Skip to content

epics.md

Latest commit

 

History

History
230 lines (198 loc) · 12 KB

epics.md

File metadata and controls

230 lines (198 loc) · 12 KB
Raw

tole — Epics & Roadmap (v1.1, chat-first replan)

Ground truth: Phase 1a/1b/2 complete (E1–E8, E10–E12, E4.5, gh read ops, TOLE_* env). Replan 2026-08-27: chat-first direction per PRD v1.1 §0 Identity. Status sync 2026-09-18 (v0.3.0): Track A (A1–A2) and Track B (B1–B4) complete; MCP client shipped ahead of schedule (#74). Status sync 2026-10-05 (v0.5.0 on crates.io): Tracks C and D complete (E9 closed 2026-09-28; D1–D3 all shipped — D1 in v0.4.0, D2 2026-09-18, D3 2026-09-28). Post-D3 work is shipped too (see the Post-D3 section). 298/298 workspace tests, CI green. Code is authoritative over this doc. Status sync 2026-10-06 (pre-0.6.0): the 0.6.0 train (#168–#185) is fully merged to develop — see the Post-D3 section.

Identity recap (PRD v1.1)

tole = a durable conversational harness — a personal-assistant chatbot that can call tools, with persistent resumable sessions. Light coding via tools (files + git + gh). Optional first-class integrations: uteke (memory, documents), cora-code (code intel). Dynamic tools via a generic approval-gated run_command — no config DSL.

Completed (historical, do not re-plan)

E1 storage · E2 state machine · E3 mock provider · E4 cora search + real provider · E4.5 native tool calling · E5 crash-resume · E6 approval gates · E7 tool suite · E8 MVP gate (real issue fixed, retro in docs/e8-retro.md) · E10 loop guard · E11 secret redaction · E12 file CRUD (hash-anchored edit) · gh read ops · TOLE_* env canonical.

Track A — Coding-lite completion (small, closes old promises) — ✅ DONE

A1 — Scoped pre-authorization — ✅ DONE (v0.3.0)

  • What: --allow <risk>:<tool> (repeatable), e.g. --allow write:edit_file. Pre-authorizes specific Write tools for headless/CI runs.
  • Hard rule: Destructive is never allowlistable — structural enforcement stays (registry + AllowlistApprover deny on sight).
  • Acceptance: headless run completes with edit_file pre-authorized while other Write tools still deny; Destructive attempt with allow flags still denied. Unit tests for the flag parser + approver wiring.
  • Est: S

A2 — Git tool (light) — ✅ DONE (v0.3.0, git.rs registered in the CLI host)

  • What: git builtin: status, diff, add, commit ops, argv whitelist discipline identical to gh.rs (validated per-op args, no free-form flags). Push stays manual.
  • Why: closes the last maintainer intervention in the coding-lite loop (branch/commit). Also the natural companion for the markdown→uteke document workflow (write_file → git commit → uteke_document).
  • Acceptance: agent commits a change end-to-end in a sandbox repo; injection attempts (--upload-pack, leading-dash messages) rejected; fake-git e2e test (same pattern as fake-gh).
  • Est: M

Track B — Chat-first (the product direction) — ✅ DONE

B1 — Chat mode (tole chat) — keystone — ✅ DONE (v0.3.0)

  • What: multi-turn REPL: prompt → agentic turn (durable, exactly like run) → answer → next prompt. --resume <id> / --last to continue. Explicit resume (no implicit auto-continue) — deliberate state transitions. Clean EOF//exit, Ctrl-C safe (resume-able mid-turn).
  • Acceptance: multi-turn conversation in one session; SIGKILL mid-chat → tole chat --resume <id> continues with full context; /exit leaves a cleanly closed session.
  • Est: M

B2 — System prompt & agent identity — ✅ DONE (v0.3.0)

  • What: resolution --system flag > TOLE_SYSTEM_PROMPT env > default. Persisted in the session header (once, not per-turn — token efficient, replay-accurate). Analysis note: persona must stay stable across resume; sessions recorded pre-B2 (no system prompt) must remain replayable (backward-compat test).
  • Acceptance: persona consistent across turns and resume; old session replay still green.
  • Est: S–M

B3 — Session UX — ✅ DONE (v0.3.0, as tole sessions + tole status <id>)

  • What: tole sessions list (id, age, turn count, last-message preview, usage) and tole sessions show <id> (timeline view). Branching deferred.
  • Acceptance: list + inspect without opening JSONL by hand.
  • Est: S

B4 — Dynamic tools: generic run_command + startup probing + uteke first-class — ✅ DONE (v0.3.0)

  • What:
    1. run_command builtin: input { "command": "..." } → shlex-parsed to argv (no shell), cwd-jail, subprocess timeout + output cap. Risk ceiling = Write (Destructive unreachable). Approval prompt shows the exact argv; headless via A1 pre-auth.
    2. Startup probing: builtins whose binary is missing (gh/uteke/cora) are skipped with one warning line — no phantom tools burning turns.
    3. uteke first-class: uteke_document (save markdown into a room), plus existing recall. Renames uteke_search → uteke_recall (name/behavior consistency).
  • Why: no TOML DSL (rejected — poor UX); any host CLI becomes usable with zero recompilation; uteke is the primary assistant integration.
  • Acceptance: agent uses run_command to invoke a non-builtin binary (e.g. figlet) approval-gated; missing-binary builtin skipped with warning; uteke_document saves a markdown doc into a room (validated against the uteke CLI); rename with spec + tests updated.
  • Est: M–L

Track C — ✅ DONE (E9, closed 2026-09-28)

E9 hardening/OSS-prep (issue #9) complete: cross-build CI (#82), timeout/truncation fuzz-lite + panic-free corpus (perf PR), perf thresholds + docs/perf.md, LICENSE/README/SECURITY public-ready (#79, #91). MCP client shipped early (#74). Session branching stays deferred.

Track D — Integration surfaces (approved 2026-09-18)

tole-core gains three hosts beyond the CLI, in build order (each reuses the previous layer):

D1 — tole mcp: MCP server over stdio (issue #94) — ✅ DONE (v0.4.0)

Expose the registry's hardened tools via rmcp's server side. ReadOnly tools always callable; Write needs --allow; Destructive structurally absent. Est: S–M.

D2 — tole acp: Agent Client Protocol host (issue #95) — ✅ DONE (2026-09-18)

Editor integration (Zed et al.): ACP sessions ↔ JSONL sessions, ACP permission requests ↔ the approval gate, streaming turn events. Est: M.

D3 — tole-serve: server mode (issues #96, #137) — ✅ DONE (2026-09-28)

Long-running daemon (uteke-serve pattern): thin REST (v1, #96) + multi-session MCP over Streamable HTTP (--transport mcp, #137) — one authenticated connection, N durable sessions, per-session jail routing via session_id. Est: M–L.

Post-D3 — shipped on develop (synced 2026-10-05)

Everything below is merged; CHANGELOG entries carry the detail.

  • v0.4.0: harness memory loop (--memory uteke / TOLE_MEMORY), cora MCP auto-preset (--no-auto-mcp opt-out), write_file wire-schema fix, 2026-09-18 CodeCora scan triage fixes, serve hardening Wave 2 (#136: connection cap, auth rate-limit, IO timeouts).
  • v0.5.0 (2026-10-02): verify_package (#144, the slopsquatting defense), turn-end stop gates --on-turnend (#145), memory-loop decision typing (#143), multi-session MCP-over-HTTP (#137/#138), ACP scan minors (#156).
  • Post-0.5.0: --trust presets (#160), SKILL.md support (--skill + discovery + load_skill, #161/#162).
  • 2026-10-05 sweep fixes (#163/#164): loud refusals for client-session-only flags on the server faces; --sessions-dir honored by serve/acp; --workspace honored by serve --transport mcp; --on-turnend wired into serve/acp; the #138 ambiguity refusal implemented; skills discovery defaults to cwd.
  • 2026-10-05 activation fix (#165/#166): TOLE_TRUST env actually read (was documented but unimplemented).
  • 0.6.0 train (merged to develop 2026-10-05/06): mcp-http becomes a default tole-cli feature (#168 — every documented face works on a plain install); the gitea tool (#169); the v0.5.0 Tier-2 baseline + HOME-scrubbing eval archiver (#170); systemone_decide typed decisions (#172/#173); depth-1 child agents agent_start/agent_poll (#171/#174); the no-mcp build gate fix (#175/#180); ACP native model picker + per-session approval controls (#176/#177/#179); ACP session/cancel (#178/#184); project-sync board-sync fixes (#181/#182, #183); REST POST /sessions/{id}/cancel + the tole_session_cancel MCP tool (#178/#185) — cooperative cancellation now exists on all three server faces (ACP, REST, MCP), spec-conformant (the receiver may ignore un-cancellable work; single-tool calls are not interrupted).
  • 0.7.0 Mission MVP (merged to develop 2026-10-06; identity extended owner-approved — chat-first personal assistant WITH a mission mode for autonomous work): durable task-list tools todo_write/todo_read (#198/#205); tole mission budgeted turn-chaining with --max-steps/--max-minutes/--max-tokens/--verify and durable mission summaries (#199/#206); budget tiers + cost report (#201/#207); ACP intra-turn visibility + true text streaming (#196/#203/#204); ACP model picker auto-advertised from the provider /models endpoint (#195/#197); remote approvals via the serve face — queue, decisions, expiry, CLI consumer (#200/#214); run ergonomics --prompt-file/--name/--timeout (#216/#219); read-only web_fetch/web_search SSRF-guarded (#215/#221, three CodeCora review rounds); startup update notification + tole upgrade (#220/#222, fleet-parity with uteke/cora); the mobile-control guide (#202/#218) defines the 0.9.0 surface.
  • 0.7.1 Hardening patch (released 2026-10-08): pre-tag rescan MAJORs #226–#235 and rescan-2 #276–#287 fixed (env scrubbing, MCP approval-prompt sanitizing, redirect/NUL/argv hardening, mailbox consume-once, perf-gate and tmpdir test fixes); follow-ups #293 (no hardcoded gh repo), #294 (plan mode in the MCP server registry), #295 (one session-id rule), #299 (ACP session cap), #300 (agent_poll is Write); one crate-internal tool-call authorization gate used by drive, resume_turn and the MCP server path (#303, PRs #304/#309/#312). Behavior changes: AllowlistApprover::new(_, Deny|Ask) ignores patterns (#283), agent_poll is Write (#300), embedder registries with pre-hooks are enforced on the MCP path (#303).
  • 0.7.2 Maintenance patch (released 2026-10-08): scan backlog closed — systemone error bodies surfaced (#328), write_file and git status/diff limitations documented accurately (#329), the bare --no-default-features tole-cli profile compiles and is CI-checked (#330); Dependabot PRs no longer blocked by naming/description/CLA checks (#322 plus a ruleset context change); dependency bumps (rmcp 3.5.0, tokio 1.53.2, libc 0.2.190, uuid 1.27.0). No behavior changes.
  • 0.8.0 Project config .tole/config.toml (#208) (released 2026-10-09): merged to develop 2026-10-09 (parts #342/#343/#345/#346). Strict TOML schema, content-bound trust store outside the repo, fail-closed gate on the protocol faces, tole config check|trust|untrust, precedence flag > env > config > default for every key (lists replaced wholesale, booleans only turned on by flags), and refusal of config-sourced hooks/skills/MCP servers on the faces that refuse the flags.
  • 0.8.1 Token-efficiency patch (#211) (released 2026-10-09): usage and per-step request-size report in tole status/serve status (#356), read_file 20,000-char cap with offset/limit continuation (#357), wire-size reference missions with a CI bound (#358), two scan-found fixes (#360); scan backlog in #361. Deferred: lazy tool registration, history trimming, non-cached budget accounting.

Execution order

A1 → A2 → B1 → B2 → B3 → B4 → Track C → D1 → D2 → D3 → Post-D3
                         ↑ all tracks done; see the Post-D3 section

A-track first: small, closes the coding-lite promises and unblocks headless testing patterns reused by B4's run_command. B1 is the keystone; B2 touches the session header (do it before B3/B4 so the format migrates once).