@coreplane/switchboard 1.251.0 → 1.253.0

package/dist/assets/config/config.example.yaml

@@ -167,6 +167,12 @@ defaults:
 #     verbosity: verbose          # hear every acknowledgement of what the bot does for you
 #     harness:
 #       coding: opencode
+#     # The person's GitHub author binding (record 0062; authorization.md item 18):
+#     # the login their commits are authored as. A bare login here is resolved to
+#     # { login, id } once at first use; `config set user --user <id> --github
+#     # <login>` (identity:write holders) stores the pair. Never set by the person
+#     # themselves; `config clear me` keeps it. One login/id binds one person.
+#     github: octocat
 
 # Authorization (docs/reference/specs/authorization.md item 9, docs/reference/authorization.md):
 # two blocks. `restrict` names what is CLOSED unless granted — an agent listed
@@ -325,8 +331,10 @@ workspaceDir: ./workspaces
 #   # and — when the run is bound to a repo — that repo's scope (repo:owner/name)
 #   # plus the requesting user's own scope (user:slack:U…) — a
 #   # person's records never surface for anyone else.
-#   limit: 8            # max records retrieved/injected per request (default 8)
-#   maxTokens: 800      # hard token budget for the injected block (default 800)
+#   limit: 32           # max records retrieved/injected per request (default 32)
+#   maxTokens: 3000     # hard token budget for the injected block (default 3000)
+#   repoWindow: 24      # newest repo facts injected ahead of the keyword hits when
+#                       # the run is bound to a repo (default 24; 0 disables the window)
 #   maxRecordsPerScope: 500
 #                       # per-scope cap on ACTIVE records (default 500): a write
 #                       # that would exceed it evicts the least recently used
@@ -386,6 +394,8 @@ workspaceDir: ./workspaces
 # ship:
 #   maxRounds: 3      # review rounds per unit
 #   maxMinutes: 240   # the ship preset's wall-clock budget in minutes (the registry's default)
+#   idleDays: 0       # days a ship unit idles instead of ending (record 0051): 0–365, 0 = today's
+#                     # endings; also per channel/user (`channels.<id>.ship.idleDays`), user > channel > org
 
 # Which harness each preset's runs are driven by, deployment-wide
 # (docs/reference/specs/harness.md item 8): a mapping of preset to a harness's
@@ -452,10 +462,16 @@ workspaceDir: ./workspaces
 # `tool` (default) forces a call to the router's `route` tool, whose schema is
 # the answer, so prose cannot occur; `text` is the one-JSON-object text contract
 # alone — set it for a provider or model that cannot take a forced tool call.
+# `operator` is the one door's flag (routing-and-config item 29): `off`
+# (default) — the operator never runs; `shadow` — one operator turn per
+# admitted chat event, ahead of stage A, its decision written beside the
+# routed request in the run store and nothing run from it; `on` — the
+# operator's decision is what runs. `shadow` runs even under `auto: false`.
 # routing:
 #   auto: false
 #   model: anthropic/claude-haiku-4-5
 #   answer: text
+#   operator: shadow
 
 # The thread-reply intake gate (docs/decisions/0058-a-thread-reply-is-read-before-it-is-answered-intake-decides-whether-the-bot-was-addressed.md;
 # docs/reference/specs/routing-and-config.md item 27). How an unmentioned reply
@@ -517,6 +533,16 @@ workspaceDir: ./workspaces
 #       cacheRead: 0.125                       #   never $0, on the costs page and on a run's own page
 #       cacheWrite: 0
 
+# Run metrics (docs/reference/specs/run-metrics.md). Optional. The Analytics Engine
+# dataset every finished run's point lands in — the SAME name the deployment
+# profile's `metrics.dataset` binds on the state Worker as RUN_METRICS (the bot
+# warns at boot when the two differ; neither side refuses to start). The reader
+# over the dataset — `metrics trend` and the /metrics page, behind the `metrics`
+# capability — is later work of the same decision; until it lands, only `dataset`
+# is read, for that boot comparison.
+# metrics:
+#   dataset: switchboard_runs
+
 # Delivery indicators: GET /delivery and `delivery report` (docs/reference/specs/delivery.md).
 # Optional. Needs a GitHub credential (the App triple or GH_TOKEN); read-only on GitHub.
 # delivery:

package/dist/assets/deploy/cloudflare/preflight.mjs

@@ -1,23 +1,22 @@
 #!/usr/bin/env node
 // Deploy preflight for the bot Worker (docs/reference/specs/slack-channel.md item 8).
 //
-// `wrangler deploy` rolls the bot container. Cloudflare's rollout sends SIGTERM
-// and the container is gone at the drain's end, whatever it was still driving:
-// the run ledger's handoff (docs/reference/specs/run-history.md item 39) lets the
-// next generation resume a run, but a resume is a recovery, not a guarantee —
-// one that fails costs the run — so a deploy never rolls over a live run.
-// `npm run deploy` runs this first and refuses while
-//   - the bot reports runs in flight (`GET /healthz` `inFlight > 0`): the
-//     runner retries every minute up to its budget, then fails by name;
+// `wrangler deploy` rolls the bot container. Cloudflare's rollout sends SIGTERM;
+// since the run ledger's handoff (docs/reference/specs/run-history.md item 39) the bot
+// hands every resumable run to the next generation and exits within seconds,
+// and the next generation continues the runs under their own cards — so a
+// deploy no longer waits on runs, and this preflight no longer refuses for
+// them. `npm run deploy` runs it first and refuses only while
 //   - the container application is not in a settled state (a rollout is still
 //     provisioning/updating — `wrangler containers list --json`): a second
 //     rollout on top of one in progress replaces the instance the first put
 //     into its graceful drain and kills whatever it was running (two deploys
 //     90 s apart once killed a review at 153 s).
-// It WARNS (never refuses) when the bot is already draining with nothing in
-// flight (`draining: true` — the instance exits on its own), and when /healthz
-// says the reconnect catch-up is failing or the bot token lacks required
-// scopes (`catchUp.error`, `catchUp.missingScopes`).
+// It WARNS (never refuses) when the bot reports runs in flight (`inFlight > 0`
+// — they hand off) or is already draining (`draining: true` — its resumable
+// runs were handed off; a ship pipeline still in flight would be killed), and
+// when /healthz says the reconnect catch-up is failing or the bot token lacks
+// required scopes (`catchUp.error`, `catchUp.missingScopes`).
 //
 // Fail closed: unreachable bot, a body without the JSON shape (a bot whose
 // /healthz answers a bare `ok` is not one this preflight can read), a wrangler failure, or an app
@@ -41,7 +40,7 @@ export const APP_NAME = "switchboard-switchboardserver";
 const SETTLED_APP_STATES = new Set(["active", "ready"]);
 
 const HOW_TO_FORCE =
-  "to deploy anyway (over the runs in flight — this kills them —, over a rollout in progress, or blind when the bot cannot be consulted): `SWITCHBOARD_DEPLOY_FORCE=1 npm run deploy` (`node preflight.mjs --force` checks alone)";
+  "to deploy anyway (over a rollout in progress, or blind when the bot cannot be consulted): `SWITCHBOARD_DEPLOY_FORCE=1 npm run deploy` (`node preflight.mjs --force` checks alone)";
 
 /** GET /healthz. Never throws: `{ok:true,payload}` (parsed JSON, or the raw text when not JSON) or `{ok:false,error}`. */
 export async function fetchHealth(baseUrl, { timeoutMs = 20_000 } = {}) {
@@ -165,16 +164,15 @@ export function decide({ health, apps }, { force = false } = {}) {
       if (!Number.isInteger(p.inFlight) || p.inFlight < 0) {
         problems.push(`bot reports an impossible inFlight=${JSON.stringify(p.inFlight)} (counter bug or old Worker)`);
       } else if (p.inFlight > 0) {
-        // A refusal: the rollout rolls the container under these runs. A
-        // handoff (run-history item 39) may resume them on the next generation,
-        // but a resume that fails costs the run — the deploy waits instead.
-        problems.push(
-          `${p.inFlight} run(s) in flight — the rollout would roll the bot container under them (a handoff is a recovery, not a guarantee)`,
+        // Not a refusal since the handoff (run-history item 39): SIGTERM hands
+        // every resumable run to the next generation, which continues it.
+        warnings.push(
+          `${p.inFlight} run(s) in flight — handed to the next generation on SIGTERM (run-history item 39); they continue there under their own cards`,
         );
       }
       if (p.draining === true) {
         warnings.push(
-          "bot is already draining from a previous deploy — the draining instance exits on its own; this rollout replaces it at once",
+          "bot is already draining from a previous deploy — its resumable runs are handed off; a ship pipeline still in flight would be killed when this rollout replaces the draining instance",
         );
       }
     }
@@ -211,7 +209,7 @@ export function decide({ health, apps }, { force = false } = {}) {
       forced: true,
       problems,
       warnings,
-      message: `preflight WARNING: deploying by force despite —\n${detail}\n  this WILL kill the runs in flight that no resume recovers, and a rollout landing on one in progress can disrupt it${warningText}`,
+      message: `preflight WARNING: deploying by force despite —\n${detail}\n  a rollout landing on one in progress can disrupt it; in-flight runs hand off regardless (run-history item 39)${warningText}`,
     };
   }
   return {
@@ -219,7 +217,7 @@ export function decide({ health, apps }, { force = false } = {}) {
     forced: false,
     problems,
     warnings,
-    message: `preflight REFUSED: a Worker deploy rolls the bot container —\n${detail}\n  wait for them to finish and retry; ${HOW_TO_FORCE}${warningText}`,
+    message: `preflight REFUSED: a Worker deploy rolls the bot container —\n${detail}\n  wait and retry; ${HOW_TO_FORCE}${warningText}`,
   };
 }
 

package/dist/assets/deploy/cloudflare/worker.ts

@@ -197,8 +197,10 @@ export class SwitchboardServer extends Container<Env> {
    * and exits, and the NEXT request through `fetch` starts the container again
    * (`startBot`, env computed then). The keep-alive cron GETs /healthz every
    * minute and the CLI's live gate polls it every 15 s, so the next request is
-   * never more than seconds away. Refuses (the deploy preflight's rules) while
-   * runs are in flight or a drain is already under way unless `force`.
+   * never more than seconds away. Refuses (the deploy preflight's rules) only the
+   * fail-closed cases — no JSON body, an impossible `inFlight` — unless
+   * `force`; runs in flight or a drain under way warn and the stop proceeds
+   * (the handoff rule).
    */
   async restart(opts: { force: boolean }): Promise<RestartOutcome> {
     if (!this.ctx.container?.running) return { kind: "not-running" };
@@ -265,7 +267,8 @@ export class SwitchboardServer extends Container<Env> {
  *  `deploy:write` in the bot's config). The Worker authenticates the bearer
  *  against the map it holds — an unknown bearer never touches the container —
  *  and the Container DO asks the bot for the grant before stopping anything.
- *  Body `{ "force": true }` bypasses the in-flight/draining refusal. */
+ *  Body `{ "force": true }` bypasses the fail-closed refusals (no JSON body,
+ *  impossible `inFlight`); runs in flight or a drain warn and never refuse. */
 async function handleAdminRestart(request: Request, env: Env): Promise<Response> {
   const json = (status: number, body: Record<string, unknown>) =>
     new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });

package/dist/assets/deploy/cloudflare-memory/runMetricsSink.ts

@@ -0,0 +1,31 @@
+import type { RunMetricsPoint } from "../../src/core/runMetrics.ts";
+
+// The run-metrics sink (docs/reference/specs/run-metrics.md): where the
+// RunHistoryDO writes the one point of a run whose row turned final, after the
+// record's commit. Two implementations behind one seam (AGENTS.md invariant 2):
+// the Workers Analytics Engine dataset when the Worker is deployed with the
+// optional `RUN_METRICS` binding, the null sink otherwise — so a Worker without
+// the binding behaves byte-identically, the same shape as `SHIP_COORDINATOR?`.
+// The write is advisory on the caller's side too: one try, one console.warn,
+// never a failed put or finish.
+
+export interface RunMetricsSink {
+  write(point: RunMetricsPoint): void;
+}
+
+/** The dataset the deploy bound: `writeDataPoint` is synchronous and does not
+ *  throw on a platform-side drop; the caller's try covers a missing or
+ *  misconfigured binding. */
+export class AnalyticsEngineSink implements RunMetricsSink {
+  constructor(private readonly dataset: AnalyticsEngineDataset) {}
+  write(point: RunMetricsPoint): void {
+    this.dataset.writeDataPoint({ indexes: point.indexes, blobs: point.blobs, doubles: point.doubles });
+  }
+}
+
+/** No binding: points are dropped — the off state. */
+export class NullSink implements RunMetricsSink {
+  write(): void {
+    // nothing is written without the binding
+  }
+}