[Feature]: Add Manual, Guided, Full auto, and Custom project execution policies

[roomote-community]

Problem

Manual project execution can reuse existing tasks, but Roomote needs a durable policy and coordinator before it can continue safely through dependencies and failures.

Proposed behavior

Add immutable policy versions and explicit Manual, Guided, Full auto, and Custom presets. Build an idempotent event-driven coordinator that dispatches approved dependency-ready items and reacts to tasks, PRs, checks, reviews, questions, branches, and control commands.

Reuse BullMQ/control-plane enqueue and settlement callbacks, current task states/retries/PR facts, and the proven manual project flow.

Acceptance criteria

• Manual remains equivalent to the existing manual vertical slice.
• Guided auto-dispatches approved work with bounded transient retry and material replan/final-delivery approval.
• Full auto merges only after configured gates and still pauses on hard safety questions.
• Concurrency and serialized repository integration are enforced.
• Restarts/duplicate events cannot duplicate tasks or merges.
• Deterministic failures cannot retry indefinitely.

Dependencies

• [Feature]: Add project item acceptance, integration PRs, and final delivery #1042
• [Feature]: Add the project event timeline and audited control commands #1043
• [Feature]: Add project-level questions and coordination chat #1044

[roomote-community]

I've analyzed this issue and here's my proposed implementation plan:

1. Land this after [Feature]: Add project item acceptance, integration PRs, and final delivery #1042, [Feature]: Add the project event timeline and audited control commands #1043, and [Feature]: Add project-level questions and coordination chat #1044, reusing their project acceptance/delivery state, append-only event ledger, audited commands, and scoped questions. Keep project execution policy distinct from the per-task Autonomous/Interactive behavior assembled in packages/cloud-agents/src/server/workflows/standardTask.ts; dispatched items remain ordinary workflow: 'standard' tasks.
2. Extend the project types and server-only planning service introduced by [Feature]: Add the project planning domain model and authorization foundation #1037 (packages/types/src/project-planning.ts, packages/db/src/schema.ts, and packages/db/src/lib/project-planning.ts) with immutable policy versions and an active-policy pointer. Each version should snapshot preset, concurrency, retry limits/backoff, approval gates, merge gates, and safety rules; policy changes create and activate a new version, append an event, and affect future coordinator decisions without rewriting running attempts or prior history.
3. Define fixed presets with explicit semantics: Manual performs no automatic dispatch, retry, replan, or merge and preserves [Feature]: Link project plan items to existing Roomote task execution and controls #1041/[Feature]: Add project item acceptance, integration PRs, and final delivery #1042's existing manual flow; Guided dispatches approved dependency-ready items and retries explicitly transient failures within bounds, but requires approval for material replans and final delivery; Full auto may dispatch, replan, and merge only after configured acceptance/check/review/head gates pass; Custom exposes the same typed fields while retaining non-disableable idempotency, authorization, hard-safety pauses, and serialized repository integration.
4. Add durable coordinator action/lease records with uniqueness over the project, policy version, action kind, subject, and generation. Record decisions before external side effects, transition actions through claimed/succeeded/blocked/failed states, and reconcile indeterminate task or merge outcomes from stored task/PR facts. BullMQ delivery must only wake processing; PostgreSQL constraints, leases, and event cursors remain the source of truth across retries and restarts.
5. Add a project coordinator queue and worker under apps/bullmq/src/, following the queue/worker registration pattern in active-pr-review-follow-up-queue.ts and apps/bullmq/src/index.ts. Coalesce wakeups by project ID, process dependency-ready items in deterministic priority/order, enforce project-wide and per-repository active-attempt limits, and retain [Feature]: Add project item acceptance, integration PRs, and final delivery #1042's single integration lease per repository. Add a reconciliation sweep so committed events/actions are recovered if enqueueing or a worker restart interrupts delivery.
6. Route [Feature]: Add the project event timeline and audited control commands #1043 events for item readiness and approvals, task settlement, PR/check/review and branch changes, [Feature]: Add project-level questions and coordination chat #1044 question state, and pause/resume/cancel/retry/replan/merge commands into the coordinator wake path. Reuse enqueueTask in packages/cloud-agents/src/server/task-run-queue.ts, [Feature]: Link project plan items to existing Roomote task execution and controls #1041's attempt launch/link operation, and the terminal synchronization boundary in packages/sdk/src/server/lib/task-runs/finish-run.ts rather than creating a second task lifecycle.
7. Make retries append new linked attempts and require both an explicitly retryable classification and remaining policy budget. Map known transient infrastructure/provider failures from stable task errorCode or typed action errors; treat validation failures, deterministic agent/code failures, permission/policy failures, exhausted conflicts, and unknown failures as blocked rather than retryable. Persist attempt count and next eligible time so duplicate events cannot bypass limits or retry indefinitely.
8. Evaluate merge automation through [Feature]: Add project item acceptance, integration PRs, and final delivery #1042's guarded source-control service: re-read PR head/base, checks, reviews, mergeability, acceptance, and expected integration SHA immediately before claiming a merge. Serialize item integration, advance the stored SHA transactionally after confirmed success, and require the configured final-delivery gate before merging the integration-to-base PR. Ambiguous provider responses remain reconciling/blocked and must never trigger a second blind merge.
9. Treat unresolved [Feature]: Add project-level questions and coordination chat #1044 questions according to their item/milestone/project scope. Questions marked as hard-safety blockers, including secret/private input, destructive or irreversible action, security/permission ambiguity, or policy conflict, always pause the affected scope in every preset, including Full auto; answering the durable question appends one event and wakes reevaluation.
10. Extend the project tRPC commands in apps/web/src/trpc/commands/projects/ and the project UI under apps/web/src/components/projects/ with preset selection, a validated Custom editor, active/version history, approval controls, coordinator status, concurrency/retry usage, and blocked-action explanations. Require an authorized activation command for every policy version, warn when activation can immediately make pending work eligible, and expose policy/activity state in Overview, Work, and Activity without duplicating task transcripts or PR evidence viewers.
11. Add real-database tests for immutable versions, activation authorization, preset semantics, concurrency races, deterministic ordering, duplicate events/actions, lease expiry, restart recovery, bounded retry classification, policy changes during active work, scoped safety questions, guarded/serialized merges, and ambiguous side-effect reconciliation. Add BullMQ queue/worker tests, task-settlement and webhook producer tests, web command/component tests for presets and Custom validation, and update apps/docs/ with the four policies, approval/merge behavior, safety invariants, and operational recovery semantics.

This approach layers durable, auditable automation over the proven manual project flow while keeping ordinary Roomote tasks and existing control-plane paths intact. It makes BullMQ an at-least-once wakeup mechanism, database state the idempotency boundary, and safety/merge gates enforceable regardless of the selected preset.

Please tag @roomote if you'd like me to implement this, or reply with feedback on the plan.