task_ci_failures worker evidence¶

Task: d989f9b4-c33d-4eb9-9f31-9ba18bee63e3, frozen version 2. Execution: 9c417f98-6e3a-46f2-a552-cf6a8a40f79a. Repository: h8v6/heyaira; branch: heyaira/d989f9b4. Source and starting HEAD: d8b5b7482aff723abb0e00ea0fad228838edbf07. The starting worktree was clean; no carried candidate or unrelated changes. No subagents were used. No installation, push, PR, merge or deployment. The RESULT receipt records the resulting commit SHA and post-commit checks.

Change and confidence¶

CI correction feedback previously contained run metadata but no way for the assigned execution to read failing tests. This change adds a read-only, project/task-scoped MCP tool, bounded GitHub job/log reads, fixed-pattern extraction with whole-line secret checks before truncation, and a rendered correction hint. Publication history remains readable after actual send-back. No correction budget, timing, notification, migration or database-write behavior was changed. Confidence is supported by real PostgreSQL and authenticated MCP tests, with synthetic provider responses and no sockets for log-download transport tests.

Tests in the change area use the existing ASGI fixture option, and signed webhook requests use ASGI with the real app lifespan. They retain real MCP, authentication, HTTP route, workflow and PostgreSQL behavior without requiring listening sockets. The separate smoke script test retains its socket coverage. scripts/test_postgres.py is unchanged.

Environment and commands¶

Working directory for the commands below: /Users/jablonskib/HeyAira-agents/.heyaira-worktrees/heyaira/d989f9b4-worker. Python: 3.12.7; pytest: 9.1.1. A prepared PostgreSQL admin capability was present; the unchanged runner created and removed isolated databases. TMPDIR="$PWD/.heyaira/task-tmp" was used for test/Git temporary files. No credential or database URL is recorded here. Git commands used /Applications/Xcode.app/Contents/Developer/usr/bin/git directly: the /usr/bin/git shim emitted denied xcrun cache writes outside the workspace. The direct binary and workspace TMPDIR succeeded.

Before edits, server_identity({}) initially returned HTTP 502. Its retry succeeded and matched the supplied resource, instance, project and execution. task_get(task_id, version=2) succeeded before implementation. The Bridge exception in the work contract excludes interactive claiming/status changes.

The implementation-tree runs below preceded the local commit; the same required checks were then run on committed HEAD and recorded in RESULT.

K1¶

criterion_id: K1 outcome: pass evidence_path: docs/reports/task-ci-failures-evidence.md feedback: Focused real-PostgreSQL tests exit 0 on the implementation; all 24 new tests fail on the isolated source archive, exit 1, for absent functionality.

Command:

python scripts/test_postgres.py tests/test_ci_failures.py tests/test_task_ci_failures.py -p no:cacheprovider

Actual result, exit 0:

........................                                                 [100%]
24 passed in 7.56s
postgres_acceptance=passed: selected tests, zero skipped tests

An isolated archive was created with git archive -o .heyaira/task-tmp/base.tar d8b5b7482aff723abb0e00ea0fad228838edbf07, unpacked into .heyaira/task-tmp/base, and only the two new test files were copied into its tests/. Its runner selects the archive's source via PYTHONPATH and runs pytest with the archive as its working directory.

Command:

python .heyaira/task-tmp/base/scripts/test_postgres.py tests/test_ci_failures.py tests/test_task_ci_failures.py -p no:cacheprovider

Actual result: exit 1, 24 failed in 7.01s, no skipped tests.

Coverage	Implementation	Isolated d8b5b74	Observed base failure
C1	1 passed	1 failed	ModuleNotFoundError: heyaira.ci_failures
C2	1 passed	1 failed	ModuleNotFoundError: heyaira.ci_failures
C3	15 passed	15 failed	GitHubContentsProvider lacks job_log_tail/list_run_jobs
C4	6 passed	6 failed	Unknown tool: task_ci_failures
C5	1 passed	1 failed	KeyError: details_tool

C3 runs the production opener and redirect handler, replacing only the HTTPSHandler transport. It checks exact allowed redirect URL, fresh headers, one hop, unsafe destinations, range validation, 4 MiB + one sentinel byte read bound, and partial-line removal. C4 compares row counts of 14 touched tables around every tool read, exercises actual CI send-back, latest run selection, origin/SHA filtering, missing publication/binding/provider, and live-version worker/verifier credentials including same-project task mismatch.

K2¶

criterion_id: K2 outcome: pass evidence_path: docs/reports/task-ci-failures-evidence.md feedback: Required change-area runner exit 0, 121 passed and zero skipped; separate smoke run exit 0 with one explicitly listed skip and no failures/errors; runner unchanged.

Command:

python scripts/test_postgres.py tests/test_ci_failures.py tests/test_task_ci_failures.py tests/test_task_ci.py tests/test_ci_correction.py tests/test_notification_docs_contract.py tests/test_docs_contract.py -p no:cacheprovider

Actual result, exit 0:

........................................................................ [ 59%]
.................................................                        [100%]
121 passed in 66.38s (0:01:06)
postgres_acceptance=passed: selected tests, zero skipped tests

The first bare python -m pytest tests/test_bind_smoke_scripts.py -p no:cacheprovider -rs invocation exited 2 during collection: ModuleNotFoundError: No module named 'heyaira'. The source package is not installed in this environment. Rerun with the repository source path:

PYTHONPATH=src python -m pytest tests/test_bind_smoke_scripts.py -p no:cacheprovider -rs

Actual result: exit 0, zero failures/errors, one skip:

SKIPPED [1] tests/test_bind_smoke_scripts.py:50: set HEYAIRA_BIND_SCRIPTS_DATABASE_URL for isolated script E2E
1 skipped in 1.27s

Additional focused check:

PYTHONPATH=src python -m pytest tests/test_git_provider.py tests/test_mcp_runtime_contract.py -p no:cacheprovider

Actual result: exit 0, 30 passed in 1.92s, zero skips.

K3¶

criterion_id: K3 outcome: pass evidence_path: docs/reports/task-ci-failures-evidence.md feedback: Export and documentation contract checks exit 0; git diff --check exits 0 with no whitespace errors.

PYTHONPATH=src python scripts/export_mcp_contract.py --check
# exit 0: MCP contract is up to date
PYTHONPATH=src python scripts/check_docs_contract.py
# exit 0: documentation contract passed: 49 MCP tools covered
git diff --check
# exit 0: no output

The tool is registered in the MCP contract, documentation table, served GET /docs catalogue, both smoke registries and the Bridge delivery skill.

K4¶

criterion_id: K4 outcome: pass evidence_path: docs/reports/task-ci-failures-evidence.md feedback: Source is an ancestor; only authorized src/tests/docs/contracts/scripts paths changed; migrations and scripts/test_postgres.py unchanged.

git merge-base --is-ancestor d8b5b7482aff723abb0e00ea0fad228838edbf07 HEAD
# exit 0: no output
git diff --exit-code d8b5b74 -- scripts/test_postgres.py migrations
# exit 0: no output

The post-commit git diff --name-only d8b5b74..HEAD path list is:

contracts/mcp-tools.json
docs/agents/skills/deliver-bridge-task/SKILL.md
docs/reference/mcp-tools.md
docs/reports/task-ci-failures-evidence.md
scripts/multi_client_smoke.py
scripts/smoke_mcp.py
src/heyaira/ci_failures.py
src/heyaira/git_provider.py
src/heyaira/server.py
src/heyaira/workflow.py
tests/test_ci_correction.py
tests/test_ci_failures.py
tests/test_server_checks.py
tests/test_task_ci.py
tests/test_task_ci_failures.py

Development runs and remaining checks¶

The initial unchanged-base run also failed all 24 tests (exit 1, 24 failed in 7.65s). Intermediate implementation runs exited 1 with 14 failures/10 passes, then 2 failures/22 passes. These exposed the default urllib redirect-body drain, a synthetic PR fixture missing html_url, the automatically generated Host header, and use of /mcp instead of an execution token's issued project resource. All were corrected and the focused tests passed before the final runs above. The first change-area run exited 1 with 3 failures/118 passes; the additional failure identified the missing served GET /docs catalogue entry. The final change-area run passed all 121 tests after it was added.

Full suite: not run, as the frozen task assigns full-suite judgment to CI. Live GitHub downloads and socket smoke E2E: not claimed verified; providers and HTTPS transport are synthetic, and the smoke test's skip is listed above. Independent acceptance and publication remain with Bridge and its verifier.