@aiwg/cli 2026.10.8 → 2026.10.10

package/dist/src/resources/web-release.js

@@ -433,6 +433,9 @@ async function fetchBytes(fetcher, url, label, maxBytes, bearerToken) {
     catch (error) {
         if (timedOut)
             throw new Error(`${label} request timed out after ${RESOURCE_FETCH_TIMEOUT_MS}ms`);
+        const message = error instanceof Error ? error.message : String(error);
+        if (bearerToken && message.includes(bearerToken))
+            throw new Error(message.split(bearerToken).join('[REDACTED]'));
         throw error;
     }
     finally {
@@ -1072,80 +1075,88 @@ export async function resolveWebRelease(options = {}) {
         const headers = { ...(init.headers || {}), ...(bearerToken ? { authorization: `Bearer ${bearerToken}` } : {}) };
         return (options.fetcher ?? globalThis.fetch)(input, { ...init, headers });
     };
-    if (selector.kind === "exact") {
-        if (options.offline)
-            return resolveOfflineExact(cacheRoot, selector, selector.value, publicKeyPem, base);
-        const fetcher = authorize;
-        if (!fetcher)
-            throw new Error("No fetch implementation is available for AIWG web resources");
-        return fetchAndCacheRelease(base, fetcher, cacheRoot, selector, selector.value, publicKeyPem);
-    }
-    if (selector.kind === "range" || selector.kind === "digest") {
-        if (!options.offline && selector.kind === "digest") {
-            for (const version of cachedReleaseVersions(cacheRoot)) {
-                if (!cachedDigests(cacheRoot, version).includes(selector.digest))
-                    continue;
-                try {
-                    return verifyCachedGeneration(cacheRoot, version, selector.digest, selector, publicKeyPem, base, selector.digest);
-                }
-                catch {
-                    // A corrupt immutable generation cannot bypass signed index resolution.
+    try {
+        if (selector.kind === "exact") {
+            if (options.offline)
+                return resolveOfflineExact(cacheRoot, selector, selector.value, publicKeyPem, base);
+            const fetcher = authorize;
+            if (!fetcher)
+                throw new Error("No fetch implementation is available for AIWG web resources");
+            return await fetchAndCacheRelease(base, fetcher, cacheRoot, selector, selector.value, publicKeyPem);
+        }
+        if (selector.kind === "range" || selector.kind === "digest") {
+            if (!options.offline && selector.kind === "digest") {
+                for (const version of cachedReleaseVersions(cacheRoot)) {
+                    if (!cachedDigests(cacheRoot, version).includes(selector.digest))
+                        continue;
+                    try {
+                        return verifyCachedGeneration(cacheRoot, version, selector.digest, selector, publicKeyPem, base, selector.digest);
+                    }
+                    catch {
+                        // A corrupt immutable generation cannot bypass signed index resolution.
+                    }
                 }
             }
+            const fetcher = authorize;
+            const index = await resolveVersionIndex(base, fetcher, cacheRoot, publicKeyPem, options.offline, options.onDiagnostic);
+            const selected = selectVersionFromIndex(index, selector);
+            if (options.offline) {
+                return resolveOfflineExact(cacheRoot, selector, selected.version, publicKeyPem, base, selected.releaseManifestSha256);
+            }
+            if (!fetcher)
+                throw new Error("No fetch implementation is available for AIWG web resources");
+            return await fetchAndCacheRelease(base, fetcher, cacheRoot, selector, selected.version, publicKeyPem, selected.releaseManifestSha256);
         }
-        const fetcher = authorize;
-        const index = await resolveVersionIndex(base, fetcher, cacheRoot, publicKeyPem, options.offline, options.onDiagnostic);
-        const selected = selectVersionFromIndex(index, selector);
         if (options.offline) {
-            return resolveOfflineExact(cacheRoot, selector, selected.version, publicKeyPem, base, selected.releaseManifestSha256);
+            const cached = readCachedChannel(cacheRoot, selector.value, publicKeyPem);
+            if (!cached)
+                throw new Error(`AIWG resource channel ${selector.value} is not cached; offline mode cannot fetch it`);
+            const release = resolveOfflineExact(cacheRoot, selector, cached.manifest.version, publicKeyPem, base, cached.manifest.releaseManifestSha256, cached.manifest.sequence);
+            return cached.manifest.expiresAt ? { ...release, channelExpiresAt: cached.manifest.expiresAt } : release;
         }
+        const fetcher = authorize;
         if (!fetcher)
             throw new Error("No fetch implementation is available for AIWG web resources");
-        return fetchAndCacheRelease(base, fetcher, cacheRoot, selector, selected.version, publicKeyPem, selected.releaseManifestSha256);
-    }
-    if (options.offline) {
-        const cached = readCachedChannel(cacheRoot, selector.value, publicKeyPem);
-        if (!cached)
-            throw new Error(`AIWG resource channel ${selector.value} is not cached; offline mode cannot fetch it`);
-        const release = resolveOfflineExact(cacheRoot, selector, cached.manifest.version, publicKeyPem, base, cached.manifest.releaseManifestSha256, cached.manifest.sequence);
-        return cached.manifest.expiresAt ? { ...release, channelExpiresAt: cached.manifest.expiresAt } : release;
-    }
-    const fetcher = authorize;
-    if (!fetcher)
-        throw new Error("No fetch implementation is available for AIWG web resources");
-    const channelPrefix = `resources/channels/${selector.value}`;
-    let prior = null;
-    try {
-        prior = readCachedChannel(cacheRoot, selector.value, publicKeyPem);
+        const channelPrefix = `resources/channels/${selector.value}`;
+        let prior = null;
+        try {
+            prior = readCachedChannel(cacheRoot, selector.value, publicKeyPem);
+        }
+        catch {
+            prior = null;
+        }
+        const fetched = await fetchMetadata(fetcher, resourceUrl(base, `${channelPrefix}.json`), `channel ${selector.value}`, MAX_SIGNED_METADATA_BYTES, prior?.validator);
+        if (fetched.notModified) {
+            cacheChannel(cacheRoot, prior.manifest, prior.bytes, prior.signatureBytes, prior.digest, fetched.validator);
+            options.onDiagnostic?.({ resource: "channel", outcome: "conditional-hit", validator: prior.validator.etag ? "etag" : "last-modified" });
+            const release = await fetchAndCacheRelease(base, fetcher, cacheRoot, selector, prior.manifest.version, publicKeyPem, prior.manifest.releaseManifestSha256, prior.manifest.sequence);
+            return prior.manifest.expiresAt ? { ...release, channelExpiresAt: prior.manifest.expiresAt } : release;
+        }
+        const channelBytes = fetched.bytes;
+        const channelSignatureBytes = await fetchBytes(fetcher, resourceUrl(base, `${channelPrefix}.sig`), `channel ${selector.value} signature`, MAX_SIGNATURE_BYTES);
+        const channelDigest = verifySignedResourceBytes(channelBytes, channelSignatureBytes, publicKeyPem, `channel ${selector.value}`);
+        const channel = validateChannelManifest(parseJson(channelBytes, `channel ${selector.value}`), selector.value);
+        if (prior && channel.sequence < prior.manifest.sequence) {
+            throw new Error(`channel ${selector.value} sequence rollback detected (${channel.sequence} < ${prior.manifest.sequence})`);
+        }
+        if (prior &&
+            channel.sequence === prior.manifest.sequence &&
+            (channelDigest !== prior.digest ||
+                channel.version !== prior.manifest.version ||
+                channel.releaseManifestSha256 !== prior.manifest.releaseManifestSha256)) {
+            throw new Error(`channel ${selector.value} sequence ${channel.sequence} has conflicting signed metadata`);
+        }
+        const release = await fetchAndCacheRelease(base, fetcher, cacheRoot, selector, channel.version, publicKeyPem, channel.releaseManifestSha256, channel.sequence);
+        cacheChannel(cacheRoot, channel, channelBytes, channelSignatureBytes, channelDigest, fetched.validator);
+        options.onDiagnostic?.({ resource: "channel", outcome: prior?.validator ? "revalidated" : "unconditional", validator: fetched.validator?.etag ? "etag" : fetched.validator?.lastModified ? "last-modified" : "none" });
+        return channel.expiresAt ? { ...release, channelExpiresAt: channel.expiresAt } : release;
     }
-    catch {
-        prior = null;
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (bearerToken && message.includes(bearerToken))
+            throw new Error(message.split(bearerToken).join('[REDACTED]'));
+        throw error;
     }
-    const fetched = await fetchMetadata(fetcher, resourceUrl(base, `${channelPrefix}.json`), `channel ${selector.value}`, MAX_SIGNED_METADATA_BYTES, prior?.validator);
-    if (fetched.notModified) {
-        cacheChannel(cacheRoot, prior.manifest, prior.bytes, prior.signatureBytes, prior.digest, fetched.validator);
-        options.onDiagnostic?.({ resource: "channel", outcome: "conditional-hit", validator: prior.validator.etag ? "etag" : "last-modified" });
-        const release = await fetchAndCacheRelease(base, fetcher, cacheRoot, selector, prior.manifest.version, publicKeyPem, prior.manifest.releaseManifestSha256, prior.manifest.sequence);
-        return prior.manifest.expiresAt ? { ...release, channelExpiresAt: prior.manifest.expiresAt } : release;
-    }
-    const channelBytes = fetched.bytes;
-    const channelSignatureBytes = await fetchBytes(fetcher, resourceUrl(base, `${channelPrefix}.sig`), `channel ${selector.value} signature`, MAX_SIGNATURE_BYTES);
-    const channelDigest = verifySignedResourceBytes(channelBytes, channelSignatureBytes, publicKeyPem, `channel ${selector.value}`);
-    const channel = validateChannelManifest(parseJson(channelBytes, `channel ${selector.value}`), selector.value);
-    if (prior && channel.sequence < prior.manifest.sequence) {
-        throw new Error(`channel ${selector.value} sequence rollback detected (${channel.sequence} < ${prior.manifest.sequence})`);
-    }
-    if (prior &&
-        channel.sequence === prior.manifest.sequence &&
-        (channelDigest !== prior.digest ||
-            channel.version !== prior.manifest.version ||
-            channel.releaseManifestSha256 !== prior.manifest.releaseManifestSha256)) {
-        throw new Error(`channel ${selector.value} sequence ${channel.sequence} has conflicting signed metadata`);
-    }
-    const release = await fetchAndCacheRelease(base, fetcher, cacheRoot, selector, channel.version, publicKeyPem, channel.releaseManifestSha256, channel.sequence);
-    cacheChannel(cacheRoot, channel, channelBytes, channelSignatureBytes, channelDigest, fetched.validator);
-    options.onDiagnostic?.({ resource: "channel", outcome: prior?.validator ? "revalidated" : "unconditional", validator: fetched.validator?.etag ? "etag" : fetched.validator?.lastModified ? "last-modified" : "none" });
-    return channel.expiresAt ? { ...release, channelExpiresAt: channel.expiresAt } : release;
 }
 export async function fetchVerifiedRawResource(release, resourcePath, options = {}) {
     assertSafeRelativePath(resourcePath, "raw resource path");

package/dist/src/serve/shared-host-admission-checks.js

@@ -0,0 +1,116 @@
+export function attemptBlock(snapshot, candidate, policy, now) {
+    const accounting = candidate.accounting;
+    const deny = (cause, kind = 'policy-exclusion') => ({ kind, cause, terminal: true });
+    const attempts = Object.values(snapshot.records).filter(record => record.accounting?.attemptNumber !== undefined);
+    const taskAttempts = attempts.filter(record => record.accounting.taskKey === accounting.taskKey);
+    if (taskAttempts.length) {
+        const previous = taskAttempts.sort((a, b) => a.accounting.attemptNumber - b.accounting.attemptNumber).at(-1);
+        if (candidate.allowance?.previousRequestId !== previous.requestId)
+            return deny('new attempt must reference the latest task attempt');
+        if (previous.state !== 'settled')
+            return deny('previous attempt requires proof-checked reconciliation before replacement');
+        const failure = previous.accounting.failure;
+        const purpose = candidate.allowance?.purpose ?? 'retry';
+        if (purpose === 'retry' || purpose === 'fallback' || failure?.class === 'rate-limit') {
+            if (!failure || !failure.retryable || !['rate-limit', 'unavailable', 'timeout'].includes(failure.class))
+                return deny('previous failure does not permit automatic retry');
+            if (!(policy.managed.retry?.on ?? ['rate-limit', 'unavailable', 'timeout']).includes(failure.class))
+                return deny(`${failure.class} retries are disabled`);
+        }
+    }
+    else if (candidate.allowance?.previousRequestId)
+        return deny('unknown previous task attempt');
+    for (const key of [accounting.runKey, accounting.taskKey]) {
+        const scope = snapshot.allowances[key];
+        if (Date.parse(scope.deadlineAt ?? '') <= now)
+            return deny('cumulative allowance deadline elapsed');
+        const prior = attempts.filter(record => record.accounting.runKey === key || record.accounting.taskKey === key);
+        if (scope.limits.maxAttempts !== undefined && prior.reduce((sum, record) => sum + record.accounting.attemptCount, 0) + accounting.attemptCount > scope.limits.maxAttempts)
+            return deny('cumulative attempt allowance exhausted', 'budget-denial');
+        for (const [dimension, limit] of [['tokens', scope.limits.maxTokens], ['costUsd', scope.limits.maxCostUsd]]) {
+            if (limit === undefined)
+                continue;
+            let used = 0;
+            for (const record of prior) {
+                const value = chargedUsage(record, dimension);
+                if (value === null)
+                    return deny(`unknown ${dimension} charge has no finite reservation`, 'budget-denial');
+                used += value;
+            }
+            const reserved = accounting.reservation[dimension];
+            if (reserved === null || reserved === 0 || used + reserved > limit)
+                return deny(`cumulative ${dimension} reservation exceeds allowance`, 'budget-denial');
+        }
+    }
+    if (taskAttempts.some(record => Date.parse(record.accounting.notBefore ?? '') > now))
+        return { kind: 'policy-exclusion', cause: 'retry-backoff', terminal: false };
+    if (policy.managed.budgets?.unknownCost === 'deny' && accounting.reservation.costUsd === null)
+        return deny('unknown cost is denied by policy', 'budget-denial');
+    const quotaScope = candidate.managed?.cli && snapshot.hostBinding
+        ? policy.managed.upstream[candidate.managed.cli].quotaScope : candidate.managed?.quotaScope;
+    const quotas = quotaScope ? [`quota/${encodeURIComponent(quotaScope)}`]
+        : Object.keys(snapshot.cooldowns ?? {});
+    if (quotas.some(key => Date.parse(snapshot.cooldowns?.[key]?.until ?? '') > now))
+        return { kind: 'policy-exclusion', cause: 'quota-cooldown', terminal: false };
+    return undefined;
+}
+function chargedUsage(record, dimension) {
+    const accounting = record.accounting;
+    const usage = accounting.usage;
+    const measured = !usage || usage.quality === 'unknown' ? null : dimension === 'costUsd' ? usage.costUsd
+        : usage.inputTokens === null || usage.outputTokens === null || usage.cacheTokens === null || usage.reasoningTokens === null ? null
+            : usage.inputTokens + usage.outputTokens + usage.cacheTokens + usage.reasoningTokens;
+    const reservation = accounting.reservation[dimension];
+    // Uncertain execution can still accrue spend; estimates never refund a reserve.
+    if (record.state !== 'settled' || usage?.quality !== 'reported') {
+        return reservation === null || measured === null ? reservation : Math.max(reservation, measured);
+    }
+    return measured ?? reservation;
+}
+export function capacityBlock(snapshot, candidate, policy, now = -Infinity) {
+    const slots = policy.managed ? candidate.reservedSlots ?? 1 : 1;
+    const active = Object.values(snapshot.records).filter(record => record.state === 'admitted' || (policy.managed && record.state === 'uncertain'));
+    const limits = [
+        { dimension: 'global', cap: policy.maxConcurrent, matches: () => true },
+    ];
+    if (policy.managed)
+        for (const key of candidate.dimensions ?? []) {
+            const cap = policy.managed.dimensionCaps[key];
+            if (cap !== undefined)
+                limits.push({ dimension: key, cap, matches: record => !record.dimensions || record.dimensions.includes(key) });
+        }
+    for (const [field, quotas] of [
+        ['environment', policy.environmentQuotas], ['provider', policy.providerQuotas],
+        ['runtimeKind', { host: policy.defaultHostQuota ?? 1, ...policy.runtimeQuotas }],
+    ]) {
+        const cap = quotas?.[candidate[field]];
+        if (cap !== undefined)
+            limits.push({ dimension: `${field}/${candidate[field]}`, cap: policy.managed ? cap : Math.ceil(cap), matches: record => record[field] === candidate[field] });
+    }
+    const impossible = limits.find(limit => slots > limit.cap);
+    if (impossible)
+        return { kind: 'policy-exclusion', cause: 'request-exceeds-cap', dimension: impossible.dimension, terminal: false };
+    const used = (records, limit) => records.filter(limit.matches)
+        .reduce((sum, record) => sum + (policy.managed ? record.reservedSlots ?? 1 : 1), 0);
+    const blocked = limits.filter(limit => used(active, limit) + slots > limit.cap);
+    if (!blocked.length)
+        return undefined;
+    const dimensions = blocked.map(limit => limit.dimension);
+    const certain = active.filter(record => record.state === 'admitted' && !(Date.parse(record.leaseExpiresAt ?? '') <= now));
+    if (policy.managed && blocked.some(limit => used(certain, limit) + slots <= limit.cap)) {
+        return { kind: 'safety-blocked', cause: 'uncertain-lease', dimension: dimensions[0], dimensions, terminal: false };
+    }
+    return { kind: 'capacity-wait', cause: 'capacity-cap', dimension: dimensions[0], dimensions, terminal: false };
+}
+/** Past retry/cooldown exclusion does not count toward an eligible service gap. */
+export function attemptReadyAt(snapshot, candidate, policy) {
+    const retry = Object.values(snapshot.records).filter(record => record.accounting?.attemptNumber !== undefined
+        && record.accounting.taskKey === candidate.accounting?.taskKey)
+        .reduce((latest, record) => Math.max(latest, Date.parse(record.accounting.notBefore ?? '') || 0), 0);
+    const quota = candidate.managed?.cli && snapshot.hostBinding
+        ? policy.managed.upstream[candidate.managed.cli].quotaScope : candidate.managed?.quotaScope;
+    const cooldown = Object.entries(snapshot.cooldowns ?? {}).filter(([key]) => !quota || key === `quota/${encodeURIComponent(quota)}`)
+        .reduce((latest, [, value]) => Math.max(latest, Date.parse(value.until) || 0), 0);
+    return Math.max(retry, cooldown);
+}
+//# sourceMappingURL=shared-host-admission-checks.js.map

package/dist/src/serve/shared-host-scheduler.js

@@ -14,6 +14,9 @@ import { hostname } from 'node:os';
 import { createHash } from 'node:crypto';
 import { advanceProgressWatermark, assertMissionWorkerHandoff, assertValidWorkerPayload, decideLeaseMapping, projectHealthTrace } from '../mission-protocol/codecs.js';
 import { isCanonicalWorkerModelKey } from '../models/provider-policy.js';
+import { attemptBlock, capacityBlock } from './shared-host-admission-checks.js';
+import { projectAdmissionDiagnostics } from './shared-host-starvation.js';
+import { resolveParallelism } from '../config/aiwg-config.js';
 /** Translate existing owner ceilings without creating another budget contract. */
 export function managedAllowanceFromOwner(runId, taskId, owner) {
     const budgets = owner.kind === 'mission' ? owner.budgets : owner.kind === 'ralph' ? {
@@ -57,8 +60,8 @@ export function managedDimensionKeys(projectId, worker) {
         ...(worker.quotaScope ? [`quota/${encodeURIComponent(worker.quotaScope)}`] : []),
     ];
 }
-/** Build the project policy for the existing config/activation owner. */
 export function managedProjectAdmissionPolicy(projectRoot, parallelism, policyDigest, maxConcurrent) {
+    parallelism = resolveParallelism(parallelism);
     const { projectId } = projectAdmissionAuthority(projectRoot);
     const admission = parallelism.admission;
     if ((admission?.authorityRef ?? 'project') !== 'project')
@@ -90,6 +93,7 @@ export function managedProjectAdmissionPolicy(projectRoot, parallelism, policyDi
         add({ kind: 'native', quotaScope }, cap);
     return {
         maxConcurrent, leaseTtlMs: (admission?.leaseSeconds ?? 60) * 1000,
+        starvationThresholdMs: (admission?.starvationSeconds ?? 120) * 1000,
         agingIntervalMs: 30_000, allowPreemption: false, defaultHostQuota: maxConcurrent,
         managed: {
             authorityRef: 'project', projectId, policyDigest, maxQueued: admission?.maxQueued ?? 128,
@@ -97,7 +101,7 @@ export function managedProjectAdmissionPolicy(projectRoot, parallelism, policyDi
             budgets: parallelism.budgets, retry: parallelism.retry,
             installations: Object.fromEntries(Object.entries(parallelism.clis ?? {}).filter(([, cli]) => cli.enabled !== false)
                 .map(([id, cli]) => [id, { accountScope: cli.accountScope, quotaScope: cli.quotaScope }])),
-            members: Object.fromEntries(Object.entries(parallelism.groups ?? {}).flatMap(([group, definition]) => definition.members.filter(member => member.enabled !== false && parallelism.clis?.[member.cli]?.enabled !== false)
+            members: Object.fromEntries(Object.entries(parallelism.groups ?? {}).flatMap(([group, definition]) => (definition.members ?? []).filter(member => member.enabled !== false && parallelism.clis?.[member.cli]?.enabled !== false)
                 .map(member => [`${group}/${member.id}`, { cli: member.cli }]))),
         },
     };
@@ -256,16 +260,21 @@ export class SharedHostScheduler {
     store;
     policy;
     clock;
-    constructor(store, policy, clock = Date.now) {
+    checkActivation;
+    constructor(store, policy, clock = Date.now, checkActivation) {
         this.store = store;
         this.policy = policy;
         this.clock = clock;
+        this.checkActivation = checkActivation;
         if (!Number.isInteger(policy.maxConcurrent) || policy.maxConcurrent < 1) {
             throw new Error('maxConcurrent must be a positive integer');
         }
         if (policy.leaseTtlMs < 1 || policy.agingIntervalMs < 1) {
             throw new Error('leaseTtlMs and agingIntervalMs must be positive');
         }
+        if (!Number.isSafeInteger(policy.starvationThresholdMs ?? 120_000) || (policy.starvationThresholdMs ?? 120_000) < 1) {
+            throw new Error('starvationThresholdMs must be a positive safe integer');
+        }
         if (policy.managed)
             this.policy = structuredClone(policy);
         const managed = this.policy.managed;
@@ -347,6 +356,7 @@ export class SharedHostScheduler {
                 const record = snapshot.records[requestKey];
                 record.state = 'denied';
                 record.reason = 'managed admission queue is full';
+                record.denial = { kind: 'policy-exclusion', cause: record.reason, terminal: true };
                 record.finishedAt = new Date(this.clock()).toISOString();
                 record.revision += 1;
             }
@@ -609,6 +619,7 @@ export class SharedHostScheduler {
             snapshot.allowances = Object.fromEntries(Object.entries(snapshot.allowances ?? {})
                 .filter(([key]) => JSON.parse(key)[0] === projectId));
         }
+        snapshot.diagnostics = projectAdmissionDiagnostics(value, record => this.policyFor(value, record), this.clock(), this.policy.managed?.authorityRef.startsWith('host:') ? this.policy.managed.projectId : undefined);
         return snapshot;
     }
     reconcile(snapshot) {
@@ -717,66 +728,17 @@ export class SharedHostScheduler {
         };
     }
     allowAttempt(snapshot, candidate, now) {
-        const accounting = candidate.accounting;
-        const deny = (reason) => {
+        const block = attemptBlock(snapshot, candidate, this.policyFor(snapshot, candidate), now);
+        if (!block)
+            return true;
+        if (block.terminal) {
             candidate.state = 'denied';
-            candidate.reason = reason;
+            candidate.reason = block.cause;
+            candidate.denial = block;
             candidate.finishedAt = new Date(now).toISOString();
             candidate.revision += 1;
-            return false;
-        };
-        const attempts = Object.values(snapshot.records).filter(record => record.accounting?.attemptNumber !== undefined);
-        const taskAttempts = attempts.filter(record => record.accounting.taskKey === accounting.taskKey);
-        if (taskAttempts.length) {
-            const previous = taskAttempts.sort((a, b) => a.accounting.attemptNumber - b.accounting.attemptNumber).at(-1);
-            if (candidate.allowance?.previousRequestId !== previous.requestId)
-                return deny('new attempt must reference the latest task attempt');
-            if (previous.state !== 'settled')
-                return deny('previous attempt requires proof-checked reconciliation before replacement');
-            const failure = previous.accounting.failure;
-            const purpose = candidate.allowance?.purpose ?? 'retry';
-            if (purpose === 'retry' || purpose === 'fallback' || failure?.class === 'rate-limit') {
-                if (!failure || !failure.retryable || !['rate-limit', 'unavailable', 'timeout'].includes(failure.class))
-                    return deny('previous failure does not permit automatic retry');
-                if (!(this.policyFor(snapshot, candidate).managed.retry?.on ?? ['rate-limit', 'unavailable', 'timeout']).includes(failure.class))
-                    return deny(`${failure.class} retries are disabled`);
-            }
-        }
-        else if (candidate.allowance?.previousRequestId)
-            return deny('unknown previous task attempt');
-        for (const key of [accounting.runKey, accounting.taskKey]) {
-            const scope = snapshot.allowances[key];
-            if (Date.parse(scope.deadlineAt ?? '') <= now)
-                return deny('cumulative allowance deadline elapsed');
-            const prior = attempts.filter(record => record.accounting.runKey === key || record.accounting.taskKey === key);
-            if (scope.limits.maxAttempts !== undefined && prior.reduce((sum, record) => sum + record.accounting.attemptCount, 0) + accounting.attemptCount > scope.limits.maxAttempts)
-                return deny('cumulative attempt allowance exhausted');
-            for (const [dimension, limit] of [['tokens', scope.limits.maxTokens], ['costUsd', scope.limits.maxCostUsd]]) {
-                if (limit === undefined)
-                    continue;
-                let used = 0;
-                for (const record of prior) {
-                    const value = chargedUsage(record, dimension);
-                    if (value === null)
-                        return deny(`unknown ${dimension} charge has no finite reservation`);
-                    used += value;
-                }
-                const reserved = accounting.reservation[dimension];
-                if (reserved === null || reserved === 0 || used + reserved > limit)
-                    return deny(`cumulative ${dimension} reservation exceeds allowance`);
-            }
         }
-        if (taskAttempts.some(record => Date.parse(record.accounting.notBefore ?? '') > now))
-            return false;
-        if (this.policyFor(snapshot, candidate).managed.budgets?.unknownCost === 'deny' && accounting.reservation.costUsd === null)
-            return deny('unknown cost is denied by policy');
-        const quotaScope = candidate.managed?.cli && snapshot.hostBinding
-            ? this.policyFor(snapshot, candidate).managed.upstream[candidate.managed.cli].quotaScope : candidate.managed?.quotaScope;
-        const quotas = quotaScope ? [`quota/${encodeURIComponent(quotaScope)}`]
-            : Object.keys(snapshot.cooldowns ?? {});
-        if (quotas.some(key => Date.parse(snapshot.cooldowns?.[key]?.until ?? '') > now))
-            return false;
-        return true;
+        return false;
     }
     tryPreempt(snapshot, candidate, now) {
         const victims = Object.values(snapshot.records)
@@ -800,31 +762,7 @@ export class SharedHostScheduler {
         victim.revision += 1;
     }
     hasCapacity(snapshot, candidate) {
-        const policy = this.policyFor(snapshot, candidate);
-        const active = Object.values(snapshot.records).filter(record => record.state === 'admitted' || (policy.managed && record.state === 'uncertain'));
-        const slots = policy.managed ? candidate.reservedSlots ?? 1 : 1;
-        if (active.reduce((sum, record) => sum + (policy.managed ? record.reservedSlots ?? 1 : 1), 0) + slots > policy.maxConcurrent)
-            return false;
-        if (policy.managed) {
-            for (const key of candidate.dimensions ?? []) {
-                const cap = policy.managed.dimensionCaps[key];
-                if (cap === undefined)
-                    continue;
-                const used = active.filter(record => !record.dimensions || record.dimensions.includes(key))
-                    .reduce((sum, record) => sum + (record.reservedSlots ?? 1), 0);
-                if (used + slots > cap)
-                    return false;
-            }
-        }
-        if (!belowQuota(active, 'environment', candidate.environment, policy.environmentQuotas, slots, !!policy.managed))
-            return false;
-        if (!belowQuota(active, 'provider', candidate.provider, policy.providerQuotas, slots, !!policy.managed))
-            return false;
-        const runtimeQuotas = {
-            host: policy.defaultHostQuota ?? 1,
-            ...policy.runtimeQuotas,
-        };
-        return belowQuota(active, 'runtimeKind', candidate.runtimeKind, runtimeQuotas, slots, !!policy.managed);
+        return !capacityBlock(snapshot, candidate, this.policyFor(snapshot, candidate));
     }
     effectivePriority(record, now) {
         const waited = Math.max(0, now - Date.parse(record.submittedAt));
@@ -927,6 +865,7 @@ export class SharedHostScheduler {
         }
     }
     assertSubmissionsOpen(snapshot) {
+        this.checkActivation?.();
         if (snapshot.migration || snapshot.authorityRedirect)
             throw new Error('admission authority is frozen for migration');
     }
@@ -1028,6 +967,7 @@ export function hostProjectAdmissionPolicy(snapshot, projectId) {
     return {
         ...structuredClone(host.policy),
         leaseTtlMs: Math.min(host.policy.leaseTtlMs, project.policy.leaseTtlMs),
+        starvationThresholdMs: Math.min(host.policy.starvationThresholdMs ?? 120_000, project.policy.starvationThresholdMs ?? 120_000),
         managed: {
             ...structuredClone(managed), authorityRef: host.authorityRef, hostPolicyRevision: host.revision,
             authorityGeneration: generation, maxQueued: Math.min(host.maxQueued, managed.maxQueued),
@@ -1271,18 +1211,9 @@ function isCanonicalManagedDimension(projectId, key) {
     return false;
 }
 function sameManagedRequest(record, request) {
-    const { state: _state, revision: _revision, reason: _reason, admittedAt: _admittedAt, leaseExpiresAt: _leaseExpiresAt, finishedAt: _finishedAt, preemptedBy: _preemptedBy, projectId: _project, attemptGeneration: _attempt, leaseGeneration: _lease, dimensions: _dimensions, reservedSlots: _slots, accounting: _accounting, launchClaimedAt: _launch, execution: _execution, health: _health, lastProgressAt: _progress, finalEvidence: _final, ...original } = record;
+    const { state: _state, revision: _revision, reason: _reason, denial: _denial, admittedAt: _admittedAt, leaseExpiresAt: _leaseExpiresAt, finishedAt: _finishedAt, preemptedBy: _preemptedBy, projectId: _project, attemptGeneration: _attempt, leaseGeneration: _lease, dimensions: _dimensions, reservedSlots: _slots, accounting: _accounting, launchClaimedAt: _launch, execution: _execution, health: _health, lastProgressAt: _progress, finalEvidence: _final, ...original } = record;
     return canonical(original) === canonical(request);
 }
-function belowQuota(active, field, value, quotas, slots = 1, managed = false) {
-    const quota = quotas?.[String(value)];
-    if (quota === undefined)
-        return true;
-    if (!managed)
-        return active.filter(record => record[field] === value).length < quota;
-    return active.filter(record => record[field] === value)
-        .reduce((sum, record) => sum + (record.reservedSlots ?? 1), 0) + slots <= quota;
-}
 function sameRequest(record, request) {
     return record.orchestratorId === request.orchestratorId
         && record.environment === request.environment
@@ -1311,19 +1242,6 @@ function intersectBudgets(...budgets) {
         }
     return result;
 }
-function chargedUsage(record, dimension) {
-    const accounting = record.accounting;
-    const usage = accounting.usage;
-    const measured = !usage || usage.quality === 'unknown' ? null : dimension === 'costUsd' ? usage.costUsd
-        : usage.inputTokens === null || usage.outputTokens === null || usage.cacheTokens === null || usage.reasoningTokens === null ? null
-            : usage.inputTokens + usage.outputTokens + usage.cacheTokens + usage.reasoningTokens;
-    const reservation = accounting.reservation[dimension];
-    // Uncertain execution can still accrue spend; estimates never refund a reserve.
-    if (record.state !== 'settled' || usage?.quality !== 'reported') {
-        return reservation === null || measured === null ? reservation : Math.max(reservation, measured);
-    }
-    return measured ?? reservation;
-}
 function canRefineUsage(previous, next) {
     const rank = { unknown: 0, estimated: 1, reported: 2 };
     if (rank[next.quality] < rank[previous.quality])

package/dist/src/serve/shared-host-starvation.js

@@ -0,0 +1,73 @@
+// Project bounded group/run service diagnostics without changing admission decisions.
+import { createHash } from 'node:crypto';
+import { attemptBlock, attemptReadyAt, capacityBlock } from './shared-host-admission-checks.js';
+const maximumFindings = 64;
+const label = (value) => Buffer.byteLength(value, 'utf8') <= 256 ? value
+    : `${Buffer.from(value).subarray(0, 180).toString('utf8')}#${createHash('sha256').update(value).digest('hex')}`;
+const run = (record) => record.allowance?.runId ?? record.orchestratorId;
+const elapsed = (now, since) => Math.max(0, now - since);
+export function projectAdmissionDiagnostics(snapshot, policyFor, now, projectId) {
+    const records = Object.values(snapshot.records);
+    const findings = new Map();
+    // Current waits take precedence over historical denials. Stable ties make
+    // truncation repeatable across independent readers of the durable snapshot.
+    const candidates = records.filter(record => record.managed && (!projectId || record.projectId === projectId)
+        && (record.state === 'queued' || (record.state === 'denied' && record.denial)))
+        .sort((a, b) => Number(a.state === 'denied') - Number(b.state === 'denied')
+        || (a.state === 'denied' ? Date.parse(b.finishedAt) - Date.parse(a.finishedAt) : Date.parse(a.submittedAt) - Date.parse(b.submittedAt))
+        || a.requestId.localeCompare(b.requestId));
+    for (const candidate of candidates) {
+        const submitted = Date.parse(candidate.submittedAt);
+        if (candidate.state === 'queued' && submitted + candidate.queueTimeoutMs <= now)
+            continue;
+        const policy = policyFor(candidate);
+        const thresholdMs = policy.starvationThresholdMs ?? 120_000;
+        const waitMs = elapsed(candidate.state === 'denied' ? Date.parse(candidate.finishedAt) : now, submitted);
+        if (candidate.state === 'queued' && waitMs < thresholdMs)
+            continue;
+        let block = candidate.denial;
+        if (candidate.state === 'queued') {
+            block = snapshot.migration || snapshot.authorityRedirect
+                ? { kind: 'policy-exclusion', cause: 'authority-frozen', terminal: false }
+                : !candidate.accounting
+                    ? { kind: 'safety-blocked', cause: 'allowance-reconciliation-required', terminal: false }
+                    : attemptBlock(snapshot, candidate, policy, now) ?? capacityBlock(snapshot, candidate, policy, now);
+        }
+        if (!block)
+            continue;
+        const scopes = [
+            ...(candidate.managed?.group ? [['group', candidate.managed.group]] : []), ['run', run(candidate)],
+        ];
+        for (const [scope, scopeId] of scopes) {
+            const sameScope = (record) => record.projectId === candidate.projectId
+                && (scope === 'group' ? record.managed?.group === scopeId : run(record) === scopeId);
+            const lastService = records.filter(sameScope).reduce((latest, record) => Math.max(latest, Date.parse(record.admittedAt ?? '') || 0), Math.max(submitted, attemptReadyAt(snapshot, candidate, policy)));
+            const serviceWaitMs = elapsed(now, lastService);
+            // Admissions from other projects also compete at host-wide dimensions;
+            // only counts, never other projects' identities, enter the public view.
+            const consumes = (record, dimension) => dimension === 'global'
+                || (dimension.startsWith('environment/') ? record.environment === candidate.environment
+                    : dimension.startsWith('provider/') ? record.provider === candidate.provider
+                        : dimension.startsWith('runtimeKind/') ? record.runtimeKind === candidate.runtimeKind
+                            : !record.dimensions || record.dimensions.includes(dimension));
+            // Every independently binding cap must see competing service. A full
+            // global queue cannot mask a local group cap that never frees capacity.
+            const competingAdmissions = records.filter(record => record.admittedAt && !sameScope(record)
+                && Date.parse(record.admittedAt) > lastService && Date.parse(record.admittedAt) <= now
+                && (block.dimensions ?? (block.dimension ? [block.dimension] : [])).every(dimension => consumes(record, dimension))).length;
+            const kind = block.kind === 'capacity-wait' && serviceWaitMs >= thresholdMs && competingAdmissions >= 2
+                ? 'service-starvation' : block.kind;
+            const finding = {
+                kind, scope, scopeId: label(scopeId), projectId: candidate.projectId ?? policy.managed?.projectId,
+                requestId: label(candidate.requestId), group: candidate.managed?.group, runId: label(run(candidate)),
+                waitMs, serviceWaitMs, thresholdMs, blockingCause: block.cause,
+                ...(block.dimension ? { dimension: label(block.dimension) } : {}), competingAdmissions,
+            };
+            const key = JSON.stringify([finding.projectId, scope, scopeId, kind, block.cause, block.dimension]);
+            if (!findings.has(key))
+                findings.set(key, finding);
+        }
+    }
+    return { findings: [...findings.values()].slice(0, maximumFindings), truncated: Math.max(0, findings.size - maximumFindings) };
+}
+//# sourceMappingURL=shared-host-starvation.js.map

package/dist/src/serve/worker-artifacts.d.mts

@@ -0,0 +1,4 @@
+/** Pure validation shared by the typed renderer and installed execution owner. */
+import type { WorkerResolvedInvocation } from '../mission-protocol/types.js';
+export function validateWorkerArtifacts(invocation: Pick<WorkerResolvedInvocation,
+  'artifacts' | 'invocationId' | 'cwd' | 'briefPath' | 'stdoutPath' | 'stderrPath' | 'finalPath'>): NonNullable<WorkerResolvedInvocation['artifacts']>;