fix(hive-app): fail closed on ambiguous project and parent task matches

[cuentapraces07-ops]

Fixes #14187

Summary

hive_create_task previously selected the first fuzzy project or parent task, which could create work in the wrong project or attach it to an unrelated parent.

This change:

• prefers a unique exact project match, then accepts only a unique partial match;
• reports candidate projects when a name is ambiguous;
• requires exactly one case-insensitive exact parent-task match inside the selected project;
• never falls back to a task from another project, and rejects blank/malformed names;
• adds hermetic regression coverage and registers the check in .github/checks-manifest.yaml.

Verification

• python3 plugins/omi-hive-app/test_main.py — 10 passed
• python3 .github/scripts/test_run_checks.py — 52 passed, 3 skipped
• python3 .github/scripts/run_checks.py --lane local --check-id hive-app-create-task-safety-tests — 10 passed
• python3 -m py_compile plugins/omi-hive-app/main.py
• git diff --check

Failure-Class: none

[Git-on-my-level]

Verified end to end against the PR head (855e607) in a clean worktree — this is a careful fix for #14187, thank you.

plugins/omi-hive-app/main.py

• find_project_by_name returning (project, candidates) is the right shape: a unique exact match wins even when partials also exist, multiple exacts fail closed with the candidate list, and a blank/non-string name returns (None, []) before any API call (the old code substring-matched every project on an empty name). Both call sites — tool_hive_get_tasks and tool_hive_create_task — unpack the tuple and surface the ambiguity; I confirmed those are the only two callers.
• The parent-task rewrite removes both dangerous fallbacks: duplicate names now require exactly one case-insensitive exact match inside the target project, and the old found_tasks[0] cross-project fallback is gone — a parent that only exists in another project is refused with "no matching task in that project". Bumping the search_tasks limit 5→50 is consistent with how fix(hive-app): disambiguate task status updates and expose task IDs in search #14179 now uses it.
• _format_candidates is de-duplicated and whitespace-stable, and the error strings list candidate names, which is exactly what the chat side needs to disambiguate.

plugins/omi-hive-app/test_main.py

• Genuinely hermetic (stdlib-only stubs for fastapi/pydantic/requests/omi_plugin_sdk/db), drives the real production handler, and asserts on the actual REST payload (projectId/parentId scoping) plus create.assert_not_called() on the ambiguity paths. I ran it standalone and through the manifest — 10/10 green.

.github/checks-manifest.yaml

• hive-app-create-task-safety-tests sits under checks: with both lanes and narrow triggers; parses cleanly and runs green via run_checks.py --check-id.

I also ran the repo's full ci-lane selection for your changed files locally (hive check, manifest contract, diff hygiene, architecture guardrails, product invariants, failure-class protocol including the Failure-Class: none declaration, deferred-work markers, lifecycle headers, changelog/plan-catalog/runtime-image contracts, oauth log-safety). Everything passes except one item that needs your action, not a code change:

Before merge — commit identity + rebase. The repo's git-author-identity check fails on the head commit: it is authored as Codex Local <codex-local@example.invalid>, which GitHub cannot attribute to your account. When you rebase (the branch also conflicts with main — plugins/omi-hive-app/main.py overlaps the just-landed #14179 whitespace normalization), please set your real git config user.name/user.email first and re-create the commit so it carries your attribution.

Heads-up: repo CI hasn't run on this PR yet (workflows need a maintainer-approved run for a first-time contributor), so my local manifest run is the evidence for now.

Leaving for human maintainer review: workflow-run approval for a first-time contributor plus the ordinary merge sign-off; no product-direction concern.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.