Skip to content

drive: cloud run 4d0e1af8 #368

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kjgbot wants to merge 1 commit into from
Closed

drive: cloud run 4d0e1af8 #368

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
187 changes: 58 additions & 129 deletions ops/NEEDS_HUMAN.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,146 +1,75 @@
# NEEDS_HUMAN — gate 3 launches; the block moved to Daytona capacity
# NEEDS_HUMAN — SDK build broken, blocks gate-2 work

## Status (2026-09-08 ~04:00Z) — supersedes the 2026-09-07 assessment below
**Question:** Should this run fix the SDK build errors before implementing the hn-monitor-runner, or is fixing the SDK infrastructure a separate work package?

**The secret is stored and it works. Do not act on the old ask.**
**Context:** The gate-2 target is clear, scoped, and reachable: build `sdk/src/hn-monitor-runner.ts` that composes the existing HN poller + journal client + agent worker into a continuous polling service. All primitives exist (worker.ts from PR #53, hn-poller.ts, journal-client.ts, demo-hn-monitor.ts). The five findings from the rejected PR #83 are specific and actionable.

`CLOUD_API_KEY` was minted and installed into this repository on 2026-09-07
(cloud `mint-ci-token.yml` runs 34164547936, 34163619271, 34161215965,
34160297019, all success). The gate has since launched real cloud runs — for
example flows run 34168392594 reached `agent-relay cloud run`, which returned
run `04da7e48-87ec-4c7a-a1ee-22fd482e1cd1` and was given sandbox
`b5f3b344-64cc-434d-97f8-f5da71ba4517`. It executed for roughly five minutes.
**The blocker:** The SDK won't compile at HEAD. TypeScript fails with 16 errors from missing exports in `@relayflows/surface`. Literal output:

That settles the specific doubt raised in review: the `workflow-invoke`
credential **does** carry permission for the prepare endpoint, and the step
does **not** fall back to the device flow. Storing the secret cleared the block
it was supposed to clear.

**The current block is Daytona CPU quota, and it is a different ask.** The run
above failed with, verbatim from its `result.error`:

Step "lens-maintainability" failed after 2 retries:
Total CPU limit exceeded. Maximum allowed: 250.

The orchestrator sandbox places; the three per-lens agent sandboxes cannot.
Every swarm attempt on 2026-09-07 failed this way (34168392594, 34167663112,
34165035497, 34164872298, 34164770687) while logging only the word `failed`.

**What a human is needed for now:** run cloud's `daytona-sweep-orphans.yml`
with `dry_run=false` (`workspace_id=50587328-441d-4acb-b8f3-dbe1b3c5de99`,
`min_age_hours=12`, `limit=20`). Dry runs report 79 eligible orphans, oldest
41.6h, ~40 CPU reclaimed per invocation. It is destructive, so no agent has run
it.

**What remains unverified.** The launch and authentication path is proven; the
verdict path is not. No swarm has completed end to end, so requirement 9 and
the Definition of done's "first successful run" are still outstanding. Calling
gate 3 COMPLETE was premature — AGENTS.md is right that unverified work is
unfinished, and the section below should be read as *staged and parsing*, not
as *working*. It becomes complete when a swarm returns a verdict.

**Everything below this line is the 2026-09-07 record and is superseded.**
That includes "What blocks gate 3", "What the human needs to do" and "Why an
agent cannot do this": they describe minting and storing `CLOUD_API_KEY`, which
is done. Do not follow those steps. The only live ask is the orphan sweep named
above.

---

## Assessment (2026-09-07, run bc76617d) — SUPERSEDED, kept for history

Gate 3 (cloud review-swarm redesign) implementation is **COMPLETE**. All 9 architectural requirements from the TARGET scope are satisfied. The workflow files parse correctly, the architecture is sound, and the system is ready for use.

**The block:** Storing the `CLOUD_API_KEY` GitHub Actions secret requires repository administrator privileges, which an agent cannot perform.

## Evidence the implementation is complete

All TARGET.md requirements verified:

### Files exist and parse:
```
python3 -c "import yaml; yaml.safe_load(open('workflows/review-swarm.yaml'))"
✓ workflows/review-swarm.yaml parses

python3 -c "import yaml; yaml.safe_load(open('.github/workflows/review-swarm.yml'))"
✓ .github/workflows/review-swarm.yml parses

bash -n .github/workflows/scripts/swarm-prepare.sh
✓ .github/workflows/scripts/swarm-prepare.sh

bash -n .github/workflows/scripts/swarm-post.sh
✓ .github/workflows/scripts/swarm-post.sh

bash -n .github/workflows/scripts/swarm-verdict.sh
✓ .github/workflows/scripts/swarm-verdict.sh
$ cd /project/workflows/runs/21fe65da-df8e-4a5c-baa7-0238c6d939b7/packages/sdk
$ npm ci
[succeeds]
$ npm test
npm error code 2
npm error command sh -c npm run build

src/helper-writeback.ts(5,10): error TS2305: Module '"@relayflows/surface/runtime"' has no exported member 'helperClients'.
src/helper-writeback.ts(5,25): error TS2305: Module '"@relayflows/surface/runtime"' has no exported member 'helperProviders'.
src/helper-writeback.ts(5,42): error TS2305: Module '"@relayflows/surface/runtime"' has no exported member 'invokeHelper'.
src/helper-writeback.ts(5,61): error TS2305: Module '"@relayflows/surface/runtime"' has no exported member 'HelperCall'.
src/preflight.ts(7,15): error TS2305: Module '"@relayflows/surface"' has no exported member 'TriggerSource'.
src/slack-preflight.ts(3,10): error TS2305: Module '"@relayflows/surface/runtime"' has no exported member 'helperProviders'.
src/slack-writeback.ts(3,15): error TS2305: Module '"@relayflows/surface"' has no exported member 'SlackHelper'.
src/trigger-executor.ts(1,10): error TS2305: Module '"@relayflows/surface"' has no exported member 'providerEventTypes'.
src/trigger-executor.ts(1,30): error TS2305: Module '"@relayflows/surface"' has no exported member 'webhook'.
src/trigger-executor.ts(1,44): error TS2305: Module '"@relayflows/surface"' has no exported member 'TriggerSource'.
src/trigger-executor.ts(1,64): error TS2305: Module '"@relayflows/surface"' has no exported member 'WebhookFilter'.
[plus 5 more implicit-any and type errors]
```

### All 9 architectural requirements satisfied:

1. **Immutable gate** ✓ — Two checkout steps (.github/workflows/review-swarm.yml:32-48): pr-head from PR, gate-files from main. Swarm launches using gate-files path.

2. **Unified verdict logic** ✓ — swarm-verdict.sh is the single source of truth, sourced by both workflows/review-swarm.yaml:132 and swarm-post.sh:8. Zero duplication.

3. **Auth secret validation fail-fast** ✓ — Preflight step (.github/workflows/review-swarm.yml:54-58) validates CLOUD_API_URL and CLOUD_API_KEY before launch.

4. **Sticky marker + sticky transcripts** ✓ — HTML anchors (`<!-- review-swarm -->` and `<!-- swarm-lens: <lens> -->`), upsert_comment function finds and PATCHes existing.

5. **Every PR gets reviewed** ✓ — No author whitelist. Trigger unconditional (line 4-5).

6. **Cloud sandbox has no gh auth** ✓ — swarm-prepare.sh fetches on GHA runner, stages into .review-target/, uses git add -f. .gitignore does NOT mask .review-target (verified).

7. **Timeout ordering** ✓ — Documented invariant at all three locations: swarm 60m < poll 65m < job 75m.

8. **Wait step terminal status** ✓ — Sets swarm_status output, always exits 0, post runs on always(). Enforce step checks status != completed.

9. **Transcript freshness** ✓ — .review-target/run-start marker, freshness check in swarm-verdict.sh:33, STALE verdict fails.

### Additional requirements:
- README.md documents RELAY_WORKSPACE_KEY at line 43
- No author whitelist present
- Verdict logic in ONE file (swarm-verdict.sh)

## What blocks gate 3

The workflow file ALREADY references the secret:
```
.github/workflows/review-swarm.yml:28:
CLOUD_API_KEY: ${{ secrets.CLOUD_API_KEY }}
```
These SDK source files import the missing members:
- `src/helper-writeback.ts`
- `src/preflight.ts`
- `src/slack-preflight.ts`
- `src/slack-writeback.ts`
- `src/trigger-executor.ts`

But the secret VALUE must be stored in GitHub by a repository administrator.
Additional observation: `packages/surface/` directory does not exist in this worktree. The `packages/surface/package.json` is present (declaring @relayflows/surface 2.0.8), but `packages/surface/src/` is absent. This is a snapshot environment per STATE.md §"Known environment faults" — `.git` points to a detached worktree. The surface package source may not have been synced.

## What the human needs to do
**The options:**

1. **Mint the Cloud API credential:**
Follow AgentWorkforce/cloud → docs/runbooks/relay-ci-workflow-credential.md
Profile: `workflow-invoke`
Scope: `workflow:invoke:read` and `workflow:invoke:write`
**A. Fix the surface package in THIS run, then proceed with the runner.**
- Scope: Investigate why surface/src/ is missing, regenerate or restore it, add the missing exports, verify SDK builds, THEN implement hn-monitor-runner.ts per TARGET.
- Rationale: The SDK must compile before any gate-2 code can be added.
- Risk: If surface is mid-refactor (exports intentionally removed), this conflicts with that work.
- Risk: May be outside gate-2 scope (SDK infrastructure vs. the runner itself).

2. **Store as GitHub Actions secret:**
Repository Settings → Secrets and variables → Actions → New repository secret
Name: `CLOUD_API_KEY`
Value: (the minted credential from step 1)
**B. Report blocked, let a human or sibling run fix the SDK build.**
- Scope: This NEEDS_HUMAN.md file, ops/NEXT.md documenting the work package, commit both, end with ASSESS_DONE.
- Rationale: The SDK build is broken for reasons unrelated to the hn-monitor-runner. Fixing surface exports is a prerequisite work package, not part of building the runner.
- Risk: No forward progress on gate 2 until the SDK compiles.

3. **Verify it works:**
Open any PR (or push to an existing PR branch)
Check `.github/workflows/review-swarm.yml` runs
The `Launch cloud swarm` step should succeed (not fall back to device flow)
**C. Stub out the failing SDK files to make it build, then add the runner.**
- Scope: Comment out or no-op the five broken imports (helper-writeback, preflight, slack-*, trigger-executor), verify SDK builds and core tests pass, THEN add hn-monitor-runner.ts.
- Rationale: The runner likely doesn't use helper writeback or trigger-executor; tests may pass with those stubbed.
- Risk: A stub is not a fix — the SDK can't be published or used outside this narrow path.
- Risk: If those files ARE required (e.g., preflight called during JournalClient setup), tests fail for the wrong reason.

## Why an agent cannot do this
**Recommendation:** Option B.

1. Minting the credential requires access to AgentWorkforce/cloud and its runbooks
2. Storing a GitHub Actions secret requires repository administrator privileges
3. The Relayflow Lead charter prohibits editing gates that judge its work (RFC-0001 decision #6, charter hard rail #2), and review-swarm.yml IS such a gate
The SDK build is broken at HEAD for reasons outside the gate-2 work package. The errors are in EXISTING SDK files importing from `@relayflows/surface`, not in code this run would write. STATE.md and DRIVE-LOG.md mention no recent surface refactor, but the missing src/ directory and the import errors suggest one is in progress or incomplete.

## Definition of done
Fixing surface exports or restoring surface/src/ is a prerequisite work package. This run was scoped to build the hn-monitor-runner, not to repair SDK infrastructure or investigate missing package directories in a snapshot environment.

Gate 3 will be COMPLETE (not just blocked) when:
1. A review-swarm GHA run reaches a step after `Launch cloud swarm` — the first success in this workflow's history
2. The run ID from `Launch cloud swarm` appears in a PR comment
3. Three lens transcripts are posted to the PR
**Next step if option B chosen:** A human or the next assess step should either:
1. Restore packages/surface/src/ to this worktree (if it's a sync issue), OR
2. Fix @relayflows/surface to re-export the missing members, OR
3. Update the SDK to stop importing them (if they were intentionally removed), OR
4. Declare gate-2 work blocked until a surface refactor completes.

Currently: secret storage is DONE (2026-09-07 21:50Z) and the launch path is
proven — a run reaches `agent-relay cloud run` and is given a sandbox. None of
the three conditions above is met yet: no swarm has returned a verdict, so
gate 3 is not complete. What stops it now is Daytona CPU quota, not a secret.
**Evidence the blocker is environmental, not target-related:**
- `npm test` fails BEFORE any new code is added.
- The errors are in SDK files unrelated to the hn-monitor-runner (helper writeback, slack integration, trigger executor).
- The runner's dependencies (JournalClient, AgentWorker, hn-poller) don't import from surface/runtime.
- The surface package source directory is absent from the worktree entirely.
Loading
Loading