[praisonai-triage-agent]

Origin: outsider

This PR was built from issue #6038, which is flagged origin/outsider, and the PR is flagged the same way. So the change is kept to a minimal fix in source and tests. It does not touch .github/, dependency manifests, lockfiles, build or install files, or conftest.py. It adds no network endpoints, telemetry, credential handling, eval/exec/subprocess or dynamic imports.

Fixes #6038

What changed (minimal, no new public params/exports)

1. Coalesced hook deliveries (gateway/hook_coalescer.py, server.py)

• The idempotency key is no longer recorded when the request is accepted. It stays an in-flight reservation, so a retry while the burst is pending is still deduplicated.
• The coalescer gets an optional settle(keys, ok) callback. It records the burst's keys after a successful run and releases them when the run fails or on aclose(), including groups that never started.
• After a crash, the in-flight reservation expires through the existing 15-minute lease. This is the same behaviour as the non-coalesced path, so the sender's retry is accepted.

2. Background jobs (praisonaiagents/background/job_manager.py, sqlite_store.py)

• reconcile_on_start now:
  • gives orphaned jobs an error (Interrupted by a process restart);
  • fires job_completed with status="lost" exactly once, after LOST is persisted;
  • passes LOST jobs that have an origin to redeliver, the same way it already handles COMPLETED-but-undelivered jobs.
• list_unreconciled includes LOST jobs with an origin that are not yet delivered, so a failed notice is retried on the next boot.
• A repeat call skips jobs that are live in the current process, so calling it again is safe.
• The emit closure is moved to a module helper so the two call sites share it.
• Gateway boot (_reconcile_background_jobs) runs reconcile with a redeliver that sends one "your background task '' was interrupted… resend to retry" notice. It goes through the existing durable scheduled_outbox with a stable key, and undelivered COMPLETED results go the same way. A job is only marked delivered after the notice is delivered. This is a no-op when no background_jobs.db exists. Nothing is re-run automatically.

3. Kanban (kanban/sqlite_store.py)

• reclaim_stale_claims now:
  • closes the interrupted current_run_id as crashed;
  • calls record_failure, so crash loops trip the circuit breaker;
  • adds an interrupted: comment, which get_retry_context and humans can see.

4. Run ledger

• I kept _recover_orphaned_runs. It is not dead code: the public core SQLiteRunLedger() writes to the same default ~/.praisonai/runs/ledger.db, so apps that use the ledger still get recovery.
• I corrected the misleading comments: the api_endpoints.py comment no longer calls the ledger the cross-restart store, and the docstring now says the gateway does not write the ledger itself. Background jobs, which are the gateway's own long-running work, are now covered by item 2.
• Out of scope: delivering kanban results to chat (companion issue).

Tests

• New: praisonai-bot/tests/unit/gateway/test_hook_coalescer_restart.py, praisonai-agents/tests/unit/background/test_reconcile_notifies_lost.py, praisonai-bot/tests/unit/gateway/test_kanban_reclaim_closes_run.py, and a boot test in test_ledger_recovery.py.
• praisonai-bot gateway, kanban and bots: 2009 passed. The 2 test_pid_lock_windows failures also fail on main.
• praisonai-agents tests/unit: the failing-test set is identical to main. Those failures come from optional dependencies and API keys missing in this environment.

Follow-up (review fixes)

• Recovery notices now resolve the saved deliver target the same way live delivery does. origin keeps thread_id, all fans out to home channels, and platform names and aliases resolve through the router. A target that cannot be resolved yet is retried on the next boot instead of being marked delivered.
• Kanban reclaim closes the crashed run, counts the failure and adds the comment in the reclaim's own transaction. This removes the race where a second dispatcher could claim the task in between.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6e904ddc-b418-4f30-865b-ac2776f8a9b8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 4/5

[Medium impact] The changes affect restart recovery in three bounded gateway workflows.

The PR still needs reservation renewal before merging because slow coalesced hooks can run twice.

Findings

1.  Slow hooks can run twice ▶

Summary

This PR tells users when a restart interrupts background work and records interrupted kanban attempts.

• The gateway tells delivery targets when a restart interrupts background jobs.
• Coalesced hook deliveries stay retryable until their run succeeds.
• Stale Kanban claims close their interrupted runs and count as failures.
• Gateway comments now describe which restart data the run ledger stores.

The latest changes fix partial-delivery retries and protect completed jobs from stale recovery snapshots. The earlier fixes also preserve saved delivery targets and keep kanban reclaim bookkeeping together.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Gateway starts] --> B[Read saved background jobs]
    B --> C{Owned by this process?}
    C -->|Yes| D[Leave unchanged]
    C -->|No| E[Mark unfinished jobs lost]
    E --> F[Resolve saved destinations]
    F --> G[Send through durable outbox]
    G --> H{Every destination succeeded?}
    H -->|Yes| I[Mark delivered]
    H -->|No| J[Keep for next restart]

Loading

_{Reviews (4) · Last reviewed commit: "fix: never reconcile jobs owned by this ..." · Reviewed by Greptile}

[MervinPraison]

@coderabbitai review

[MervinPraison]

/review

[coderabbitai]

⚠️ Action not completed

Review skipped.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[MervinPraison]

@claude You are the FINAL architecture reviewer. If the branch is under MervinPraison/PraisonAI (not a fork), you are able to make modifications to this branch and push directly. SCOPE: Review changes in this PR. Python SDK: praisonaiagents, praisonai. TypeScript SDK: src/praisonai-ts/. Do NOT modify src/praisonai-rust. Read ALL comments above from Gemini, Qodo, CodeRabbit, and Copilot carefully before responding.

MANDATORY READ (before reviewing):

• Always read src/praisonai-agents/AGENTS.md
• If this PR touches src/praisonai-ts/, also read src/praisonai-ts/AGENTS.md §2.1.2 (TS triage + PR review checklist)

Phase 1: Review per AGENTS.md

1. Protocol-driven: check heavy implementations vs core SDK
2. Backward compatible: ensure zero feature regressions
3. Performance: no hot-path regressions
4. SDK value: review in depth whether the change genuinely adds value to the SDK — never add features for the sake of adding them. It must strengthen the SDK (simpler, more user-friendly, robust, world-class, secure). If it does not clearly add value, request changes or recommend rejecting/closing rather than merging scope creep
5. Do not bloat the Agent class with additional params — only if absolutely required; we already support many params.
6. Repo routing: agent-callable tools → PraisonAI-Tools; lifecycle plugins → PraisonAI-Plugins; optional sandbox backends → PraisonAI-Plugins (praisonai.sandbox entry point) — request changes if wrongly added to praisonaiagents/
   6b. External tool examples (examples/tools/external/**): If the diff is confined to that path, mark SDK value ❌ for monorepo merge — redirect the contributor to PraisonAI-Tools; do not Approve for merge unless the PR has the maintainer-accept-example label.
   6c. New vendor *_tools.py in core (src/praisonai-agents/praisonaiagents/tools/): If the PR adds a new *_tools.py for a third-party API/SaaS/dataset (e.g. FXMacroData), mark Repo routing ❌ and SDK value ❌ — redirect to MervinPraison/PraisonAI-Tools. Do not Approve because legacy bundled tools (Tavily/Exa/You.com/etc.) already in core are not precedent for new vendor modules. Request changes or recommend closing unless the PR has maintainer-accept-core-tools.

MANDATORY COMMENT FORMAT — include this Phase 1 table in your review comment:

Phase 1 — AGENTS.md review

Check	Result
Protocol-driven / no heavy impl in core	✅ or ❌ + one-line rationale
Backward compatible	✅ or ❌ + one-line rationale
Performance (hot path)	✅ or ❌ + one-line rationale
SDK value	✅ or ❌ + one-line rationale (explicitly judge whether the change strengthens the SDK)
No Agent param bloat	✅ or ❌ + one-line rationale
Repo routing	✅ or ❌ + one-line rationale

For TypeScript PRs (src/praisonai-ts/), also add:
| TS types / parity / tests | ✅ or ❌ + one-line rationale (npm run build && npm test) |

Phase 2: FIX Valid Issues
7. For any VALID bugs or architectural flaws found by Gemini, CodeRabbit, Qodo, Copilot, or any other reviewer: implement the fix
8. Also independently identify and fix any gaps or issues you find in the changed code — do not rely only on prior reviewer feedback
9. Push all code fixes directly to THIS branch (do NOT create a new PR)
10. Comment a summary of exact files modified and what you skipped

Phase 3: Final Verdict
11. Never Approve or write “Approve for merge” if any Phase 1 row is ❌, if rule 6b/6c applies, or if the change belongs in PraisonAI-Tools/PraisonAI-Plugins. Use Request changes, redirect to the external repo, and recommend closing the monorepo PR when routing is wrong.
12. Approve only when every Phase 1 row is ✅ (including Repo routing and SDK value) and blocking issues are resolved; otherwise request changes with clear action items

[MervinPraison]

@claude CI failed on HEAD 86f5dc49. Please fix the failures below and push to this branch.

Failed checks

• github-actions / test-core — https://github.com/MervinPraison/PraisonAI/actions/runs/40386926393/job/121818244927
• github-actions / main (3.11) — https://github.com/MervinPraison/PraisonAI/actions/runs/40386926204/job/121812950313
• github-actions / test-core (root) — https://github.com/MervinPraison/PraisonAI/actions/runs/40386926393/job/121805497500

Failures (extracted)

1. tests/unit/test_yaml_headless_5826.py::test_output_file_and_metrics_json — RuntimeError: output_file not written: /tmp/pytest-of-runner/pytest-0/popen-gw0/test_output_file_and_metrics_j0/out/risk_report.md, /tmp/pytest-of-runner/pytest-0/popen-gw0/test_output_file_and_metrics_j0/flat.md
   • Job: main (3.11)
2. tests/unit/test_yaml_headless_5826.py::test_output_file_and_metrics_json — RuntimeError: output_file not written: /tmp/pytest-of-runner/pytest-0/popen-gw0/test_output_file_and_metrics_j0/out/risk_report.md, /tmp/pytest-of-runner/pytest-0/popen-gw0/test_output_file_and_metrics_j0/flat.md
   • Job: test-core (root)

Critical review first

Before changing code or tests, decide which side is wrong:

1. Legitimate feature change — the PR intent is correct but implementation or tests need updating. Preserve SDK guarantees; update tests only when behaviour intentionally changed and document why.
2. Regression / bug in this PR — the failure exposes a real breakage introduced here. Fix the implementation; do not weaken, skip, or delete tests just to go green.
3. Pre-existing flake or unrelated failure — say so explicitly; prefer fixing the root cause over masking it.

SDK guardrails (AGENTS.md):

• Agent-callable tools → PraisonAI-Tools; lifecycle plugins → PraisonAI-Plugins; sandbox backends → PraisonAI-Plugins (praisonai.sandbox) — not praisonaiagents/.
• Do not disturb core SDK contracts to accommodate a wrapper/feature change.
• Tests must continue to guard backward compatibility and hot-path behaviour — passing CI by lowering test standards is not acceptable.
• If the feature does not genuinely add SDK value, recommend reverting or narrowing scope instead of patching around failures.

What to do

1. State your verdict: legitimate fix, regression fix, or needs human review — and why (1–3 sentences).
2. Fix root cause with minimal changes; never bloat the Agent class with extra params.
3. Run failing tests locally, e.g. pytest tests/unit/test_yaml_headless_5826.py::test_output_file_and_metrics_json -q, plus any related SDK tests touched by the PR.
4. Push to this branch and comment: files changed, review verdict, and why tests still protect SDK behaviour.

[praisonai-triage-agent]

Review fixes pushed (aca5d41)

Origin: outsider. Issue #6038 and this PR are flagged outsider, so the change stays a minimal fix in source and tests. It does not touch CI, manifests, lockfiles, build files or conftest.py, and adds no network, telemetry, credentials, eval/exec/subprocess or dynamic imports.

Fixed (both Greptile P1 findings were valid)

1. Recovery messages missed their target (src/praisonai-bot/praisonai_bot/gateway/server.py)
   • New _resolve_job_routes follows the live delivery rules:
     • origin keeps thread_id (platform:chat:thread).
     • all fans out to home channels.
     • Platform names and aliases resolve through DeliveryRouter.resolve.
   • If a target cannot be resolved yet (unknown alias, or all with no homes), the job is not marked delivered and is retried on the next boot.
   • Only two cases count as permanently undeliverable and are marked delivered:
     • no deliver was requested, which matches the live path;
     • origin has no chat fields; those fields never change, so retrying cannot help.
2. Kanban reclaim race (src/praisonai-bot/praisonai_bot/kanban/sqlite_store.py)
   • These steps now happen inside the reclaim transaction:
     • closing the crashed run (_close_crashed_run);
     • counting the failure and tripping the breaker (_count_failure, split out of record_failure);
     • adding the interrupted: comment.
   • Hooks fire only after commit (_emit_failure), so a second dispatcher can't claim a task that is about to be blocked.
   • record_failure behaves as before.

Tests

• tests/unit/gateway/test_ledger_recovery.py: a new routing test covers thread kept, alias resolved, unresolvable raises, all with no homes raises, and no-deliver gives []. The expected outbox key is updated.
• tests/unit/gateway/test_kanban_reclaim_closes_run.py: a new test checks that the run is already crashed and the task already blocked at the first post-commit hook. It fails on the previous commit and passes now.
• Results:
  • praisonai-bot tests/unit/gateway + tests/unit/kanban: 800+ pass. The failure set is identical with and without this commit; all 24 come from missing optional deps (typer, etc.) and test_pid_lock_windows.
  • praisonai-agents tests/unit/background: 34 passed.

Security review (full PR diff)

#	Check	Result
1	Scope	✅ All changes serve #6038 or the review fixes. The api_endpoints.py change is comment-only.
2	Network / exfiltration	✅ No new URLs, hosts or sockets. Notices go through the existing DeliveryRouter + scheduled_outbox, which applies outbound secret redaction, and only to the job's own saved target.
3	Code execution	✅ None. The only lazy import is the existing in-repo praisonaiagents.background / BotOS.
4	Secrets	✅ No env, token or credential reads. The notice includes at most 80 chars of the user's own task text, sent back to the origin it came from.
5	Weakened controls	✅ Coalesced hook idempotency keys are now recorded only after a successful run. Failed or cancelled runs release them so the sender can retry, and in-flight duplicates are still deduplicated. This is the intended fix, not a bypass. No auth, approval or validation changes.
6	Supply chain	✅ No manifests, lockfiles, CI, conftest.py or entry points.
7	Obfuscation	✅ No encoded blobs, long lines, or bidi/zero-width characters (scanned).
8	Tests	✅ Only additions. The one changed assertion follows the new outbox key format.
9	Backdoors	✅ No magic values, or behaviour keyed on users, dates or hosts.
10	Injection artifacts	✅ None found in code, comments or test data.

The deterministic risk flag list in the request was empty. My own pattern scan of the added lines also found no hits.

Skipped

• Re-running jobs automatically after a restart. The PR deliberately sends a notice only; this is unchanged.
• Delivering kanban results to chat, which is out of scope (companion issue).

[praisonai-triage-agent]

CI failure triage: not caused by this PR (no code pushed)

Origin: outsider. Issue #6038 and this PR are flagged outsider, so the change stays a minimal fix in source and tests. Nothing under .github/, dependency manifests, lockfiles, build or install files, or conftest.py is touched. No network endpoints, telemetry, credential handling, eval/exec/subprocess or dynamic imports are added.

Verdict: pre-existing failure on main, unrelated to this PR

tests/unit/test_yaml_headless_5826.py::test_output_file_and_metrics_json fails because of two changes that are both already on main:

• abc3d7219 (fix(security): contain Task and Workflow step output_file writes in project root #5770) limits output_file writes to the project root, which is PRAISONAI_PROJECT_ROOT or the cwd (praisonaiagents/utils/output_file.py).
• The fix(cli): headless YAML runs ignore --metrics, drop output_file, and exit 0 when every task fails #5826 test writes its output files into pytest's tmp_path (/tmp/...), which is outside the cwd (src/praisonai).

The CI log shows this directly: Output file '/tmp/.../risk_report.md' is outside project root '/home/runner/work/PraisonAI/PraisonAI/src/praisonai'; skipping save, and then RuntimeError: output_file not written.

Two more facts confirm it is not this PR:

• PR chore(deps): require aiui>=0.3.148 for PraisonAI Replay embed #6067 changes only src/praisonai/pyproject.toml and fails test-core (root) with the same test and the same error.
• This PR does not touch output_file, the YAML adapter, or src/praisonai/.

Not fixed here, on purpose. The fix belongs in a separate maintainer PR on main, because a change to an unrelated test file would break the outsider-PR scope rule (checklist item 1). The likely fix keeps the security guard and gives the test a valid root: monkeypatch.setenv("PRAISONAI_PROJECT_ROOT", str(tmp_path)) (or monkeypatch.chdir(tmp_path)) in test_yaml_headless_5826.py. That keeps the test's assertions as strict as they are now.

Security review of the full diff (HEAD aca5d416e)

#	Check	Result
1	Scope	✅ All 10 files serve #6038 or the review fixes (background reconcile, hook coalescer settle, kanban reclaim, tests). api_endpoints.py changes only a comment.
2	Network / exfiltration	✅ No new URLs, hosts or sockets. Notices go through the existing DeliveryRouter and scheduled_outbox, and only to the job's own saved origin / deliver target.
3	Code execution	✅ No eval/exec/subprocess/pickle/yaml. The only lazy imports are existing in-repo modules (praisonaiagents.background, praisonaiagents.paths, BotOS). Every conn.execute is parameterized.
4	Secrets	✅ No env, token or credential reads. A notice includes at most 80 characters of the user's own task text, sent back to the place it came from.
5	Weakened controls	✅ None weakened. Hook idempotency stays reserved while a run is in flight and is only released when the run fails or is cancelled. The crash path uses the existing 15-minute lease, which is the same as the non-coalesced path.
6	Supply chain	✅ No manifests, lockfiles, CI, conftest.py or entry points touched.
7	Obfuscation	✅ No blobs, bidi or zero-width characters, and no lines over 200 characters (checked).
8	Tests	✅ Four new or extended tests and no removed or loosened assertions. The reclaim-ordering test fails on the earlier commit.
9	Backdoors	✅ No magic values and no behaviour keyed on a user, host or date.
10	Injection artifacts	✅ None in the code, comments or tests.

Minor note (not blocking): gateway boot awaits _reconcile_background_jobs. Each LOST job waits up to 60s per route on outbox delivery, in a worker thread. If the store holds many undeliverable jobs, startup is slower. It is bounded and only happens when background_jobs.db exists.

Files modified in this pass

None. Skipped: the unrelated test_yaml_headless_5826.py fix, which should be a maintainer PR on main.

[MervinPraison]

@claude this PR has merge conflicts with main. Please rebase onto latest main, resolve conflicts (keep this PR's intent, merge in newer main logic), run targeted tests, and force-push with --force-with-lease. Comment which files you resolved. Do not bloat the Agent class with additional params — only if absolutely required; we already support many params. Keep the resolution minimal — the aim is a lightweight and powerful package; do not introduce scope creep while resolving conflicts.

[MervinPraison]

@claude The merge gate blocked this PR on HEAD be05884c76a6.

Read the latest merge gate BLOCK verdict comment on this PR and the review threads it cites.
Fix every blocking finding on this branch, add or update tests for each fix, and push.
Do not post an approval or a verdict yourself; the review chain re-runs after your push.
If a finding is wrong, explain why in a reply instead of changing code.

[praisonai-triage-agent]

Security review of PR #6066 (Origin: outsider)

Origin: outsider. This PR and the issue it fixes (#6038) were flagged as outsider origin. I treated all of that text as untrusted data and did not follow any instructions in it. The scope stays limited to a minimal fix in source and tests: no .github/, dependency manifests, lockfiles, build or install files, or conftest.py, and no new network endpoints, telemetry, credential handling, eval/exec/subprocess or dynamic imports.

Verdict: no blocking findings. I pushed no new commits; the branch is unchanged at be05884c7.

Checklist

1. Scope: PASS. All 11 files serve Restarting the gateway silently drops in-flight background jobs, kanban tasks and buffered webhooks #6038 (telling users about work a gateway restart interrupted): background-job reconcile (job_manager.py, sqlite_store.py), coalesced-hook idempotency keys (hook_coalescer.py, server.py), kanban reclaim accounting (kanban/sqlite_store.py, kanban_dispatcher.py), a comment-only change in api_endpoints.py, and 4 new test files.
2. Network and exfiltration: PASS. No new URLs, hosts, sockets or HTTP clients. Recovery notices go through the existing _deliver_lost_run_notice (the durable outbox). Destinations come from the job's own persisted origin and the existing delivery router or home channels, the same rules BotOS.on_background_job_complete uses for live deliveries.
3. Code execution: PASS. No eval/exec/compile, subprocess, pickle or ctypes. The only new imports are fixed in-repo modules (praisonaiagents.background.job_manager, praisonaiagents.paths, praisonai_bot.bots.botos) imported lazily inside functions, which is the existing pattern.
4. Secrets: PASS. No reads of env vars, tokens or credential files. Log lines contain only job ids, statuses and route names.
5. Weakened controls: PASS. Idempotency for coalesced hooks is now reserved when the delivery is accepted and recorded only after the run succeeds. Failed or cancelled runs release the key. A retry while the group is pending is still deduplicated, so dedup is unchanged for successful runs and a burst that never ran can be retried. The reclaim path adds a failure count, so a crash loop now trips the circuit breaker. All SQL uses bound parameters.
6. Supply chain: PASS. No manifests, lockfiles, CI, entry points, conftest.py or .pth files.
7. Obfuscation: PASS. No encoded blobs or binary files. I scanned the diff for bidi and zero-width characters and found none.
8. Tests: PASS. The diff only adds tests (353 lines added, none removed); nothing is skipped or loosened. The new tests assert specific behaviour: LOST is redelivered, jobs live in this process are skipped on a repeat reconcile, reclaim closes the run as crashed and counts the failure, coalesced keys are released on failure or shutdown, and ledger recovery works.
9. Persistence and backdoors: PASS. No hard-coded credentials, magic values, or behaviour keyed on specific users, dates or hosts.
10. Injection artifacts: PASS. No instructions aimed at AI tools in the code, comments, docstrings, test data or commit messages.

Non-blocking notes

• _redeliver marks a COMPLETED job delivered when _summarize_job_result returns empty text. This is intended (nothing to send).
• In reclaim_stale_claims, the emitted KANBAN_TASK_FAILED reports old_status='ready' because the failure is counted after the reclaim. This matches the running -> ready move that is announced first.

Tests run locally

• praisonai-agents tests/unit/background: 35 passed.
• praisonai-bot tests/unit/gateway tests/unit/kanban: 859 passed, 3 skipped, 2 failed. Both failures are in test_pid_lock_windows.py and fail the same way on origin/main, so this PR did not cause them.

Files modified by this pass: none. Skipped: no code changes were needed.

[praisonai-triage-agent]

SECURITY_REVIEW: FAIL

file:line	category	severity	evidence
(whole PR, 11 files, +727/-148)	review-incomplete	High	The automated reviewer could not read the diff at HEAD be05884c76a6fb69b9d34972349ba16eb6e78806. get_pull_request_files returned about 61 KB, more than the tool can return inline. The fallback tools for reading it (get_commit, get_file_contents, list_commits, and local file or shell access) were not permitted in this run. No changed line was inspected.

Scope matches the request: unknown. Only the PR description was readable. It describes changes to the gateway hook coalescer and server.py, background job_manager.py and sqlite_store.py, kanban sqlite_store.py, run-ledger comments in api_endpoints.py, and new tests. That is consistent with #6038, but this was not verified against the code.

Risk flags: none were extracted deterministically, so there is nothing to explain.

Why this fails: the PR has outsider origin and the checklist was not applied to any added line. The review policy is to fail when unsure. Before merging, a maintainer should manually review these areas:

• the new redeliver / scheduled_outbox notice path, for whether delivery targets are fixed and expected;
• the reservation and release logic for idempotency keys in hook_coalescer.py and server.py, because dedup is a control;
• the new tests, for whether their assertions are meaningful.

As an alternative, re-run this review with file-read permissions granted.

[praisonai-triage-agent]

SECURITY_REVIEW: FAIL

Automated security review of HEAD be05884c76a6fb69b9d34972349ba16eb6e78806 (origin/outsider). I could not finish this review, so it fails closed under the "when unsure, FAIL" rule. This is not evidence of malicious code.

Why it is incomplete: the full diff (11 files, +727/−148, about 61k characters) was too large to return inline. The reviewer environment had no file-read or shell tool to page through the saved output, and it was denied permission to call get_commit and list_commits. As a result, I did not read any added line of the diff. I only read the PR metadata and description.

file:line	category	severity	evidence
(whole diff)	review-incomplete	High (fail-closed)	The diff content could not be read, so checklist items 1–10 could not be verified against the actual code.

Scope matches the request: unverified. The PR description (coalesced hook idempotency settle, background-job LOST reconciliation and notices, kanban reclaim closing crashed runs, ledger comment fixes, plus tests) fits issue #6038 and says no .github/, manifests, lockfiles, conftest.py, network, eval/exec or subprocess changes were made. I could not confirm these claims against the diff.

Risk flags: none were reported by the deterministic scan, so there is nothing to address individually. That scan does not replace reading the diff.

Recommended next step: a maintainer reviews the diff by hand, paying particular attention to the new outbound notice path in _reconcile_background_jobs / scheduled_outbox (delivery target resolution, including all fan-out to home channels) and to the changes in the new test files. Alternatively, re-run this review with tooling that can read large diffs.

[praisonai-triage-agent]

MERGE_GATE_VERDICT: BLOCK

• This PR has outsider origin (origin/outsider). The latest independent security reviews on HEAD be05884c76a6fb69b9d34972349ba16eb6e78806 say SECURITY_REVIEW: FAIL. They failed closed because the reviewer could not read the diff (about 61 KB, too large to return inline). The gate only allows an outsider-origin PR through on SECURITY_REVIEW: PASS.
• An earlier security pass reported no blocking findings. It is not the required SECURITY_REVIEW: PASS verdict, so it does not replace the failed reviews.
• Before merging, a maintainer needs to review by hand:
  • the new recovery-notice path (_reconcile_background_jobs → scheduled_outbox), especially how the delivery target is resolved, including all fan-out to home channels;
  • the reservation, settle and release of idempotency keys in hook_coalescer.py and server.py, because dedup is a control;
  • whether the assertions in the new tests actually check the behaviour.
• Context: the PR has 11 files and +727/−148 lines, so it is within the size limits. It has no CHANGES_REQUESTED reviews, and it changes core praisonaiagents/background/ together with tests.

Manual review and merge by a maintainer is required. Alternatively, re-run the security review with tooling that can read large diffs.

[praisonai-triage-agent]

MERGE_GATE_VERDICT: BLOCK

• This PR has outsider origin (origin/outsider). Both of the latest independent security reviews on HEAD be05884c76a6fb69b9d34972349ba16eb6e78806 say SECURITY_REVIEW: FAIL. They failed closed because the diff was too large to read (about 61 KB). The gate only lets an outsider-origin PR through on SECURITY_REVIEW: PASS.
• This gate pass could not read the full diff inline either, so I cannot independently confirm there is no security concern. The earlier "no blocking findings" security pass is not a SECURITY_REVIEW: PASS verdict.
• Other checks look fine and do not cause this block: 11 files, +727/−148 lines (within size limits), no CHANGES_REQUESTED reviews, no sensitive paths or labels, the author is the triage-agent app, and tests are included.
• A maintainer needs to review by hand:
  • the recovery-notice delivery path (_reconcile_background_jobs → scheduled_outbox), especially how the delivery target is resolved, including all fan-out to home channels;
  • how idempotency keys are reserved, settled and released in hook_coalescer.py and server.py;
  • whether the new tests' assertions actually check the behaviour.

The maintainer must merge this by hand, or re-run the security review with tooling that can read large diffs.

[praisonai-triage-agent]

Merge gate scan — not eligible for auto-merge.

• merge gate blocked this HEAD (waiting for a fix commit)

Actions: wait for CI and the Claude review chain, or add label needs-manual-review and merge manually.
Opt out: label no-auto-merge.

[praisonai-triage-agent]

Merge gate scan — eligible for assessment. Claude merge gate will assess and may auto-merge on an APPROVE verdict.

[praisonai-triage-agent]

SECURITY_REVIEW: FAIL

Why this fails: the review could not be completed. No malicious code was found in what was read. The reviewer could not read the full diff, so it cannot certify this change. A maintainer needs to review it by hand.

• get_pull_request_files returned about 61 KB on one line, which was too large to return to the reviewer. The reviewer had no shell or file-read tool to open the saved copy.
• Permission to use get_commit and list_commits was denied, so the per-commit diffs could not be read.
• Only one of the 11 changed files was read: src/praisonai-agents/praisonaiagents/background/job_manager.py, as the full file at the PR head (be05884c), not as a diff. The other 10 files (gateway/hook_coalescer.py, server.py, background/sqlite_store.py, kanban/sqlite_store.py, api_endpoints.py and the new or changed tests) were not checked.

file:line	category	severity	evidence
(whole PR)	review-incomplete	High	10 of 11 changed files (727 additions, 148 deletions) were not read, so checklist items 1–10 cannot be confirmed for them.
src/praisonai-agents/praisonaiagents/background/job_manager.py	read, nothing found	Info	Only stdlib imports plus a lazy import of praisonaiagents.hooks.fire_hook and the package's own .sqlite_store. No network calls, eval/exec, subprocess or secret reads. The only environment variable read is PRAISONAI_BACKGROUND_JOB_STORE, an opt-out switch that already existed. reconcile_on_start and _emit_job_completed match the PR description. No injection text was found.

Scope matches the request: unknown (could not be verified; the one file read matches the stated scope)

Risk flags: none were supplied, so there were none to address.

Suggested next step: a maintainer should review the full diff by hand. They should look most closely at the new outbound notice path in server.py (_reconcile_background_jobs and the redelivery through scheduled_outbox), deliver-target resolution, the coalescer settle callback and its effect on idempotency, and the kanban reclaim transaction. Then rerun this review with diff access.

[praisonai-triage-agent]

SECURITY_REVIEW: FAIL

Why this fails: the review could not finish, so it fails closed. The PR comes from an outsider (origin/outsider, built from issue #6038). It changes 11 files (+727/−148). The full diff from get_pull_request_files came to about 61 KB and was too large to load in this session. Fetching individual commit diffs was not permitted. I fully reviewed only one file, the head version of src/praisonai-agents/praisonaiagents/background/job_manager.py. I could not read the other 10 changed files or confirm the full file list. Per the review rules ("When you are unsure, FAIL"), a maintainer needs to review the rest.

file:line	category	severity	evidence
(whole PR)	Review coverage	Medium	Only 1 of 11 changed files was reviewed. Not reviewed: the gateway server.py and hook_coalescer.py changes (idempotency-key reservation and the new settle callback), background/sqlite_store.py, kanban/sqlite_store.py, api_endpoints.py, and 4 test files.
src/praisonai-agents/praisonaiagents/background/job_manager.py	Network / exec / secrets	None found	At head, the new code is _emit_job_completed, which calls the existing local praisonaiagents.hooks.fire_hook. It also includes the LOST-job handling in reconcile_on_start and the ownership check that skips jobs live in this process. I found no network calls, eval/exec, subprocess, dynamic imports from user paths, or credential reads. The only environment variable read is PRAISONAI_BACKGROUND_JOB_STORE, an opt-out switch that turns persistence off and does not weaken any control.
gateway hook coalescer / server.py (description)	Weakened controls (needs check)	Unverified	According to the PR description, the hook idempotency key is no longer recorded when a request is accepted. Instead it is held as an in-flight reservation and released when a run fails. That changes how duplicate webhook deliveries are suppressed. A maintainer should confirm that a failed or aborted burst cannot be used to replay a delivery that already ran.
gateway recovery notices (description)	Data egress (needs check)	Unverified	The PR adds boot-time notices that are sent through the existing scheduled_outbox to saved deliver targets, and an all target fans out to home channels. A maintainer should confirm that messages only go to the routes stored with each job and to configured home channels, never to destinations taken from untrusted input.

Scope matches the request: unverified. From the PR description and the one file I reviewed, the changes look like they serve issue #6038 (restart recovery for hooks, background jobs, kanban and the run ledger). The rest of the diff was not available to confirm this.

Risk flags: the deterministic extractor reported none, so there are no flags to address. That does not replace the review that is missing here.

Next step: a maintainer, or a re-run with access to the per-file diff, should review the remaining 10 files against the checklist. The most important are the hook coalescer's idempotency semantics, the gateway _reconcile_background_jobs delivery path, and any manifest, CI, or conftest.py changes, which the PR description says were not made.

[praisonai-triage-agent]

MERGE_GATE_VERDICT: BLOCK

• This PR comes from an outsider (origin/outsider, built from issue Restarting the gateway silently drops in-flight background jobs, kanban tasks and buffered webhooks #6038). The gate needs SECURITY_REVIEW: PASS for HEAD be05884, but both security reviews posted for this HEAD say SECURITY_REVIEW: FAIL. They failed because the review could not finish: only 1 of the 11 changed files (background/job_manager.py) was read, and no malicious code was found in that file.
• The gate could not check the diff either. The get_pull_request_files output (about 61 KB) was too large to read with the tools available here. That leaves several things unchecked by any automated review: the hook-coalescer idempotency change (keys are now reserved while in flight and released when a run fails), the boot-time notices that _reconcile_background_jobs sends through scheduled_outbox (deliver-target resolution and the all fan-out), and the kanban reclaim transaction.
• Other checks look fine: the PR is 11 files and +727/−148 lines (under the limits), it includes tests, there are no blocking labels and no CHANGES_REQUESTED reviews, and the PR description says .github/ and dependency manifests are untouched. None of this overrides the failed security review.

A maintainer needs to review the full diff by hand, focusing on the areas above, and then either merge it manually or re-run the security review with access to the full diff.

[praisonai-triage-agent]

MERGE_GATE_VERDICT: BLOCK

• This is an outsider-origin PR (labelled origin/outsider, built from issue Restarting the gateway silently drops in-flight background jobs, kanban tasks and buffered webhooks #6038). The two independent security review comments on HEAD be05884c both say SECURITY_REVIEW: FAIL. Auto-merge needs PASS.
• Both security reviews failed closed because they were incomplete: only 1 of 11 changed files was reviewed (background/job_manager.py, nothing found in it). The merge gate hit the same tooling limit: the per-file diff (about 61 KB) could not be loaded. So this gate cannot confirm that the other 10 files have no security problems either.
• These need maintainer review: the change to hook idempotency in the hook coalescer and server.py (the key is now reserved while in flight and released when a run fails, so check that it can't be used to replay a delivery), the path that sends recovery notices at boot (_reconcile_background_jobs → scheduled_outbox, including all fanning out to home channels), and the kanban reclaim transaction.
• Other notes: there are no CHANGES_REQUESTED reviews, and the PR is 875 changed lines (+727/−148) across 11 files, which is over the 800-line limit.

A maintainer needs to review and merge this by hand.