feat(missions): Slice 5 — let a model size the mission's team

`routes/planner.rs` has had Opus proposing rosters since the Master Planner shipped, and none of it ever reached a mission: the proposal lived in React state and died with the tab. A mission's shape came from a team template instead — fixed roles, and every claw minted `claude-sonnet-5` from a literal in `mint_team_from_template`. That literal is why no mission has ever run more than one provider. A roster is `(topology_kind, [(role, backend)])`, which is exactly what the composed executor already consumes: `Roster::graph` builds a `TopologyGraph` with the backend in `attrs`, and `MicroVmTurnExecutor` reads `attrs["backend"]` per node. So a verifier on another provider's rootfs stops being a bolt-on and becomes a graph node — the correlated-failure break the independent judge exists for, one layer down. Three verbs, and the split is the point. **suggest** asks the model and persists the answer, changing nothing. **decide** approves (writes `config.roster` and switches the mission to the composed engine) or rejects. A proposal is never applied on arrival: a model sizing a team is a suggestion about how many VMs to boot, and this codebase treats model output that costs money as evidence for a decision, not the decision. Fail-closed at every seam, because each of these otherwise surfaces much later and much more expensively: - a backend no ONLINE node can boot is refused when PROPOSED, naming the ones the fleet actually has. Placement would refuse it too — at launch, after the roster was approved and someone believed the mission would run. The model is handed that same list in its prompt, so the usual case never arises. - an invented `topology_kind` is refused, not defaulted. `parse_topology_kind` defaults to hub-spoke, which is right for a template we wrote and wrong for a string a model just produced: running a `pipeline` proposal as a hub-and-spoke changes what every node sees and nothing would say so. - the roster is validated BEFORE it is stored, so a stored proposal is always one that could be approved; and again at approval, against the fleet as it is then — a node can go offline in between. - `MAX_MEMBERS = 6`. Each member is a whole VM, not a subagent, and a model asked to size a team proposes twelve happily. Two properties live in SQL rather than in the handler: at most one approved roster per mission (partial unique index — two approved rosters are two answers to "what shape is this mission", and the executor reads one field), and decide-once (`WHERE status = 'proposed'`, so a double-clicked approve claims nothing the second time). Both tested against a real database, including that the second approval is refused by Postgres rather than merely losing a race. NEGATIVE CONTROL, run rather than assumed: with the roster preference removed from `composed_graph`, `an_approved_roster_outranks_the_template` FAILS — 3 nodes from the template instead of the roster's 2. A stored roster that is silently ignored at launch is precisely the shape this project keeps paying for. Not closed: per-role models for CLAWS. `template_roles` has no model column, so a ZeroClaw team still mints one model for every role. The literal is now a named constant that says so and points at the roster path, rather than sitting inline where nobody reads it. 527 tests pass, clippy clean. Migration 0070. Not yet exercised against the deployed stack — the route has never been called with a live model. Co-Authored-By: Claude Opus 5 <[email protected]>
2026-08-06 16:25:34 -07:00
parent abb97e6f03
commit 1797669296
10 changed files with 1121 additions and 1 deletions
@@ -0,0 +1,141 @@
+//! Model-authored mission rosters, and whether a human accepted them.
+//!
+//! See `migrations/0070_mission_team_proposals.sql` for why a proposal is
+//! persisted rather than applied on arrival.
+
+use crate::DbError;
+use serde_json::Value;
+use sqlx::PgPool;
+use time::OffsetDateTime;
+use uuid::Uuid;
+
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct MissionTeamProposal {
+    pub id: Uuid,
+    pub mission_id: Uuid,
+    pub roster: Value,
+    pub author_model: String,
+    pub status: String,
+    pub note: Option<String>,
+    #[serde(with = "time::serde::rfc3339")]
+    pub created_at: OffsetDateTime,
+    #[serde(with = "time::serde::rfc3339::option")]
+    pub decided_at: Option<OffsetDateTime>,
+}
+
+pub async fn insert(
+    pool: &PgPool,
+    id: Uuid,
+    mission_id: Uuid,
+    workspace_id: Uuid,
+    roster: &Value,
+    author_model: &str,
+) -> Result<(), DbError> {
+    sqlx::query(
+        "INSERT INTO mission_team_proposals
+             (id, mission_id, workspace_id, roster, author_model)
+         VALUES ($1, $2, $3, $4, $5)",
+    )
+    .bind(id)
+    .bind(mission_id)
+    .bind(workspace_id)
+    .bind(roster)
+    .bind(author_model)
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+/// Every proposal for a mission, newest first. Rejected ones are included on
+/// purpose: what a human turned down is the only record of what the planner
+/// gets wrong.
+pub async fn list(
+    pool: &PgPool,
+    mission_id: Uuid,
+    workspace_id: Uuid,
+) -> Result<Vec<MissionTeamProposal>, DbError> {
+    let rows = sqlx::query_as::<_, (Uuid, Uuid, Value, String, String, Option<String>, OffsetDateTime, Option<OffsetDateTime>)>(
+        "SELECT id, mission_id, roster, author_model, status, note, created_at, decided_at
+           FROM mission_team_proposals
+          WHERE mission_id = $1 AND workspace_id = $2
+          ORDER BY created_at DESC",
+    )
+    .bind(mission_id)
+    .bind(workspace_id)
+    .fetch_all(pool)
+    .await?;
+    Ok(rows
+        .into_iter()
+        .map(
+            |(id, mission_id, roster, author_model, status, note, created_at, decided_at)| {
+                MissionTeamProposal {
+                    id,
+                    mission_id,
+                    roster,
+                    author_model,
+                    status,
+                    note,
+                    created_at,
+                    decided_at,
+                }
+            },
+        )
+        .collect())
+}
+
+pub async fn get(
+    pool: &PgPool,
+    id: Uuid,
+    workspace_id: Uuid,
+) -> Result<Option<MissionTeamProposal>, DbError> {
+    let row = sqlx::query_as::<_, (Uuid, Uuid, Value, String, String, Option<String>, OffsetDateTime, Option<OffsetDateTime>)>(
+        "SELECT id, mission_id, roster, author_model, status, note, created_at, decided_at
+           FROM mission_team_proposals
+          WHERE id = $1 AND workspace_id = $2",
+    )
+    .bind(id)
+    .bind(workspace_id)
+    .fetch_optional(pool)
+    .await?;
+    Ok(row.map(
+        |(id, mission_id, roster, author_model, status, note, created_at, decided_at)| {
+            MissionTeamProposal {
+                id,
+                mission_id,
+                roster,
+                author_model,
+                status,
+                note,
+                created_at,
+                decided_at,
+            }
+        },
+    ))
+}
+
+/// Record a decision. Only a `proposed` row may be decided, so approving twice
+/// — a double-click, a retried request — cannot re-apply a roster to a mission
+/// that has since moved on. Returns whether this call was the one that decided.
+pub async fn decide(
+    pool: &PgPool,
+    id: Uuid,
+    workspace_id: Uuid,
+    status: &str,
+    note: Option<&str>,
+    decided_by: Option<Uuid>,
+) -> Result<bool, DbError> {
+    let done = sqlx::query(
+        "UPDATE mission_team_proposals
+            SET status = $3, note = $4, decided_at = now(), decided_by = $5
+          WHERE id = $1 AND workspace_id = $2 AND status = 'proposed'",
+    )
+    .bind(id)
+    .bind(workspace_id)
+    .bind(status)
+    .bind(note)
+    .bind(decided_by)
+    .execute(pool)
+    .await?
+    .rows_affected();
+    Ok(done == 1)
+}
@@ -11,6 +11,7 @@ pub mod fleet_beszel;
 pub mod fleet_tailscale;
 pub mod level_up;
 pub mod messages;
+pub mod mission_team_proposals;
 pub mod missions;
 pub mod node_metrics;
 pub mod node_rules;