@coreplane/switchboard 1.252.0 → 1.254.0

package/dist/assets/config/config.example.yaml

@@ -11,6 +11,13 @@ providers:
   anthropic:
     wire: anthropic-messages
     apiKeyEnv: ANTHROPIC_API_KEY
+    # The biller's invoice for the daily tie-out on the costs page (costs.md item
+    # 4d): each block may name its own invoice API and the env var holding that
+    # API's key — an admin or management key, never the inference key. This is
+    # where `costs.anthropicAdminKeyEnv` moved; the old key under `costs:` is
+    # still accepted for one release.
+    # invoiceApi: anthropic-cost-report   # GET /v1/organizations/cost_report
+    # invoiceKeyEnv: ANTHROPIC_ADMIN_KEY  # sk-ant-admin…
   # OpenAI itself runs on its Responses API (record 0052): every first-party
   # OpenAI card in pi's registry is `openai-responses`, OpenAI recommends the
   # wire for new projects, and its chat route loses tool calling with any
@@ -21,6 +28,8 @@ providers:
     wire: openai-responses
     baseUrl: https://api.openai.com/v1
     apiKeyEnv: OPENAI_API_KEY
+    # invoiceApi: openai-costs            # GET /v1/organization/costs, an admin key
+    # invoiceKeyEnv: OPENAI_ADMIN_KEY
   # groq:
   #   wire: openai-chat
   #   baseUrl: https://api.groq.com/openai/v1
@@ -42,6 +51,10 @@ providers:
     catalog: openrouter
     baseUrl: https://openrouter.ai/api/v1
     apiKeyEnv: OPENROUTER_API_KEY
+    # invoiceApi: openrouter-activity     # GET /api/v1/activity, a management key;
+    #                                     #   its `usage` ties against the summed BYOK
+    #                                     #   fees, `byok_usage_inference` the remainder
+    # invoiceKeyEnv: OPENROUTER_MANAGEMENT_KEY
     # The operator's layer over the registry card: what a run needs that no
     # layer names goes out unvouched (and a note says so on the record) until
     # an override like this pins it. `providers check` (a later unit) reads the
@@ -167,6 +180,12 @@ defaults:
 #     verbosity: verbose          # hear every acknowledgement of what the bot does for you
 #     harness:
 #       coding: opencode
+#     # The person's GitHub author binding (record 0062; authorization.md item 18):
+#     # the login their commits are authored as. A bare login here is resolved to
+#     # { login, id } once at first use; `config set user --user <id> --github
+#     # <login>` (identity:write holders) stores the pair. Never set by the person
+#     # themselves; `config clear me` keeps it. One login/id binds one person.
+#     github: octocat
 
 # Authorization (docs/reference/specs/authorization.md item 9, docs/reference/authorization.md):
 # two blocks. `restrict` names what is CLOSED unless granted — an agent listed
@@ -388,6 +407,8 @@ workspaceDir: ./workspaces
 # ship:
 #   maxRounds: 3      # review rounds per unit
 #   maxMinutes: 240   # the ship preset's wall-clock budget in minutes (the registry's default)
+#   idleDays: 0       # days a ship unit idles instead of ending (record 0051): 0–365, 0 = today's
+#                     # endings; also per channel/user (`channels.<id>.ship.idleDays`), user > channel > org
 
 # Which harness each preset's runs are driven by, deployment-wide
 # (docs/reference/specs/harness.md item 8): a mapping of preset to a harness's
@@ -454,10 +475,17 @@ workspaceDir: ./workspaces
 # `tool` (default) forces a call to the router's `route` tool, whose schema is
 # the answer, so prose cannot occur; `text` is the one-JSON-object text contract
 # alone — set it for a provider or model that cannot take a forced tool call.
+# `operator` is the one door's flag (routing-and-config item 29): `on`
+# (default) — the operator's decision is what runs; `shadow` — one operator
+# turn per admitted chat event, ahead of stage A, its decision written beside
+# the routed request in the run store and nothing run from it; `off` — the
+# rollback lever: it turns the operator back off after a bad day, not a choice
+# to make up front. `shadow` and `on` run even under `auto: false`.
 # routing:
 #   auto: false
 #   model: anthropic/claude-haiku-4-5
 #   answer: text
+#   operator: off
 
 # The thread-reply intake gate (docs/decisions/0058-a-thread-reply-is-read-before-it-is-answered-intake-decides-whether-the-bot-was-addressed.md;
 # docs/reference/specs/routing-and-config.md item 27). How an unmentioned reply
@@ -479,6 +507,19 @@ workspaceDir: ./workspaces
 #   threadReplies: classify
 #   model: anthropic/claude-haiku-4-5
 
+# The orchestration plane (docs/decisions/0064-the-plane-owns-every-runs-state-a-refusal-becomes-a-queue-position-an-ending-is-judged-by-the-ledger-that-saw-it-and-a-release-is-a-quiet-window-a-person-closes.md;
+# docs/reference/specs/routing-and-config.md item 31; orchestration-plane.md).
+# `admission` gates the ledger object's queue decider: `off` (default) — the
+# plane hears of no dispatch and nothing is posted; `shadow` — the bot posts
+# its own outcome per dispatch (`proceeded`, `refused:<code>`) to the ledger
+# object, which logs its decider's decision beside it — nothing runs from the
+# decider; `on` — a later release's flip (the decider's answer is what runs).
+# `reaskMinutes` (default 2) is the plane's one re-ask cadence, used only while
+# something waits on a reporter that fell silent; nothing reads it yet.
+# plane:
+#   admission: shadow
+#   reaskMinutes: 2
+
 # Linked threads (docs/decisions/0037-a-linked-thread-is-quoted-not-joined.md;
 # docs/reference/specs/routing-and-config.md item 22). Off by default. On, a
 # permalink in a request to a thread in another PUBLIC channel the bot is a
@@ -494,7 +535,8 @@ workspaceDir: ./workspaces
 #   cloudflareAccountId: <32-hex account id>
 #   cloudflareAccountName: acme-infra              # optional: how the page names the account beside its share (else the id's first hex)
 #   cloudflareTokenEnv: CF_ANALYTICS_TOKEN     # token with Account Analytics:Read
-#   anthropicAdminKeyEnv: ANTHROPIC_ADMIN_KEY  # optional: sk-ant-admin… for LLM spend
+#   anthropicAdminKeyEnv: ANTHROPIC_ADMIN_KEY  # legacy (one release): moved to providers.anthropic.invoiceKeyEnv
+#                                              #   (invoiceApi: anthropic-cost-report); still feeds the LLM line here
 #   snapshot:                                  # the page serves a snapshot of both billing sources, never a live read;
 #     everyHours: 24                           #   how often the bot reads them (1–168, default 24). `costs snapshot`
 #                                              #   takes one now. Kept on the state Worker any `*.worker` block names
@@ -519,6 +561,17 @@ workspaceDir: ./workspaces
 #       cacheRead: 0.125                       #   never $0, on the costs page and on a run's own page
 #       cacheWrite: 0
 
+# Run metrics (docs/reference/specs/run-metrics.md). Optional. The Analytics Engine
+# dataset every finished run's point lands in — the SAME name the deployment
+# profile's `metrics.dataset` binds on the state Worker as RUN_METRICS (the bot
+# warns at boot when the two differ; neither side refuses to start). With the
+# `costs` block's Cloudflare account and analytics token this turns the `metrics`
+# capability on: `metrics trend` reads the trend report from the dataset over the
+# Analytics Engine SQL API, weighted for sampling.
+# metrics:
+#   dataset: switchboard_runs
+#   days: 30                                  # optional: the default report range in whole UTC days, 1..90
+
 # Delivery indicators: GET /delivery and `delivery report` (docs/reference/specs/delivery.md).
 # Optional. Needs a GitHub credential (the App triple or GH_TOKEN); read-only on GitHub.
 # delivery:

package/dist/assets/deploy/cloudflare-memory/runMetricsSink.ts

@@ -0,0 +1,31 @@
+import type { RunMetricsPoint } from "../../src/core/runMetrics.ts";
+
+// The run-metrics sink (docs/reference/specs/run-metrics.md): where the
+// RunHistoryDO writes the one point of a run whose row turned final, after the
+// record's commit. Two implementations behind one seam (AGENTS.md invariant 2):
+// the Workers Analytics Engine dataset when the Worker is deployed with the
+// optional `RUN_METRICS` binding, the null sink otherwise — so a Worker without
+// the binding behaves byte-identically, the same shape as `SHIP_COORDINATOR?`.
+// The write is advisory on the caller's side too: one try, one console.warn,
+// never a failed put or finish.
+
+export interface RunMetricsSink {
+  write(point: RunMetricsPoint): void;
+}
+
+/** The dataset the deploy bound: `writeDataPoint` is synchronous and does not
+ *  throw on a platform-side drop; the caller's try covers a missing or
+ *  misconfigured binding. */
+export class AnalyticsEngineSink implements RunMetricsSink {
+  constructor(private readonly dataset: AnalyticsEngineDataset) {}
+  write(point: RunMetricsPoint): void {
+    this.dataset.writeDataPoint({ indexes: point.indexes, blobs: point.blobs, doubles: point.doubles });
+  }
+}
+
+/** No binding: points are dropped — the off state. */
+export class NullSink implements RunMetricsSink {
+  write(): void {
+    // nothing is written without the binding
+  }
+}