From bc14a2fbcb4720c4c1fbbd111e73bdce5cc03c86 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?= Date: Sat, 23 May 2026 18:26:56 -0400 Subject: [PATCH] Add operations controls and SLO drills --- AgentCompany-New/src/main/app/ipc-handlers.ts | 4 + .../migrations/017-operations-controls.ts | 109 ++++++++ AgentCompany-New/src/main/database/schema.ts | 2 + .../src/main/services/migration-service.ts | 23 ++ .../src/main/services/operations-service.ts | 233 ++++++++++++++++++ .../main/services/org-governance-service.ts | 13 +- .../src/main/services/organization-service.ts | 4 + .../src/main/services/provider-service.ts | 25 +- .../src/main/services/skill-service.ts | 12 + .../src/main/services/snapshot-service.ts | 11 + AgentCompany-New/src/preload/index.ts | 2 + .../src/renderer/src/pages/SettingsPage.tsx | 19 ++ .../src/pages/settings/OperationsPanel.tsx | 197 +++++++++++++++ AgentCompany-New/src/shared/commands.ts | 11 + AgentCompany-New/src/shared/desktop-api.ts | 4 + AgentCompany-New/src/shared/domain.ts | 3 + AgentCompany-New/src/shared/ipc.ts | 2 + .../src/shared/operations-domain.ts | 50 ++++ AgentCompany-New/tests/e2e/desktop.spec.ts | 10 +- .../tests/unit/domain-services.test.ts | 5 +- .../tests/unit/migration-service.test.ts | 14 ++ .../tests/unit/operations-service.test.ts | 124 ++++++++++ .../tests/unit/provider-service.test.ts | 1 + 23 files changed, 873 insertions(+), 5 deletions(-) create mode 100644 AgentCompany-New/src/main/database/migrations/017-operations-controls.ts create mode 100644 AgentCompany-New/src/main/services/operations-service.ts create mode 100644 AgentCompany-New/src/renderer/src/pages/settings/OperationsPanel.tsx create mode 100644 AgentCompany-New/src/shared/operations-domain.ts create mode 100644 AgentCompany-New/tests/unit/operations-service.test.ts diff --git a/AgentCompany-New/src/main/app/ipc-handlers.ts b/AgentCompany-New/src/main/app/ipc-handlers.ts index b2a57dad..587d9b94 100644 --- a/AgentCompany-New/src/main/app/ipc-handlers.ts +++ b/AgentCompany-New/src/main/app/ipc-handlers.ts @@ -16,6 +16,7 @@ import { OnboardingService } from "../services/onboarding-service"; import { ComplianceService } from "../services/compliance-service"; import { SearchService } from "../services/search-service"; import { IdentityAccessService } from "../services/identity-access-service"; +import { OperationsService } from "../services/operations-service"; export interface IpcDeps { connection: DatabaseConnection; @@ -36,6 +37,7 @@ export function registerIpcHandlers(deps: IpcDeps): void { const compliance = new ComplianceService(deps.connection.db); const search = new SearchService(deps.connection.db); const identityAccess = new IdentityAccessService(deps.connection.db); + const operations = new OperationsService(deps.connection.db); const onboarding = new OnboardingService({ db: deps.connection.db, saveProviderCredential: (input) => providers.saveCredential(input), @@ -153,6 +155,8 @@ export function registerIpcHandlers(deps: IpcDeps): void { }); ipcMain.handle(IPC_CHANNELS.createMigrationReport, (_event, input) => mutate(() => migrations.createReport(input))); + ipcMain.handle(IPC_CHANNELS.setFeatureFlag, (_event, input) => mutate(() => operations.setFeatureFlag(input))); + ipcMain.handle(IPC_CHANNELS.runChaosDrill, (_event, input) => mutate(() => operations.runChaosDrill(input))); ipcMain.handle(IPC_CHANNELS.createComplianceExport, (_event, input) => mutate(() => compliance.createExport(input))); ipcMain.handle(IPC_CHANNELS.createLegalHold, (_event, input) => mutate(() => compliance.createLegalHold(input))); ipcMain.handle(IPC_CHANNELS.setLegalHoldState, (_event, input) => mutate(() => compliance.setLegalHoldState(input))); diff --git a/AgentCompany-New/src/main/database/migrations/017-operations-controls.ts b/AgentCompany-New/src/main/database/migrations/017-operations-controls.ts new file mode 100644 index 00000000..9a3f0373 --- /dev/null +++ b/AgentCompany-New/src/main/database/migrations/017-operations-controls.ts @@ -0,0 +1,109 @@ +export const operationsControlsSchema = ` + create table if not exists feature_flags ( + id text primary key, + org_id text not null references organizations(id) on delete cascade, + key text not null, + label text not null, + enabled integer not null check(enabled in (0, 1)), + created_at text not null, + updated_at text not null, + unique(org_id, key) + ); + + create table if not exists slo_targets ( + id text primary key, + org_id text not null references organizations(id) on delete cascade, + signal_key text not null, + label text not null, + target_basis_points integer not null, + window_minutes integer not null, + created_at text not null, + updated_at text not null, + unique(org_id, signal_key) + ); + + create table if not exists operational_events ( + id text primary key, + org_id text not null references organizations(id) on delete cascade, + signal_key text not null, + source text not null, + success integer not null check(success in (0, 1)), + duration_ms integer, + detail_json text not null, + created_at text not null + ); + + create table if not exists chaos_drills ( + id text primary key, + org_id text not null references organizations(id) on delete cascade, + key text not null, + label text not null, + scenario_key text not null, + enabled integer not null check(enabled in (0, 1)), + created_at text not null, + updated_at text not null, + unique(org_id, key) + ); + + create table if not exists chaos_drill_runs ( + id text primary key, + org_id text not null references organizations(id) on delete cascade, + drill_id text not null references chaos_drills(id) on delete cascade, + state text not null, + result_json text not null, + started_at text not null, + completed_at text not null + ); + + create index if not exists idx_operational_events_org_signal_created + on operational_events(org_id, signal_key, created_at); + + create index if not exists idx_chaos_drill_runs_org_drill_started + on chaos_drill_runs(org_id, drill_id, started_at); + + insert into feature_flags(id, org_id, key, label, enabled, created_at, updated_at) + select 'ffg_' || lower(hex(randomblob(16))), organizations.id, seed.key, seed.label, seed.enabled, datetime('now'), datetime('now') + from organizations + cross join ( + select 'provider_background_execution' as key, 'Provider background execution' as label, 1 as enabled + union all select 'social_publish_approval', 'Social publish approval', 1 + union all select 'board_intervention', 'Board intervention', 1 + union all select 'chaos_drills', 'Chaos drills', 1 + ) seed + where not exists ( + select 1 from feature_flags + where feature_flags.org_id = organizations.id and feature_flags.key = seed.key + ); + + insert into slo_targets(id, org_id, signal_key, label, target_basis_points, window_minutes, created_at, updated_at) + select 'slo_' || lower(hex(randomblob(16))), organizations.id, seed.signal_key, seed.label, seed.target_basis_points, seed.window_minutes, datetime('now'), datetime('now') + from organizations + cross join ( + select 'provider_request_success' as signal_key, 'Provider requests' as label, 9950 as target_basis_points, 43200 as window_minutes + union all select 'approval_route_coverage', 'Approval routing', 10000, 43200 + union all select 'browser_session_boundary', 'Browser session boundary', 10000, 43200 + union all select 'skill_resolve_success', 'Skill resolve', 9950, 43200 + union all select 'migration_validation_success', 'Migration validation', 10000, 43200 + ) seed + where not exists ( + select 1 from slo_targets + where slo_targets.org_id = organizations.id and slo_targets.signal_key = seed.signal_key + ); + + insert into chaos_drills(id, org_id, key, label, scenario_key, enabled, created_at, updated_at) + select 'cdr_' || lower(hex(randomblob(16))), organizations.id, seed.key, seed.label, seed.scenario_key, 1, datetime('now'), datetime('now') + from organizations + cross join ( + select 'provider-outage-policy' as key, 'Provider outage policy' as label, 'provider_outage_policy_gate' as scenario_key + union all select 'approval-backlog-routing', 'Approval backlog routing', 'approval_backlog_gate' + union all select 'browser-session-boundary', 'Browser session boundary', 'browser_session_boundary' + union all select 'migration-rollback-pack', 'Migration rollback pack', 'migration_rollback_pack' + ) seed + where not exists ( + select 1 from chaos_drills + where chaos_drills.org_id = organizations.id and chaos_drills.key = seed.key + ); + + insert into schema_migrations(version, name, applied_at) + values (17, 'operations_controls', datetime('now')); +`; diff --git a/AgentCompany-New/src/main/database/schema.ts b/AgentCompany-New/src/main/database/schema.ts index 950bd8e5..45408b68 100644 --- a/AgentCompany-New/src/main/database/schema.ts +++ b/AgentCompany-New/src/main/database/schema.ts @@ -15,6 +15,7 @@ import { searchDocumentsSchema } from "./migrations/013-search-documents"; import { providerPolicyUsageSchema } from "./migrations/014-provider-policy-usage"; import { identityAccessSchema } from "./migrations/015-identity-access"; import { orgGovernanceSchema } from "./migrations/016-org-governance"; +import { operationsControlsSchema } from "./migrations/017-operations-controls"; interface Migration { version: number; @@ -39,6 +40,7 @@ const MIGRATIONS: Migration[] = [ { version: 14, name: "provider_policy_usage", sql: providerPolicyUsageSchema }, { version: 15, name: "identity_access", sql: identityAccessSchema }, { version: 16, name: "org_governance", sql: orgGovernanceSchema }, + { version: 17, name: "operations_controls", sql: operationsControlsSchema }, ]; const SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version; diff --git a/AgentCompany-New/src/main/services/migration-service.ts b/AgentCompany-New/src/main/services/migration-service.ts index e84d7824..ffa52683 100644 --- a/AgentCompany-New/src/main/services/migration-service.ts +++ b/AgentCompany-New/src/main/services/migration-service.ts @@ -3,8 +3,10 @@ import { createHash } from "node:crypto"; import { resolve } from "node:path"; import { DatabaseSync, type StatementSync } from "node:sqlite"; import type { CreateMigrationReportInput } from "../../shared/commands"; +import { SLO_SIGNAL_KEY } from "../../shared/domain"; import { createId } from "../../shared/ids"; import { AuditService } from "./audit-service"; +import { OperationsService } from "./operations-service"; const LEGACY_TABLES = [ "organizations", @@ -24,6 +26,11 @@ const LEGACY_TABLES = [ "approvals", "approval_routing_rules", "approval_assignments", + "feature_flags", + "slo_targets", + "operational_events", + "chaos_drills", + "chaos_drill_runs", "chat_spaces", "chat_messages", "chat_threads", @@ -129,6 +136,12 @@ const RELATION_CHECKS: RelationCheck[] = [ { table: "approval_assignments", column: "org_id", referencedTable: "organizations", referencedColumn: "id", reason: "dangling_org_id" }, { table: "approval_assignments", column: "approval_id", referencedTable: "approvals", referencedColumn: "id", reason: "dangling_approval_id" }, { table: "approval_assignments", column: "routing_rule_id", referencedTable: "approval_routing_rules", referencedColumn: "id", reason: "dangling_routing_rule_id" }, + { table: "feature_flags", column: "org_id", referencedTable: "organizations", referencedColumn: "id", reason: "dangling_org_id" }, + { table: "slo_targets", column: "org_id", referencedTable: "organizations", referencedColumn: "id", reason: "dangling_org_id" }, + { table: "operational_events", column: "org_id", referencedTable: "organizations", referencedColumn: "id", reason: "dangling_org_id" }, + { table: "chaos_drills", column: "org_id", referencedTable: "organizations", referencedColumn: "id", reason: "dangling_org_id" }, + { table: "chaos_drill_runs", column: "org_id", referencedTable: "organizations", referencedColumn: "id", reason: "dangling_org_id" }, + { table: "chaos_drill_runs", column: "drill_id", referencedTable: "chaos_drills", referencedColumn: "id", reason: "dangling_drill_id" }, { table: "chat_spaces", column: "org_id", referencedTable: "organizations", referencedColumn: "id", reason: "dangling_org_id" }, { table: "chat_messages", column: "org_id", referencedTable: "organizations", referencedColumn: "id", reason: "dangling_org_id" }, { table: "chat_messages", column: "space_id", referencedTable: "chat_spaces", referencedColumn: "id", reason: "dangling_space_id" }, @@ -199,9 +212,11 @@ const RELATION_CHECKS: RelationCheck[] = [ export class MigrationService { private readonly audit: AuditService; + private readonly operations: OperationsService; constructor(private readonly db: DatabaseSync) { this.audit = new AuditService(db); + this.operations = new OperationsService(db); } createReport(input: CreateMigrationReportInput): string { @@ -270,6 +285,14 @@ export class MigrationService { action: "created", payload: { sourceRef: sourceDatabasePath, tableCount: Object.keys(tableCounts).length, sourceFingerprint }, }); + this.operations.recordSignal({ + orgId: input.orgId, + signalKey: SLO_SIGNAL_KEY.MIGRATION_VALIDATION_SUCCESS, + source: "migration_validation", + success: failures.length === 0, + durationMs: null, + detail: { reportId, sourceFingerprint, failureCount: failures.length }, + }); return reportId; } finally { source.close(); diff --git a/AgentCompany-New/src/main/services/operations-service.ts b/AgentCompany-New/src/main/services/operations-service.ts new file mode 100644 index 00000000..be3da6b6 --- /dev/null +++ b/AgentCompany-New/src/main/services/operations-service.ts @@ -0,0 +1,233 @@ +import type { DatabaseSync } from "node:sqlite"; +import type { RunChaosDrillInput, SetFeatureFlagInput } from "../../shared/commands"; +import { + CHAOS_DRILL_SCENARIO, + CHAOS_DRILL_STATE, + FEATURE_FLAG_KEY, + SLO_SIGNAL_KEY, + type ChaosDrillScenario, + type FeatureFlagKey, + type SloSignalKey, +} from "../../shared/domain"; +import { createId } from "../../shared/ids"; +import { AuditService } from "./audit-service"; + +const FEATURE_FLAGS = [ + { key: FEATURE_FLAG_KEY.PROVIDER_BACKGROUND_EXECUTION, label: "Provider background execution", enabled: true }, + { key: FEATURE_FLAG_KEY.SOCIAL_PUBLISH_APPROVAL, label: "Social publish approval", enabled: true }, + { key: FEATURE_FLAG_KEY.BOARD_INTERVENTION, label: "Board intervention", enabled: true }, + { key: FEATURE_FLAG_KEY.CHAOS_DRILLS, label: "Chaos drills", enabled: true }, +] as const; + +const SLO_TARGETS = [ + { signalKey: SLO_SIGNAL_KEY.PROVIDER_REQUEST_SUCCESS, label: "Provider requests", targetBasisPoints: 9950, windowMinutes: 43200 }, + { signalKey: SLO_SIGNAL_KEY.APPROVAL_ROUTE_COVERAGE, label: "Approval routing", targetBasisPoints: 10000, windowMinutes: 43200 }, + { signalKey: SLO_SIGNAL_KEY.BROWSER_SESSION_BOUNDARY, label: "Browser session boundary", targetBasisPoints: 10000, windowMinutes: 43200 }, + { signalKey: SLO_SIGNAL_KEY.SKILL_RESOLVE_SUCCESS, label: "Skill resolve", targetBasisPoints: 9950, windowMinutes: 43200 }, + { signalKey: SLO_SIGNAL_KEY.MIGRATION_VALIDATION_SUCCESS, label: "Migration validation", targetBasisPoints: 10000, windowMinutes: 43200 }, +] as const; + +const CHAOS_DRILLS = [ + { key: "provider-outage-policy", label: "Provider outage policy", scenarioKey: CHAOS_DRILL_SCENARIO.PROVIDER_OUTAGE_POLICY_GATE }, + { key: "approval-backlog-routing", label: "Approval backlog routing", scenarioKey: CHAOS_DRILL_SCENARIO.APPROVAL_BACKLOG_GATE }, + { key: "browser-session-boundary", label: "Browser session boundary", scenarioKey: CHAOS_DRILL_SCENARIO.BROWSER_SESSION_BOUNDARY }, + { key: "migration-rollback-pack", label: "Migration rollback pack", scenarioKey: CHAOS_DRILL_SCENARIO.MIGRATION_ROLLBACK_PACK }, +] as const; + +interface DrillOutcome { + success: boolean; + checks: Record; +} + +interface ChaosDrillRow { + id: string; + scenario_key: ChaosDrillScenario; + enabled: number; +} + +export class OperationsService { + private readonly audit: AuditService; + + constructor(private readonly db: DatabaseSync) { + this.audit = new AuditService(db); + } + + seedOrganizationOperations(orgId: string, now: string): void { + for (const flag of FEATURE_FLAGS) { + this.db.prepare(` + insert into feature_flags(id, org_id, key, label, enabled, created_at, updated_at) + values (?, ?, ?, ?, ?, ?, ?) + on conflict(org_id, key) do nothing + `).run(createId("ffg"), orgId, flag.key, flag.label, flag.enabled ? 1 : 0, now, now); + } + for (const target of SLO_TARGETS) { + this.db.prepare(` + insert into slo_targets(id, org_id, signal_key, label, target_basis_points, window_minutes, created_at, updated_at) + values (?, ?, ?, ?, ?, ?, ?, ?) + on conflict(org_id, signal_key) do nothing + `).run(createId("slo"), orgId, target.signalKey, target.label, target.targetBasisPoints, target.windowMinutes, now, now); + } + for (const drill of CHAOS_DRILLS) { + this.db.prepare(` + insert into chaos_drills(id, org_id, key, label, scenario_key, enabled, created_at, updated_at) + values (?, ?, ?, ?, ?, 1, ?, ?) + on conflict(org_id, key) do nothing + `).run(createId("cdr"), orgId, drill.key, drill.label, drill.scenarioKey, now, now); + } + } + + setFeatureFlag(input: SetFeatureFlagInput): void { + const flag = this.db.prepare("select key from feature_flags where id = ? and org_id = ?") + .get(input.flagId, input.orgId) as { key: FeatureFlagKey } | undefined; + if (!flag) throw new Error("Feature flag was not found."); + const now = new Date().toISOString(); + const result = this.db.prepare("update feature_flags set enabled = ?, updated_at = ? where id = ? and org_id = ?") + .run(input.enabled ? 1 : 0, now, input.flagId, input.orgId); + if (result.changes === 0) throw new Error("Feature flag was not found."); + this.audit.record({ + orgId: input.orgId, + entityType: "feature_flag", + entityId: input.flagId, + actorType: "system", + actorId: null, + action: "updated", + payload: { key: flag.key, enabled: input.enabled }, + }); + } + + runChaosDrill(input: RunChaosDrillInput): string { + if (!this.isFeatureEnabled(input.orgId, FEATURE_FLAG_KEY.CHAOS_DRILLS)) throw new Error("Chaos drills are disabled."); + const drill = this.db.prepare("select id, scenario_key, enabled from chaos_drills where id = ? and org_id = ?") + .get(input.drillId, input.orgId) as ChaosDrillRow | undefined; + if (!drill) throw new Error("Chaos drill was not found."); + if (drill.enabled !== 1) throw new Error("Chaos drill is disabled."); + const startedAt = new Date().toISOString(); + const outcome = this.evaluateScenario(input.orgId, drill.scenario_key); + const runId = createId("cdrun"); + const completedAt = new Date().toISOString(); + this.db.prepare(` + insert into chaos_drill_runs(id, org_id, drill_id, state, result_json, started_at, completed_at) + values (?, ?, ?, ?, ?, ?, ?) + `).run( + runId, + input.orgId, + input.drillId, + outcome.success ? CHAOS_DRILL_STATE.PASSED : CHAOS_DRILL_STATE.FAILED, + JSON.stringify(outcome.checks), + startedAt, + completedAt, + ); + this.recordSignal({ + orgId: input.orgId, + signalKey: this.signalForScenario(drill.scenario_key), + source: "chaos_drill", + success: outcome.success, + durationMs: new Date(completedAt).getTime() - new Date(startedAt).getTime(), + detail: { drillId: input.drillId, scenarioKey: drill.scenario_key }, + }); + this.audit.record({ + orgId: input.orgId, + entityType: "chaos_drill", + entityId: input.drillId, + actorType: "system", + actorId: null, + action: "run", + payload: { runId, state: outcome.success ? CHAOS_DRILL_STATE.PASSED : CHAOS_DRILL_STATE.FAILED }, + }); + return runId; + } + + isFeatureEnabled(orgId: string, key: FeatureFlagKey): boolean { + const row = this.db.prepare("select enabled from feature_flags where org_id = ? and key = ?") + .get(orgId, key) as { enabled: number } | undefined; + if (!row) throw new Error("Feature flag is required."); + return row.enabled === 1; + } + + recordSignal(input: { + orgId: string; + signalKey: SloSignalKey; + source: string; + success: boolean; + durationMs: number | null; + detail: unknown; + }): void { + this.db.prepare(` + insert into operational_events(id, org_id, signal_key, source, success, duration_ms, detail_json, created_at) + values (?, ?, ?, ?, ?, ?, ?, ?) + `).run( + createId("ope"), + input.orgId, + input.signalKey, + input.source, + input.success ? 1 : 0, + input.durationMs, + JSON.stringify(input.detail), + new Date().toISOString(), + ); + } + + private evaluateScenario(orgId: string, scenario: ChaosDrillScenario): DrillOutcome { + if (scenario === CHAOS_DRILL_SCENARIO.PROVIDER_OUTAGE_POLICY_GATE) return this.providerOutagePolicyGate(orgId); + if (scenario === CHAOS_DRILL_SCENARIO.APPROVAL_BACKLOG_GATE) return this.approvalBacklogGate(orgId); + if (scenario === CHAOS_DRILL_SCENARIO.BROWSER_SESSION_BOUNDARY) return this.browserSessionBoundary(orgId); + if (scenario === CHAOS_DRILL_SCENARIO.MIGRATION_ROLLBACK_PACK) return this.migrationRollbackPack(orgId); + throw new Error("Chaos drill scenario is invalid."); + } + + private providerOutagePolicyGate(orgId: string): DrillOutcome { + const total = count(this.db, "select count(*) as count from providers where org_id = ?", orgId); + const policyConflicts = count(this.db, ` + select count(*) as count + from providers + where org_id = ? and data_policy = 'zero_data_retention' and background_enabled = 1 + `, orgId); + const invalidLimits = count(this.db, "select count(*) as count from providers where org_id = ? and monthly_request_limit < 1", orgId); + return { + success: total > 0 && policyConflicts === 0 && invalidLimits === 0, + checks: { providers: total, policyConflicts, invalidLimits }, + }; + } + + private approvalBacklogGate(orgId: string): DrillOutcome { + const routes = count(this.db, "select count(*) as count from approval_routing_rules where org_id = ?", orgId); + const unassigned = count(this.db, ` + select count(*) as count + from approvals + where org_id = ? and id not in ( + select approval_id from approval_assignments where org_id = ? + ) + `, orgId, orgId); + return { success: routes > 0 && unassigned === 0, checks: { routes, unassignedApprovals: unassigned } }; + } + + private browserSessionBoundary(orgId: string): DrillOutcome { + const accounts = count(this.db, "select count(*) as count from social_accounts where org_id = ?", orgId); + const grants = count(this.db, "select count(*) as count from social_account_grants where org_id = ?", orgId); + const actions = count(this.db, "select count(*) as count from browser_actions where org_id = ?", orgId); + return { success: grants >= accounts, checks: { accounts, grants, actions } }; + } + + private migrationRollbackPack(orgId: string): DrillOutcome { + const reports = this.db.prepare("select report_json from migration_reports where org_id = ?").all(orgId) as Array<{ report_json: string }>; + const complete = reports.filter((report) => hasRollbackPack(report.report_json)).length; + return { success: reports.length === complete, checks: { reports: reports.length, rollbackPacks: complete } }; + } + + private signalForScenario(scenario: ChaosDrillScenario): SloSignalKey { + if (scenario === CHAOS_DRILL_SCENARIO.PROVIDER_OUTAGE_POLICY_GATE) return SLO_SIGNAL_KEY.PROVIDER_REQUEST_SUCCESS; + if (scenario === CHAOS_DRILL_SCENARIO.APPROVAL_BACKLOG_GATE) return SLO_SIGNAL_KEY.APPROVAL_ROUTE_COVERAGE; + if (scenario === CHAOS_DRILL_SCENARIO.BROWSER_SESSION_BOUNDARY) return SLO_SIGNAL_KEY.BROWSER_SESSION_BOUNDARY; + if (scenario === CHAOS_DRILL_SCENARIO.MIGRATION_ROLLBACK_PACK) return SLO_SIGNAL_KEY.MIGRATION_VALIDATION_SUCCESS; + throw new Error("Chaos drill scenario is invalid."); + } +} + +function count(db: DatabaseSync, sql: string, ...params: string[]): number { + return (db.prepare(sql).get(...params) as { count: number }).count; +} + +function hasRollbackPack(reportJson: string): boolean { + const parsed = JSON.parse(reportJson) as { rollbackPack?: unknown }; + return typeof parsed.rollbackPack === "object" && parsed.rollbackPack !== null; +} diff --git a/AgentCompany-New/src/main/services/org-governance-service.ts b/AgentCompany-New/src/main/services/org-governance-service.ts index fd4562d7..84198b1a 100644 --- a/AgentCompany-New/src/main/services/org-governance-service.ts +++ b/AgentCompany-New/src/main/services/org-governance-service.ts @@ -1,17 +1,20 @@ import type { DatabaseSync } from "node:sqlite"; import type { CreateAgentInput } from "../../shared/commands"; -import { RISK_LEVEL, ROUTE_TO_TYPE, type RiskLevel } from "../../shared/domain"; +import { RISK_LEVEL, ROUTE_TO_TYPE, SLO_SIGNAL_KEY, type RiskLevel } from "../../shared/domain"; import { createId } from "../../shared/ids"; import { AuditService } from "./audit-service"; +import { OperationsService } from "./operations-service"; const DEFAULT_DEPARTMENTS = ["Executive", "Engineering", "Product", "Design", "Marketing", "Operations", "Support"] as const; const RISK_RANK: Record = { low: 0, medium: 1, high: 2 }; export class OrgGovernanceService { private readonly audit: AuditService; + private readonly operations: OperationsService; constructor(private readonly db: DatabaseSync) { this.audit = new AuditService(db); + this.operations = new OperationsService(db); } seedOrganizationGovernance(orgId: string, boardEmployeeId: string, now: string): void { @@ -61,6 +64,14 @@ export class OrgGovernanceService { action: "routed", payload: { routingRuleId: rule.id, routeToType: rule.route_to_type, routeToId: rule.route_to_id }, }); + this.operations.recordSignal({ + orgId: input.orgId, + signalKey: SLO_SIGNAL_KEY.APPROVAL_ROUTE_COVERAGE, + source: "approval_routing", + success: true, + durationMs: null, + detail: { approvalId: input.approvalId, routingRuleId: rule.id }, + }); } private seedDepartmentPolicy(orgId: string, departmentName: string, now: string): void { diff --git a/AgentCompany-New/src/main/services/organization-service.ts b/AgentCompany-New/src/main/services/organization-service.ts index 8b57bce0..6b3b4598 100644 --- a/AgentCompany-New/src/main/services/organization-service.ts +++ b/AgentCompany-New/src/main/services/organization-service.ts @@ -7,6 +7,7 @@ import { AuditService } from "./audit-service"; import { PolicyService } from "./policy-service"; import { IdentityAccessService } from "./identity-access-service"; import { OrgGovernanceService } from "./org-governance-service"; +import { OperationsService } from "./operations-service"; import { assertUsableMentionName } from "./mention-handles"; export class OrganizationService { @@ -14,12 +15,14 @@ export class OrganizationService { private readonly policy: PolicyService; private readonly identityAccess: IdentityAccessService; private readonly governance: OrgGovernanceService; + private readonly operations: OperationsService; constructor(private readonly db: DatabaseSync) { this.audit = new AuditService(db); this.policy = new PolicyService(db); this.identityAccess = new IdentityAccessService(db); this.governance = new OrgGovernanceService(db); + this.operations = new OperationsService(db); } createOrganization(input: CreateOrganizationInput): string { @@ -48,6 +51,7 @@ export class OrganizationService { .run(employeeId, orgId, input.employeeName.trim(), "Board Chair", now); this.identityAccess.seedEmployeeAccess(orgId, employeeId, now); this.governance.seedOrganizationGovernance(orgId, employeeId, now); + this.operations.seedOrganizationOperations(orgId, now); for (const space of [ ["company", "general", "Company coordination", "workspace"], diff --git a/AgentCompany-New/src/main/services/provider-service.ts b/AgentCompany-New/src/main/services/provider-service.ts index ba82d91c..4d9c08ac 100644 --- a/AgentCompany-New/src/main/services/provider-service.ts +++ b/AgentCompany-New/src/main/services/provider-service.ts @@ -2,10 +2,11 @@ import type { DatabaseSync } from "node:sqlite"; import { createHash } from "node:crypto"; import { BrowserWindow, session } from "electron"; import type { CreateProviderResponseInput, SaveProviderCredentialInput, UpdateProviderPolicyInput } from "../../shared/commands"; -import { PROVIDER_AUTH_TYPE, PROVIDER_DATA_POLICY, PROVIDER_EXECUTION_MODE, PROVIDER_REQUEST_STATE, type ProviderExecutionMode } from "../../shared/domain"; +import { FEATURE_FLAG_KEY, PROVIDER_AUTH_TYPE, PROVIDER_DATA_POLICY, PROVIDER_EXECUTION_MODE, PROVIDER_REQUEST_STATE, SLO_SIGNAL_KEY, type ProviderExecutionMode } from "../../shared/domain"; import { PROVIDER_CATALOG } from "../../shared/provider-catalog"; import { createId } from "../../shared/ids"; import { AuditService } from "./audit-service"; +import { OperationsService } from "./operations-service"; import { SecretVault } from "./secret-vault"; import { providerAdapters, type ProviderAdapterRegistry } from "./provider-adapters"; @@ -23,6 +24,7 @@ function displayHint(secret: string): string { export class ProviderService { private readonly audit: AuditService; + private readonly operations: OperationsService; constructor( private readonly db: DatabaseSync, @@ -30,6 +32,7 @@ export class ProviderService { private readonly vault: SecretVault = new SecretVault(), ) { this.audit = new AuditService(db); + this.operations = new OperationsService(db); } saveCredential(input: SaveProviderCredentialInput): void { @@ -187,6 +190,7 @@ export class ProviderService { const requestId = createId("preq"); const now = new Date().toISOString(); + const startedAt = Date.now(); this.db.prepare(` insert into provider_requests( id, org_id, provider_id, provider_key, model, prompt_sha256, @@ -232,6 +236,14 @@ export class ProviderService { action: "response_created", payload: { providerKey: provider.provider_key, model: provider.model }, }); + this.operations.recordSignal({ + orgId: input.orgId, + signalKey: SLO_SIGNAL_KEY.PROVIDER_REQUEST_SUCCESS, + source: "provider_gateway", + success: true, + durationMs: Date.now() - startedAt, + detail: { requestId, providerKey: provider.provider_key, executionMode }, + }); } catch (error) { const message = error instanceof Error ? error.message : String(error); this.db.prepare(` @@ -241,6 +253,14 @@ export class ProviderService { `).run(PROVIDER_REQUEST_STATE.FAILED, message, new Date().toISOString(), requestId, input.orgId); this.recordUsage(input.orgId, provider.id, prompt.length, 0); this.recordProviderHealth(provider.id, input.orgId, HEALTH_STATE_FAILED, message); + this.operations.recordSignal({ + orgId: input.orgId, + signalKey: SLO_SIGNAL_KEY.PROVIDER_REQUEST_SUCCESS, + source: "provider_gateway", + success: false, + durationMs: Date.now() - startedAt, + detail: { requestId, providerKey: provider.provider_key, executionMode }, + }); throw error; } } @@ -250,6 +270,9 @@ export class ProviderService { if (executionMode === PROVIDER_EXECUTION_MODE.BACKGROUND && provider.data_policy === PROVIDER_DATA_POLICY.ZERO_DATA_RETENTION) { throw new Error("Background execution conflicts with zero data retention policy."); } + if (executionMode === PROVIDER_EXECUTION_MODE.BACKGROUND && !this.operations.isFeatureEnabled(orgId, FEATURE_FLAG_KEY.PROVIDER_BACKGROUND_EXECUTION)) { + throw new Error("Provider background execution is disabled by feature flag."); + } if (executionMode === PROVIDER_EXECUTION_MODE.BACKGROUND && provider.background_enabled !== 1) { throw new Error("Background execution is disabled for this provider policy."); } diff --git a/AgentCompany-New/src/main/services/skill-service.ts b/AgentCompany-New/src/main/services/skill-service.ts index 16b1648a..2d24019e 100644 --- a/AgentCompany-New/src/main/services/skill-service.ts +++ b/AgentCompany-New/src/main/services/skill-service.ts @@ -1,8 +1,10 @@ import { existsSync, readFileSync } from "node:fs"; import type { DatabaseSync } from "node:sqlite"; import type { BindSkillInput, ImportSkillDirectoryInput, ResolveAgentSkillsInput } from "../../shared/commands"; +import { SLO_SIGNAL_KEY } from "../../shared/domain"; import { createId } from "../../shared/ids"; import { AuditService } from "./audit-service"; +import { OperationsService } from "./operations-service"; import { copySkillRevision, recursiveSkillChecksum } from "./skill-artifacts"; import { loadSkillManifest, type SkillManifest } from "./skill-manifest"; @@ -12,9 +14,11 @@ function slugify(value: string): string { export class SkillService { private readonly audit: AuditService; + private readonly operations: OperationsService; constructor(private readonly db: DatabaseSync, private readonly artifactRoot: string) { this.audit = new AuditService(db); + this.operations = new OperationsService(db); } importDirectory(input: ImportSkillDirectoryInput): string { @@ -166,6 +170,14 @@ export class SkillService { action: "resolved", payload: { agentId: input.agentId, runId: input.runId, revisionIds }, }); + this.operations.recordSignal({ + orgId: input.orgId, + signalKey: SLO_SIGNAL_KEY.SKILL_RESOLVE_SUCCESS, + source: "skill_resolver", + success: true, + durationMs: null, + detail: { agentId: input.agentId, runId: input.runId, revisionIds }, + }); return snapshotId; } diff --git a/AgentCompany-New/src/main/services/snapshot-service.ts b/AgentCompany-New/src/main/services/snapshot-service.ts index e50a07e9..204ed586 100644 --- a/AgentCompany-New/src/main/services/snapshot-service.ts +++ b/AgentCompany-New/src/main/services/snapshot-service.ts @@ -53,6 +53,12 @@ export class SnapshotService { .map((freeze) => ({ ...freeze, active: toBool(freeze.active) })); const employeeIdentities = list(this.db, "employee_identities", "created_at desc") .map((identity) => ({ ...identity, active: toBool(identity.active) })); + const featureFlags = list(this.db, "feature_flags", "key asc") + .map((flag) => ({ ...flag, enabled: toBool(flag.enabled) })); + const operationalEvents = list(this.db, "operational_events", "created_at desc") + .map((event) => ({ ...event, success: toBool(event.success) })); + const chaosDrills = list(this.db, "chaos_drills", "key asc") + .map((drill) => ({ ...drill, enabled: toBool(drill.enabled) })); return { activeOrgId, @@ -100,6 +106,11 @@ export class SnapshotService { hiringPolicies: list(this.db, "hiring_policies", "department_name asc"), approvalRoutingRules: list(this.db, "approval_routing_rules", "created_at asc"), approvalAssignments: list(this.db, "approval_assignments", "created_at desc"), + featureFlags, + sloTargets: list(this.db, "slo_targets", "signal_key asc"), + operationalEvents, + chaosDrills, + chaosDrillRuns: list(this.db, "chaos_drill_runs", "started_at desc"), auditEvents: list(this.db, "audit_events", "created_at desc").slice(0, 200), }; } diff --git a/AgentCompany-New/src/preload/index.ts b/AgentCompany-New/src/preload/index.ts index d2ff349b..c8b1655b 100644 --- a/AgentCompany-New/src/preload/index.ts +++ b/AgentCompany-New/src/preload/index.ts @@ -38,6 +38,8 @@ const api: DesktopApi = { importFile: (input) => invoke(IPC_CHANNELS.importFile, input), setFilePinned: (input) => invoke(IPC_CHANNELS.setFilePinned, input), createMigrationReport: (input) => invoke(IPC_CHANNELS.createMigrationReport, input), + setFeatureFlag: (input) => invoke(IPC_CHANNELS.setFeatureFlag, input), + runChaosDrill: (input) => invoke(IPC_CHANNELS.runChaosDrill, input), createComplianceExport: (input) => invoke(IPC_CHANNELS.createComplianceExport, input), createLegalHold: (input) => invoke(IPC_CHANNELS.createLegalHold, input), setLegalHoldState: (input) => invoke(IPC_CHANNELS.setLegalHoldState, input), diff --git a/AgentCompany-New/src/renderer/src/pages/SettingsPage.tsx b/AgentCompany-New/src/renderer/src/pages/SettingsPage.tsx index d9bebdbe..7f534333 100644 --- a/AgentCompany-New/src/renderer/src/pages/SettingsPage.tsx +++ b/AgentCompany-New/src/renderer/src/pages/SettingsPage.tsx @@ -6,6 +6,7 @@ import { MembersPanel } from "./settings/MembersPanel"; import { BillingPanel } from "./settings/BillingPanel"; import { ModelsPanel } from "./settings/ModelsPanel"; import { PoliciesPanel } from "./settings/PoliciesPanel"; +import { OperationsPanel } from "./settings/OperationsPanel"; import { MigrationPanel } from "./settings/MigrationPanel"; import { CompliancePanel } from "./settings/CompliancePanel"; import { NotificationsPanel, ProfilePanel, SecurityPanel } from "./settings/AccountPanels"; @@ -20,6 +21,7 @@ type SettingsTab = | "providers" | "skills" | "policies" + | "operations" | "compliance" | "migration" | "profile" @@ -41,6 +43,7 @@ const AGENTS_GROUP: NavSpec[] = [ { id: "providers", label: "Providers" }, { id: "skills", label: "Skills" }, { id: "policies", label: "Policies" }, + { id: "operations", label: "Operations" }, { id: "compliance", label: "Compliance" }, { id: "migration", label: "Migration" }, ]; @@ -83,6 +86,11 @@ export function SettingsPage({ snapshot, actions }: PageProps) { const hiringPolicies = useMemo(() => snapshot.hiringPolicies.filter((item) => item.orgId === orgId), [snapshot.hiringPolicies, orgId]); const approvalRoutingRules = useMemo(() => snapshot.approvalRoutingRules.filter((item) => item.orgId === orgId), [snapshot.approvalRoutingRules, orgId]); const approvalAssignments = useMemo(() => snapshot.approvalAssignments.filter((item) => item.orgId === orgId), [snapshot.approvalAssignments, orgId]); + const featureFlags = useMemo(() => snapshot.featureFlags.filter((item) => item.orgId === orgId), [snapshot.featureFlags, orgId]); + const sloTargets = useMemo(() => snapshot.sloTargets.filter((item) => item.orgId === orgId), [snapshot.sloTargets, orgId]); + const operationalEvents = useMemo(() => snapshot.operationalEvents.filter((item) => item.orgId === orgId), [snapshot.operationalEvents, orgId]); + const chaosDrills = useMemo(() => snapshot.chaosDrills.filter((item) => item.orgId === orgId), [snapshot.chaosDrills, orgId]); + const chaosDrillRuns = useMemo(() => snapshot.chaosDrillRuns.filter((item) => item.orgId === orgId), [snapshot.chaosDrillRuns, orgId]); return (
@@ -139,6 +147,17 @@ export function SettingsPage({ snapshot, actions }: PageProps) { approvalAssignments={approvalAssignments} /> )} + {tab === "operations" && ( + + )} {tab === "compliance" && ( +

Operations

+

{featureFlags.length} flags / {sloTargets.length} SLOs / {chaosDrills.length} drills.

+ + + +
+ ); +} + +function FeatureFlagsTable({ + orgId, + flags, + actions, +}: { + orgId: string; + flags: FeatureFlagRecord[]; + actions: SnapshotActions; +}) { + return ( + <> +
Feature flags
+
+
+
Flag
State
Updated
+
+ {flags.map((flag, index) => ( +
+
+
{flag.label}
+
{flag.key}
+
+ +
{formatRelative(flag.updatedAt)}
+
+ ))} +
+ + ); +} + +function SloTable({ + targets, + events, +}: { + targets: SloTargetRecord[]; + events: OperationalEventRecord[]; +}) { + return ( + <> +
SLO targets
+
+
+
Signal
Target
Current
Samples
+
+ {targets.map((target, index) => { + const samples = events.filter((event) => event.signalKey === target.signalKey && withinWindow(event.createdAt, target.windowMinutes)); + const successes = samples.filter((event) => event.success).length; + return ( +
+
+
{target.label}
+
{target.signalKey}
+
+
{formatBasisPoints(target.targetBasisPoints)}
+
0 && currentBasisPoints(successes, samples.length) < target.targetBasisPoints ? "amber" : undefined}>{formatCurrent(successes, samples.length)}
+
{samples.length}
+
+ ); + })} +
+ + ); +} + +function ChaosDrillsTable({ + orgId, + drills, + runs, + actions, +}: { + orgId: string; + drills: ChaosDrillRecord[]; + runs: ChaosDrillRunRecord[]; + actions: SnapshotActions; +}) { + return ( + <> +
Chaos drills
+
+
+
Drill
Last run
Result
Action
+
+ {drills.map((drill, index) => { + const run = runs.find((item) => item.drillId === drill.id) ?? null; + return ( +
+
+
{drill.label}
+
{drill.scenarioKey}
+
+
{run ? formatRelative(run.startedAt) : "0 runs"}
+
{run?.state ?? "Ready"}
+ +
+ ); + })} +
+ + ); +} + +function withinWindow(iso: string, windowMinutes: number): boolean { + const createdAt = new Date(iso).getTime(); + if (Number.isNaN(createdAt)) return false; + return Date.now() - createdAt <= windowMinutes * 60_000; +} + +function currentBasisPoints(successes: number, samples: number): number { + if (samples === 0) return 0; + return Math.round((successes / samples) * 10000); +} + +function formatCurrent(successes: number, samples: number): string { + if (samples === 0) return "0 / 0"; + return formatBasisPoints(currentBasisPoints(successes, samples)); +} + +function formatBasisPoints(value: number): string { + return `${(value / 100).toFixed(value % 100 === 0 ? 0 : 2)}%`; +} diff --git a/AgentCompany-New/src/shared/commands.ts b/AgentCompany-New/src/shared/commands.ts index 94ff9e54..8e7a421b 100644 --- a/AgentCompany-New/src/shared/commands.ts +++ b/AgentCompany-New/src/shared/commands.ts @@ -277,6 +277,17 @@ export interface SetFilePinnedInput { pinned: boolean; } +export interface SetFeatureFlagInput { + orgId: string; + flagId: string; + enabled: boolean; +} + +export interface RunChaosDrillInput { + orgId: string; + drillId: string; +} + export interface BootstrapOnboardingInput { companyName: string; companyDescription: string; diff --git a/AgentCompany-New/src/shared/desktop-api.ts b/AgentCompany-New/src/shared/desktop-api.ts index 51bf9502..63c6b1c8 100644 --- a/AgentCompany-New/src/shared/desktop-api.ts +++ b/AgentCompany-New/src/shared/desktop-api.ts @@ -26,11 +26,13 @@ import type { LaunchProviderSignInInput, LaunchSocialLoginInput, ResolveAgentSkillsInput, + RunChaosDrillInput, SaveProviderCredentialInput, SearchInput, SendMessageInput, SetActiveOrganizationInput, SetFilePinnedInput, + SetFeatureFlagInput, SetLegalHoldStateInput, SetRetentionFreezeStateInput, SetScheduledPostStateInput, @@ -75,6 +77,8 @@ export interface DesktopApi { importFile(input: ImportFileInput): Promise>; setFilePinned(input: SetFilePinnedInput): Promise>; createMigrationReport(input: CreateMigrationReportInput): Promise>; + setFeatureFlag(input: SetFeatureFlagInput): Promise>; + runChaosDrill(input: RunChaosDrillInput): Promise>; createComplianceExport(input: CreateComplianceExportInput): Promise>; createLegalHold(input: CreateLegalHoldInput): Promise>; setLegalHoldState(input: SetLegalHoldStateInput): Promise>; diff --git a/AgentCompany-New/src/shared/domain.ts b/AgentCompany-New/src/shared/domain.ts index 4b8b0020..2366337c 100644 --- a/AgentCompany-New/src/shared/domain.ts +++ b/AgentCompany-New/src/shared/domain.ts @@ -2,11 +2,13 @@ import type { BoardInterventionRecord as BoardInterventionRecordModel, ChatThrea import type { ComplianceExportRecord, LegalHoldRecord, RetentionFreezeRecord } from "./compliance-domain"; import type { AccessDecisionRecord, EmployeeIdentityRecord, RoleGrantRecord, ServiceIdentityRecord } from "./identity-domain"; import type { ApprovalAssignmentRecord, ApprovalRoutingRuleRecord, HiringPolicyRecord, OrgDepartmentRecord } from "./org-governance-domain"; +import type { ChaosDrillRecord, ChaosDrillRunRecord, FeatureFlagRecord, OperationalEventRecord, SloTargetRecord } from "./operations-domain"; import type { ProviderDataPolicy, ProviderExecutionMode } from "./provider-policy-domain"; export { BOARD_INTERVENTION_ACTION, BOARD_INTERVENTION_MODE, CHAT_THREAD_BOARD_STATE, type BoardInterventionAction, type BoardInterventionMode, type BoardInterventionRecord, type ChatThreadBoardState } from "./board-domain"; export { COMPLIANCE_EXPORT_STATE, COMPLIANCE_EXPORT_TYPE, type ComplianceExportRecord, type ComplianceExportState, type ComplianceExportType, type ComplianceSubjectType, type LegalHoldEntityType, type LegalHoldRecord, type RetentionFreezeRecord, type RetentionFreezeScopeType } from "./compliance-domain"; export { ACCESS_DECISION, IDENTITY_SOURCE, ROLE_KEY, type AccessDecision, type AccessDecisionRecord, type EmployeeIdentityRecord, type IdentitySource, type PrincipalType, type RoleGrantRecord, type RoleKey, type ServiceIdentityRecord } from "./identity-domain"; export { ROUTE_TO_TYPE, type ApprovalAssignmentRecord, type ApprovalRoutingRuleRecord, type HiringPolicyRecord, type OrgDepartmentRecord, type RouteToType } from "./org-governance-domain"; +export { CHAOS_DRILL_SCENARIO, CHAOS_DRILL_STATE, FEATURE_FLAG_KEY, SLO_SIGNAL_KEY, type ChaosDrillRecord, type ChaosDrillRunRecord, type ChaosDrillScenario, type ChaosDrillState, type FeatureFlagKey, type FeatureFlagRecord, type OperationalEventRecord, type SloSignalKey, type SloTargetRecord } from "./operations-domain"; export { PROVIDER_DATA_POLICY, PROVIDER_EXECUTION_MODE, type ProviderDataPolicy, type ProviderExecutionMode } from "./provider-policy-domain"; export { SEARCH_ENTITY_TYPES, type SearchEntityType, type SearchResultRecord } from "./search-domain"; export const TASK_STATUS = { BACKLOG: "backlog", IN_PROGRESS: "in_progress", REVIEW: "review", DONE: "done" } as const; @@ -471,5 +473,6 @@ export interface AppSnapshot { complianceExports: ComplianceExportRecord[]; legalHolds: LegalHoldRecord[]; retentionFreezes: RetentionFreezeRecord[]; employeeIdentities: EmployeeIdentityRecord[]; serviceIdentities: ServiceIdentityRecord[]; roleGrants: RoleGrantRecord[]; accessDecisions: AccessDecisionRecord[]; orgDepartments: OrgDepartmentRecord[]; hiringPolicies: HiringPolicyRecord[]; approvalRoutingRules: ApprovalRoutingRuleRecord[]; approvalAssignments: ApprovalAssignmentRecord[]; + featureFlags: FeatureFlagRecord[]; sloTargets: SloTargetRecord[]; operationalEvents: OperationalEventRecord[]; chaosDrills: ChaosDrillRecord[]; chaosDrillRuns: ChaosDrillRunRecord[]; auditEvents: AuditEventRecord[]; } diff --git a/AgentCompany-New/src/shared/ipc.ts b/AgentCompany-New/src/shared/ipc.ts index 6803c1df..d51d3544 100644 --- a/AgentCompany-New/src/shared/ipc.ts +++ b/AgentCompany-New/src/shared/ipc.ts @@ -30,6 +30,8 @@ export const IPC_CHANNELS = { importFile: "agentcompany:import-file", setFilePinned: "agentcompany:set-file-pinned", createMigrationReport: "agentcompany:create-migration-report", + setFeatureFlag: "agentcompany:set-feature-flag", + runChaosDrill: "agentcompany:run-chaos-drill", createComplianceExport: "agentcompany:create-compliance-export", createLegalHold: "agentcompany:create-legal-hold", setLegalHoldState: "agentcompany:set-legal-hold-state", diff --git a/AgentCompany-New/src/shared/operations-domain.ts b/AgentCompany-New/src/shared/operations-domain.ts new file mode 100644 index 00000000..e6c82ee9 --- /dev/null +++ b/AgentCompany-New/src/shared/operations-domain.ts @@ -0,0 +1,50 @@ +type ValueOf = T[keyof T]; + +export const FEATURE_FLAG_KEY = { + PROVIDER_BACKGROUND_EXECUTION: "provider_background_execution", + SOCIAL_PUBLISH_APPROVAL: "social_publish_approval", + BOARD_INTERVENTION: "board_intervention", + CHAOS_DRILLS: "chaos_drills", +} as const; + +export const SLO_SIGNAL_KEY = { + PROVIDER_REQUEST_SUCCESS: "provider_request_success", + APPROVAL_ROUTE_COVERAGE: "approval_route_coverage", + BROWSER_SESSION_BOUNDARY: "browser_session_boundary", + SKILL_RESOLVE_SUCCESS: "skill_resolve_success", + MIGRATION_VALIDATION_SUCCESS: "migration_validation_success", +} as const; + +export const CHAOS_DRILL_SCENARIO = { + PROVIDER_OUTAGE_POLICY_GATE: "provider_outage_policy_gate", + APPROVAL_BACKLOG_GATE: "approval_backlog_gate", + BROWSER_SESSION_BOUNDARY: "browser_session_boundary", + MIGRATION_ROLLBACK_PACK: "migration_rollback_pack", +} as const; + +export const CHAOS_DRILL_STATE = { PASSED: "passed", FAILED: "failed" } as const; + +export type FeatureFlagKey = ValueOf; +export type SloSignalKey = ValueOf; +export type ChaosDrillScenario = ValueOf; +export type ChaosDrillState = ValueOf; + +export interface FeatureFlagRecord { + id: string; orgId: string; key: FeatureFlagKey; label: string; enabled: boolean; createdAt: string; updatedAt: string; +} + +export interface SloTargetRecord { + id: string; orgId: string; signalKey: SloSignalKey; label: string; targetBasisPoints: number; windowMinutes: number; createdAt: string; updatedAt: string; +} + +export interface OperationalEventRecord { + id: string; orgId: string; signalKey: SloSignalKey; source: string; success: boolean; durationMs: number | null; detailJson: string; createdAt: string; +} + +export interface ChaosDrillRecord { + id: string; orgId: string; key: string; label: string; scenarioKey: ChaosDrillScenario; enabled: boolean; createdAt: string; updatedAt: string; +} + +export interface ChaosDrillRunRecord { + id: string; orgId: string; drillId: string; state: ChaosDrillState; resultJson: string; startedAt: string; completedAt: string; +} diff --git a/AgentCompany-New/tests/e2e/desktop.spec.ts b/AgentCompany-New/tests/e2e/desktop.spec.ts index 2696e647..ca2f32b5 100644 --- a/AgentCompany-New/tests/e2e/desktop.spec.ts +++ b/AgentCompany-New/tests/e2e/desktop.spec.ts @@ -47,6 +47,12 @@ test("onboards, hires, and creates work in the Electron shell", async () => { await page.getByRole("button", { name: "Policies" }).click(); await expect(page.getByText("Hiring policies")).toBeVisible(); await expect(page.getByText("Review routing")).toBeVisible(); + await page.getByRole("button", { name: "Operations", exact: true }).click(); + await expect(page.getByText("Feature flags")).toBeVisible(); + await expect(page.getByText("SLO targets")).toBeVisible(); + await expect(page.getByText("Chaos drills").first()).toBeVisible(); + await page.getByRole("button", { name: "Run" }).first().click(); + await expect(page.getByText("passed").first()).toBeVisible(); await page.getByRole("button", { name: "Work", exact: true }).click(); await page.getByRole("button", { name: "New task" }).click(); @@ -128,9 +134,9 @@ async function verifyPagesDoNotOverflow(page: Page): Promise { await page.getByRole("button", { name: nav, exact: true }).click(); await expectPageToFit(page); } - for (const tab of ["Workspace", "Members", "Billing", "Models", "Providers", "Skills", "Policies", "Compliance", "Migration", "Profile", "Notifications", "Security"]) { + for (const tab of ["Workspace", "Members", "Billing", "Models", "Providers", "Skills", "Policies", "Operations", "Compliance", "Migration", "Profile", "Notifications", "Security"]) { await page.getByRole("button", { name: "Settings" }).click(); - await page.getByRole("button", { name: tab }).click(); + await page.getByRole("button", { name: tab, exact: true }).click(); await expectPageToFit(page); } } diff --git a/AgentCompany-New/tests/unit/domain-services.test.ts b/AgentCompany-New/tests/unit/domain-services.test.ts index 7e9bbb6b..e0880584 100644 --- a/AgentCompany-New/tests/unit/domain-services.test.ts +++ b/AgentCompany-New/tests/unit/domain-services.test.ts @@ -23,7 +23,7 @@ describe("domain services", () => { const connection = createConnection(); const rows = connection.db.prepare("select version from schema_migrations order by version asc").all() as Array<{ version: number }>; - expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]); + expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17]); connection.close(); }); @@ -48,6 +48,9 @@ describe("domain services", () => { expect(state.orgDepartments.map((department) => department.name)).toContain("Engineering"); expect(state.hiringPolicies.some((policy) => policy.departmentName === "Engineering")).toBe(true); expect(state.approvalRoutingRules[0]).toMatchObject({ kind: "*", minimumRisk: "low", routeToType: "employee" }); + expect(state.featureFlags.map((flag) => flag.key)).toContain("chaos_drills"); + expect(state.sloTargets.map((target) => target.signalKey)).toContain("provider_request_success"); + expect(state.chaosDrills.map((drill) => drill.scenarioKey)).toContain("approval_backlog_gate"); expect(state.chatSpaces.map((space) => space.name)).toContain("board"); expect(state.policyRules[0]?.action).toBe("task_create"); expect(state.auditEvents[0]?.action).toBe("created"); diff --git a/AgentCompany-New/tests/unit/migration-service.test.ts b/AgentCompany-New/tests/unit/migration-service.test.ts index 91d4211e..ccc72cec 100644 --- a/AgentCompany-New/tests/unit/migration-service.test.ts +++ b/AgentCompany-New/tests/unit/migration-service.test.ts @@ -108,6 +108,11 @@ describe("migration service", () => { create table approvals(id text primary key, org_id text, decided_by_employee_id text); create table approval_routing_rules(id text primary key, org_id text); create table approval_assignments(id text primary key, org_id text, approval_id text, routing_rule_id text); + create table feature_flags(id text primary key, org_id text); + create table slo_targets(id text primary key, org_id text); + create table operational_events(id text primary key, org_id text); + create table chaos_drills(id text primary key, org_id text); + create table chaos_drill_runs(id text primary key, org_id text, drill_id text); create table chat_spaces(id text primary key, org_id text); create table chat_messages(id text primary key, org_id text, space_id text, thread_id text); create table chat_threads(id text primary key, org_id text, space_id text, root_message_id text); @@ -163,6 +168,11 @@ describe("migration service", () => { insert into approvals(id, org_id, decided_by_employee_id) values ('approval-1', 'org-1', 'emp-1'); insert into approval_routing_rules(id, org_id) values ('route-1', 'org-1'); insert into approval_assignments(id, org_id, approval_id, routing_rule_id) values ('assign-1', 'org-1', 'approval-1', 'route-1'); + insert into feature_flags(id, org_id) values ('flag-1', 'org-1'); + insert into slo_targets(id, org_id) values ('slo-1', 'org-1'); + insert into operational_events(id, org_id) values ('op-1', 'org-1'); + insert into chaos_drills(id, org_id) values ('drill-1', 'org-1'); + insert into chaos_drill_runs(id, org_id, drill_id) values ('drill-run-1', 'org-1', 'drill-1'); insert into chat_threads(id, org_id, space_id, root_message_id) values ('thread-1', 'org-1', 'space-1', null); insert into chat_messages(id, org_id, space_id, thread_id) values ('msg-1', 'org-1', 'space-1', 'thread-1'); insert into chat_memberships(space_id, principal_type, principal_id) values ('space-1', 'employee', 'emp-1'); @@ -207,6 +217,8 @@ describe("migration service", () => { expect(body.tableCounts.employee_identities).toBe(1); expect(body.tableCounts.org_departments).toBe(1); expect(body.tableCounts.hiring_policies).toBe(1); + expect(body.tableCounts.feature_flags).toBe(1); + expect(body.tableCounts.chaos_drill_runs).toBe(1); expect(body.tableCounts.role_grants).toBe(1); expect(body.tableCounts.skill_artifacts).toBe(1); expect(body.tableCounts.chat_read_state).toBe(1); @@ -221,6 +233,8 @@ describe("migration service", () => { expect(body.idMaps.service_identities).toEqual(["sid-1"]); expect(body.idMaps.access_decisions).toEqual(["access-1"]); expect(body.idMaps.approval_assignments).toEqual(["assign-1"]); + expect(body.idMaps.operational_events).toEqual(["op-1"]); + expect(body.idMaps.chaos_drill_runs).toEqual(["drill-run-1"]); expect(body.idMaps.board_interventions).toEqual(["bdi-1"]); expect(body.idMaps.retention_freezes).toEqual(["freeze-1"]); expect(body.idMaps.provider_usage_windows).toEqual(["usage-1"]); diff --git a/AgentCompany-New/tests/unit/operations-service.test.ts b/AgentCompany-New/tests/unit/operations-service.test.ts new file mode 100644 index 00000000..dcfeba2c --- /dev/null +++ b/AgentCompany-New/tests/unit/operations-service.test.ts @@ -0,0 +1,124 @@ +import { randomUUID } from "node:crypto"; +import { tmpdir } from "node:os"; +import { join } from "node:path"; +import { describe, expect, test } from "vitest"; +import { DatabaseConnection } from "../../src/main/database/connection"; +import { OperationsService } from "../../src/main/services/operations-service"; +import { OrganizationService } from "../../src/main/services/organization-service"; +import { ProviderService } from "../../src/main/services/provider-service"; +import { providerAdapters, type ProviderAdapterRegistry } from "../../src/main/services/provider-adapters"; +import { SnapshotService } from "../../src/main/services/snapshot-service"; +import { PROVIDER_DATA_POLICY, PROVIDER_EXECUTION_MODE } from "../../src/shared/domain"; + +function createConnection(): DatabaseConnection { + return new DatabaseConnection(join(tmpdir(), `agentcompany-new-operations-${randomUUID()}.db`)); +} + +function createOrganization(organization: OrganizationService): string { + return organization.createOrganization({ + organizationName: "Acme Operations", + employeeName: "Dana Lee", + mission: "Coordinate agents with auditable approvals.", + goal: "Ship a verified control plane.", + }); +} + +function providerId(connection: DatabaseConnection, orgId: string, key: string): string { + return (connection.db.prepare("select id from providers where org_id = ? and provider_key = ?") + .get(orgId, key) as { id: string }).id; +} + +const testVault = { + encryptSecret: (secret: string) => Buffer.from(secret, "utf8"), + decryptSecret: (ciphertext: Buffer) => ciphertext.toString("utf8"), +}; + +describe("operations service", () => { + test("seeds feature flags, SLO targets, and chaos drills for new organizations", () => { + const connection = createConnection(); + const organization = new OrganizationService(connection.db); + const snapshot = new SnapshotService(connection.db); + + connection.transaction(() => { + createOrganization(organization); + }); + + const state = snapshot.load(); + expect(state.featureFlags.map((flag) => flag.key).sort()).toEqual([ + "board_intervention", + "chaos_drills", + "provider_background_execution", + "social_publish_approval", + ]); + expect(state.sloTargets.map((target) => target.signalKey)).toContain("browser_session_boundary"); + expect(state.chaosDrills).toHaveLength(4); + connection.close(); + }); + + test("feature flags gate provider background execution", async () => { + const connection = createConnection(); + const organization = new OrganizationService(connection.db); + const operations = new OperationsService(connection.db); + const adapters: ProviderAdapterRegistry = { + ...providerAdapters, + openai: { + ...providerAdapters.openai, + parseAuthProfile: (secret) => ({ type: "api_key", apiKey: secret.trim() }), + checkHealth: async () => ({ checkedAt: new Date().toISOString() }), + createResponse: async () => ({ text: "accepted", rawResponseJson: "{}" }), + }, + }; + const providers = new ProviderService(connection.db, adapters, testVault); + let orgId = ""; + let openAiProviderId = ""; + let flagId = ""; + + connection.transaction(() => { + orgId = createOrganization(organization); + openAiProviderId = providerId(connection, orgId, "openai"); + flagId = (connection.db.prepare("select id from feature_flags where org_id = ? and key = ?") + .get(orgId, "provider_background_execution") as { id: string }).id; + providers.saveCredential({ orgId, providerId: openAiProviderId, secret: "sk-live-provider", model: "gpt-5.4" }); + providers.updatePolicy({ + orgId, + providerId: openAiProviderId, + dataPolicy: PROVIDER_DATA_POLICY.STANDARD, + backgroundEnabled: true, + monthlyRequestLimit: 10, + workspaceScope: "organization", + }); + operations.setFeatureFlag({ orgId, flagId, enabled: false }); + }); + + await expect(providers.createResponse({ + orgId, + providerId: openAiProviderId, + prompt: "Run background analysis", + instructions: null, + executionMode: PROVIDER_EXECUTION_MODE.BACKGROUND, + })).rejects.toThrow("Provider background execution is disabled by feature flag."); + connection.close(); + }); + + test("runs chaos drills and records operational signals", () => { + const connection = createConnection(); + const organization = new OrganizationService(connection.db); + const operations = new OperationsService(connection.db); + const snapshot = new SnapshotService(connection.db); + let orgId = ""; + let drillId = ""; + + connection.transaction(() => { + orgId = createOrganization(organization); + drillId = (connection.db.prepare("select id from chaos_drills where org_id = ? and scenario_key = ?") + .get(orgId, "approval_backlog_gate") as { id: string }).id; + operations.runChaosDrill({ orgId, drillId }); + }); + + const state = snapshot.load(); + expect(state.chaosDrillRuns[0]).toMatchObject({ orgId, drillId, state: "passed" }); + expect(state.operationalEvents[0]).toMatchObject({ orgId, signalKey: "approval_route_coverage", source: "chaos_drill", success: true }); + expect(state.auditEvents.some((event) => event.entityType === "chaos_drill" && event.action === "run")).toBe(true); + connection.close(); + }); +}); diff --git a/AgentCompany-New/tests/unit/provider-service.test.ts b/AgentCompany-New/tests/unit/provider-service.test.ts index 81cb977d..ffa9a9a5 100644 --- a/AgentCompany-New/tests/unit/provider-service.test.ts +++ b/AgentCompany-New/tests/unit/provider-service.test.ts @@ -118,6 +118,7 @@ describe("provider service", () => { responseText: "api_key:gpt-5.4:Draft board memo", state: "succeeded", }); + expect(state.operationalEvents[0]).toMatchObject({ signalKey: "provider_request_success", source: "provider_gateway", success: true }); expect(state.providers.find((provider) => provider.id === openAiProviderId)?.healthState).toBe("healthy"); connection.close(); });