@ai-dossier/sched 0.39.0 → 0.41.0

package/README.md

@@ -29,8 +29,10 @@ ai-dossier sched enqueue --from-manifest batch-prep.json                  # batc
 ai-dossier sched start            # the dispatch engine: spawn, verify, escalate, watch parked PRs (Ctrl-C stops it)
 ai-dossier sched start --once     # a single reconcile+refill tick (cron-style)
 ai-dossier sched status           # queue (+pr/cleanup), parked PRs, slots, batches, blocked/failed
-ai-dossier sched pause            # stop NEW assignments; live units keep running
+ai-dossier sched pause            # prevent every new agent process; live units keep running
 ai-dossier sched resume
+ai-dossier sched stop --issue 42  # terminate one full-cycle agent and record it stopped (no recovery)
+ai-dossier sched stop --batch b1  # terminate the batch process and stop unfinished members
 ai-dossier sched abandon --issue 42 --reason "operator abort"
 ai-dossier sched abandon --batch b1   # dissolve; members requeue as full-cycle
 ai-dossier sched stats --issues 4..9  # per-issue tokens/cost from ~/.dossier/runs.jsonl (#524)
@@ -47,6 +49,14 @@ every other subcommand and reads that project's `~/.dossier/sched/<project>/runs
 directory directly, reconstructing costs from the raw dispatch logs rather than
 `runs.jsonl` (#564) — see "Batch members (#564)" below.
 
+`pause` prevents every new agent process, including escalation and same-tier recovery
+takeovers; it does not terminate agents that are already running. `stop --issue <n>` is the
+single-command stop path: it PID-start-safely terminates that issue's live agent, releases its
+slot, and records a terminal `stopped` outcome that will not recover or escalate. An active
+slot-mode member must instead be stopped through `stop --batch <id>`, which terminates the batch
+process and atomically stops the batch and its unfinished members. `abandon` only records failure
+and releases the slot; it intentionally does not terminate its process.
+
 Since #507, `enqueue` additionally reads each candidate issue's live GitHub labels (one
 `gh issue view --json labels` call per issue, resolved against the current directory's repo
 unless `--repo <owner/name>` is passed) and lands an issue carrying `decision-pending` /

package/dist/batch-dispatch.d.ts

@@ -125,6 +125,8 @@ export interface BatchTickResult {
     parked: string[];
     mergeAccepted: string[];
     failed: string[];
+    /** Per-batch exceptions contained so unrelated units can continue this tick (#635). */
+    reconciliation_errors: string[];
     /** Issue numbers requeued full-cycle by a dissolve — matches `TickResult.blocked`'s shape. */
     blocked: number[];
 }

package/dist/batch-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAmBH,OAAO,EAYL,KAAK,gBAAgB,EAGrB,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,KAAK,WAAW,EAQjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAUL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAoBpB,OAAO,EAAE,KAAK,QAAQ,EAA2D,MAAM,YAAY,CAAC;AACpG,OAAO,KAAK,EAEV,UAAU,EAEV,oBAAoB,EAMpB,WAAW,EAGZ,MAAM,SAAS,CAAC;AAYjB,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sGAAsG;IACtG,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,WAAW,CAAC;IAC5C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAkhBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3F;AAswCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,GACtB,IAAI,CA+BN;AAiSD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IACD,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA2KA;AA+gCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CAgOjB"}
+{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAmBH,OAAO,EAYL,KAAK,gBAAgB,EAGrB,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,KAAK,WAAW,EAQjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAUL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAoBpB,OAAO,EAAE,KAAK,QAAQ,EAA2D,MAAM,YAAY,CAAC;AACpG,OAAO,KAAK,EAEV,UAAU,EAEV,oBAAoB,EAMpB,WAAW,EAGZ,MAAM,SAAS,CAAC;AAYjB,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sGAAsG;IACtG,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,WAAW,CAAC;IAC5C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uFAAuF;IACvF,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AA0hBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3F;AAswCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,GACtB,IAAI,CA+BN;AAiSD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IACD,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA2KA;AA+gCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CA+PjB"}

package/dist/batch-dispatch.js

@@ -116,7 +116,15 @@ const state_1 = require("./state");
 const teardown_1 = require("./teardown");
 const types_1 = require("./types");
 function emptyResult() {
-    return { spawned: [], completed: [], parked: [], mergeAccepted: [], failed: [], blocked: [] };
+    return {
+        spawned: [],
+        completed: [],
+        parked: [],
+        mergeAccepted: [],
+        failed: [],
+        reconciliation_errors: [],
+        blocked: [],
+    };
 }
 function unit(batchId) {
     return `batch:${batchId}`;
@@ -2902,6 +2910,22 @@ function runBatchTick(deps, config, dispatch) {
             }
         }
     };
+    const containFailure = (batchId, err) => {
+        const detail = `${err.name}: ${err.message}`;
+        // A corrupt unit must not turn into a project-wide scheduler outage.
+        // Keep the failed batch inspectable, release its slot, and continue.
+        deps.store.withLock((state) => {
+            const fresh = (0, state_1.findBatch)(state, batchId);
+            if (!fresh || types_1.TERMINAL_BATCH_STATUSES.has(fresh.status) || fresh.status === 'blocked') {
+                return { state, result: undefined };
+            }
+            const blocked = (0, state_1.transitionBatch)(state, batchId, 'blocked', { blocked_reason: 'reconcile-error' }, now);
+            return { state: (0, state_1.releaseBatchSlot)(blocked, batchId, now), result: undefined };
+        });
+        journalEvent(deps, 'unit-failed', unit(batchId), { reason: 'reconcile-error', detail });
+        result.failed.push(unit(batchId));
+        result.reconciliation_errors.push(`${unit(batchId)}: ${detail}`);
+    };
     // #565: when more ready batches exist than free capacity, claim them in
     // the same priority order `runnableUnits` would (desc priority → asc
     // readiness age → anchor) — this loop never goes through
@@ -2933,11 +2957,16 @@ function runBatchTick(deps, config, dispatch) {
         const state = deps.store.load();
         const batch = (0, state_1.findBatch)(state, batchId);
         if (batch && batch.status === 'ready' && slotFor(state, batchId) === undefined) {
-            // #707: batch-setup dispatches through the batch's own profile too — it
-            // is the batch's first agent, not an engine-internal step.
-            const batchDispatch = dispatchFor(batch);
-            if (batchDispatch !== null) {
-                claimAndSetup(deps, config, batchDispatch, batchId, now, result);
+            try {
+                // #707: batch-setup dispatches through the batch's own profile too — it
+                // is the batch's first agent, not an engine-internal step.
+                const batchDispatch = dispatchFor(batch);
+                if (batchDispatch !== null) {
+                    claimAndSetup(deps, config, batchDispatch, batchId, now, result);
+                }
+            }
+            catch (err) {
+                containFailure(batchId, err);
             }
         }
     }
@@ -2966,78 +2995,83 @@ function runBatchTick(deps, config, dispatch) {
             }
             continue;
         }
-        // #707: resolve this batch's profile once per pass — or dissolve/fall
-        // back loudly when it no longer resolves (see `dispatchFor` above).
-        // Terminal batches are skipped before this call so a removed profile does
-        // not generate a missing-profile event on every later tick.
-        const batchDispatch = dispatchFor(batch);
-        if (batchDispatch === null)
-            continue;
-        if (slot && (slot.status === 'running' || slot.status === 'assigned')) {
-            if (batch.status === 'executing') {
-                reconcileMemberSlot(deps, config, batchDispatch, batch.id, slot, now, result);
+        try {
+            // #707: resolve this batch's profile once per pass — or dissolve/fall
+            // back loudly when it no longer resolves (see `dispatchFor` above).
+            // Terminal batches are skipped before this call so a removed profile does
+            // not generate a missing-profile event on every later tick.
+            const batchDispatch = dispatchFor(batch);
+            if (batchDispatch === null)
+                continue;
+            if (slot && (slot.status === 'running' || slot.status === 'assigned')) {
+                if (batch.status === 'executing') {
+                    reconcileMemberSlot(deps, config, batchDispatch, batch.id, slot, now, result);
+                }
+                else if (batch.status === 'fixing') {
+                    reconcileFixSlot(deps, config, batch.id, slot, now, result);
+                }
+                else if (batch.status === 'reviewing' || batch.status === 'shipping') {
+                    reconcileTailSlot(deps, batch.id, slot, now, result);
+                }
+                else if (batch.status === 'deployed') {
+                    reconcileReportSlot(deps, batch.id, slot, now, result);
+                }
+                continue;
             }
-            else if (batch.status === 'fixing') {
-                reconcileFixSlot(deps, config, batch.id, slot, now, result);
+            if (slot)
+                continue; // live but neither running/assigned (e.g. mid-verify) — next tick
+            if (batch.status === 'validating') {
+                // A local suite run, not a provider dispatch — unaffected by `paused`.
+                runValidate(deps, config, batchDispatch, batch.id, now, result);
+                continue;
+            }
+            // #629: every branch below spawns a provider agent — hold the wedge
+            // until `sched resume` (see the top of this function for why `paused`
+            // is read once, up front, rather than per iteration).
+            if (paused)
+                continue;
+            if (batch.status === 'deployed') {
+                spawnReportAgent(deps, config, batchDispatch, batch.id, now, result);
+            }
+            else if (batch.status === 'executing') {
+                // A prior spawn threw, or `claimAndSpawn` found zero free capacity —
+                // either way the batch is stuck mid-member with no slot and nothing
+                // else will ever retry it (Conformance review AC5 caveat; Supportability
+                // review #12). Retrying every tick is cheap-by-contract (#677 review):
+                // `spawnMemberContinuation` runs the free-capacity and member-identity
+                // pre-checks BEFORE any pool/git work, so a full scheduler (or stale
+                // member context) exits here without exec'ing, and `claimAndSpawn`
+                // remains the authoritative capacity gate.
+                spawnMemberContinuation(deps, config, batchDispatch, batch.id, now, result);
             }
             else if (batch.status === 'reviewing' || batch.status === 'shipping') {
-                reconcileTailSlot(deps, batch.id, slot, now, result);
+                // Same wedge, for a dead-or-never-claimed tail agent.
+                spawnTailAgent(deps, config, batchDispatch, batch.id, now, result);
             }
-            else if (batch.status === 'deployed') {
-                reconcileReportSlot(deps, batch.id, slot, now, result);
+            else if (batch.status === 'fixing') {
+                // `beginFixAttempt` already recorded this member's ONE attempt as
+                // `dispatched` before `claimAndSpawn` could find capacity — retrying the
+                // exact same dispatch isn't reconstructible from persisted state (only
+                // the outcome is persisted, not the command/prompt), so resolve it
+                // `red` (conservatively: the member loses its one attempt and evicts on
+                // the next validate pass, which is safe — never a permanent wedge).
+                const state = deps.store.load();
+                const b = (0, state_1.findBatch)(state, batch.id);
+                const offenderRecord = b
+                    ? [...b.fix_attempts].reverse().find((a) => a.outcome === 'dispatched')
+                    : undefined;
+                if (b && offenderRecord) {
+                    const rDeps = recoveryDeps(deps, config, b, now);
+                    const { state: resolved } = (0, recovery_1.resolveFixAttempt)(state, batch.id, offenderRecord.issue, 'red', rDeps);
+                    deps.store.withLock((s) => ({
+                        state: applyBatchAndIssues(s, resolved, batch.id, []),
+                        result: undefined,
+                    }));
+                }
             }
-            continue;
         }
-        if (slot)
-            continue; // live but neither running/assigned (e.g. mid-verify) — next tick
-        if (batch.status === 'validating') {
-            // A local suite run, not a provider dispatch — unaffected by `paused`.
-            runValidate(deps, config, batchDispatch, batch.id, now, result);
-            continue;
-        }
-        // #629: every branch below spawns a provider agent — hold the wedge
-        // until `sched resume` (see the top of this function for why `paused`
-        // is read once, up front, rather than per iteration).
-        if (paused)
-            continue;
-        if (batch.status === 'deployed') {
-            spawnReportAgent(deps, config, batchDispatch, batch.id, now, result);
-        }
-        else if (batch.status === 'executing') {
-            // A prior spawn threw, or `claimAndSpawn` found zero free capacity —
-            // either way the batch is stuck mid-member with no slot and nothing
-            // else will ever retry it (Conformance review AC5 caveat; Supportability
-            // review #12). Retrying every tick is cheap-by-contract (#677 review):
-            // `spawnMemberContinuation` runs the free-capacity and member-identity
-            // pre-checks BEFORE any pool/git work, so a full scheduler (or stale
-            // member context) exits here without exec'ing, and `claimAndSpawn`
-            // remains the authoritative capacity gate.
-            spawnMemberContinuation(deps, config, batchDispatch, batch.id, now, result);
-        }
-        else if (batch.status === 'reviewing' || batch.status === 'shipping') {
-            // Same wedge, for a dead-or-never-claimed tail agent.
-            spawnTailAgent(deps, config, batchDispatch, batch.id, now, result);
-        }
-        else if (batch.status === 'fixing') {
-            // `beginFixAttempt` already recorded this member's ONE attempt as
-            // `dispatched` before `claimAndSpawn` could find capacity — retrying the
-            // exact same dispatch isn't reconstructible from persisted state (only
-            // the outcome is persisted, not the command/prompt), so resolve it
-            // `red` (conservatively: the member loses its one attempt and evicts on
-            // the next validate pass, which is safe — never a permanent wedge).
-            const state = deps.store.load();
-            const b = (0, state_1.findBatch)(state, batch.id);
-            const offenderRecord = b
-                ? [...b.fix_attempts].reverse().find((a) => a.outcome === 'dispatched')
-                : undefined;
-            if (b && offenderRecord) {
-                const rDeps = recoveryDeps(deps, config, b, now);
-                const { state: resolved } = (0, recovery_1.resolveFixAttempt)(state, batch.id, offenderRecord.issue, 'red', rDeps);
-                deps.store.withLock((s) => ({
-                    state: applyBatchAndIssues(s, resolved, batch.id, []),
-                    result: undefined,
-                }));
-            }
+        catch (err) {
+            containFailure(batch.id, err);
         }
     }
     reconcilePrWatch(deps, now, result);