Archive completed tasks, add cleanup commands, self-documenting dashboard UI

- Archive 79 completed framework-dev tasks from tasks/ -> tasks/complete/ - status.py: add --cleanup-done and --install-cleanup-schedule commands - Add scripts/automaton-cleanup.sh for periodic task archiving - Dashboard: rename 'Background' tab -> 'Agent', 'Cleanup' agent -> 'Completed Task Archiver', remove redundant group headers and pill badges, dim inactive agent placeholders - .rules.md: add Self-Documenting UI Names rule - New tests: test_cleanup_done.py, expanded test_app.py and test_task.py
2026-06-24 22:43:33 -04:00
parent e13513faaa
commit 4a2301b077
572 changed files with 856 additions and 101 deletions
@@ -0,0 +1 @@
+complete
@@ -0,0 +1,2 @@
+research:approved|2026-06-23T13:04:47.561659+00:00|user
+code_review:approved|2026-06-23T13:06:37.501736+00:00|user
@@ -0,0 +1,48 @@
+# ADVERSARIAL_BUG_REPORT: add-self-improvement-loop
+
+## Methodology
+
+Targeted attack on:
+1. Shell injection via `$FRAMEWORK_DIR`
+2. Race condition between install.sh and update.sh
+3. Loop creation failure cascading to install failure
+4. Schedule installation on unsupported platforms
+5. Template path traversal
+
+## Findings
+
+### Attack 1: Shell injection via `$FRAMEWORK_DIR` -- NOT VULNERABLE
+
+`$FRAMEWORK_DIR` is set to `$HOME/.automaton` at the top of both scripts. It is not derived from user input. The `--project "$FRAMEWORK_DIR"` argument is passed as a single quoted argument to `python3`, so no shell expansion occurs inside the Python process. No injection vector.
+
+**Verdict:** NOT VULNERABLE
+
+### Attack 2: Race condition between install.sh and update.sh -- NOT EXPLOITABLE
+
+If a user runs `install.sh` and `update.sh` concurrently (which would be unusual), both might try to create the loop simultaneously. `--create-loop` checks `if loop_path.exists()` and returns rc=2 if it exists. The `mkdir(parents=True)` in `cmd_create_loop` is not atomic, but the `.state.loop` write is atomic (tmp+rename). Worst case: one script gets rc=2 and `|| true` swallows it. No data corruption.
+
+**Verdict:** NOT EXPLOITABLE
+
+### Attack 3: Loop creation failure cascading -- NOT VULNERABLE
+
+Both `--create-loop` and `--install-schedule` are followed by `|| true`. If either fails, the script continues. The `.venv` setup and pip install at the end of `install.sh` are outside the `else` block and run regardless. The framework works without the loop.
+
+**Verdict:** NOT VULNERABLE
+
+### Attack 4: Schedule installation on unsupported platforms -- HANDLED
+
+`--install-schedule` handles platform dispatch internally (Darwin -> launchd, Linux -> cron, Windows -> schtasks). On an unknown platform, it prints an error and returns non-zero, which `|| true` swallows. The loop is created but not scheduled; the user can manually run `--mode tick` or `--mode daemon`.
+
+**Verdict:** HANDLED
+
+### Attack 5: Template path traversal -- NOT VULNERABLE
+
+`--from-template self-improvement` is a fixed string in both scripts. `cmd_create_loop` constructs the template path as `AUTOMATON_DIR / "templates" / "loops" / template`. The template name is not user-supplied in this context.
+
+**Verdict:** NOT VULNERABLE
+
+## Summary
+
+No exploitable vulnerabilities found. All attack surfaces are mitigated by trusted input, `|| true` non-fatal behavior, and atomic state writes.
+
+**Verdict: CLEAN**
@@ -0,0 +1,23 @@
+# BUG_REPORT: add-self-improvement-loop
+
+## Findings
+
+### Bug 1 (LOW): install.sh loop bootstrap is inside the `else` block
+
+The loop creation commands are inside the `else` block of `if [ -d "$FRAMEWORK_DIR" ]`, which means they only run on fresh installs. If a user previously installed the framework before this change and runs `install.sh` again, they get "already installed" and the loop is NOT created. This is correct behavior -- `update.sh` handles the existing-user case.
+
+**Severity:** LOW (by design)
+**Fix:** None needed.
+
+### Bug 2 (INFO): No `--project` flag consistency check
+
+`install.sh` uses `--project "$FRAMEWORK_DIR"` while `update.sh` also uses `--project "$FRAMEWORK_DIR"`. Both are consistent. The `work_source.project` in the template is `"~/.automaton/"` (a string), but `--create-loop` doesn't use `work_source.project` -- it uses the `--project` flag. The runner reads `work_source.project` at tick time. No mismatch because `--project "$FRAMEWORK_DIR"` (which is `$HOME/.automaton`) and `work_source.project: "~/.automaton/"` resolve to the same path.
+
+**Severity:** INFO (no bug)
+**Fix:** None needed.
+
+## Summary
+
+No correctness bugs found. One LOW (by design) and one INFO.
+
+**Verdict: CLEAN**
@@ -0,0 +1,56 @@
+# CODE_REVIEW: add-self-improvement-loop
+
+## Reviewed Files
+
+1. `scripts/install.sh` -- self-improvement loop bootstrap (lines ~70-82)
+2. `scripts/update.sh` -- idempotent loop bootstrap (lines ~61-70)
+3. `tests/test_self_improvement_loop.py` -- 16 tests
+4. `CHANGELOG.md` -- task 7 entry
+5. `design/loops/technical.md` section 9 -- updated install note
+6. `README.md` -- self-improvement loop default-on section
+
+## Findings
+
+### 1. install.sh -- loop bootstrap placement
+
+The loop bootstrap is placed inside the `else` block (after the git clone), after guard registration and before `fi`. This is correct -- the loop should only be created on fresh installs, not when the framework is already installed (the `if [ -d "$FRAMEWORK_DIR" ]` branch prints "already installed" and exits).
+
+The `|| true` ensures install continues even if `status.py` fails (e.g. Python not in PATH yet, or schedule installation fails on an unusual platform). The framework works without the loop.
+
+**Verdict:** PASS
+
+### 2. update.sh -- idempotent bootstrap
+
+The `if [ ! -d "$FRAMEWORK_DIR/loops/self-improvement" ]` check correctly prevents duplicate creation. `--create-loop` itself also refuses duplicates (returns rc=2), but the directory check avoids the error output entirely. The `|| true` on both commands ensures update continues on failure.
+
+**Verdict:** PASS
+
+### 3. Test coverage
+
+- `TestInstallShWiring` (5 tests): covers create-loop, install-schedule, opt-out message, framework project, and non-fatal behavior. All assertions check the script content.
+- `TestUpdateShWiring` (4 tests): covers create-loop, idempotent check, install-schedule, and non-fatal behavior.
+- `TestSelfImprovementTemplate` (5 tests): regression guard for template fields.
+- `TestCreateLoopFromTemplate` (2 tests): integration test for `cmd_create_loop` with the self-improvement template.
+
+**Verdict:** PASS
+
+### 4. Shell syntax
+
+`bash -n scripts/install.sh scripts/update.sh` passes. No syntax errors.
+
+**Verdict:** PASS
+
+### 5. Edge cases
+
+- **Python not in PATH**: `|| true` handles this. Install continues.
+- **Loop already exists (update.sh)**: directory check prevents creation; `--create-loop` also refuses.
+- **Schedule installation fails**: `|| true` handles this. Loop is created but not scheduled; user can manually `--install-schedule` later.
+- **Framework not in ~/.automaton**: the `$FRAMEWORK_DIR` variable is set at the top of each script and used consistently.
+
+**Verdict:** PASS
+
+## Summary
+
+All 5 review areas pass. The implementation is clean, idempotent, and well-tested. 16 new tests cover script wiring, template validation, and loop creation. Full suite: 409 passed.
+
+**Overall verdict: APPROVED**
@@ -0,0 +1,38 @@
+# DOC_REVIEW: add-self-improvement-loop
+
+## Reviewed Documentation
+
+1. `README.md` -- new "Self-Improvement Loop (Default-On)" section
+2. `CHANGELOG.md` -- task 7 entry
+3. `design/loops/technical.md` section 9 -- updated install note
+
+## Findings
+
+### 1. README.md
+
+New section "Self-Improvement Loop (Default-On)" accurately documents:
+- What the loop does (ticks against `status.py --audit`)
+- Schedule (3600s / 1 hour)
+- Brakes (max_iterations: 10, score_plateau_window: 3)
+- How to disable/re-enable (`--pause-loop` / `--resume-loop`)
+- Worktree and file scope
+
+**Verdict:** PASS
+
+### 2. CHANGELOG.md
+
+Entry accurately describes install.sh and update.sh changes, new tests (16), and doc updates.
+
+**Verdict:** PASS
+
+### 3. technical.md section 9
+
+Updated the install note to include `--project "$FRAMEWORK_DIR"`, `|| true`, and the `update.sh` idempotent bootstrap. Matches the implementation.
+
+**Verdict:** PASS
+
+## Summary
+
+All documentation is accurate and consistent with the implementation.
+
+**Verdict: APPROVED**
@@ -0,0 +1,41 @@
+# IMPLEMENTATION: add-self-improvement-loop
+
+## Summary
+
+Wired the self-improvement loop into `install.sh` (default-on for fresh installs) and `update.sh` (idempotent bootstrap for existing users). Both use `status.py --create-loop self-improvement --from-template self-improvement` and `--install-schedule self-improvement --interval 3600` with `|| true` to ensure the framework continues to work even if loop creation fails.
+
+## Changes
+
+### R1 -- `scripts/install.sh`
+
+Added after guard registration (inside the `else` block, before `fi`):
+- `--create-loop self-improvement --from-template self-improvement --project "$FRAMEWORK_DIR"` with `|| true`
+- `--install-schedule self-improvement --interval 3600 --project "$FRAMEWORK_DIR"` with `|| true`
+- User-facing message about the self-improvement loop and how to disable it with `--pause-loop`
+
+### R2 -- `scripts/update.sh`
+
+Added after guard registration:
+- Idempotent check: `if [ ! -d "$FRAMEWORK_DIR/loops/self-improvement" ]`
+- Same `--create-loop` and `--install-schedule` commands with `|| true`
+- Info message when the loop is created
+
+### R3 -- `tests/test_self_improvement_loop.py`
+
+16 tests across 4 classes:
+- `TestInstallShWiring` (5 tests): verify install.sh contains create-loop, install-schedule, opt-out message, framework project, and `|| true`
+- `TestUpdateShWiring` (4 tests): verify update.sh contains create-loop, idempotent check, install-schedule, and `|| true`
+- `TestSelfImprovementTemplate` (5 tests): verify template fields (audit work source, brakes, worktree, file scope, role prompts)
+- `TestCreateLoopFromTemplate` (2 tests): simulate `--create-loop self-improvement --from-template self-improvement` and verify directory structure; verify duplicate creation is refused
+
+### R4 -- Documentation
+
+- `CHANGELOG.md`: task 7 entry under `[unreleased]`
+- `README.md`: note that self-improvement loop is default-on at install
+- `design/loops/technical.md` section 9: note that install.sh creates it default-on
+
+## Verification
+
+- `bash -n scripts/install.sh scripts/update.sh` -- OK
+- `python3 -m pytest tests/test_self_improvement_loop.py -v` -- 16 passed
+- `python3 -m pytest tests/ -q` -- 409 passed (393 + 16 new)
@@ -0,0 +1,81 @@
+# RESEARCH: add-self-improvement-loop
+
+## Objective
+
+Make the self-improvement loop default-on at install time (D21). The template `templates/loops/self-improvement/loop.json` was already created in task 6. This task wires it into `install.sh` and `update.sh` so that:
+- Fresh installs get the loop created and scheduled automatically
+- Existing users who run `update.sh` get the loop bootstrapped (idempotent -- skip if already exists)
+
+## Current State
+
+### `install.sh` (lines 1-79)
+- Clones repo to `~/.automaton`
+- Runs VRAM detection
+- Registers pre-edit guards via `register-guards.sh`
+- Sets up `.venv` and pip deps
+- Does NOT create any loops
+
+### `update.sh` (lines 1-74)
+- Pulls latest from git
+- Checks for deprecated file locations
+- Registers guards
+- Installs git hooks in current project
+- Does NOT create any loops
+
+### `--create-loop` (status.py:1773)
+- Takes `--create-loop <name>`, `--from-template <name>`, `--project <path>`
+- Creates `~/.automaton/loops/<name>/` (when project is `~/.automaton/`)
+- Copies `loop.json` from template, patches `name` field
+- Creates `.state.loop` with initial state (`running`)
+- Creates empty `.state.log`
+- Returns error if loop already exists
+
+### `--install-schedule` (status.py:1807)
+- Takes `--install-schedule <name>`, `--interval <seconds>`, `--project <path>`
+- Generates OS-specific tick stub (`automaton-loop-tick.sh` or `.bat`)
+- Installs OS schedule unit (launchd plist on macOS, cron on Linux, schtasks on Windows)
+- Interval defaults to `loop.json schedule.interval_seconds` or 3600
+
+### `_loops_dir` (status.py:1609)
+- When project is `~/.automaton/`, loops dir is `~/.automaton/loops/`
+- When project is other, loops dir is `<project>/.automaton/loops/`
+
+## Design Decisions
+
+### D1: Where to add the install hook
+In `install.sh`, after the clone and guard registration, add:
+```bash
+# Bootstrap self-improvement loop (default-on, D21)
+python3 "$FRAMEWORK_DIR/scripts/status.py" --create-loop self-improvement \
+  --from-template self-improvement --project "$FRAMEWORK_DIR"
+python3 "$FRAMEWORK_DIR/scripts/status.py" --install-schedule self-improvement \
+  --interval 3600 --project "$FRAMEWORK_DIR"
+```
+
+### D2: Where to add the update hook
+In `update.sh`, after the git pull and guard registration, add an idempotent bootstrap:
+```bash
+# Bootstrap self-improvement loop if not present (default-on, D21)
+if [ ! -d "$FRAMEWORK_DIR/loops/self-improvement" ]; then
+  python3 "$FRAMEWORK_DIR/scripts/status.py" --create-loop self-improvement \
+    --from-template self-improvement --project "$FRAMEWORK_DIR"
+  python3 "$FRAMEWORK_DIR/scripts/status.py" --install-schedule self-improvement \
+    --interval 3600 --project "$FRAMEWORK_DIR"
+fi
+```
+
+### D3: Test approach
+The test `test_self_improvement_installs_default_on` should verify that `install.sh` contains the create-loop and install-schedule commands for the self-improvement loop. A full integration test (actually running install.sh) would require a mock git clone target and is fragile. Instead, test the script content for the required commands, and test that `--create-loop self-improvement --from-template self-improvement --project <framework>` produces the expected directory structure (this is already tested in the status.py tests but we add a specific test for the self-improvement template).
+
+### D4: User opt-out
+Users can disable the self-improvement loop with:
+```bash
+python3 ~/.automaton/scripts/status.py --pause-loop self-improvement --project ~/.automaton/
+```
+This should be documented in the install output and README.
+
+## Risks
+
+- **install.sh failure**: if `--create-loop` fails (e.g. Python not in PATH yet), install.sh should continue (the loop is optional, not critical for framework operation). Use `|| true` to non-fatal the loop bootstrap.
+- **update.sh idempotency**: the `if [ ! -d ... ]` check ensures existing users don't get errors on repeated updates.
+- **Platform differences**: `--install-schedule` handles platform dispatch internally. No shell-level platform checks needed.
@@ -0,0 +1,72 @@
+# SPEC: add-self-improvement-loop
+
+## Context
+
+Task 6 created the self-improvement loop template at `templates/loops/self-improvement/loop.json`. This task wires it into `install.sh` and `update.sh` so the loop is default-on at install time (D21). Existing users who run `update.sh` get the loop bootstrapped idempotently.
+
+## Non-Goals (deferred)
+
+- Loop dashboard panel -> v1.1
+- Auto-approve for self-improvement loop -> never (D4)
+- Tier 2 context-sizing work -> picked up by the loop itself after first tick
+- `design/context-sizing/` skeleton -> v1.1 (the loop will create it when it picks up Tier 2 work)
+
+## Requirements
+
+### R1 -- `install.sh` creates and schedules the self-improvement loop
+
+After the clone and guard registration, add:
+```bash
+# Bootstrap self-improvement loop (default-on, D21)
+python3 "$FRAMEWORK_DIR/scripts/status.py" --create-loop self-improvement \
+  --from-template self-improvement --project "$FRAMEWORK_DIR" || true
+python3 "$FRAMEWORK_DIR/scripts/status.py" --install-schedule self-improvement \
+  --interval 3600 --project "$FRAMEWORK_DIR" || true
+```
+
+The `|| true` ensures install continues even if loop creation fails (e.g. Python not yet in PATH, or schedule installation fails on an unusual platform). The loop is optional; the framework works without it.
+
+Print a message telling the user the loop is running and how to disable it:
+```bash
+echo ""
+echo "=== Self-Improvement Loop ==="
+echo "A self-improvement loop has been created and scheduled (runs every 3600s)."
+echo "It will tick against status.py --audit on this framework's own repo."
+echo "To disable: python3 ~/.automaton/scripts/status.py --pause-loop self-improvement --project ~/.automaton/"
+```
+
+### R2 -- `update.sh` bootstraps the self-improvement loop idempotently
+
+After the git pull and guard registration, add:
+```bash
+# Bootstrap self-improvement loop if not present (default-on, D21)
+if [ ! -d "$FRAMEWORK_DIR/loops/self-improvement" ]; then
+  python3 "$FRAMEWORK_DIR/scripts/status.py" --create-loop self-improvement \
+    --from-template self-improvement --project "$FRAMEWORK_DIR" || true
+  python3 "$FRAMEWORK_DIR/scripts/status.py" --install-schedule self-improvement \
+    --interval 3600 --project "$FRAMEWORK_DIR" || true
+  echo "Created self-improvement loop (default-on). --pause-loop self-improvement to disable."
+fi
+```
+
+### R3 -- Tests
+
+Write `tests/test_self_improvement_loop.py` with:
+
+1. `test_install_sh_creates_self_improvement_loop` -- verify `install.sh` contains `--create-loop self-improvement` and `--install-schedule self-improvement`
+2. `test_update_sh_bootstraps_self_improvement_loop` -- verify `update.sh` contains the idempotent bootstrap check
+3. `test_install_sh_has_opt_out_message` -- verify `install.sh` contains `--pause-loop self-improvement`
+4. `test_self_improvement_template_has_correct_fields` -- verify the template has `work_source.kind: audit`, `brakes.max_iterations: 10`, `blast_radius.use_worktree: true` (this may overlap with task 6 tests; if so, keep it as a regression guard)
+5. `test_create_loop_self_improvement_from_template` -- simulate `--create-loop self-improvement --from-template self-improvement --project <tmp>` and verify the loop dir, `loop.json`, `.state.loop`, and `.state.log` are created correctly
+
+### R4 -- Documentation updates
+
+- `CHANGELOG.md` under `[unreleased]`
+- `README.md` -- add a note in the Loop Engineering section that the self-improvement loop is default-on at install
+- `design/loops/technical.md` -- section 9 already documents the self-improvement template; add a note that install.sh creates it default-on
+
+## Verification
+
+- `bash -n scripts/install.sh scripts/update.sh` -- syntax check
+- `python3 -m pytest tests/test_self_improvement_loop.py -v`
+- `python3 -m pytest tests/ -q` -- full suite must remain green
@@ -0,0 +1,29 @@
+# VERDICT: add-self-improvement-loop
+
+## Task
+
+Wire the self-improvement loop into `install.sh` (default-on for fresh installs) and `update.sh` (idempotent bootstrap for existing users), per D21.
+
+## Deliverables Review
+
+| Requirement | Status | Evidence |
+|---|---|---|
+| R1: install.sh creates and schedules loop | DONE | `scripts/install.sh` lines ~70-82, 5 tests in `TestInstallShWiring` |
+| R2: update.sh idempotent bootstrap | DONE | `scripts/update.sh` lines ~61-70, 4 tests in `TestUpdateShWiring` |
+| R3: Tests | DONE | 16 tests in `tests/test_self_improvement_loop.py`, all passing |
+| R4: Documentation | DONE | CHANGELOG, README, technical.md section 9 updated |
+
+## Quality Assessment
+
+- **Test coverage:** 16 new tests, all passing. Full suite 409 passed (was 393). No regressions.
+- **Shell syntax:** `bash -n` passes for both scripts.
+- **Idempotency:** `update.sh` checks for existing loop dir before creating. `--create-loop` also refuses duplicates.
+- **Non-fatal behavior:** `|| true` on both commands ensures framework works even if loop creation fails.
+- **Security:** Adversarial review found no exploitable vulnerabilities.
+- **Documentation:** All docs accurate and consistent.
+
+## Verdict
+
+**APPROVED -- ready for complete.**
+
+All 4 requirements fully implemented, tested, and documented. The self-improvement loop is now default-on at install time (D21), with idempotent bootstrap for existing users.