Echo: retire legacy interactions prototype and drop provider prompt: sugar (Slice 6)

[etdsoft]

Summary

Final PR (7th) of the Echo Sessions merge train. Retires the legacy Roslin
one-shot interaction prototype now that the ReplyJob-backed sessions UI is live
(Slices 3–5), and drops the provider prompt: sugar that only existed to serve
it.

Stacked on echo/add-session-stimulus (Slice 5b, #1653) — merge after Slice 5b
so the sessions replacement is on develop before the legacy path is removed.

Removed (legacy Roslin one-shot path):

• Projects::InteractionsController#create and #show (their views were already
  removed by Slice 5; #show was orphaned). Pruned the now-dead before_action
  filters — set_prompt runs on :preview only; set_record runs on every
  surviving action.
• Route: resources :interactions now only: [:index], keeping preview as the
  member route.
• Dradis::Plugins::Echo::InteractionJob + its spec.
• Provider prompt: sugar and #resolve_messages from provider.rb,
  http_streaming.rb, ollama.rb (+ specs). #generate now takes messages:
  only. ReplyJob already calls generate(messages:), so this is safe. Updated
  the http_streaming.rb doc comment that referenced InteractionJob.

Kept (this is the new UI, not legacy): InteractionsController#index /
#preview, the interactions/* views, and the Echo tab wiring.

SEC-498 · Milestone: SEC-469

Testing steps

• Open an Issue's Echo tab: the sessions panel ("Start a new conversation" +
  existing conversations) still loads.
• The old one-shot POST/GET :id interaction routes no longer resolve.
• Starting a conversation and receiving a streamed reply still works (ReplyJob
  path, unchanged).

Automated coverage: new spec/requests/.../projects/interactions_spec.rb asserts
the panel loads and the create/show routes are gone; provider specs updated to
messages:-only.

Other Information

• Echo engine suite green locally: 168 examples, 0 failures.
• rubocop (changed files), brakeman -w2, and zeitwerk:check all clean.
• Slice size: 11 files, +63/-175.

I assign all rights, including copyright, to any future Dradis work by myself to Security Roots.

Check List

• Added a CHANGELOG entry (n/a — teardown of an unshipped prototype within the merge train; no user-facing behaviour reaches develop)
• Commit message has a detailed description of what changed and why.

[etdsoft]

QA Evidence Report — ready-for-human-merge

Branch: echo/retire-interactions-prototype @ 1858e277e — stacked on Slice 5b base echo/add-session-stimulus @ 8946175f1 (NOT rebased on develop; this is the 7th/final PR of the SEC-469 merge train and merges after Slice 5b). Current develop @ 7fa72106c.
Clean checkout: yes — fresh detached worktree at PR head, gems/DB isolated, verified independently (did not read Coder's CI).
Machine: QA box, mise Ruby 3.4.6, SQLite test DB, bundle exec via engine.

Slice cap: 11 files, +63/-175 (238 lines) — within ≤15 files / ≤600 lines.

CI jobs reproduced (all on PR head)

Job	Command	Exit	Duration	Output snippet
bundler-audit	bundler-audit --update --ignore CVE-2024-21510 CVE-2025-61921 CVE-2026-38969	0	~5s	No vulnerabilities found
ruby-audit	ruby-audit update && ruby-audit check --ignore CVE-2025-61594 CVE-2025-58767 CVE-2026-41316	0	~3s	No vulnerabilities found
brakeman	brakeman -q -w2	0	~10s	No warnings found
rubocop	rubocop <9 changed .rb>	0	~5s	9 files inspected, no offenses detected
rspec (Echo engine)	rspec engines/dradis-echo/spec/	0	17s	168 examples, 0 failures
zeitwerk:check	rails zeitwerk:check	0	~15s	All is good! (no dangling constant refs)

Note on audits: run bare, bundler-audit/ruby-audit surface CVE-2025-61921 (Sinatra) and CVE-2026-41316 (ERB) — but Gemfile.lock is unchanged by this PR (pre-existing/repo-wide, affects develop equally) and both are in the dradis-ce ci.yml ignore-lists. With the verbatim CI ignore flags both jobs are green (above).

Affected-flow checks (independent repro)

• Sessions panel still loads — GET /addons/echo/projects/:id/interactions → 200, body includes "Start a new conversation" (request spec) ✅
• Legacy Roslin one-shot path gone — POST .../interactions and GET .../interactions/:id both raise ActionController::RoutingError; rails routes -g interaction shows only index + preview (GET) ✅
• Provider #generate is messages:-only — signature def generate(messages:, model: nil, &block); resolve_messages + prompt: sugar fully removed from provider.rb/http_streaming.rb/ollama.rb; provider specs green ✅
• ReplyJob unaffected — already calls generate(messages: context, model: …) ✅
• Server-side sessions flow — session specs green: "creates a session with the first user message and triggers a reply", "responds with the session turbo frame" ✅
• No dangling InteractionJob refs — grep -rn InteractionJob engines/ app/ config/ lib/ → none; zeitwerk eager-load clean ✅

Affected-flow spec bundle (interactions request + provider + session specs): 43 examples, 0 failures.

Findings

• (none blocking)
• Documented manual-verification gap (not a blocker): the live streamed-reply path (Turbo-Stream chunk streaming + ActionCable) needs a real browser + Redis and is not exercised by rack_test. Server-side session creation and turbo-frame response ARE covered. Flagging for human sign-off at merge, consistent with the Coder's note.

Verdict

ready-for-human-merge

[etdsoft]

SEC-514 — PR #1655 code-review fixes (Slice 6: echo/retire-interactions-prototype)

Applies the review findings on the retire slice (restacked cleanly on the updated Slice 5b tip, force-pushed).

• Api after action in rescue #10 Shared cable check: interactions_controller now uses the shared TurboConfigCheck concern instead of its own Redis-pinging copy (duplicate removed).
• Issue tabs #8 N+1: the includes(:user) + grouped-count fix is carried up from Slice 5a and remains applied to interactions#index after the retire.
• Nit — blank @type: set_record raises RecordNotFound when @type is blank, so an unknown/missing type returns 404 instead of a 500 from send('').pluralize, mirroring SessionsController#set_record.
• Nit — set_prompt scoping: the preview prompt lookup is now scoped through .for(@type) like sessions#create, honouring the Prompt::SCOPES whitelist.

Restacking note (for reviewer): on origin this branch had forked from add-session-stimulus early and re-applied three stimulus commits under different SHAs. I dropped those duplicates (verified patch-identical) and cherry-picked only the two genuinely retire-specific commits onto the current stimulus tip, so the stack is now linear again (stimulus → this branch). The avatar-tokenize change from Slice 5b lives in this PR's base, not its diff.

Verification: full non-feature echo suite green locally (194 examples), incl. a new 404-on-missing-type spec; rubocop clean. Feature specs need QA.

[etdsoft]

QA Evidence Report — send-back

Branch: echo/retire-interactions-prototype @ f644293d2 (base 5b echo/add-session-stimulus @ c8bbc7308), targeting develop @ 3eaead603
Clean checkout: yes — fresh worktree off origin/echo/retire-interactions-prototype, ignored the stale sibling worktree
Machine: QA box, CE / sqlite. No Firefox/geckodriver (Selenium feature specs unrunnable here — same gap Coder flagged).

CI jobs reproduced (.github/workflows/ci.yml)

Job	Command	Exit	Duration	Output snippet
bundler-audit	bundle exec bundler-audit --update --ignore CVE-2024-21510 CVE-2025-61921 CVE-2026-38969	1 ❌	1.2s	loofah (2.25.1) GHSA-9wjq-cp2p-hrgf + rails-html-sanitizer (1.6.2) GHSA-cj75-f6xr-r4g7 → Vulnerabilities found!
ruby-audit	ruby-audit update && ruby-audit check --ignore CVE-2025-61594 CVE-2025-58767 CVE-2026-41316	0 ✅	—	No vulnerabilities found
brakeman	bundle exec brakeman -q -w2	0 ✅	4.4s	No warnings found
rubocop-ci	bin/rubocop-ci develop false	0 ✅	—	Clean code — 9 changed files, 0 offenses (also slice-level direct lint vs 5b: 9 files, 0 offenses)
rspec (echo engine, non-feature)	bundle exec rspec engines/dradis-echo/spec --exclude-pattern "**/features/**"	0 ✅	16.7s	197 examples, 0 failures

Affected-flow checks

• Cascade integrity — 7 designer commits (648f591c1…09995d236) all ancestors of f644293d2 ✅; retire's own 3 commits (4734a95af / 79de2140a / f644293d2) replay on top ✅
• Dual intent (legacy removed + redesign intact) — interactions_controller.rb now exposes only #index (legacy #show/#create gone); interaction_job.rb deleted; redesigned index intact (@sessions = Session.for_record(@record).order(updated_at: :desc)) ✅
• Slice cap Echo: retire legacy interactions prototype and drop provider prompt: sugar (Slice 6) #1654 (retire vs 5b) — 11 files, 51+/185− = 236 lines ✅ (≤15 / ≤600)

NOT run (environment gaps — coverage the CTO in-browser pass must still cover)

• Selenium feature specs (sessions_spec, sessions_conversation_spec, providers_spec = 10 examples) — no Firefox/geckodriver in either Coder's or QA's box.
• Pro-schema engine specs — this is the CE box.

Findings

1. BLOCKER — bundler-audit CI job fails. The branch's Gemfile.lock carries loofah 2.25.1 + rails-html-sanitizer 1.6.2, which are vulnerable (GHSA-9wjq-cp2p-hrgf, GHSA-cj75-f6xr-r4g7). origin/develop already bumped these to loofah 2.25.2 / rails-html-sanitizer 1.7.1 to fix exactly these advisories. The branch is behind develop — merge-base(retire, develop) = 7fa72106c, develop tip = 3eaead603 — so it never picked up the bump.
   • Proof of attribution (isolated, same ignore list): origin/develop's exact lock → bundler-audit EXIT 0 "No vulnerabilities found"; this branch's lock → EXIT 1 "Vulnerabilities found!". The branch is the sole cause; not an environment/audit-DB false alarm.
   • Impact: Echo Sessions: full feature #1655 → develop. As-is, the branch's push CI is red, and merging would regress develop's security posture (downgrade both gems). This is a hard pre-merge blocker.
   • Fix (Coder): bring the Echo stack up to develop's gems — rebase the stack on current develop (preferred), or bump Gemfile + Gemfile.lock to loofah 2.25.2 / rails-html-sanitizer 1.7.1. This is stack-wide staleness (the whole 5a/5b/retire base predates the bump), so coordinate the rebase/freeze with the CTO before force-pushing.

Verdict

send-back-with-findings — the cascade mechanics are correct (commits present, dual intent verified, engine specs/rubocop/brakeman/ruby-audit all green), but the branch fails the bundler-audit CI job because it is behind develop's loofah/rails-html-sanitizer security bump. Fix the Gemfile.lock staleness (rebase on develop) and re-request QA. Prior verdict remains void.

[etdsoft]

QA re-verify — PASS on c54f5b48d ✅

Re-verified the gem-bump fix on the new retire tip. Same QA worktree, CE/sqlite.

Integrity of the change

• Fast-forward, additive — f644293d2 is an ancestor of c54f5b48d; the only new commit is the bump (CHANGELOG/Gemfile/Gemfile.lock). My prior code verdict (dual intent, cascade, rubocop, engine specs) carries forward untouched.
• Cherry-pick is byte-identical to develop's 6befa70f4 — git patch-id matches exactly (1ed81f1779…). No drift, no hand-editing of the lock.

Checks

Check	Result
bundler-audit (CI ignore list CVE-2024-21510 CVE-2025-61921 CVE-2026-38969)	✅ EXIT 0, "No vulnerabilities found"
lock versions	✅ loofah 2.25.2, rails-html-sanitizer 1.7.1; Gemfile ~> 1.7.1
echo engine specs (non-feature, bumped gems)	✅ 197 examples, 0 failures
7 designer + retire's 3 commits ancestors of tip	✅ all 10 present
Slice cap #1654 (retire vs 5b)	✅ 14 files, 57+/191− = 248 lines (≤15 / ≤600; +3 files are the bump's CHANGELOG/Gemfile/lock)

Still not runnable in either box → CTO's in-browser pass covers these

• Selenium feature specs (sessions_spec, sessions_conversation_spec, providers_spec) — no Firefox/geckodriver.
• Pro-schema engine specs — QA box is CE.

Verdict

PASS on the full automated scope I can run. bundler-audit blocker is cleared. Handing to CTO for the in-browser two-column UI pass + go-signal (which also covers the Selenium/Pro-schema gaps).

[etdsoft]

QA Evidence Report — ready-for-human-merge

Branch: echo/retire-interactions-prototype @ 6cf55f725 (slice diff 9c99dfd5e..6cf55f725 = 8 files, +36/-36)
PRs: #1654 (slice, base echo/add-session-stimulus) · #1655 (full feature, base develop @ 3ecbf7af0)
Clean checkout: yes — isolated worktree qa-sec536 @ 6cf55f725, shared bundle, own sqlite test DB
Machine: Ruby 3.4.6, sqlite3, independent of Coder's run

Slice cap

8 files changed, 72 LOC — within the ≤15-file / ≤600-LOC cap. Spec-only, style-only → no CHANGELOG required. ✅

CI jobs reproduced (independent, on Coder's branch)

Job	Command	Exit	Duration	Output
bundler-audit	bundle exec bundler-audit --update --ignore …	0	~1.2s	No vulnerabilities found
ruby-audit	bundle exec ruby-audit check --ignore …	0	~1.0s	No vulnerabilities found
brakeman	bundle exec brakeman -q -w2	0	~4.9s	No warnings found
rubocop (CI push semantics)	bin/rubocop-ci 9c99dfd5e true	0	~1.9s	Clean — 8 changed files, 0 offenses
rubocop (scoped deliverable)	rubocop --only Style/BlockDelimiters engines/dradis-echo	0	~1.0s	76 files, 0 offenses
rspec (touched specs)	8 touched spec files	0	~2.2s	67 examples, 0 failures
rspec (affected flow)	rspec engines/dradis-echo/spec	0	~18s	197 examples, 0 failures

CI base note (why the lint job is green)

CI triggers on push and lints github.event.before..HEAD with IS_MERGE=true (falls back to origin/develop only when no previous SHA). Coder's push was a fast-forward from 9c99dfd5e, so the real lint job compares only this slice's 8 spec files → clean. Reproduced exactly with bin/rubocop-ci 9c99dfd5e true.

Affected-flow checks

• Echo grammar/sessions/replies/messages/interactions request specs — full engine suite green (197 ex, 0 fail).
• Style/BlockDelimiters deliverable: expect { … } → expect do … end conversions verified; chained multi-line matchers preserved, single-line inner change { } blocks correctly left as braces. Cop reports 0 offenses across the whole engine.

Findings

• (non-blocking, out of scope) 10 pre-existing Layout offenses across the full stack. Diffing the entire stack against origin/develop (bin/rubocop-ci develop false) surfaces 10 Layout/ExtraSpacing / Layout/HashAlignment / Layout/SpaceAroundOperators offenses in non-echo-spec files (app/controllers/attachments_controller.rb, evidence_controller.rb, app/models/comment.rb, two API specs). These are not Style/BlockDelimiters, are not in any file this slice touched, and are not introduced by SEC-536 (the slice diff 9c99dfd5e..6cf55f725 is spec-only). They are latent stack debt and are not flagged by the push-based CI as configured. Recommend a separate cleanup slice (analogous to how SEC-536 handled BlockDelimiters) before the full-feature PR Echo Sessions: full feature #1655 lands on develop — flagging to CTO, no action required for SEC-536.

Verdict

ready-for-human-merge — SEC-536's scoped deliverable (Style/BlockDelimiters = 0 in engines/dradis-echo) is verified clean, all CI jobs reproduce green independently, and the touched/affected Echo specs stay green. Within slice cap. The 10 Layout offenses are pre-existing, out-of-scope stack debt noted for a follow-up slice.

[etdsoft]

QA Evidence Report — ready-for-human-merge

Branch: echo/retire-interactions-prototype @ 500634046d64135a6f070958fc52fc00d2889f4f (tip = SEC-539 fix commit), vs develop @ 3ecbf7af00dcbcfedb0340c2819f65325f20368d
Clean checkout: yes — detached QA worktree qa-sec539 pinned to the exact remote SHA 500634046, independent of Coder's checkout and CI logs
Machine: local; ruby 3.4.6 via mise, gems shared from main checkout vendor/bundle

CI jobs reproduced

Job	Command	Exit	Duration	Output snippet
Lint (rubocop-ci)	bin/rubocop-ci develop false	0	~1.8s	✅ Clean code! No rubocop offenses detected in 18 changed file(s). Compared to origin/develop.
Syntax	ruby -c on all 5 touched files	0	<1s	Syntax OK ×5

Note on the CI command: CI runs the bin/rubocop-ci wrapper, which prepends origin/ when the merge flag is false. So the correct local invocation is bin/rubocop-ci develop false (→ diffs origin/develop..HEAD); the literal bin/rubocop-ci origin/develop false from the issue text double-prefixes to origin/origin/develop and no-ops. I reproduced with the correct form — the same wrapper CI gates on.

Scope / slice cap

• SEC-539 commit 500634046: 5 files, 9 insertions / 9 deletions — well under the 15-file / 600-LOC cap.
• git show -w 500634046 (ignore-all-whitespace) → empty diff: the change is provably pure whitespace, tokens byte-identical. No behaviour change.
• Files: attachments_controller.rb, evidence_controller.rb, comment.rb, api/v1/issues_spec.rb, api/v3/issues_spec.rb.

Affected-flow checks

• Directly-affected CI job for this issue is Lint — reproduced in full: 0 total offenses (all cops, not just Layout/*) across the whole-stack-vs-develop diff (18 changed files).
• rspec / brakeman / audits not re-run: the delta is a provably pure-whitespace commit on the already-QA'd stack (SEC-536), so token-level behaviour, security surface, and gem set are unchanged from the prior verified state. Full-suite re-run has nil marginal value here; the smallest change-proving verification is the Lint job + syntax check, both green.

Findings

• (none blocking)
• Observation (out of scope, non-blocking): the wrapper prints Error: No such file or directory: .../echo/interaction_job.rb — that file is deleted by the retire-interactions-prototype branch, so git diff-tree lists it but rubocop can't inspect a non-existent path. This is inherent to the stack (not introduced by SEC-539) and does not flip the wrapper exit: the wrapper gates on parsed offense counts, and it exited 0. No action needed for this issue.

Verdict

ready-for-human-merge

Independently reproduced on a clean worktree pinned to 500634046. The whole-stack-vs-develop Lint diff is clean (0 offenses), so the Layout/* offenses that would have tripped the Lint job when #1655 merges to develop are resolved. Must land before #1655 merges.

Handing to CTO for the go-signal.