fix(tasks): claim-promote satisfied conditional tasks

Author: legreffier[bot]

apps/rest-api/e2e/judge-eval-attempt.e2e.test.ts

@@ -150,8 +150,9 @@ describe('judge_eval_attempt duplicate protection', () => {
         });
         return data!;
       },
-      (task) => task.status === 'completed' || task.status === 'failed',
-      { label: `run_eval.complete[${taskId.slice(0, 8)}]`, maxAttempts: 30 },
+      (task) =>
+        task.status === 'completed' && task.acceptedAttemptN === attemptN,
+      { label: `run_eval.accepted[${taskId.slice(0, 8)}]`, maxAttempts: 30 },
     );
   }
 
@@ -213,6 +214,14 @@ describe('judge_eval_attempt duplicate protection', () => {
     expect(prematureClaim.response.status).toBe(409);
 
     await completeRunEval(firstRunTaskId);
+    const halfReadyClaim = await claimTask({
+      client,
+      auth: () => claimer.accessToken,
+      path: { id: judge!.id },
+      body: { leaseTtlSec: 60 },
+    });
+    expect(halfReadyClaim.response.status).toBe(409);
+
     const stillWaiting = await pollUntil(
       async () => {
         const { data } = await getTask({
@@ -228,20 +237,6 @@ describe('judge_eval_attempt duplicate protection', () => {
     expect(stillWaiting.status).toBe('waiting');
 
     await completeRunEval(secondRunTaskId);
-    const queued = await pollUntil(
-      async () => {
-        const { data } = await getTask({
-          client,
-          auth: () => proposer.accessToken,
-          path: { id: judge!.id },
-        });
-        return data!;
-      },
-      (task) => task.status === 'queued',
-      { label: 'conditional judge promoted', maxAttempts: 30 },
-    );
-    expect(queued.status).toBe('queued');
-
     const claimed = await claimTask({
       client,
       auth: () => claimer.accessToken,

apps/rest-api/e2e/legreffier-onboarding.e2e.test.ts

@@ -21,6 +21,7 @@ import {
   getLegreffierOnboardingStatus,
   startLegreffierOnboarding,
 } from '@moltnet/api-client';
+import { cryptoService } from '@moltnet/crypto-service';
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 
 import { createTestHarness, type TestHarness } from './setup.js';
@@ -179,12 +180,13 @@ describe('LeGreffier onboarding', () => {
   describe('happy path (requires SPONSOR_AGENT_ID)', () => {
     it('full onboarding flow: start → callback → installed → completed', async () => {
       // Arrange
+      const keyPair = await cryptoService.generateKeyPair();
       const { data: startData, error: startError } =
         await startLegreffierOnboarding({
           client,
           body: {
-            publicKey: VALID_PUBLIC_KEY,
-            fingerprint: VALID_FINGERPRINT,
+            publicKey: keyPair.publicKey,
+            fingerprint: keyPair.fingerprint,
             agentName: 'e2e-test-bot',
           },
         });

libs/task-service/src/task.service.ts

@@ -438,6 +438,43 @@ export function createTaskService(deps: TaskServiceDeps) {
     );
   }
 
+  async function promoteWaitingTaskIfSatisfied(row: DbTask): Promise<DbTask> {
+    const condition = row.claimCondition as ClaimCondition | null;
+    if (row.status !== 'waiting' || !condition) return row;
+    const tasksById = await loadConditionTaskMap(condition);
+    if (!evaluateClaimConditionFromTasks(condition, tasksById)) return row;
+
+    const proposerId = row.proposedByAgentId ?? row.proposedByHumanId;
+    const proposerNs = row.proposedByAgentId
+      ? KetoNamespace.Agent
+      : KetoNamespace.Human;
+    if (!proposerId) {
+      logger.warn({ taskId: row.id }, 'task.claim.waiting.missing_proposer');
+      return row;
+    }
+
+    const errors = await validateTaskInputAsync(
+      row.taskType,
+      row.input,
+      makeAsyncValidationContext(proposerId, proposerNs, {
+        currentTaskId: row.id,
+      }),
+    );
+    if (errors.length > 0) {
+      logger.warn(
+        { taskId: row.id, errors },
+        'task.claim.waiting.strict_validation_failed',
+      );
+      return row;
+    }
+
+    const [promoted] = await transactionRunner.runInTransaction(
+      () => taskRepository.promoteWaitingTasks([row.id]),
+      { name: 'task.claim.promoteWaiting' },
+    );
+    return promoted ?? row;
+  }
+
   async function tryPromoteSatisfiedWaitingTasks(opts: {
     triggerTaskId?: string;
   }): Promise<void> {
@@ -888,7 +925,23 @@ export function createTaskService(deps: TaskServiceDeps) {
         throw new TaskServiceError('invalid', 'Only agents may claim tasks');
       }
 
-      const row = await taskRepository.findById(taskId);
+      const initialRow = await taskRepository.findById(taskId);
+      if (initialRow?.status === 'waiting') {
+        const canClaimWaiting = await permissionChecker.canClaimTask(
+          taskId,
+          callerId,
+          callerNs,
+        );
+        if (!canClaimWaiting)
+          throw new TaskServiceError(
+            'forbidden',
+            'Not authorized to claim this task',
+          );
+      }
+      const row =
+        initialRow?.status === 'waiting'
+          ? await promoteWaitingTaskIfSatisfied(initialRow)
+          : initialRow;
       if (!row || row.status !== 'queued') {
         throw new TaskServiceError(
           'conflict',