chore: bump portfolio pin v0.14.1 → v0.14.2 (protoAgent ≥ 0.77 compat) (#17)

* chore: bump portfolio pin v0.14.1 -> v0.14.2 (two-tier store paths) + verified_against 0.81.0

portfolio v0.14.2 fixes the dashboard 500 on protoAgent >= 0.77 (scope_leaf was
deleted in protoAgent#1481; the plugin's PM data stores now resolve via
instance_paths().store() with a legacy fallback). verified_against trued up to
the 0.81.0 host this pin set is being proven on.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* verify: probe enabled members' GET data routes (page-200 alone missed a dead data layer)

The view probe asserts the PAGE serves 200, but portfolio v0.14.1's page did
serve 200 while every /api/plugins/portfolio/* data route 500'd (the deleted
scope_leaf import) — verify stayed green while the dashboard was dead. Now every
parameterless GET route under an ENABLED member's gated prefix must answer <500.
Carried-but-off members (project_board, agent_browser) are exempt: their data
layers legitimately need runtime state (a bound repo, a browser) the scratch
agent doesn't have.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: mabry1985

protoagent.bundle.yaml

@@ -34,11 +34,11 @@ description: >-
 
 # The core version this exact pin set was last verified against (ADR 0049). The verify
 # workflow checks out this protoAgent ref for the smoke — bump on re-verify.
-verified_against: 0.66.0
+verified_against: 0.81.0
 
 plugins:
   - { id: delegates, builtin: true }                                                  # ACP/A2A spawn spine — ships with protoAgent
-  - { id: portfolio,     url: https://github.com/protoLabsAI/portfolio-plugin,     ref: v0.14.1 }   # orchestrate + spawn teams
+  - { id: portfolio,     url: https://github.com/protoLabsAI/portfolio-plugin,     ref: v0.14.2 }   # orchestrate + spawn teams
   - { id: project_board, url: https://github.com/protoLabsAI/projectBoard-plugin,  ref: v0.24.0 }  # installed-not-enabled: spawned teams' board
   - { id: agent_browser, url: https://github.com/protoLabsAI/agent-browser-plugin, ref: v0.5.1 }   # installed-not-enabled: spawned teams' browser
 

scripts/verify_bundle.py

@@ -2,17 +2,19 @@
 """Verify a bundle's pin set against a protoAgent checkout (ADR 0049).
 
 Installs the bundle (at its pinned refs) into a SCRATCH agent, enables every member,
-loads them through the real plugin loader, and probes every declared console-view
-path over HTTP — the check that catches "the pin predates the view fix" before an
-operator spawns a broken archetype.
+loads them through the real plugin loader, probes every declared console-view path
+over HTTP, and probes the parameterless GET data routes of the members the bundle
+ENABLES — the checks that catch "the pin predates the view fix" and "the page serves
+but the data layer 500s" before an operator spawns a broken archetype.
 
 Run from inside a protoAgent checkout with deps synced (the verify workflow does
 exactly this):
 
     uv run --no-sync python /path/to/bundle/scripts/verify_bundle.py /path/to/bundle
 
 The bundle path must be a git repo (a CI checkout is); the installer clones from it.
-Exit code 0 = every member installed, loaded, and every declared view answered 200.
+Exit code 0 = every member installed, loaded, every declared view answered 200, and
+every enabled member's parameterless GET data route answered < 500.
 """
 
 from __future__ import annotations
@@ -91,12 +93,35 @@ def main(bundle_src: str) -> int:
             if not ok:
                 failures.append(f"{pid}: view {path!r} returned {status}")
 
+    # ── 4. PROBE the data routes of ENABLED members ───────────────────────────────
+    # The page probe alone can't catch a data-layer break: a view page serves 200
+    # while every /api/plugins/<id>/* route 500s (portfolio v0.14.1 importing the
+    # scope_leaf knob protoAgent 0.77 deleted — the dashboard died, verify stayed
+    # green). So every parameterless GET route under an enabled member's gated
+    # prefix must answer < 500. Enabled members only: carried-but-off members
+    # (project_board, agent_browser) legitimately need runtime state (a bound
+    # repo, a browser) this scratch agent doesn't have.
+    from fastapi.routing import APIRoute
+
+    enabled_members = set(summary.get("enabled") or []) & set(members)
+    for route in app.routes:
+        if not isinstance(route, APIRoute) or "GET" not in (route.methods or set()) or "{" in route.path:
+            continue
+        pid = next((p for p in enabled_members if route.path.startswith(f"/api/plugins/{p}/")), None)
+        if pid is None:
+            continue
+        status = client.get(route.path).status_code
+        ok = status < 500
+        print(f"  data {pid} {route.path!r} -> {status}{'' if ok else '  ✗'}")
+        if not ok:
+            failures.append(f"{pid}: data route {route.path!r} returned {status}")
+
     if failures:
         print(f"\nFAIL ({len(failures)}):")
         for f in failures:
             print(f"  - {f}")
         return 1
-    print(f"\nOK — {len(members)} member(s) installed+loaded, all declared views serve 200.")
+    print(f"\nOK — {len(members)} member(s) installed+loaded, declared views serve 200, enabled data routes < 500.")
     return 0