Skip to content

feat(foreman): run_integrate tool for sliced-workload union #1045

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Defilan merged 3 commits into from
Jul 10, 2026
Merged

feat(foreman): run_integrate tool for sliced-workload union #1045

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1e7da7f
feat(foreman): integrate + reconcile AgenticTask kinds + slice payload
Defilan Jul 10, 2026
a82f8c3
feat(foreman): run_integrate tool for sliced-workload union
Defilan Jul 10, 2026
4981f51
fix(foreman): validate git refs/URLs in run_integrate against argv in…
Defilan Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 71 additions & 1 deletion api/foreman/v1alpha1/agentictask_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ import (

// AgenticTaskKind is the unit of work the task performs. Each kind has a
// payload shape, scheduler routing, and lifecycle.
// +kubebuilder:validation:Enum=issue-fix;verify;review;freeform
// +kubebuilder:validation:Enum=issue-fix;verify;review;freeform;integrate;reconcile
type AgenticTaskKind string

const (
Expand All @@ -47,6 +47,19 @@ const (
AgenticTaskKindReview AgenticTaskKind = "review"
// AgenticTaskKindFreeform passes an arbitrary prompt to a named agent.
AgenticTaskKindFreeform AgenticTaskKind = "freeform"
// AgenticTaskKindIntegrate unions the disjoint slice branches of a sliced
// Workload onto the current base on a fresh integration branch, gated by a
// build. Scheduled after all slice issue-fix tasks Succeed; its payload
// carries the slice branches (payload.slices[].branch) and the base
// (payload.baseBranch). Part of Sliced Workloads (#1033).
AgenticTaskKindIntegrate AgenticTaskKind = "integrate"
// AgenticTaskKindReconcile checks the integrated union against the slice
// plan's pinned shared identifiers, catching cross-slice interface drift a
// build cannot see. A pinned-missing drift is authoritative (GATE-FAIL); an
// llm-flagged-only drift is advisory. Its payload carries the pins
// (payload.sharedIdentifiers), the slices' files (payload.slices[].files),
// and the contract (payload.contract). Part of Sliced Workloads (#1033).
AgenticTaskKindReconcile AgenticTaskKind = "reconcile"
)

// BranchStrategy controls how the executor cuts an issue-fix task's working
Expand Down Expand Up @@ -351,6 +364,63 @@ type AgenticTaskPayload struct {
// produced no advisories or has not yet completed.
// +optional
GateAdvisories []GateAdvisory `json:"gateAdvisories,omitempty"`

// Slices are the disjoint slices of a sliced Workload. The integrate task
// unions their branches; the reconcile task checks pins against their
// files. Set on integrate and reconcile tasks. Part of #1033.
// +optional
Slices []SliceRef `json:"slices,omitempty"`

// Contract is the slice plan's prose contract, handed to a reconcile
// task's LLM sweep as the description of the intended shared interfaces.
// Reconcile only. Part of #1033.
// +optional
Contract string `json:"contract,omitempty"`

// SharedIdentifiers pins the exact cross-slice strings a reconcile task
// verifies against the integrated union. Reconcile only. Part of #1033.
// +optional
SharedIdentifiers []SharedIdentifier `json:"sharedIdentifiers,omitempty"`
}

// SliceRef describes one disjoint slice of a sliced Workload. The integrate
// task unions each slice's Branch; the reconcile task verifies pinned
// identifiers appear in each slice's Files. Part of Sliced Workloads (#1033).
type SliceRef struct {
// Name is the slice's name within the plan.
// +kubebuilder:validation:Required
// +kubebuilder:validation:MinLength=1
Name string `json:"name"`

// Branch is the git ref the slice's coder pushed. Required for the
// integrate task, which applies each slice branch's diff onto the base.
// +optional
Branch string `json:"branch,omitempty"`

// Files are the repo-relative paths this slice owns, so a reconcile task
// looks for each pinned identifier in the right slice.
// +optional
Files []string `json:"files,omitempty"`
}

// SharedIdentifier pins one exact string that crosses a slice boundary (a
// metric name, config key, or CRD field). The reconcile task asserts the ID
// appears verbatim in the DefinedBy slice and every ReferencedBy slice; a
// missing pin is an authoritative drift. Part of Sliced Workloads (#1033).
type SharedIdentifier struct {
// ID is the exact string every listed slice must contain verbatim.
// +kubebuilder:validation:Required
// +kubebuilder:validation:MinLength=1
ID string `json:"id"`

// DefinedBy is the slice name that must produce the identifier.
// +kubebuilder:validation:Required
// +kubebuilder:validation:MinLength=1
DefinedBy string `json:"definedBy"`

// ReferencedBy are the slice names that must consume the identifier.
// +optional
ReferencedBy []string `json:"referencedBy,omitempty"`
}

// AgenticTaskSpec defines the desired state of an AgenticTask.
Expand Down
54 changes: 54 additions & 0 deletions api/foreman/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

71 changes: 71 additions & 0 deletions charts/foreman/templates/crds/agentictasks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,8 @@ spec:
- verify
- review
- freeform
- integrate
- reconcile
type: string
mcpEnabled:
description: |-
Expand Down Expand Up @@ -216,6 +218,12 @@ spec:
- reset
- rebase
type: string
contract:
description: |-
Contract is the slice plan's prose contract, handed to a reconcile
task's LLM sweep as the description of the intended shared interfaces.
Reconcile only. Part of #1033.
type: string
gateAdvisories:
description: |-
GateAdvisories holds non-blocking findings copied from the upstream
Expand Down Expand Up @@ -286,6 +294,69 @@ spec:
executor logs and falls back to branching from BaseBranch rather
than failing.
type: string
sharedIdentifiers:
description: |-
SharedIdentifiers pins the exact cross-slice strings a reconcile task
verifies against the integrated union. Reconcile only. Part of #1033.
items:
description: |-
SharedIdentifier pins one exact string that crosses a slice boundary (a
metric name, config key, or CRD field). The reconcile task asserts the ID
appears verbatim in the DefinedBy slice and every ReferencedBy slice; a
missing pin is an authoritative drift. Part of Sliced Workloads (#1033).
properties:
definedBy:
description: DefinedBy is the slice name that must produce
the identifier.
minLength: 1
type: string
id:
description: ID is the exact string every listed slice must
contain verbatim.
minLength: 1
type: string
referencedBy:
description: ReferencedBy are the slice names that must
consume the identifier.
items:
type: string
type: array
required:
- definedBy
- id
type: object
type: array
slices:
description: |-
Slices are the disjoint slices of a sliced Workload. The integrate task
unions their branches; the reconcile task checks pins against their
files. Set on integrate and reconcile tasks. Part of #1033.
items:
description: |-
SliceRef describes one disjoint slice of a sliced Workload. The integrate
task unions each slice's Branch; the reconcile task verifies pinned
identifiers appear in each slice's Files. Part of Sliced Workloads (#1033).
properties:
branch:
description: |-
Branch is the git ref the slice's coder pushed. Required for the
integrate task, which applies each slice branch's diff onto the base.
type: string
files:
description: |-
Files are the repo-relative paths this slice owns, so a reconcile task
looks for each pinned identifier in the right slice.
items:
type: string
type: array
name:
description: Name is the slice's name within the plan.
minLength: 1
type: string
required:
- name
type: object
type: array
type: object
priority:
description: |-
Expand Down
71 changes: 71 additions & 0 deletions charts/foreman/templates/crds/workloads.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -421,6 +421,8 @@ spec:
- verify
- review
- freeform
- integrate
- reconcile
type: string
name:
description: |-
Expand Down Expand Up @@ -482,6 +484,12 @@ spec:
- reset
- rebase
type: string
contract:
description: |-
Contract is the slice plan's prose contract, handed to a reconcile
task's LLM sweep as the description of the intended shared interfaces.
Reconcile only. Part of #1033.
type: string
gateAdvisories:
description: |-
GateAdvisories holds non-blocking findings copied from the upstream
Expand Down Expand Up @@ -553,6 +561,69 @@ spec:
executor logs and falls back to branching from BaseBranch rather
than failing.
type: string
sharedIdentifiers:
description: |-
SharedIdentifiers pins the exact cross-slice strings a reconcile task
verifies against the integrated union. Reconcile only. Part of #1033.
items:
description: |-
SharedIdentifier pins one exact string that crosses a slice boundary (a
metric name, config key, or CRD field). The reconcile task asserts the ID
appears verbatim in the DefinedBy slice and every ReferencedBy slice; a
missing pin is an authoritative drift. Part of Sliced Workloads (#1033).
properties:
definedBy:
description: DefinedBy is the slice name that must
produce the identifier.
minLength: 1
type: string
id:
description: ID is the exact string every listed slice
must contain verbatim.
minLength: 1
type: string
referencedBy:
description: ReferencedBy are the slice names that
must consume the identifier.
items:
type: string
type: array
required:
- definedBy
- id
type: object
type: array
slices:
description: |-
Slices are the disjoint slices of a sliced Workload. The integrate task
unions their branches; the reconcile task checks pins against their
files. Set on integrate and reconcile tasks. Part of #1033.
items:
description: |-
SliceRef describes one disjoint slice of a sliced Workload. The integrate
task unions each slice's Branch; the reconcile task verifies pinned
identifiers appear in each slice's Files. Part of Sliced Workloads (#1033).
properties:
branch:
description: |-
Branch is the git ref the slice's coder pushed. Required for the
integrate task, which applies each slice branch's diff onto the base.
type: string
files:
description: |-
Files are the repo-relative paths this slice owns, so a reconcile task
looks for each pinned identifier in the right slice.
items:
type: string
type: array
name:
description: Name is the slice's name within the plan.
minLength: 1
type: string
required:
- name
type: object
type: array
type: object
priority:
description: |-
Expand Down
7 changes: 7 additions & 0 deletions cmd/foreman-agent/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -748,6 +748,13 @@ func makeRegistryFactory(
Fetcher: githubissue.NewClient(),
Token: repo.TokenFromEnvOrFile,
},
// run_integrate: deterministic tool for a sliced Workload's
// integrate step. Unions the disjoint slice branches onto the
// current base and pushes the integration branch (#1033).
&foremantools.RunIntegrateTool{
Workspace: workspace,
Token: repo.TokenFromEnvOrFile,
},
}

var mcpTools []foremantools.Tool
Expand Down
Loading
Loading