@claudexor/orchestrator 3.2.0 → 3.2.1

package/dist/orchestrator.js

@@ -326,9 +326,11 @@ export class Orchestrator {
     execRootOf(input) {
         return input.executionRoot ?? input.repoRoot;
     }
-    async sessionSpecFields(input, harnessId, log, defaultRoute = null) {
+    async sessionSpecFields(input, harnessId, model, log, defaultRoute = null, quotaAdmission) {
         const cfg = this.config(input.repoRoot)?.global;
-        const profile = await this.preflightProfile(input, harnessId, log, defaultRoute);
+        const profile = quotaAdmission?.model === model
+            ? quotaAdmission.profile
+            : await this.preflightProfile(input, harnessId, model, log, defaultRoute);
         return {
             // "auto" at ANY level falls through (thread turns send the thread default
             // "auto" as a per-run value; it must not shadow a configured preference).
@@ -426,13 +428,13 @@ export class Orchestrator {
             .filter(({ profile, status }) => profileStatusAdmits(profile, status))
             .map(({ profile }) => profile.profile_id));
     }
-    async preflightProfile(input, harnessId, log, defaultRoute) {
+    async preflightProfile(input, harnessId, model, log, defaultRoute) {
         const profile = this.resolveCredentialProfile(input, harnessId);
         const policy = this.profilePolicy(input.repoRoot, harnessId);
         const registry = this.config(input.repoRoot)?.global.credential_profiles ?? [];
         const snapshots = this.deps.quotaSnapshots?.() ?? [];
         const emit = (type, payload) => log?.emit(type, payload);
-        const breach = profileHeadroomBreach(snapshots, harnessId, profile?.profile_id ?? null, policy.headroom_threshold);
+        const breach = profileHeadroomBreach(snapshots, harnessId, profile?.profile_id ?? null, policy.headroom_threshold, model);
         const readyProfileIds = policy.limit_action === "rotate" &&
             breach !== null &&
             (profile !== null || defaultRoute === "local_session")
@@ -449,6 +451,7 @@ export class Orchestrator {
                 snapshots,
                 readyProfileIds,
                 defaultRoute,
+                model,
                 emit,
             });
         }
@@ -459,6 +462,7 @@ export class Orchestrator {
             registry,
             snapshots,
             readyProfileIds,
+            model,
             emit,
         });
     }
@@ -728,6 +732,7 @@ export class Orchestrator {
                     // the default store's sources apply only to profile-less runs.
                     authRouteEstimate: this.profileAuthRoute(input, id) ??
                         estimateEffectiveAuthRoute(this.authPreferenceForHarness(input.repoRoot, id, input.authPreference), status.authSources),
+                    quotaAdmission: { model: null, profile: null, route: null },
                     supportsSynthesize: manifest.capabilities.synthesize,
                     supportsInteractive: manifest.capabilities.interactive,
                     supportsJsonSchemaOutput: manifest.capabilities.json_schema_output,
@@ -762,11 +767,29 @@ export class Orchestrator {
         if (pool.length === 0) {
             throw new HarnessUnavailableError(`no harness can perform '${intent}' for this mode${dropped.length ? ` (skipped: ${dropped.join(", ")})` : ""}`);
         }
-        const ordered = this.orderPool(pool, input, intent, statusById, ledger, runId);
+        // Quota admission must use the account that will actually spawn. In
+        // particular, an opt-in default-subject rotation has to select its ready
+        // profile before the budget router filters the exhausted default away.
+        // The same resolved profile is reused by the first spec build below.
+        const quotaPreparedPool = await Promise.all(pool.map(async (routed) => {
+            const model = input.models?.[routed.adapter.id] ?? routed.settings?.defaultModel ?? null;
+            const profile = await this.preflightProfile(input, routed.adapter.id, model, log, routed.authRouteEstimate);
+            const route = profile
+                ? profile.credential_kind === "api_key"
+                    ? "managed_api_key"
+                    : "vendor_native"
+                : routed.authRouteEstimate === "api_key"
+                    ? "managed_api_key"
+                    : routed.authRouteEstimate === "local_session"
+                        ? "vendor_native"
+                        : null;
+            return { ...routed, quotaAdmission: { model, profile, route } };
+        }));
+        const ordered = this.orderPool(quotaPreparedPool, input, intent, statusById, ledger, runId);
         if (ordered.length === 0) {
             throw new HarnessUnavailableError(`no harness remains eligible for '${intent}' after budget and quota routing`);
         }
-        emitPrimaryDivergence(log, input.primaryHarness, ordered, pool, dropped);
+        emitPrimaryDivergence(log, input.primaryHarness, ordered, quotaPreparedPool, dropped);
         const n = input.n ?? ordered.length;
         const selectionOrder = ordered;
         const out = [];
@@ -873,28 +896,25 @@ export class Orchestrator {
                     : authModes.includes("api_key")
                         ? "api_key"
                         : "unknown";
-                // A selected profile's credential_kind decides the route outright
-                // (round-18 #2): an api_key profile must never inherit a
+                // The quota-preflight profile's credential_kind decides the route
+                // outright (round-18 #2). This includes an unpinned default subject
+                // that rotated before ranking; an api_key profile must never inherit a
                 // subscription classification from the default store's metric.
-                const authMode = this.profileAuthRoute(input, r.adapter.id) ??
+                const admittedProfileRoute = r.quotaAdmission.profile
+                    ? r.quotaAdmission.profile.credential_kind === "api_key"
+                        ? "api_key"
+                        : "local_session"
+                    : null;
+                const authMode = admittedProfileRoute ??
                     (input.authPreference === "api_key"
                         ? "api_key"
                         : input.authPreference === "subscription"
                             ? "local_session"
                             : (metric?.last_auth_mode ?? guessedAuthMode));
-                // The quota subject this candidate would actually run as (release
-                // wave round-16 #2): the resolved profile id, or null for the engine
-                // default — so profile A's cooldown never excludes profile B or the
-                // default. A profile that does not resolve for this harness routes
-                // as unknown (undefined) and stays conservatively any-subject.
-                let credentialSubjectId;
-                try {
-                    credentialSubjectId =
-                        this.resolveCredentialProfile(input, r.adapter.id)?.profile_id ?? null;
-                }
-                catch {
-                    credentialSubjectId = undefined;
-                }
+                // The exact quota subject selected before ranking: profile id or the
+                // engine default. Profile A's cooldown never excludes profile B or the
+                // default on the same harness and route.
+                const credentialSubjectId = r.quotaAdmission.profile?.profile_id ?? null;
                 // QA-034: the typed auth-route evidence (doctor source verification x the
                 // resolved route) is AUTHORITATIVE for billing knowledge in the router —
                 // a VERIFIED native route proves subscription_entitlement, so it survives
@@ -905,20 +925,19 @@ export class Orchestrator {
                 return {
                     harnessId: r.adapter.id,
                     available: true,
-                    model: input.models?.[r.adapter.id] ??
-                        config.harnesses[r.adapter.id]?.default_model ??
-                        undefined,
+                    model: r.quotaAdmission.model,
                     effort: input.efforts?.[r.adapter.id] ??
                         input.effort ??
                         config.harnesses[r.adapter.id]?.effort ??
                         undefined,
                     billingKnowledge: authMode === "api_key" ? "metered" : "unknown",
                     incrementalCostUsd: authMode === "api_key" ? (metric?.avg_cost_usd ?? null) : null,
-                    credentialRoute: authMode === "api_key"
-                        ? "managed_api_key"
-                        : authMode === "local_session"
-                            ? "vendor_native"
-                            : undefined,
+                    credentialRoute: r.quotaAdmission.route ??
+                        (authMode === "api_key"
+                            ? "managed_api_key"
+                            : authMode === "local_session"
+                                ? "vendor_native"
+                                : undefined),
                     ...(authRoute ? { authRoute } : {}),
                     credentialSubjectId,
                 };
@@ -966,6 +985,36 @@ export class Orchestrator {
         }
         return ordered;
     }
+    /** Harness-only convergence helpers still need the exact quota identity
+     * selected before ranking. This facade keeps their small interface while
+     * preventing a scoped limit on one model/account from cooling another. */
+    quotaLedgerView(ledger, routes) {
+        const byId = new Map(routes.map((route) => [route.adapter.id, route]));
+        const identity = (id) => {
+            const route = byId.get(id);
+            return route
+                ? {
+                    credentialRoute: route.quotaAdmission.route ?? undefined,
+                    credentialSubjectId: route.quotaAdmission.profile?.profile_id ?? null,
+                    model: route.quotaAdmission.model,
+                }
+                : null;
+        };
+        return {
+            bindingPaceSlack: (id) => {
+                const selected = identity(id);
+                return selected
+                    ? ledger.bindingPaceSlack(id, selected.credentialRoute, selected.credentialSubjectId, Date.now(), selected.model)
+                    : ledger.bindingPaceSlack(id);
+            },
+            cooldownActive: (id) => {
+                const selected = identity(id);
+                return selected
+                    ? ledger.cooldownActive(id, selected.credentialRoute, selected.credentialSubjectId, Date.now(), selected.model)
+                    : ledger.cooldownActive(id);
+            },
+        };
+    }
     /**
      * Typed auth-route evidence for one candidate (QA-034): the concrete
      * credential route the resolved auth mode maps to, plus the doctor's
@@ -1343,7 +1392,7 @@ export class Orchestrator {
         const inPlaceEnvelope = envelope.worktree_path === envelope.repo_root;
         const rawContextPacket = await rawContextForEnvelope(routed.implementationTransport, envelope);
         const sessionFields = runInput
-            ? await this.sessionSpecFields(runInput, adapter.id, log, routed.authRouteEstimate)
+            ? await this.sessionSpecFields(runInput, adapter.id, knobs.model, log, routed.authRouteEstimate, routed.quotaAdmission)
             : undefined;
         // Continuity (INV-137): once the lane (harness + resolved profile) is known,
         // build the continuation packet, materialize context/THREAD.md, and point
@@ -3263,7 +3312,8 @@ export class Orchestrator {
         // observed quota cooldown across all harnesses, or genuine no-progress (a stall on the same
         // failure signature after every available harness has tried it).
         const stallThreshold = input.untilClean === true ? 4 : 2;
-        const allCooledDown = () => adapterPool.every((a) => ledger.cooldownActive(a.adapter.id));
+        const convergenceQuotaLedger = this.quotaLedgerView(ledger, adapterPool);
+        const allCooledDown = () => adapterPool.every((a) => convergenceQuotaLedger.cooldownActive(a.adapter.id));
         const attemptTelemetries = [];
         let lastDiffStable = true;
         try {
@@ -3614,7 +3664,7 @@ export class Orchestrator {
                     if (adapterPool.length > 1 && triedSinceProgress.size < adapterPool.length) {
                         // Quota-headroom consumer (mid-run, where quota observations EXIST);
                         // pick + honest route event owned by runSupport.rotateOnStall.
-                        adapterIdx = rotateOnStall(adapterPool.map((a) => a.adapter.id), adapterIdx, ledger, triedSinceProgress, log, lastRun?.harnessId ?? null);
+                        adapterIdx = rotateOnStall(adapterPool.map((a) => a.adapter.id), adapterIdx, convergenceQuotaLedger, triedSinceProgress, log, lastRun?.harnessId ?? null);
                         routed = adapterPool[adapterIdx];
                         adapter = routed.adapter;
                     }
@@ -3903,7 +3953,7 @@ export class Orchestrator {
                 const adapter = routed.adapter;
                 const knobs = this.routeSpecKnobs(routed, contract, undefined, input.effort);
                 const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
-                const sessionFields = await this.sessionSpecFields(input, adapter.id, log, routed.authRouteEstimate);
+                const sessionFields = await this.sessionSpecFields(input, adapter.id, knobs.model, log, routed.authRouteEstimate, routed.quotaAdmission);
                 const laneContinuity = args.laneRun
                     ? await this.resolveContinuity(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null, sessionFields.resume_session_id !== null, sessionFields, store, paths, this.execRootOf(input), log)
                     : null;
@@ -4281,7 +4331,7 @@ export class Orchestrator {
             buildSpec: async (routed, homeEnv, prompt, attemptId) => {
                 const knobs = this.routeSpecKnobs(routed, contract, undefined, input.effort);
                 const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
-                const sessionFields = await this.sessionSpecFields(input, routed.adapter.id, log, routed.authRouteEstimate);
+                const sessionFields = await this.sessionSpecFields(input, routed.adapter.id, knobs.model, log, routed.authRouteEstimate, routed.quotaAdmission);
                 const spec = HarnessRunSpec.parse({
                     session_id: newId("ses"),
                     intent: "synthesize",
@@ -4519,7 +4569,7 @@ export class Orchestrator {
                 const explorerPrompt = (opts.deepScan
                     ? `${prompt}\n\nExplorer ${idx + 1}/${adapters.length}: focus on a distinct slice. Emit evidence-cited findings, explicit unknowns/omissions, and follow-up questions. Do not edit files.`
                     : prompt) + contextSection;
-                const sessionFields = await this.sessionSpecFields(input, adapter.id, log, routed.authRouteEstimate);
+                const sessionFields = await this.sessionSpecFields(input, adapter.id, knobs.model, log, routed.authRouteEstimate, routed.quotaAdmission);
                 const grantResume = sessionFields.resume_session_id !== null && !resumeGranted.has(adapter.id);
                 if (grantResume)
                     resumeGranted.add(adapter.id);