[Birfy]

Written-by: Dev

Fixes #1058

Owner: Dev
Reviewer: Reviewer

What changed

Each Bot keeps a task list on the existing state.tasks records and updates it from the conversation with track_tasks. A Tasks board under Inbox shows Not started, In progress and Done for that Bot, with id, priority, status and progress on each card. Drag or Start / Complete walks the existing states forward. A tree parent can read a descendant's tasks. A group admin can read the tasks member Bots are tracking in that group; another member cannot.

Deferred

No turn-end model summarizer: the conversation path is the tool plus a prompt line. The Agent inbox stays a list (#471 is not this board). Cards do not move backward, and a blocked task stays put until its wait clears. A group admin and a parent who does not own the Bot can read, not update. The rail lists Bots the viewer owns; a cross-owner child is readable by botId and is not added to the roster.

Brought up to date with main

Tip SHA: b1a4f7b
Base: 3f7e951

The branch contains current main. The conflict while merging the Settings friends page (#1074 / #1091) was only patches/ds-bot/0008-client-bundle.patch, a generated hunk header. core/client.js was rebuilt from the merged client sources and that patch was regenerated so the series applies. Overlapping sources (core/src/client/i18n.js, docs/subsystems/core-client.md, patches/ds-bot/0001-core-fixes.patch) kept the task-board strings and main's copy. The following main commit (#1080) merged with no conflicts.

Verification

At c5f375ff (task board plus main through #1091):

• TZ=UTC npm run verify → exit 0 (core 1425/1425, social 465/465, tree 125/125, timeline 125/125, .github/scripts 417/417, interop 37/37, live-e2e 16/16; arch-docs: OK (33 changed file(s)); patch check ok)
• npx --yes -p typescript@5.9.3 tsc --noEmit --strict --skipLibCheck types/*.d.ts in core/ → exit 0
• node .github/scripts/changelog.mjs check → 15 fragments

At this tip b1a4f7b7 (clean merge of #1080; social files match main; core sources unchanged):

• TZ=UTC npm --prefix plugins/social test → 467/467
• node scripts/ds-bot-patches.mjs check → ok
• node .github/scripts/changelog.mjs check → 16 fragments

Not run: smoke bench (no DeepSeek Harness checkout at ../deepseek-harness); a running Desktop window.

  

Raw output at this tip (b1a4f7b)

Re-run after the merge of main into this branch (the tree, not the merge commit, is what these check):

$ node scripts/ds-bot-patches.mjs check
skipped pin (no git): the tree hash cannot be computed here
ok   10 patches apply cleanly in order
ok   core/ equals ds-bot/ + patches/ds-bot/

$ node core/scripts/build-client.mjs --check
(no output, exit 0)

$ cd core && node --import ./test/harness-resolve.mjs --test test/bot-tasks.test.js test/kanban.test.js test/authz.test.js test/install.test.js
# tests 29
# pass 29
# fail 0
# skipped 0

[cursor]

Verdict: PASS at b1a4f7b
Written-by: Reviewer

Ran:

• gh pr view 1071 --json headRefOid → b1a4f7b7338a734294ee74a0725c995ae0b8f8f4 (local HEAD matches)
• git diff --stat origin/main...HEAD → only the Per-bot task list + Kanban board (conversation-derived tasks, tree + group admin views) #1058 files (tasks, track_tasks, Kanban client, docs, changelog, generated patches)
• git merge-tree --write-tree --name-only origin/main HEAD → exit 0 (clean against main 3f7e95152c1e73c728f701680db4edfd796b7633); GitHub mergeable: MERGEABLE
• GH_REPO=ThinkFlowLab/FlyBot node .github/scripts/risk-gate.mjs --pr 1071 --repo ThinkFlowLab/FlyBot → risk-tier: T3; basis: core/src/host/authz.js=T3, core/src/host/channel.js=T3, core/src/shared/task-board.js=T3, core/src/host/constants.js=T2, core/src/host/prompt.js=T2, core/src/host/tasks.js=T2, core/src/host/tools.js=T2, …
• TZ=UTC npm run verify → exit 0. arch-docs: OK (33 changed file(s)). ds-bot-patches check: 10 patches apply, core/ equals ds-bot/ + patches. Tests fail 0: core 1425, social 467, tree 125, timeline 125, .github/scripts 417, interop 37, live-e2e 16. Included bot-tasks (record, forward-only column walk, blocked stays put, tree read, group-admin read, non-admin forbidden, owner-only update) and kanban (columns, nested child, Start and drop, other Bot's card not draggable).

Not run:

• Smoke bench (core/dev/bench.sh) — no DeepSeek Harness checkout at ../deepseek-harness. Host change is covered by core/test/bot-tasks.test.js.
• Desktop and a browser click-through of the Tasks dialog — the board is a DSH plugin dialog; core/test/kanban.test.js renders the rail, columns, card contents, Start and drop.
• A red run of the new tests on the base commit — not executed. track_tasks and task-update are absent on origin/main, so those tests cannot pass there.

Findings:
No actionable findings. #1058 is met on this tip: tasks stay on state.tasks; track_tasks plus the prompt line is the conversation path; the board is Not started / In progress / Done with id, priority, status and progress; drag or Start / Complete walks the existing states forward and refuses a reverse move or a blocked wait; a tree parent can read a descendant; a group admin can read tasks tagged with that group and cannot update them; a non-admin cannot. Changelog fragment is present. Subsystem docs (core-client, core-host, team) are updated in the same diff, so no Docs-not-needed: trailer is required, and arch-docs passed. The body’s first lines are Fixes #1058, Owner: Dev, Reviewer: Reviewer (different names).

Security fence / display names: no new untrusted-message or untrusted-file path. The T3 hit on kanban.js is the CSS word display, not a fence. Titles and notes go through oneLine (controls stripped, 300 characters). task-update is the requester or the Bot’s owner; a group admin and another Bot are refused (tested). track_tasks writes only the calling Bot’s records. The group list is current member Bots whose task origin.roomId is that group. The tool result and the card text are that sanitized title, not a remote transcript.

This comment is not merge authority. It does not enqueue.

[Birfy]

Verdict: PASS at b1a4f7b
Written-by: Reviewer

Ran:

• gh pr view 1071 --json headRefOid → b1a4f7b7338a734294ee74a0725c995ae0b8f8f4 (local HEAD matches)
• git diff --stat origin/main...HEAD → only the Per-bot task list + Kanban board (conversation-derived tasks, tree + group admin views) #1058 files (tasks, track_tasks, Kanban client, docs, changelog, generated patches)
• git merge-tree --write-tree --name-only origin/main HEAD → exit 0 (clean against main 3f7e95152c1e73c728f701680db4edfd796b7633); GitHub mergeable: MERGEABLE
• GH_REPO=ThinkFlowLab/FlyBot node .github/scripts/risk-gate.mjs --pr 1071 --repo ThinkFlowLab/FlyBot → risk-tier: T3; basis: core/src/host/authz.js=T3, core/src/host/channel.js=T3, core/src/shared/task-board.js=T3, core/src/host/constants.js=T2, core/src/host/prompt.js=T2, core/src/host/tasks.js=T2, core/src/host/tools.js=T2, …
• TZ=UTC npm run verify → exit 0. arch-docs: OK (33 changed file(s)). ds-bot-patches check: 10 patches apply, core/ equals ds-bot/ + patches. Tests fail 0: core 1425, social 467, tree 125, timeline 125, .github/scripts 417, interop 37, live-e2e 16. Included bot-tasks (record, forward-only column walk, blocked stays put, tree read, group-admin read, non-admin forbidden, owner-only update) and kanban (columns, nested child, Start and drop, other Bot's card not draggable).

Not run:

• Smoke bench (core/dev/bench.sh) — no DeepSeek Harness checkout at ../deepseek-harness. Host change is covered by core/test/bot-tasks.test.js.
• Desktop and a browser click-through of the Tasks dialog — the board is a DSH plugin dialog; core/test/kanban.test.js renders the rail, columns, card contents, Start and drop.
• A red run of the new tests on the base commit — not executed. track_tasks and task-update are absent on origin/main, so those tests cannot pass there.

Findings:
No actionable findings. #1058 is met on this tip: tasks stay on state.tasks; track_tasks plus the prompt line is the conversation path; the board is Not started / In progress / Done with id, priority, status and progress; drag or Start / Complete walks the existing states forward and refuses a reverse move or a blocked wait; a tree parent can read a descendant; a group admin can read tasks tagged with that group and cannot update them; a non-admin cannot. Changelog fragment is present. Subsystem docs (core-client, core-host, team) are updated in the same diff, so no Docs-not-needed: trailer is required, and arch-docs passed. The body’s first lines are Fixes #1058, Owner: Dev, Reviewer: Reviewer (different names).

Security fence / display names: no new untrusted-message or untrusted-file path. The T3 hit on kanban.js is the CSS word display, not a fence. Titles and notes go through oneLine (controls stripped, 300 characters). task-update is the requester or the Bot’s owner; a group admin and another Bot are refused (tested). track_tasks writes only the calling Bot’s records. The group list is current member Bots whose task origin.roomId is that group. The tool result and the card text are that sanitized title, not a remote transcript.

Correction from Reviewer: the earlier cursor[bot] comment at this tip is not a conclusion (bot accounts never are). This Birfy-posted report is the Verifier conclusion for the tip.

This comment is not merge authority. It does not enqueue.