lsm / HyperNeo / 30579445923 / 5
83%
dev: 83%

DEFAULT BRANCH: dev
Ran
Files 365
Run time 28s
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 21.725%. First build
30579445923.5

push

github

web-flow 
feat(space): enforce per-agent autonomyLevel as a ceiling (#2276)

* feat(space): enforce per-agent autonomyLevel as a ceiling

SpaceLongHorizonAgent.autonomyLevel was stored and templated
(suggestedAutonomyLevel) but never read in the daemon — all gating used
the space-level autonomy, so per-agent trust tiers had no effect.

For long-term agent sessions (resolved via promptProvenance.agentId),
treat the agent's autonomyLevel as a ceiling on its own space-agent-tools
calls: effective = min(spaceLevel, agentLevel), applied to
requireSessionWriteAutonomy, approve_gate (autonomy path), and
approve_task. Ceiling-blocked denials are audit-logged.

Coordinators and ad-hoc members remain uncapped (only
buildLongTermAgentMcpServer passes myAgentId); agents without a level
and worker-agent-backed sessions are unchanged, preserving existing
error messages and behavior.

Tests cover the min() ceiling, the unaffected higher-level case, the
no-level fallback (space-level message preserved), and audit logging.

* test(space): cover ceiling branches from review (P2/P3)

Address PR #2276 review test-coverage gaps (no behavior change):
- writers-allowlist override: a level-1 agent named in a gate's approved
  field writers list is approved (ceiling only binds the autonomy path)
- cross-space myAgentId guard: an LH agent in another space contributes
  no ceiling; the space-level message governs
- session-write boundary at agentLevel === 4 is permitted (inclusive <)
- ceiling-blocked approve_task denial is audit-logged (task-attributed)

Also attribute the approve_task ceiling audit entry with taskId so it is
reachable via listByTask.

* fix(space): harden agent ceiling against bypass vectors

Address review findings (chatgpt-codex-connector) that the new ceiling
was evadable. No change to the happy path.

- send_session_message: the coordinator exemption now requires no calling
  agent id (myAgentId), so a long-term agent renamed to "coordinator"/
  "space-agent" via u... (continued)

24929 of 114746 relevant lines covered (21.73%)

11.71 hits per line

Source Files on job daemon-online-agent-sdk - 30579445923.5