long-running: wire the indexing, KB-population, security-scan and code-analysis operations to their existing implementations, or retire them — no parallel implementation #17023

Activity

1. mrveiss

   added this to the v0.9.0 milestone on Sep 18, 2026
2. mrveiss

   added

   tech-debt

   needs-decisionBlocked on an owner decision; options and a recommendation are on the issueBlocked on an owner decision; options and a recommendation are on the issue

   on Sep 18, 2026
3. mrveiss

   added a parent issue on Sep 18, 2026

   • security: /api/long-running has no authentication — anyone can start test runs, scans and KB population, or cancel any operation #17010
4. github-actions

   added

   backend

   on Sep 18, 2026
5. mrveiss commented on Sep 28, 2026

   

   mrveiss

   on Sep 28, 2026 – with Claude

   OwnerAuthor

   More actions

   Classification (for work assignment — not a fix proposal)

   • Scope: api (secondary kb)
   • Primary files/dirs:
     • autobot-backend/api/long_running_operations.py (verified on main; the _not_implemented routes are at :136, :212 and :218)
     • autobot-backend/utils/operation_timeout_integration.py (verified on main)
     • autobot-backend/api/codebase_analytics/endpoints/indexing.py (verified on main)
     • autobot-backend/api/knowledge_population.py (verified on main)
   • Same-file note: api/long_running_operations.py and utils/operation_timeout_integration.py are shared with long-running: the four start routes cannot create an operation — create_operation gets estimated_items/context it does not accept (TypeError → 500) #17017 and ws: three unreachable WebSocket surfaces would accept unauthenticated if wired — finish or retire each (gateway adapter, /operations router, websocket_heartbeat) #17011, so under the same-file rule the three go to one session.
   • Umbrella: no. It is a child of security: /api/long-running has no authentication — anyone can start test runs, scans and KB population, or cancel any operation #17010 (closed).
   • Blocked by: an owner ruling for the security-scan route. The acceptance criteria require asking the owner "is a runtime security scan wanted at all?", and the issue carries needs-decision. Indexing, KB population and code analysis have nothing visible blocking them.
   • Read vs inferred: Read the issue body (0 comments) and the parent's state, and grepped main for the 501 stubs. It is inferred that the three routes still answer 501 on main.
   • Undetermined: whether the owner has already answered the security-scan question anywhere outside this issue.

   ---

   Generated by Claude Code
6. mrveiss

   modified the milestones: v0.9.0, v0.9-decisions on Sep 28, 2026
7. mrveiss commented on Oct 3, 2026

   

   mrveiss

   on Oct 3, 2026

   OwnerAuthor

   More actions

   Three of the four have an unambiguous answer. The fourth — the security scan — cannot be answered as posed, because "security scan" names two different things here and each already has an implementation.

   The three that are decidable now

   Route	Recommendation	Why
   POST /api/long-running/codebase/index	Wire to api/codebase_analytics/endpoints/indexing.py (verified present on main)	A real indexer with its own queue exists; the current operation function imports ..knowledge_base from above the top-level utils package and calls kb.populate_from_codebase, which exists nowhere — so it is an ImportError wrapping a missing method, not a partial implementation worth salvaging
   POST /api/long-running/knowledge-base/populate	Wire to api/knowledge_population.py (verified present)	populate_system_commands, populate_man_pages, populate_autobot_docs, refresh_system_knowledge and their task machinery already exist; today's function sleeps and reports done
   code analysis (type only, no route)	Retire	OperationType.CODE_ANALYSIS has a branch at operation_timeout_integration.py:413 and a default at :600, but no route reaches it. A placeholder with no caller is not a feature with a missing implementation — it is dead weight, and retiring it is the honest reading of "consolidate, never fork"

   The security scan — the question is ambiguous, and that is the finding

   AC2 asks the owner "is a runtime security scan wanted at all?", on the premise that nothing exists at runtime. Something does — but possibly not the thing the route meant.

   agents/security_scanner_agent.py is 663 lines of real implementation: a StandardizedAgent with ActionHandler, supporting port_scan, service_detection, vulnerability_scan, ssl_scan. That is network and host scanning.

   The route's three siblings are all codebase-oriented — indexing, KB population, code analysis. A codebase security scan is SAST, and the implementation of that is the CI security jobs, which is what the issue table points at.

   So "is a runtime security scan wanted?" has two answers depending on which was meant:

   • Network/host scanning — already exists and is already reachable through the agent. The route would be a second front door onto it, which is the parallel implementation this issue opens by forbidding. Retire the route.
   • Codebase SAST at runtime — does not exist outside CI, and that is a genuine build-or-not decision. Note it would inherit security(ci): bandit and pip-audit parsers read a failed scan as zero findings, and pip-audit is gated at --fail-on any #16185's defect: parse_bandit currently reads a scan that errored as a clean result, so a runtime SAST surface built on it would report "no findings" for a file it could not parse.

   Recommended first step: settle which scan the route meant before answering wanted-or-not. If nobody can say, that is itself the answer — retire it, because a route whose subject cannot be identified has no consumer who would notice.

   One note on AC3

   "No route answers 501 once this closes. Each one works or is gone, with a test."

   Sound, and worth keeping — but it means #17017's 501s are a temporary state owned by this issue, so #17017 should not be closed on the 501s standing. Worth saying explicitly on #17017, which currently reads as delivered on exactly that.

   Verified against origin/main. Recommendation only; the call is the owner's.