return_value="corporate")
handler._resolve_task_session_config = MagicMock(return_value=("org", "custom"))
handler._resolve_task_org_id = MagicMock(return_value="selected-org")
handler._chat_store_is_ready = MagicMock(return_value=False)
handler._flush_progress = AsyncMock()
parent_task = SimpleNamespace(id="delivery-task")
run_engine = SimpleNamespace(
project_id="project-a",
store=SimpleNamespace(get_task=AsyncMock(return_value=parent_task)),
run_company_delivery_self_evolution_checkpoint=AsyncMock(return_value="ran"),
)
await handler._process_company_delivery_feedback_reply(
parent_task_id="delivery-task",
parent_session_id="delivery-session",
reply_channel_id="session:delivery-task",
content="approved",
attachment_refs=None,
message_metadata=None,
user_message_id=None,
user_message_created_at=None,
run_engine=run_engine,
run_project_id="project-a",
checkpoint=SimpleNamespace(checkpoint_id="cp-delivery", payload={}),
waiting_task_id="delivery-task",
lock=asyncio.Lock(),
)
call = run_engine.run_company_delivery_self_evolution_checkpoint.await_args
assert call is not None
assert call.kwargs["action"] == "approve"
handler._resolve_task_org_id.assert_called_once_with(parent_task)
asyncio.run(scenario())
def test_suspend_reply_missing_custom_org_id_fails_closed_before_engine_call() -> None:
async def scenario() -> None:
_tasks, checkpoint = _runtime_records()
tests/test_org_mode_entrypoint.py
+29
View File
@@ -13,6 +13,7 @@ from opc.core.org_config import (
)
from opc.engine import OPCEngine
from opc.layer2_organization.custom_runtime import CustomRuntimeRunner
from opc.plugins.office_ui.services.models import ServiceError
def test_requested_mode_normalization_keeps_core_company_router_main_compatible() -> None:
@@ -61,6 +62,34 @@ def test_custom_runtime_runner_loads_org_storage_without_mutating_parent_config(
assert (config_dir / "company_orgs" / "org_lab_config.yaml").exists()
def test_process_message_rejects_org_mode_without_org_id() -> None:
engine = OPCEngine.__new__(OPCEngine)
engine.opc_home = None
engine.config = OPCConfig()
runner = CustomRuntimeRunner(engine)
caught: ServiceError | None = None
async def _run() -> None:
await runner.process_message(
"run org",
project_id="default",
session_id="session-1",
org_id=None,
preferred_agent=None,
domains=None,
origin_task_id=None,
attachment_refs=None,
message_metadata=None,
)
try:
asyncio.run(_run())
except ServiceError as exc:
caught = exc
assert caught is not None
assert caught.code == "org_id_required"
def test_process_message_routes_org_mode_to_custom_runner(monkeypatch) -> None:
engine = OPCEngine.__new__(OPCEngine)
engine._initialized = True
tests/test_runtime_config_enforcement.py
+585 -2
View File
@@ -11,9 +11,15 @@ from unittest.mock import AsyncMock, MagicMock, patch
import yaml
from pydantic import ValidationError
from opc.core.config import AgentsConfig, ExternalAgentConfig, OPCConfig
from opc.core.config import (
AgentsConfig,
DEFAULT_ORGANIZATION_ID,
ExternalAgentConfig,
OPCConfig,
)
from opc.core.models import (
DelegationWorkItem,
ExecutionCheckpoint,
ExecutionMode,
RouterDecision,
SessionMessageRecord,
@@ -24,7 +30,8 @@ from opc.core.models import (
WorkItemExecutionStrategy,
)
from opc.engine import OPCEngine
from opc.layer2_organization.company_mode import CompanyWorkItemExecutor
from opc.layer2_organization.company_mode import CompanyRuntimeSpecBuilder, CompanyWorkItemExecutor
from opc.plugins.office_ui.services.models import ServiceError
from opc.layer3_agent.adapters.claude_code import ClaudeCodeAdapter
from opc.layer3_agent.adapters.codex_adapter import CodexAdapter
from opc.layer3_agent.adapters.cursor_adapter import CursorAdapter
@@ -391,6 +398,582 @@ class RuntimeConfigEnforcementTests(unittest.IsolatedAsyncioTestCase):
self.assertEqual(task.metadata["org_id"], "selected-org")
self.assertEqual(task.metadata["organization_id"], "selected-org")
def test_build_spec_rejects_custom_run_without_durable_org_id(self) -> None:
builder = CompanyRuntimeSpecBuilder(
org_engine=SimpleNamespace(
get_company_profile=lambda: "custom",
config=SimpleNamespace(
org=SimpleNamespace(
organization_id="active-org",
organization_name="Active Org",
organization_config_file="org_active-org_config.yaml",
company_profile="custom",
)
),
)
)
with self.assertRaises(ServiceError) as ctx:
builder.build_spec(
RouterDecision(
mode=ExecutionMode.COMPANY_MODE,
company_profile="custom",
org_id=None,
),
original_message="Run the company.",
)
assert ctx.exception.code == "org_id_required"
def test_build_spec_serializes_selected_org_not_active_config(self) -> None:
builder = CompanyRuntimeSpecBuilder(
org_engine=SimpleNamespace(
get_company_profile=lambda: "custom",
config=SimpleNamespace(
org=SimpleNamespace(
organization_id="active-org",
organization_name="Active Org",
organization_config_file="org_active-org_config.yaml",
company_profile="custom",
)
),
)
)
decision = RouterDecision(
mode=ExecutionMode.COMPANY_MODE,
company_profile="custom",
org_id="selected-org",
)
spec = builder.build_spec(decision, original_message="Run the company.")
assert spec.metadata["org_id"] == "selected-org"
assert spec.metadata["organization_id"] == "selected-org"
def test_runtime_org_id_for_identity_never_derives_from_active_config(self) -> None:
engine = OPCEngine(config=OPCConfig(), project_id="proj1")
engine.config.org.company_profile = "custom"
engine.config.org.organization_id = "active-org"
decision = RouterDecision(
mode=ExecutionMode.COMPANY_MODE,
company_profile="custom",
org_id=None,
)
resolved = OPCEngine._runtime_org_id_for_identity(
decision,
{},
engine.config.org,
)
assert resolved is None
async def test_ensure_runtime_work_item_task_rejects_custom_without_durable_org(self) -> None:
engine = OPCEngine(config=OPCConfig(), project_id="proj1")
engine.config.org.company_profile = "custom"
engine.config.org.organization_id = "active-org"
engine.store = SimpleNamespace(
get_runtime_task_for_work_item=AsyncMock(return_value=None),
save_delegation_work_item=AsyncMock(),
save_task=AsyncMock(),
link_work_item_runtime_task=AsyncMock(return_value=True),
)
engine.memory = SimpleNamespace(ensure_session=AsyncMock())
engine.org_engine = SimpleNamespace(
current_org_version=MagicMock(return_value=1),
current_runtime_topology_version=MagicMock(return_value=1),
)
engine._requests_explicit_project_knowledge = MagicMock(return_value=False)
work_item = DelegationWorkItem(
work_item_id="wi-no-durable-org",
run_id="run-no-durable-org",
cell_id="team::engineering",
team_instance_id="team-instance-1",
role_id="engineer",
seat_id="seat-engineer",
title="Engineering execution",
summary="Implement the requested change.",
kind="execute",
projection_id="engineering-execute",
metadata={"seat_id": "seat-engineer", "team_id": "team::engineering"},
)
with self.assertRaises(ServiceError) as ctx:
await engine._ensure_runtime_work_item_task(
work_item=work_item,
parent_session_id="sess-company",
original_message="Build the thing.",
decision=RouterDecision(
mode=ExecutionMode.COMPANY_MODE,
company_profile="custom",
org_id=None,
),
runtime_topology={
"final_decider_role_id": "lead",
"seats": [
{
"seat_id": "seat-engineer",
"team_id": "team::engineering",
"role_id": "engineer",
"employee_assignment": {"employee_id": "eng-1", "name": "Engineer"},
"metadata": {"role_name": "Engineer"},
}
],
},
delegation_playbook={},
secretary_context="",
target_output_dir=None,
origin_channel="cli",
origin_chat_id="",
origin_thread_id="",
origin_task_id=None,
attachment_refs=[],
attachment_context="",
force_native_execution=False,
)
assert ctx.exception.code == "org_id_required"
engine.store.save_task.assert_not_awaited()
async def test_ensure_runtime_work_item_task_rejects_existing_custom_task_without_durable_org(self) -> None:
existing = Task(
id="existing-no-org",
title="Engineering execution",
project_id="proj1",
session_id="sess-company:wi-existing-no-org",
assigned_to="engineer",
metadata={
"execution_mode": "company_mode",
"runtime_model": "multi_team_org",
"work_item_runtime": True,
"work_item_projection_id": "engineering-execute",
"work_item_turn_type": "execute",
"company_profile": "custom",
"delegation_seat_id": "seat-engineer",
},
)
engine = OPCEngine(config=OPCConfig(), project_id="proj1")
engine.config.org.company_profile = "custom"
engine.config.org.organization_id = "active-org"
engine.store = SimpleNamespace(
get_runtime_task_for_work_item=AsyncMock(return_value=existing),
save_delegation_work_item=AsyncMock(),
save_task=AsyncMock(),
link_work_item_runtime_task=AsyncMock(return_value=True),
)
engine.memory = SimpleNamespace(ensure_session=AsyncMock())
work_item = DelegationWorkItem(
work_item_id="wi-existing-no-org",
run_id="run-existing-no-org",
cell_id="team::engineering",
team_instance_id="team-instance-1",
role_id="engineer",
seat_id="seat-engineer",
title="Engineering execution",
summary="Implement the requested change.",
kind="execute",
projection_id="engineering-execute",
metadata={"seat_id": "seat-engineer", "team_id": "team::engineering"},
)
with self.assertRaises(ServiceError) as ctx:
await engine._ensure_runtime_work_item_task(
work_item=work_item,
parent_session_id="sess-company",
original_message="Build the thing.",
decision=RouterDecision(
mode=ExecutionMode.COMPANY_MODE,
company_profile="custom",
org_id=None,
),
runtime_topology={
"final_decider_role_id": "lead",
"seats": [
{
"seat_id": "seat-engineer",
"team_id": "team::engineering",
"role_id": "engineer",
"employee_assignment": {"employee_id": "eng-1", "name": "Engineer"},
"metadata": {"role_name": "Engineer"},
}
],
},
delegation_playbook={},
secretary_context="",
target_output_dir=None,
origin_channel="cli",
origin_chat_id="",
origin_thread_id="",
origin_task_id=None,
attachment_refs=[],
attachment_context="",
force_native_execution=False,
)
assert ctx.exception.code == "org_id_required"
engine.store.save_task.assert_not_awaited()
async def test_ensure_runtime_work_item_task_rejects_conflicting_org_ids(self) -> None:
existing = Task(
id="existing-conflict-org",
title="Engineering execution",
project_id="proj1",
session_id="sess-company:wi-existing-conflict-org",
assigned_to="engineer",
org_id="persisted-org",
metadata={
"execution_mode": "company_mode",
"runtime_model": "multi_team_org",
"work_item_runtime": True,
"work_item_projection_id": "engineering-execute",
"work_item_turn_type": "execute",
"company_profile": "custom",
"organization_id": "persisted-org",
"delegation_seat_id": "seat-engineer",
},
)
engine = OPCEngine(config=OPCConfig(), project_id="proj1")
engine.config.org.company_profile = "custom"
engine.config.org.organization_id = "active-org"
engine.store = SimpleNamespace(
get_runtime_task_for_work_item=AsyncMock(return_value=existing),
save_delegation_work_item=AsyncMock(),
save_task=AsyncMock(),
link_work_item_runtime_task=AsyncMock(return_value=True),
)
engine.memory = SimpleNamespace(ensure_session=AsyncMock())
work_item = DelegationWorkItem(
work_item_id="wi-existing-conflict-org",
run_id="run-existing-conflict-org",
cell_id="team::engineering",
team_instance_id="team-instance-1",
role_id="engineer",
seat_id="seat-engineer",
title="Engineering execution",
summary="Implement the requested change.",
kind="execute",
projection_id="engineering-execute",
metadata={"seat_id": "seat-engineer", "team_id": "team::engineering"},
)
with self.assertRaises(ServiceError) as ctx:
await engine._ensure_runtime_work_item_task(
work_item=work_item,
parent_session_id="sess-company",
original_message="Build the thing.",
decision=RouterDecision(
mode=ExecutionMode.COMPANY_MODE,
company_profile="custom",
org_id="selected-org",
),
runtime_topology={
"final_decider_role_id": "lead",
"seats": [
{
"seat_id": "seat-engineer",
"team_id": "team::engineering",
"role_id": "engineer",
"employee_assignment": {"employee_id": "eng-1", "name": "Engineer"},
"metadata": {"role_name": "Engineer"},
}
],
},
delegation_playbook={},
secretary_context="",
target_output_dir=None,
origin_channel="cli",
origin_chat_id="",
origin_thread_id="",
origin_task_id=None,
attachment_refs=[],
attachment_context="",
force_native_execution=False,
)
assert ctx.exception.code == "org_id_conflict"
engine.store.save_task.assert_not_awaited()
async def test_ensure_runtime_work_item_task_repairs_existing_custom_task_from_persisted_durable_org(self) -> None:
existing = Task(
id="existing-durable-org",
title="Engineering execution",
project_id="proj1",
session_id="sess-company:wi-existing-durable-org",
assigned_to="engineer",
org_id="persisted-org",
metadata={
"execution_mode": "company_mode",
"runtime_model": "multi_team_org",
"work_item_runtime": True,
"work_item_projection_id": "engineering-execute",
"work_item_turn_type": "execute",
"company_profile": "custom",
"organization_id": "stale-org",
"delegation_seat_id": "seat-engineer",
},
)
engine = OPCEngine(config=OPCConfig(), project_id="proj1")
engine.config.org.company_profile = "custom"
engine.config.org.organization_id = "active-org"
engine.store = SimpleNamespace(
get_runtime_task_for_work_item=AsyncMock(return_value=existing),
save_delegation_work_item=AsyncMock(),
save_task=AsyncMock(),
link_work_item_runtime_task=AsyncMock(return_value=True),
)
engine.memory = SimpleNamespace(ensure_session=AsyncMock())
work_item = DelegationWorkItem(
work_item_id="wi-existing-durable-org",
run_id="run-existing-durable-org",
cell_id="team::engineering",
team_instance_id="team-instance-1",
role_id="engineer",
seat_id="seat-engineer",
title="Engineering execution",
summary="Implement the requested change.",
kind="execute",
projection_id="engineering-execute",
metadata={"seat_id": "seat-engineer", "team_id": "team::engineering"},
)
repaired = await engine._ensure_runtime_work_item_task(
work_item=work_item,
parent_session_id="sess-company",
original_message="Build the thing.",
decision=RouterDecision(
mode=ExecutionMode.COMPANY_MODE,
company_profile="custom",
org_id=None,
),
runtime_topology={
"final_decider_role_id": "lead",
"seats": [
{
"seat_id": "seat-engineer",
"team_id": "team::engineering",
"role_id": "engineer",
"employee_assignment": {"employee_id": "eng-1", "name": "Engineer"},
"metadata": {"role_name": "Engineer"},
}
],
},
delegation_playbook={},
secretary_context="",
target_output_dir=None,
origin_channel="cli",
origin_chat_id="",
origin_thread_id="",
origin_task_id=None,
attachment_refs=[],
attachment_context="",
force_native_execution=False,
)
self.assertEqual(repaired.id, "existing-durable-org")
self.assertEqual(repaired.org_id, "persisted-org")
self.assertEqual(repaired.metadata["org_id"], "persisted-org")
self.assertEqual(repaired.metadata["organization_id"], "persisted-org")
engine.store.save_task.assert_awaited_with(existing)
async def test_delivery_self_evolution_custom_without_durable_org_fails_closed(self) -> None:
engine = OPCEngine(config=OPCConfig(), project_id="proj1")
engine.config.org.company_profile = "custom"
engine.config.org.organization_id = "active-org"
waiting_task = Task(
id="waiting-custom",
project_id="proj1",
session_id="sess-delivery",
metadata={
"execution_mode": "company_mode",
"company_profile": "custom",
"work_item_runtime": True,
"work_item_projection_id": "delivery",
"work_item_turn_type": "deliver",
},
)
engine.store = SimpleNamespace(get_task=AsyncMock(return_value=waiting_task))
engine._mark_company_runtime_checkpoint_status = AsyncMock()
engine._create_company_self_evolution_root_work_item = AsyncMock()
checkpoint = ExecutionCheckpoint(
checkpoint_id="cp-delivery",
project_id="proj1",
session_id="sess-delivery",
task_id="waiting-custom",
checkpoint_type="company_delivery_feedback",
payload={"waiting_task_id": "waiting-custom", "task_ids": ["waiting-custom"]},
)
result = await engine._run_company_delivery_self_evolution_consumed(
checkpoint,
action="approve",
)
assert "durable org identity" in result
engine._mark_company_runtime_checkpoint_status.assert_awaited_once_with(
checkpoint,
status="invalid",
)
engine._create_company_self_evolution_root_work_item.assert_not_awaited()
async def test_delivery_self_evolution_custom_uses_durable_org_over_payload_and_config(self) -> None:
engine = OPCEngine(config=OPCConfig(), project_id="proj1")
engine.config.org.company_profile = "custom"
engine.config.org.organization_id = "active-org"
waiting_task = Task(
id="waiting-custom-2",
project_id="proj1",
session_id="sess-delivery",
org_id="selected-org",
metadata={
"execution_mode": "company_mode",
"company_profile": "custom",
"work_item_runtime": True,
"work_item_projection_id": "delivery",
"work_item_turn_type": "deliver",
},
)
engine.store = SimpleNamespace(get_task=AsyncMock(return_value=waiting_task))
engine._mark_company_runtime_checkpoint_status = AsyncMock()
engine.org_engine = None
engine._company_followup_target_task = MagicMock(
return_value=SimpleNamespace(assigned_to="lead", metadata={}),
)
engine.company_executor = SimpleNamespace()
engine._self_evolution_assignments_by_role = MagicMock(return_value={})
engine._create_company_self_evolution_root_work_item = AsyncMock(return_value=None)
checkpoint = ExecutionCheckpoint(
checkpoint_id="cp-delivery-2",
project_id="proj1",
session_id="sess-delivery",
task_id="waiting-custom-2",
checkpoint_type="company_delivery_feedback",
payload={
"waiting_task_id": "waiting-custom-2",
"task_ids": ["waiting-custom-2"],
"organization_id": "stale-org",
},
)
await engine._run_company_delivery_self_evolution_consumed(
checkpoint,
action="approve",
)
call = engine._create_company_self_evolution_root_work_item.await_args
assert call is not None
assert call.kwargs["organization_id"] == "selected-org"
async def test_delivery_self_evolution_corporate_still_uses_config_default(self) -> None:
engine = OPCEngine(config=OPCConfig(), project_id="proj1")
waiting_task = Task(
id="waiting-corporate",
project_id="proj1",
session_id="sess-delivery",
metadata={
"execution_mode": "company_mode",
"company_profile": "corporate",
"work_item_runtime": True,
"work_item_projection_id": "delivery",
"work_item_turn_type": "deliver",
},
)
engine.store = SimpleNamespace(get_task=AsyncMock(return_value=waiting_task))
engine._mark_company_runtime_checkpoint_status = AsyncMock()
engine.org_engine = None
engine._company_followup_target_task = MagicMock(
return_value=SimpleNamespace(assigned_to="lead", metadata={}),
)
engine.company_executor = SimpleNamespace()
engine._self_evolution_assignments_by_role = MagicMock(return_value={})
engine._create_company_self_evolution_root_work_item = AsyncMock(return_value=None)
checkpoint = ExecutionCheckpoint(
checkpoint_id="cp-delivery-corp",
project_id="proj1",
session_id="sess-delivery",
task_id="waiting-corporate",
checkpoint_type="company_delivery_feedback",
payload={"waiting_task_id": "waiting-corporate", "task_ids": ["waiting-corporate"]},
)
await engine._run_company_delivery_self_evolution_consumed(
checkpoint,
action="approve",
)
call = engine._create_company_self_evolution_root_work_item.await_args
assert call is not None
assert call.kwargs["organization_id"] == DEFAULT_ORGANIZATION_ID
async def test_delivery_self_evolution_metadata_only_legacy_custom_uses_metadata_org(self) -> None:
engine = OPCEngine(config=OPCConfig(), project_id="proj1")
engine.config.org.company_profile = "custom"
engine.config.org.organization_id = "active-org"
waiting_task = Task(
id="waiting-legacy-metadata",
project_id="proj1",
session_id="sess-delivery",
metadata={
"work_item_runtime": True,
"work_item_projection_id": "delivery",
"work_item_turn_type": "deliver",
"org_id": "selected-org",
},
)
engine.store = SimpleNamespace(get_task=AsyncMock(return_value=waiting_task))
engine._mark_company_runtime_checkpoint_status = AsyncMock()
engine.org_engine = None
engine._company_followup_target_task = MagicMock(
return_value=SimpleNamespace(assigned_to="lead", metadata={}),
)
engine.company_executor = SimpleNamespace()
engine._self_evolution_assignments_by_role = MagicMock(return_value={})
engine._create_company_self_evolution_root_work_item = AsyncMock(return_value=None)
checkpoint = ExecutionCheckpoint(
checkpoint_id="cp-delivery-legacy",
project_id="proj1",
session_id="sess-delivery",
task_id="waiting-legacy-metadata",
checkpoint_type="company_delivery_feedback",
payload={
"waiting_task_id": "waiting-legacy-metadata",
"task_ids": ["waiting-legacy-metadata"],
},
)
await engine._run_company_delivery_self_evolution_consumed(
checkpoint,
action="approve",
)
call = engine._create_company_self_evolution_root_work_item.await_args
assert call is not None
assert call.kwargs["organization_id"] == "selected-org"
async def test_delivery_self_evolution_conflicting_org_ids_fail_closed(self) -> None:
engine = OPCEngine(config=OPCConfig(), project_id="proj1")
engine.config.org.company_profile = "custom"
engine.config.org.organization_id = "active-org"
waiting_task = Task(
id="waiting-conflict",
project_id="proj1",
session_id="sess-delivery",
org_id="selected-org",
metadata={
"work_item_runtime": True,
"work_item_projection_id": "delivery",
"work_item_turn_type": "deliver",
"org_id": "other-org",
},
)
engine.store = SimpleNamespace(get_task=AsyncMock(return_value=waiting_task))
engine._mark_company_runtime_checkpoint_status = AsyncMock()
engine.org_engine = None
engine._company_followup_target_task = MagicMock(
return_value=SimpleNamespace(assigned_to="lead", metadata={}),
)
engine.company_executor = SimpleNamespace()
engine._self_evolution_assignments_by_role = MagicMock(return_value={})
engine._create_company_self_evolution_root_work_item = AsyncMock(return_value=None)
checkpoint = ExecutionCheckpoint(
checkpoint_id="cp-delivery-conflict",
project_id="proj1",
session_id="sess-delivery",
task_id="waiting-conflict",
checkpoint_type="company_delivery_feedback",
payload={
"waiting_task_id": "waiting-conflict",
"task_ids": ["waiting-conflict"],
},
)
result = await engine._run_company_delivery_self_evolution_consumed(
checkpoint,
action="approve",
)
assert "org identity" in result
engine._mark_company_runtime_checkpoint_status.assert_awaited_once_with(
checkpoint,
status="invalid",
)
engine._create_company_self_evolution_root_work_item.assert_not_awaited()
async def test_company_materialized_work_item_uses_selected_agent_over_template_preference(self) -> None:
saved_tasks: list[Task] = []