tatara-managed 3-label issue lifecycle - Implementation Plan¶

// internal/scm/scm.go
type IssueRef struct { Repo string; Number int; Title string; Labels []string; UpdatedAt time.Time; IsPR bool }
type IssueComment struct { Author string; Body string; CreatedAt time.Time }
type IssueContent struct { Title string; Body string }
// SCMWriter:
AddLabel(ctx context.Context, token, issueRef, label string) error
RemoveLabel(ctx context.Context, token, issueRef, label string) error
CloseIssue(ctx context.Context, token, repo string, number int, comment string) error
Comment(ctx context.Context, token, issueRef, body string) error
// SCMReader:
ListOpenIssues(ctx context.Context, owner, repo string) ([]IssueRef, error)
ListIssueComments(ctx context.Context, owner, repo string, number int) ([]IssueComment, error)
GetIssue(ctx context.Context, owner, repo string, number int) (IssueContent, error)
func OwnerRepo(repoURL string) (owner, repo string, err error)

// internal/controller (TaskReconciler methods)
func (r *TaskReconciler) scmContext(ctx, task) (proj Project, repo Repository, writer scm.SCMWriter, token, provider string, err error)
func (r *TaskReconciler) scmToken(ctx, namespace, secretRef string) (string, error)
func (r *TaskReconciler) recordSCM(provider, verb string, err error) // verb is free-form metric label
func (r *TaskReconciler) setLifecycleState(ctx, task, state, reason string) error
func (r *TaskReconciler) resetAgentRun(ctx, task) error
func (r *TaskReconciler) repoURLForTask(ctx, task) string
// TaskReconciler fields: Client, Scheme, Metrics *obs.OperatorMetrics, SCMFor func(string)(scm.SCMWriter,error), ReaderFor func(provider,token string)(scm.SCMReader,error)

// helpers in package controller
func hasLabel(labels []string, want string) bool   // KEEP
func repoSlug(repo *Repository) string

// api/v1alpha1
ScmSpec{ Provider, Owner, BotLogin string; ApprovalLabel string; PriorityLabel string; ConversationIdleMinutes int; ... }
TaskSource{ Provider, IssueRef, URL, AuthorLogin string; IsPR bool; Number int }
IssueOutcome{ Action string; Comment string }   // Action in {implement, close, discuss}

func TestScmSpecLabelFields(t *testing.T) {
    s := ScmSpec{IdeaLabel: "tatara-idea", ApprovedLabel: "tatara-approved", RejectedLabel: "tatara-rejected"}
    if s.IdeaLabel != "tatara-idea" || s.ApprovedLabel != "tatara-approved" || s.RejectedLabel != "tatara-rejected" {
        t.Fatalf("label fields not set: %+v", s)
    }
}

    // ApprovalLabel is DEPRECATED and no longer used: approval is now driven by
    // the conversation (the triage agent reads the thread) and projected onto the
    // idea/approved/rejected labels below. Kept only for migration tooling.
    // +kubebuilder:default="tatara/awaiting-approval"
    // +optional
    ApprovalLabel string `json:"approvalLabel,omitempty"`
    // IdeaLabel marks an issue tatara originated or updated but that is not yet
    // ready for implementation.
    // +kubebuilder:default="tatara-idea"
    // +optional
    IdeaLabel string `json:"ideaLabel,omitempty"`
    // ApprovedLabel marks an issue approved for implementation.
    // +kubebuilder:default="tatara-approved"
    // +optional
    ApprovedLabel string `json:"approvedLabel,omitempty"`
    // RejectedLabel marks an issue tatara closed (redundant, duplicate, not actionable).
    // +kubebuilder:default="tatara-rejected"
    // +optional
    RejectedLabel string `json:"rejectedLabel,omitempty"`

package controller

import (
    "context"
    "sync"
    "testing"

    "github.com/prometheus/client_golang/prometheus"
    "github.com/stretchr/testify/require"
    tatarav1alpha1 "github.com/szymonrychu/tatara-operator/api/v1alpha1"
    "github.com/szymonrychu/tatara-operator/internal/obs"
    "github.com/szymonrychu/tatara-operator/internal/scm"
    corev1 "k8s.io/api/core/v1"
    metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
    "k8s.io/apimachinery/pkg/types"
)

type labelWriter struct {
    scm.SCMWriter
    mu      sync.Mutex
    added   []string
    removed []string
}

func (w *labelWriter) AddLabel(_ context.Context, _, _, label string) error {
    w.mu.Lock()
    defer w.mu.Unlock()
    w.added = append(w.added, label)
    return nil
}
func (w *labelWriter) RemoveLabel(_ context.Context, _, _, label string) error {
    w.mu.Lock()
    defer w.mu.Unlock()
    w.removed = append(w.removed, label)
    return nil
}

type labelReader struct {
    fakeProposalReader
    current []string
}

func (r *labelReader) ListOpenIssues(_ context.Context, _, _ string) ([]scm.IssueRef, error) {
    return []scm.IssueRef{{Repo: "o/r", Number: 7, Labels: r.current}}, nil
}

// seedLabelTask creates a project (with scm spec), repo, secret, and a lifecycle
// Task whose Source points at o/r#7.
func seedLabelTask(t *testing.T, suffix string, currentLabels []string) (*TaskReconciler, *tatarav1alpha1.Task, *labelWriter) {
    t.Helper()
    ctx := context.Background()
    sec := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "lbl-scm-" + suffix, Namespace: testNS}, Data: map[string][]byte{"token": []byte("tok")}}
    require.NoError(t, k8sClient.Create(ctx, sec))
    proj := &tatarav1alpha1.Project{
        ObjectMeta: metav1.ObjectMeta{Name: "lbl-proj-" + suffix, Namespace: testNS},
        Spec: tatarav1alpha1.ProjectSpec{ScmSecretRef: "lbl-scm-" + suffix, Scm: &tatarav1alpha1.ScmSpec{Provider: "github", Owner: "o", BotLogin: "tatara-bot"}},
    }
    require.NoError(t, k8sClient.Create(ctx, proj))
    repo := &tatarav1alpha1.Repository{
        ObjectMeta: metav1.ObjectMeta{Name: "lbl-repo-" + suffix, Namespace: testNS},
        Spec:       tatarav1alpha1.RepositorySpec{ProjectRef: proj.Name, URL: "https://github.com/o/r.git", DefaultBranch: "main", ReingestSchedule: "0 6 * * *"},
    }
    require.NoError(t, k8sClient.Create(ctx, repo))
    task := &tatarav1alpha1.Task{
        ObjectMeta: metav1.ObjectMeta{Name: "lbl-task-" + suffix, Namespace: testNS},
        Spec: tatarav1alpha1.TaskSpec{ProjectRef: proj.Name, RepositoryRef: repo.Name, Kind: "issueLifecycle",
            Source: &tatarav1alpha1.TaskSource{Provider: "github", IssueRef: "o/r#7", Number: 7, AuthorLogin: "human"}},
    }
    require.NoError(t, k8sClient.Create(ctx, task))
    var fresh tatarav1alpha1.Task
    require.NoError(t, k8sClient.Get(ctx, types.NamespacedName{Namespace: testNS, Name: task.Name}, &fresh))
    w := &labelWriter{}
    rdr := &labelReader{current: currentLabels}
    r := &TaskReconciler{Client: k8sClient, Scheme: k8sClient.Scheme(), Metrics: obs.NewOperatorMetrics(prometheus.NewRegistry()),
        SCMFor:    func(string) (scm.SCMWriter, error) { return w, nil },
        ReaderFor: func(_, _ string) (scm.SCMReader, error) { return rdr, nil }}
    return r, &fresh, w
}

func TestSetLifecycleLabel_AddsDesiredRemovesOthers(t *testing.T) {
    r, task, w := seedLabelTask(t, "addrm", []string{"tatara-idea", "unrelated"})
    var proj tatarav1alpha1.Project
    require.NoError(t, k8sClient.Get(context.Background(), types.NamespacedName{Namespace: testNS, Name: task.Spec.ProjectRef}, &proj))
    require.NoError(t, r.setLifecycleLabel(context.Background(), &proj, task, "tatara-approved"))
    require.Equal(t, []string{"tatara-approved"}, w.added)
    require.Equal(t, []string{"tatara-idea"}, w.removed) // only the managed label removed, not "unrelated"
}

func TestSetLifecycleLabel_NoopWhenAlreadySet(t *testing.T) {
    r, task, w := seedLabelTask(t, "noop", []string{"tatara-approved"})
    var proj tatarav1alpha1.Project
    require.NoError(t, k8sClient.Get(context.Background(), types.NamespacedName{Namespace: testNS, Name: task.Spec.ProjectRef}, &proj))
    require.NoError(t, r.setLifecycleLabel(context.Background(), &proj, task, "tatara-approved"))
    require.Empty(t, w.added)
    require.Empty(t, w.removed)
}

func TestSetLifecycleLabel_NeverTouchesTriggerOrPriority(t *testing.T) {
    r, task, w := seedLabelTask(t, "scope", []string{"tatara", "priority/high", "tatara-idea"})
    var proj tatarav1alpha1.Project
    require.NoError(t, k8sClient.Get(context.Background(), types.NamespacedName{Namespace: testNS, Name: task.Spec.ProjectRef}, &proj))
    require.NoError(t, r.setLifecycleLabel(context.Background(), &proj, task, "tatara-rejected"))
    require.Equal(t, []string{"tatara-rejected"}, w.added)
    require.Equal(t, []string{"tatara-idea"}, w.removed) // tatara + priority/high untouched
}

package controller

import (
    "context"
    "fmt"

    tatarav1alpha1 "github.com/szymonrychu/tatara-operator/api/v1alpha1"
    "github.com/szymonrychu/tatara-operator/internal/scm"
    "sigs.k8s.io/controller-runtime/pkg/log"
)

// lifecycleLabels returns the three managed labels for the project, applying the
// tatara-idea/tatara-approved/tatara-rejected defaults when a field is empty.
func lifecycleLabels(s *tatarav1alpha1.ScmSpec) (idea, approved, rejected string) {
    idea, approved, rejected = "tatara-idea", "tatara-approved", "tatara-rejected"
    if s == nil {
        return
    }
    if s.IdeaLabel != "" {
        idea = s.IdeaLabel
    }
    if s.ApprovedLabel != "" {
        approved = s.ApprovedLabel
    }
    if s.RejectedLabel != "" {
        rejected = s.RejectedLabel
    }
    return
}

// setLifecycleLabel ensures exactly `desired` of the three managed labels is
// present on the task's source issue: it adds `desired` if absent and removes
// the other two managed labels if present. It never touches any non-managed
// label (triggerLabel, priorityLabel, etc.). Idempotent: a no-op when already in
// the target state. AddLabel failures are returned (caller requeues); RemoveLabel
// failures are logged and tolerated (a lingering extra label self-heals next pass).
func (r *TaskReconciler) setLifecycleLabel(ctx context.Context, proj *tatarav1alpha1.Project, task *tatarav1alpha1.Task, desired string) error {
    if task.Spec.Source == nil || task.Spec.Source.IssueRef == "" {
        return nil
    }
    l := log.FromContext(ctx)
    idea, approved, rejected := lifecycleLabels(proj.Spec.Scm)
    managed := []string{idea, approved, rejected}
    _, repo, writer, token, provider, err := r.scmContext(ctx, task)
    if err != nil {
        return fmt.Errorf("set label: %w", err)
    }
    issueRef := task.Spec.Source.IssueRef

    // Read current labels (best-effort) so we add/remove only what is needed and
    // avoid 404 churn from removing absent labels.
    current := map[string]bool{}
    if r.ReaderFor != nil {
        if reader, rerr := r.ReaderFor(provider, token); rerr == nil {
            if owner, name, oerr := scm.OwnerRepo(repo.Spec.URL); oerr == nil {
                if issues, lerr := reader.ListOpenIssues(ctx, owner, name); lerr == nil {
                    for _, iss := range issues {
                        if fmt.Sprintf("%s#%d", iss.Repo, iss.Number) == issueRef {
                            for _, lb := range iss.Labels {
                                current[lb] = true
                            }
                            break
                        }
                    }
                }
            }
        }
    }

    if !current[desired] {
        if aerr := writer.AddLabel(ctx, token, issueRef, desired); aerr != nil {
            r.recordSCM(provider, "add_label", aerr)
            return fmt.Errorf("set label add %q: %w", desired, aerr)
        }
        r.recordSCM(provider, "add_label", nil)
    }
    for _, lb := range managed {
        if lb == desired || !current[lb] {
            continue
        }
        if rerr := writer.RemoveLabel(ctx, token, issueRef, lb); rerr != nil {
            r.recordSCM(provider, "remove_label", rerr)
            l.Info("set label: remove other label failed (non-fatal)",
                "action", "scm_set_label", "resource_id", task.Name, "issue_ref", issueRef, "label", lb, "err", rerr.Error())
            continue
        }
        r.recordSCM(provider, "remove_label", nil)
    }
    l.Info("lifecycle label set", "action", "scm_set_label",
        "resource_id", task.Name, "issue_ref", issueRef, "label", desired)
    return nil
}

type commentReader struct {
    fakeProposalReader
    comments []scm.IssueComment
}

func (r *commentReader) ListIssueComments(_ context.Context, _, _ string, _ int) ([]scm.IssueComment, error) {
    return r.comments, nil
}

func newReconcilerWithReader(rdr scm.SCMReader) *TaskReconciler {
    return &TaskReconciler{Client: k8sClient, Scheme: k8sClient.Scheme(),
        Metrics:   obs.NewOperatorMetrics(prometheus.NewRegistry()),
        SCMFor:    func(string) (scm.SCMWriter, error) { return &labelWriter{}, nil },
        ReaderFor: func(_, _ string) (scm.SCMReader, error) { return rdr, nil }}
}

func TestHasHumanComment(t *testing.T) {
    _, task, _ := seedLabelTask(t, "humancmt", nil)
    var proj tatarav1alpha1.Project
    require.NoError(t, k8sClient.Get(context.Background(), types.NamespacedName{Namespace: testNS, Name: task.Spec.ProjectRef}, &proj))

    // only a bot comment -> false
    r1 := newReconcilerWithReader(&commentReader{comments: []scm.IssueComment{{Author: "tatara-bot", Body: "proposal"}}})
    got, err := r1.hasHumanComment(context.Background(), &proj, task)
    require.NoError(t, err)
    require.False(t, got)

    // a human comment present -> true
    r2 := newReconcilerWithReader(&commentReader{comments: []scm.IssueComment{{Author: "tatara-bot", Body: "x"}, {Author: "szymon", Body: "looks good, go"}}})
    got, err = r2.hasHumanComment(context.Background(), &proj, task)
    require.NoError(t, err)
    require.True(t, got)
}

// hasHumanComment reports whether the task's source issue has at least one
// comment authored by a non-bot login. Used to gate self-approval of
// bot-authored issues: tatara never self-approves its own idea before a human
// has engaged. Returns the underlying error so the caller can fail closed.
func (r *TaskReconciler) hasHumanComment(ctx context.Context, proj *tatarav1alpha1.Project, task *tatarav1alpha1.Task) (bool, error) {
    if r.ReaderFor == nil || task.Spec.Source == nil {
        return false, nil
    }
    botLogin := ""
    if proj.Spec.Scm != nil {
        botLogin = proj.Spec.Scm.BotLogin
    }
    provider := task.Spec.Source.Provider
    if provider == "" && proj.Spec.Scm != nil {
        provider = proj.Spec.Scm.Provider
    }
    token, err := r.scmToken(ctx, task.Namespace, proj.Spec.ScmSecretRef)
    if err != nil {
        return false, err
    }
    reader, err := r.ReaderFor(provider, token)
    if err != nil {
        return false, err
    }
    owner, name, err := scm.OwnerRepo(r.repoURLForTask(ctx, task))
    if err != nil {
        return false, err
    }
    comments, err := reader.ListIssueComments(ctx, owner, name, task.Spec.Source.Number)
    if err != nil {
        return false, err
    }
    for _, c := range comments {
        if c.Author != "" && c.Author != botLogin {
            return true, nil
        }
    }
    return false, nil
}

package controller

import (
    "context"
    "testing"

    "github.com/prometheus/client_golang/prometheus"
    "github.com/stretchr/testify/require"
    tatarav1alpha1 "github.com/szymonrychu/tatara-operator/api/v1alpha1"
    "github.com/szymonrychu/tatara-operator/internal/obs"
    "github.com/szymonrychu/tatara-operator/internal/scm"
    metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
    "k8s.io/apimachinery/pkg/types"
)

// reconcilerFor builds a TaskReconciler with the given writer + reader for the
// finishTriage label path. resetAgentRun and setLifecycleState use the same
// k8sClient, so the seeded task must already exist.
func reconcilerFor(w scm.SCMWriter, rdr scm.SCMReader) *TaskReconciler {
    return &TaskReconciler{Client: k8sClient, Scheme: k8sClient.Scheme(),
        Metrics:   obs.NewOperatorMetrics(prometheus.NewRegistry()),
        SCMFor:    func(string) (scm.SCMWriter, error) { return w, nil },
        ReaderFor: func(_, _ string) (scm.SCMReader, error) { return rdr, nil }}
}

func markSucceededWithOutcome(t *testing.T, name, action string) {
    t.Helper()
    ctx := context.Background()
    var fresh tatarav1alpha1.Task
    require.NoError(t, k8sClient.Get(ctx, types.NamespacedName{Namespace: testNS, Name: name}, &fresh))
    fresh.Status.Phase = "Succeeded"
    fresh.Status.IssueOutcome = &tatarav1alpha1.IssueOutcome{Action: action, Comment: "c"}
    require.NoError(t, k8sClient.Status().Update(ctx, &fresh))
}

func getTask(t *testing.T, name string) *tatarav1alpha1.Task {
    t.Helper()
    var fresh tatarav1alpha1.Task
    require.NoError(t, k8sClient.Get(context.Background(), types.NamespacedName{Namespace: testNS, Name: name}, &fresh))
    return &fresh
}

func TestFinishTriage_HumanFiledImplement_Approved(t *testing.T) {
    r, task, w := seedLabelTask(t, "hf-impl", []string{"tatara-idea"})
    w2 := w // labelWriter
    r = reconcilerFor(w2, &commentReader{})
    var proj tatarav1alpha1.Project
    require.NoError(t, k8sClient.Get(context.Background(), types.NamespacedName{Namespace: testNS, Name: task.Spec.ProjectRef}, &proj))
    markSucceededWithOutcome(t, task.Name, "implement")
    got := getTask(t, task.Name)
    _, err := r.finishTriage(context.Background(), &proj, got)
    require.NoError(t, err)
    require.Equal(t, []string{"tatara-approved"}, w2.added)
    require.Equal(t, "Implement", getTask(t, task.Name).Status.LifecycleState)
}

func TestFinishTriage_Close_Rejected(t *testing.T) {
    r, task, w := seedLabelTask(t, "close-rej", []string{"tatara-idea"})
    r = reconcilerFor(w, &commentReader{})
    var proj tatarav1alpha1.Project
    require.NoError(t, k8sClient.Get(context.Background(), types.NamespacedName{Namespace: testNS, Name: task.Spec.ProjectRef}, &proj))
    markSucceededWithOutcome(t, task.Name, "close")
    _, err := r.finishTriage(context.Background(), &proj, getTask(t, task.Name))
    require.NoError(t, err)
    require.Equal(t, []string{"tatara-rejected"}, w.added)
    require.Equal(t, "Done", getTask(t, task.Name).Status.LifecycleState)
}

func TestFinishTriage_Discuss_Idea(t *testing.T) {
    r, task, w := seedLabelTask(t, "disc-idea", nil)
    r = reconcilerFor(w, &commentReader{})
    var proj tatarav1alpha1.Project
    require.NoError(t, k8sClient.Get(context.Background(), types.NamespacedName{Namespace: testNS, Name: task.Spec.ProjectRef}, &proj))
    markSucceededWithOutcome(t, task.Name, "discuss")
    _, err := r.finishTriage(context.Background(), &proj, getTask(t, task.Name))
    require.NoError(t, err)
    require.Equal(t, []string{"tatara-idea"}, w.added)
    require.Equal(t, "Conversation", getTask(t, task.Name).Status.LifecycleState)
}

func TestFinishTriage_BotAuthoredImplement_NoHumanComment_ParksIdea(t *testing.T) {
    r, task, w := seedLabelTask(t, "bot-noh", nil)
    // make the task bot-authored
    got := getTask(t, task.Name)
    got.Spec.Source.AuthorLogin = "tatara-bot"
    require.NoError(t, k8sClient.Update(context.Background(), got))
    r = reconcilerFor(w, &commentReader{comments: []scm.IssueComment{{Author: "tatara-bot", Body: "my idea"}}})
    var proj tatarav1alpha1.Project
    require.NoError(t, k8sClient.Get(context.Background(), types.NamespacedName{Namespace: testNS, Name: task.Spec.ProjectRef}, &proj))
    markSucceededWithOutcome(t, task.Name, "implement")
    _, err := r.finishTriage(context.Background(), &proj, getTask(t, task.Name))
    require.NoError(t, err)
    require.Equal(t, []string{"tatara-idea"}, w.added) // downgraded
    require.Equal(t, "Conversation", getTask(t, task.Name).Status.LifecycleState)
}

func TestFinishTriage_BotAuthoredImplement_WithHumanComment_Approved(t *testing.T) {
    r, task, w := seedLabelTask(t, "bot-h", nil)
    got := getTask(t, task.Name)
    got.Spec.Source.AuthorLogin = "tatara-bot"
    require.NoError(t, k8sClient.Update(context.Background(), got))
    r = reconcilerFor(w, &commentReader{comments: []scm.IssueComment{{Author: "szymon", Body: "approved, go"}}})
    var proj tatarav1alpha1.Project
    require.NoError(t, k8sClient.Get(context.Background(), types.NamespacedName{Namespace: testNS, Name: task.Spec.ProjectRef}, &proj))
    markSucceededWithOutcome(t, task.Name, "implement")
    _, err := r.finishTriage(context.Background(), &proj, getTask(t, task.Name))
    require.NoError(t, err)
    require.Equal(t, []string{"tatara-approved"}, w.added)
    require.Equal(t, "Implement", getTask(t, task.Name).Status.LifecycleState)
}

// enterConversation sets the conversation idle deadline + LastActivityAt and
// transitions the task to Conversation with the given reason. Shared by the
// discuss and bot-await-approval triage outcomes.
func (r *TaskReconciler) enterConversation(ctx context.Context, project *tatarav1alpha1.Project, task *tatarav1alpha1.Task, reason string) error {
    idleMinutes := 60
    if project.Spec.Scm != nil && project.Spec.Scm.ConversationIdleMinutes > 0 {
        idleMinutes = project.Spec.Scm.ConversationIdleMinutes
    }
    if err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
        fresh := &tatarav1alpha1.Task{}
        if err := r.Get(ctx, client.ObjectKeyFromObject(task), fresh); err != nil {
            return err
        }
        now := metav1.Now()
        deadline := metav1.NewTime(now.Add(time.Duration(idleMinutes) * time.Minute))
        fresh.Status.DeadlineAt = &deadline
        fresh.Status.LastActivityAt = &now
        return r.Status().Update(ctx, fresh)
    }); err != nil {
        return fmt.Errorf("enter conversation: set deadline: %w", err)
    }
    return r.setLifecycleState(ctx, task, "Conversation", reason)
}

    idea, approved, rejected := lifecycleLabels(project.Spec.Scm)

    switch action {
    case "close":
        if err := r.setLifecycleLabel(ctx, project, task, rejected); err != nil {
            return ctrl.Result{}, err
        }
        if err := r.triageCloseIssue(ctx, project, task, comment); err != nil {
            return ctrl.Result{}, err
        }
        if err := r.setLifecycleState(ctx, task, "Done", "triage-close"); err != nil {
            return ctrl.Result{}, err
        }

    case "discuss":
        if err := r.setLifecycleLabel(ctx, project, task, idea); err != nil {
            return ctrl.Result{}, err
        }
        if err := r.triagePostComment(ctx, project, task, comment); err != nil {
            return ctrl.Result{}, err
        }
        if err := r.enterConversation(ctx, project, task, "triage-discuss"); err != nil {
            return ctrl.Result{}, err
        }

    default: // "implement" and anything else
        // Bot-authored self-approve guard (rules R1/R2): tatara never approves its
        // own idea before a human has engaged. A human-filed issue may self-approve.
        if task.Spec.Source != nil && project.Spec.Scm != nil &&
            project.Spec.Scm.BotLogin != "" && task.Spec.Source.AuthorLogin == project.Spec.Scm.BotLogin {
            human, herr := r.hasHumanComment(ctx, project, task)
            if herr != nil {
                l.Info("triage: hasHumanComment failed; parking as idea (fail closed)",
                    "action", "lifecycle_triage_guard", "resource_id", task.Name, "err", herr.Error())
                human = false
            }
            if !human {
                if err := r.setLifecycleLabel(ctx, project, task, idea); err != nil {
                    return ctrl.Result{}, err
                }
                if err := r.enterConversation(ctx, project, task, "triage-await-approval"); err != nil {
                    return ctrl.Result{}, err
                }
                return ctrl.Result{}, r.resetAgentRun(ctx, task)
            }
        }
        if err := r.setLifecycleLabel(ctx, project, task, approved); err != nil {
            return ctrl.Result{}, err
        }
        if err := r.setLifecycleState(ctx, task, "Implement", "triage-implement"); err != nil {
            return ctrl.Result{}, err
        }
    }

    return ctrl.Result{}, r.resetAgentRun(ctx, task)

func TestLifecycleTriageText_ApprovalInstructions(t *testing.T) {
    task := &tatarav1alpha1.Task{Spec: tatarav1alpha1.TaskSpec{Source: &tatarav1alpha1.TaskSource{IssueRef: "o/r#1", URL: "u"}}}
    got := lifecycleTriageText(task, "T", "B")
    if !strings.Contains(got, "human") || !strings.Contains(got, "approval comment") {
        t.Fatalf("triage prompt missing conversation-approval guidance:\n%s", got)
    }
}

    return fmt.Sprintf(
        "You are the tatara lifecycle agent performing Triage for issue %s (%s).\n\n"+
            "Issue title: %s\n"+
            "Issue body:\n%s\n\n"+
            "Your job:\n"+
            "1. Read the issue AND the full conversation thread carefully.\n"+
            "2. Use tatara MCP tools (memory, code search, docs) to understand the codebase.\n"+
            "3. Decide the outcome by interpreting the human's intent in the thread:\n"+
            "   - A human approval / go-ahead -> action=implement.\n"+
            "   - A human decline, or duplicate / out-of-scope / not-actionable -> action=close (supply the reason as `comment`).\n"+
            "   - Still under discussion or needing the human -> action=discuss (supply your questions as `comment`).\n"+
            "4. IMPORTANT: if THIS issue was opened by tatara itself (a tatara idea), emit action=implement "+
            "ONLY if a human has posted an approval comment in the thread; otherwise emit action=discuss and wait.\n"+
            "5. Call the `issue_outcome` MCP tool with your chosen action.\n\n"+
            "You MUST call issue_outcome before finishing. Do not open PRs or make code changes in this turn.",
        issueRef, issueURL, title, body)

    idea, _, _ := lifecycleLabels(proj.Spec.Scm)
    label := idea

// completeProposal marks the brainstorm proposal Task Succeeded after the idea
// issue has been opened. The issue (now carrying the idea label) flows through
// the normal issue lifecycle from here; there is no AwaitingApproval parking.
func (r *TaskReconciler) completeProposal(ctx context.Context, task *tatarav1alpha1.Task, issueURL string) (ctrl.Result, error) {
    if err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
        fresh := &tatarav1alpha1.Task{}
        if gerr := r.Get(ctx, client.ObjectKeyFromObject(task), fresh); gerr != nil {
            return gerr
        }
        fresh.Status.Phase = "Succeeded"
        present := false
        for _, u := range fresh.Status.DiscoveredIssues {
            if u == issueURL {
                present = true
                break
            }
        }
        if !present {
            fresh.Status.DiscoveredIssues = append(fresh.Status.DiscoveredIssues, issueURL)
        }
        apimeta.SetStatusCondition(&fresh.Status.Conditions, metav1.Condition{
            Type:               "WritebackPending",
            Status:             metav1.ConditionFalse,
            Reason:             "BrainstormProposed",
            Message:            "proposal issue opened with idea label",
            ObservedGeneration: fresh.Generation,
        })
        return r.Status().Update(ctx, fresh)
    }); err != nil {
        return ctrl.Result{}, fmt.Errorf("proposal: complete: %w", err)
    }
    return ctrl.Result{}, nil
}