caltechads/bot-todo

No problems traced to this repository code in these checks.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• validate checks the canonical files: Real input produced the expected result: valid

  Source: | `validate` | Check the canonical files |

  Input: demo repo

  Expected: valid

  Command: <guest-path> --root <guest-path> validate

  Observed: valid

• show prints one task: Real input produced the expected result: Write the README

  Source: | `show TASK_ID` | Print one task |

  Input: T001

  Expected: task T001 title

  Command: <guest-path> --root <guest-path> show T001

  Observed: …Write the README #docs - Acceptance: README covers install and usage - Outcome: completed - Closed: 2026-10-28

• --json is the stable automation interface: Real input produced the expected result: Write the README

  Source: `--json` is the stable automation interface.

  Input: show T001 with --json

  Expected: JSON task with title

  Command: <guest-path> --json --root <guest-path> show T001

  Observed: …Write the README", "state": "completed", "priority": null, "type": "docs", "tags": [], "simple": false, "acceptance": "README covers install and usage", "context": null, "related": null, "blocked_by": [], "claim": null, "actionable": false, "closed_on": "2026-10-28", "reviewed_on": null, "reason": null}}}

• add creates an open task when --acceptance is given: Real input produced the expected result: Claim check task

  Source: `add` requires either `--acceptance` or `--simple`.

  Input: title Claim check task with acceptance

  Expected: added task with title

  Command: <guest-path> --root <guest-path> add 'Claim check task' --type ops --acceptance 'claim check passes'

  Observed: …Claim check task

Examples

• Development section: run the repository test suite with make pytest: command completed successfully

  Source: README.md Development

  Input: make pytest

  Expected: all tests pass

  Command: make pytest

  Observed: [ 57%] tests/test_repository.py .......................... [ 66%] tests/test_skill_guidance.py ........ [ 68%] tests/test_skill_installation.py ............................ [ 77%] tests/test_task_management_snippet.py .... [ 79%] tests/test_web.py ...................................................... [ 96%] .......... [100%] ======================= 308 passed in 112.11s (0:01:52) ========================

• Quick start: list open tasks in a repository: command completed successfully

  Source: README.md Quick start

  Input: list --root demo repo

  Expected: open task T002 listed

  Command: <guest-path> --root <guest-path> list

  Observed: T002 P2 Live check task #ops T003 P2 Claim check task #ops T004 P2 Cycle check task #ops T005 P2 Claim check task #ops T006 P2 Cycle check task #ops

Cycles

• Kanban board polls /board-version every 2 seconds and reloads when the TODO.md version changes: Triggered one cycle by hand (run-once: one external CLI edit of TODO.md (the trigger the poll reacts to); the board-version observation was done by hand against the running server; normal trigger: browser-side poll every 2000 ms while the board page is open and visible): added T006 Cycle check task

  Source: src/bot_todo/web.py

  Input: add "Cycle check task" to the demo repo

  Expected: TODO.md changes and the CLI reports the added task; the board-version token changes within the poll interval

  Command: <guest-path> --root <guest-path> add 'Cycle check task' --type ops --acceptance 'cycle check passes'

  Observed: added T006 Cycle check task

Local or hosted: local

Install bot-todo from the README and run its task-backlog CLI (init, add, list, show, claim, complete, validate) plus the local Kanban web board, with a live CLI-to-board refresh cycle

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -150
cd <guest-path> && ls -la; echo; cat README* 2>/dev/null | wc -l; echo; ls <guest-path> /inputs 2>&1; echo $CDP_URL
cd <guest-path> && sed -n 150,366p README.md
which uv pip3 2>&1; uv --version 2>&1; ls -la <guest-path>; python3 -m pip --version 2>&1 | head -1; cat <guest-path> | head -40
cd /tmp && uv tool install bot-todo 2>&1 | tail -15; echo "rc=$?"; bot-todo --version 2>&1
B=<guest-path>; $B --version; mkdir -p <guest-path> && cd <guest-path> && $B init --name demo-proj --root <guest-path> 2>&1; echo rc=$?; ls -la <guest-path> 2>&1
B=<guest-path>; cd <guest-path> && $B --root <guest-path> init --name demo-proj 2>&1; echo rc=$?; ls -la <guest-path> 2>&1
B=<guest-path>; cd <guest-path> && $B --root <guest-path> init --name demo-repo 2>&1 | head -2; echo rc=$?; $B --root <guest-path> add "Write the README" --type docs --priority P1 --acceptance "README covers install and usage"; echo rc=$?; $B --root <guest-path> list; echo rc=$?; $B --root <guest-path> show T001; echo rc=$?; $B --root <guest-path> validate; echo rc=$?
B=<guest-path>; R=<guest-path>; cd <guest-path>; $B --root $R claim T001 --actor taylor; echo rc=$?; $B --json --root $R show T001; echo rc=$?; $B --root $R complete T001; echo rc=$?; $B --json --root $R show T999; echo rc=$?; $B --root $R list; echo rc=$?; cat $R/TODO.md | head -40
B=<guest-path>; R=<guest-path>; cd <guest-path>; ($B --root $R web --port 8765 --no-open > <guest-path> 2>&1 &); sleep 2; cat <guest-path>; curl -s -i http://127.0.0.1:8765/ | head -20; echo; curl -s http://127.0.0.1:8765/api/board 2>&1 | head -c 600; echo; curl -s http://127.0.0.1:8765/api/tasks 2>&1 | head -c 300
pkill -f "bot-todo.*web --port 8765" ; sleep 1; (curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8765/ || echo "port closed"); cd <guest-path> && grep -rn "while \|sleep(\|schedule\|cron\|--once\|--now\|webhook\|setInterval\|poll" src/ | head -30; ls src/*
ps -eo pid,args | grep "[w]eb --port" ; curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8765/ || echo "port closed"
cd <guest-path> && grep -rln "while \|sleep\|schedule\|cron\|once\|webhook\|setInterval\|poll\|refresh\|reload" src/ ; echo ---; grep -rn "while \|sleep(\|cron\|--once\|--now\|webhook\|poll\|live-reload\|refresh" src/ | head -30
cd <guest-path> && sed -n 50,72p src/bot_todo/web.py; echo ----; grep -n "board-version\|board_version" src/bot_todo/web.py | head; echo ----; R=<guest-path>; B=<guest-path>; cd <guest-path>; ($B --root $R web --port 8765 --no-open > <guest-path> 2>&1 &); sleep 2; curl -s "http://127.0.0.1:8765/board-version?repo=current"; echo; $B --root $R add "Live check task" --type ops --acceptance "appears on board"; sleep 3; curl -s "http://127.0.0.1:8765/board-version?repo=current"; echo; curl -s "http://127.0.0.1:8765/?repo=current" | grep -o "Live check task" | head -2
for p in $(ps -eo pid,args | grep "[b]ot-todo --root <guest-path> web" | awk '{print $1}'); do kill $p; done; sleep 1; ps -eo pid,args | grep "[w]eb --port" || echo "no web server running"; curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8765/ || echo "port 8765 closed"
cd <guest-path> && wc -l check.py && grep -n "def \|output_directory\|expected_file\|stays_running\|\"url\"\|mcp_http\|cycles.json\|examples.json\|report.json" check.py | head -80
cd <guest-path> && sed -n 636,686p check.py; grep -n "cycles\|examples" check.py | head -40
cd <guest-path> && grep -n -A4 "^pytest" Makefile; timeout 600 uv sync 2>&1 | tail -5; echo rc=$?
cd <guest-path> && timeout 900 make pytest 2>&1 | tail -15; echo rc=${PIPESTATUS[0]}
mkdir -p <guest-path> && cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"http","argv":["<guest-path>","--root","<guest-path>","web","--port","8765","--no-open"],"cwd":"<guest-path>","url":"http://127.0.0.1:8765/?repo=current","expected_text":"Write the README"}
EOF
cat > claims.json <<'EOF'
[
{"kind":"claim","claim":"validate checks the canonical files","source":"| `validate` | Check the canonical files |","input":"demo repo","expected":"valid","probe_kind":"cli","argv":["<guest-path>","--root","<guest-path>","validate"],"expected_text":"valid","cwd":"<guest-path>"},
{"kind":"claim","claim":"show prints one task","source":"| `show TASK_ID` | Print one task |","input":"T001","expected":"task T001 title","probe_kind":"cli","argv":["<guest-path>","--root","<guest-path>","show","T001"],"expected_text":"Write the README","cwd":"<guest-path>"},
{"kind":"claim","claim":"--json is the stable automation interface","source":"`--json` is the stable automation interface.","input":"show T001 with --json","expected":"JSON task with title","probe_kind":"cli","argv":["<guest-path>","--json","--root","<guest-path>","show","T001"],"expected_text":"Write the README","cwd":"<guest-path>"},
{"kind":"claim","claim":"add creates an open task when --acceptance is given","source":"`add` requires either `--acceptance` or `--simple`.","input":"title Claim check task with acceptance","expected":"added task with title","probe_kind":"cli","argv":["<guest-path>","--root","<guest-path>","add","Claim check task","--type","ops","--acceptance","claim check passes"],"expected_text":"Claim check task","cwd":"<guest-path>"}
]
EOF
python3 -I -c 'import json;json.load(open("probe.json"));print(len(json.load(open("claims.json"))),"claims ok")'
cd <guest-path> && cat > examples.json <<'EOF'
[
{"kind":"example","claim":"Development section: run the repository test suite with make pytest","source":"README.md Development","input":"make pytest","expected":"all tests pass","argv":["make","pytest"],"cwd":"<guest-path>","env":{},"expected_text":"308 passed"},
{"kind":"example","claim":"Quick start: list open tasks in a repository","source":"README.md Quick start","input":"list --root demo repo","expected":"open task T002 listed","argv":["<guest-path>","--root","<guest-path>","list"],"cwd":"<guest-path>","env":{},"expected_text":"Live check task"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":true,"checks":[{"claim":"Kanban board polls /board-version every 2 seconds and reloads when the TODO.md version changes","source":"src/bot_todo/web.py","quote":"setInterval(poll, 2000);","schedule":"browser-side poll every 2000 ms while the board page is open and visible","method":"run-once: one external CLI edit of TODO.md (the trigger the poll reacts to); the board-version observation was done by hand against the running server","input":"add \"Cycle check task\" to the demo repo","expected":"TODO.md changes and the CLI reports the added task; the board-version token changes within the poll interval","kind":"cli","argv":["<guest-path>","--root","<guest-path>","add","Cycle check task","--type","ops","--acceptance","cycle check passes"],"cwd":"<guest-path>","expected_text":"Cycle check task"}]}
EOF
python3 -I -c 'import json;[json.load(open(f)) for f in ("examples.json","cycles.json")];print("ok")'
cd <guest-path> && <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; head -c 6000 <guest-path>
cd <guest-path> && python3 -I -c '
import json,sys
t=open("check-run1.txt").read()
d=json.loads(t[t.index("{"):]) if False else None
' ; tail -c 1500 <guest-path>; echo; grep -o '"valid": [a-z]*' <guest-path>; grep -o '"problems": \[[^]]*\]' <guest-path> | head -3
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install bot-todo from the README and run its task-backlog CLI (init, add, list, show, claim, complete, validate) plus the local Kanban web board, with a live CLI-to-board refresh cycle","operation_scope":"Linux guest, Python 3.12.3, uv 0.13.5, bot-todo 0.6.0 from PyPI via the README's uv tool install; repo pinned at caltechads/bot-todo 96ff277279fdd221f561b5a57eb15e28ddcd5f0d (workspace snapshot, bot-todo VERSION 0.6.0); no browser, no credentials, no external notifications; CDP endpoint not needed because the board was checked over HTTP only","steps":["uv tool install bot-todo","bot-todo --version","bot-todo --root <guest-path> init --name demo-repo","bot-todo --root <guest-path> add \"Write the README\" --type docs --priority P1 --acceptance \"README covers install and usage\"","bot-todo --root <guest-path> list","bot-todo --root <guest-path> show T001","bot-todo --root <guest-path> claim T001 --actor taylor","bot-todo --json --root <guest-path> show T001","bot-todo --root <guest-path> complete T001","bot-todo --json --root <guest-path> show T999 (expected unknown_task error, exit 1)","bot-todo --root <guest-path> validate","bot-todo --root <guest-path> web --port 8765 --no-open (HTTP board checked at /?repo=current and /board-version)","uv sync","make pytest (308 passed)"],"deviations":["README shows bot-todo on PATH after uv tool install; uv installed it to <guest-path> which was not on PATH, so every command used the absolute path <guest-path>","README Quick start uses bot-todo init in the project directory; this guest used the documented --root global option (placed before the subcommand, since --root after init is rejected with exit 2).","init created TODO.md and .bot-todo.lock but not TODO.archive.md, although the README Commands table says init creates both files. Not fixed; archive file may be created lazily.","A mistaken pkill -f in my own shell killed that shell (returncode 255); the manual web server was then stopped by PID. Not a product fault.","The checker path /inputs/coldpass-preflight.py from the instructions does not exist in this guest; the supplied <guest-path> was used with the same --validate --replay flags.","No git metadata was needed: the workspace was used as supplied and the README needs no git commands, so the git init/fetch pin steps were not run.","The cycle check is a run-once trigger (one CLI add to TODO.md) because the browser-side 2-second poll cannot be driven without a browser; the board-version change was observed by hand against the live server and is not part of the replayed check.","The demo repo at <guest-path> is mutated by replays (add/claim/complete/list); add-based checks create new task IDs each run, and their expected_text is the fixed title."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"No fix required for the working path. Optionally: create TODO.archive.md in init to match the README table, and document that --root goes before the subcommand in the Quick start."}
EOF
python3 -I -c 'import json;d=json.load(open("report.json"));print(d["outcome"], d["fault_owner"], len(d["steps"]))'