fix(workflows): repo-bound task w/o workflow_ref → coding/new-task-v1, not default/agent-v1

aws-samples#296 (workflow-driven tasks) replaced the task_type→workflow mapping with a
resolution ladder, but left the repo-aware rung ('Phase 4') unwired. Every
task with no explicit workflow_ref — all Slack tasks and all aws-samples#247
orchestration children (neither sets one) — fell through to the platform
default default/agent-v1: the freeform, repo-less agent prompt with NO
git/PR discipline. The agent then improvised (gh api / gh pr create against
an empty local clone), so ensure_pr found no commits and recorded
pr_url=null, screenshot→Linear routing lost its branch signal, and aws-samples#247 A4
stacking broke (children couldn't fetch the unpushed predecessor branch).

Re-wire the missing rung minimally: resolveWorkflowRef takes hasRepo; an
absent ref with a repo present resolves to coding/new-task-v1 (the
disciplined coding workflow — edit locally, commit, push, platform opens
the PR via ensure_pr), matching pre-aws-samples#296 behaviour. Repo-less tasks still
default to default/agent-v1. An explicit workflow_ref always wins. The
single create-task-core call site passes Boolean(body.repo), so both Slack
and orchestration (which create via createTaskCore with repo set) inherit
the fix. Upstream regression — worth an upstream issue too.

Updated workflows + create-task-core tests; the old test asserting
default/agent-v1 for a repo task encoded the regression.

Author: bgagent

cdk/src/handlers/shared/create-task-core.ts

@@ -116,7 +116,11 @@ export async function createTaskCore(
   if (!isValidWorkflowRef(body.workflow_ref)) {
     return errorResponse(400, ErrorCode.VALIDATION_ERROR, 'Invalid workflow_ref. Expected "<domain>/<name>-vN[@<constraint>]".', requestId);
   }
-  const resolvedWorkflow = resolveWorkflowRef(body.workflow_ref);
+  // Pass whether the request carries a repo: a repo-bound task with no
+  // explicit workflow_ref resolves to coding/new-task-v1 (the disciplined
+  // coding workflow), not the repo-less default/agent-v1 (#296 regression —
+  // see resolveWorkflowRef rung 3a).
+  const resolvedWorkflow = resolveWorkflowRef(body.workflow_ref, Boolean(body.repo));
   if (resolvedWorkflow === null) {
     // Distinguish an unknown id from an unsatisfiable @version pin so the caller
     // learns which it is (#296 finding #6 — a bad pin no longer silently runs

cdk/src/handlers/shared/workflows.ts

@@ -180,17 +180,32 @@ export type WorkflowResolutionError = 'unknown_id' | 'unsatisfiable_version';
  * resolution ladder (WORKFLOWS.md §"Replacing task types"):
  *   1. explicit ``workflow_ref`` (id + optional ``@constraint``);
  *   2. (Blueprint default — Phase 4, not yet wired);
- *   3. the platform default ``default/agent-v1``.
+ *   3a. no explicit ref BUT a repo is present ⇒ the coding default
+ *       ``coding/new-task-v1`` (a repo-bound task is a coding task);
+ *   3b. otherwise the repo-less platform default ``default/agent-v1``.
+ *
+ * Rung 3a restores the pre-#296 behaviour: before workflow-driven tasks, a
+ * task with a repo and no explicit type ran as ``new_task`` →
+ * ``coding/new-task-v1`` (edit locally, commit, push, platform opens the PR
+ * via ``ensure_pr``). #296 introduced the resolution ladder but left the
+ * repo-aware rung unwired, so every repo task fell through to
+ * ``default/agent-v1`` — the freeform repo-less agent prompt with no git/PR
+ * discipline — which broke PR-url reporting, screenshot→issue routing, and
+ * #247 stacking (the agent improvised ``gh api``/``gh pr create`` against an
+ * empty local clone). ``hasRepo`` re-wires that rung minimally until the
+ * Blueprint router (Phase 4) lands. Callers WITHOUT an explicit ref pass
+ * whether the request carries a repo.
  *
  * Returns ``null`` when an explicit ref cannot be resolved — either the id is
  * unknown OR an ``@constraint`` pins a version the platform does not ship. The
  * constraint is NO LONGER silently discarded (PR review #296 finding #6): a pin
  * like ``coding/new-task-v1@2.0.0`` fails admission rather than quietly running
  * ``1.0.0``. Use {@link resolveWorkflowRefError} for which case, to craft the 400.
  */
-export function resolveWorkflowRef(ref?: string | null): ResolvedWorkflow | null {
+export function resolveWorkflowRef(ref?: string | null, hasRepo = false): ResolvedWorkflow | null {
   if (ref === undefined || ref === null || ref === '') {
-    const fallback = DESCRIPTORS[DEFAULT_WORKFLOW_ID];
+    const fallbackId = hasRepo ? 'coding/new-task-v1' : DEFAULT_WORKFLOW_ID;
+    const fallback = DESCRIPTORS[fallbackId];
     return { id: fallback.id, version: fallback.version };
   }
   const { id, constraint } = parseWorkflowRef(ref);

cdk/test/handlers/shared/create-task-core.test.ts

@@ -523,16 +523,19 @@ describe('createTaskCore', () => {
     expect(result.statusCode).toBe(201);
   });
 
-  test('resolves the default workflow when workflow_ref is omitted', async () => {
+  test('resolves the coding workflow when workflow_ref is omitted AND a repo is present', async () => {
     const result = await createTaskCore(
       { repo: 'org/repo', task_description: 'Fix the bug' },
       makeContext(),
       'req-default',
     );
     expect(result.statusCode).toBe(201);
     const body = JSON.parse(result.body);
-    // No workflow_ref ⇒ the resolution ladder falls to the platform default.
-    expect(body.data.resolved_workflow).toEqual({ id: 'default/agent-v1', version: '1.0.0' });
+    // No workflow_ref BUT a repo is present ⇒ the repo-aware fallback resolves
+    // to the disciplined coding workflow, not the repo-less default/agent-v1.
+    // (Pre-#296 behaviour; #296 left this rung unwired and every repo task
+    // fell through to default/agent-v1, breaking pr_url/screenshot/stacking.)
+    expect(body.data.resolved_workflow).toEqual({ id: 'coding/new-task-v1', version: '1.0.0' });
   });
 
   test('creates a pr-iteration workflow task with pr_number', async () => {

cdk/test/handlers/shared/workflows.test.ts

@@ -72,10 +72,27 @@ describe('resolveWorkflowRef', () => {
     expect(resolveWorkflowRefError(undefined)).toBeNull();
   });
 
-  test('falls back to the platform default when ref is absent', () => {
+  test('falls back to the repo-less platform default when ref is absent AND no repo', () => {
     expect(resolveWorkflowRef(undefined)).toEqual({ id: DEFAULT_WORKFLOW_ID, version: '1.0.0' });
     expect(resolveWorkflowRef(null)).toEqual({ id: DEFAULT_WORKFLOW_ID, version: '1.0.0' });
     expect(resolveWorkflowRef('')).toEqual({ id: DEFAULT_WORKFLOW_ID, version: '1.0.0' });
+    // explicit hasRepo=false is the same as omitting it
+    expect(resolveWorkflowRef(undefined, false)).toEqual({ id: DEFAULT_WORKFLOW_ID, version: '1.0.0' });
+  });
+
+  test('falls back to coding/new-task-v1 when ref is absent BUT a repo is present (#296 regression fix)', () => {
+    // A repo-bound task with no explicit workflow_ref is a coding task — it must
+    // get the disciplined coding workflow (edit/commit/push, platform ensure_pr),
+    // NOT the freeform repo-less default/agent-v1 that broke pr_url/screenshot/stacking.
+    expect(resolveWorkflowRef(undefined, true)).toEqual({ id: 'coding/new-task-v1', version: '1.0.0' });
+    expect(resolveWorkflowRef(null, true)).toEqual({ id: 'coding/new-task-v1', version: '1.0.0' });
+    expect(resolveWorkflowRef('', true)).toEqual({ id: 'coding/new-task-v1', version: '1.0.0' });
+  });
+
+  test('an EXPLICIT ref is honored regardless of hasRepo (repo-less workflow against a repo)', () => {
+    // hasRepo only steers the absent-ref fallback; an explicit ref always wins.
+    expect(resolveWorkflowRef('default/agent-v1', true)).toEqual({ id: 'default/agent-v1', version: '1.0.0' });
+    expect(resolveWorkflowRef('knowledge/web-research-v1', true)).toEqual({ id: 'knowledge/web-research-v1', version: '1.0.0' });
   });
 
   test('returns null for an unknown but well-formed ref', () => {