@coreplane/switchboard 1.254.1 → 1.256.0

package/dist/assets/deploy/cloudflare-memory/wrangler.template.jsonc

@@ -58,6 +58,11 @@
   // deploy/cloudflare/wrangler.template.jsonc). The class is deployed with the
   // bot, which deploys after this Worker — so this binding lands one release
   // after the class did, never in the same one.
+  // The bot Worker, for the plane's effect push (record 0064, "Where it
+  // lives"): committed effects POST to the bot's bearer-gated /plane/effects,
+  // which forwards them to the container. A push that fails is not retried by
+  // a timer — the effect rides the next heartbeat or reclaim-sweep answer.
+  "services": [{ "binding": "BOT", "service": "{{bot.script}}" }],
   "workflows": [
     {
       "name": "{{bot.script}}-ship-coordinator",

package/dist/assets/deploy/cloudflare-resident/Dockerfile

@@ -22,8 +22,20 @@ FROM docker.io/cloudflare/sandbox:0.13.0-next.751.1
 # installed here — matching the resident system prompts and the tests that pin
 # that claim. No system credential.helper is configured; each worktree sets its
 # own per-attach helper.
+# The fallback user.email stays OFF the GitHub domain (a noreply-shaped
+# address would render as a GitHub account it is not); the real pairs ride
+# each /exec body's env. The system-level core.hooksPath replaces repo-local
+# .git/hooks entirely — deliberate: an untrusted checkout's own hooks never
+# run here (a repo-local core.hooksPath still wins, git's ordinary
+# precedence) — docs/reference/specs/execution.md item 5.
 RUN git config --system user.name "switchboard-resident" \
-  && git config --system user.email "switchboard-resident@users.noreply.github.com"
+  && git config --system user.email "switchboard-resident@switchboard.invalid" \
+  && git config --system core.hooksPath /opt/switchboard/hooks
+
+# The shared agent-trailer hook (deploy/hooks/prepare-commit-msg — this copy is
+# byte-identical, held so by a test: the build context is this directory, so
+# COPY cannot reach the canonical file).
+COPY --chmod=0755 prepare-commit-msg /opt/switchboard/hooks/prepare-commit-msg
 
 # The container is FOUR vCPUs shared by up to 16 threads (wrangler.jsonc).
 # Node test runners size their worker pools from the CPU count the kernel

package/dist/assets/deploy/cloudflare-resident/drain.ts

@@ -23,6 +23,17 @@ export interface DrainRecord {
   by: string;
   /** Why, in the words the attach refusal repeats. */
   reason: string;
+  /** The residents whose containers still run the pre-deploy image (issue
+   *  1931): the deploy's reconcile marks the Durable Objects but the platform
+   *  replaces the container processes asynchronously, so "reconciled" is not
+   *  "swapped" — each hold stands until that resident reports its running
+   *  container on the deploy's image, and the fleet reopens on the LAST
+   *  report, a fact, never a wait. Absent or empty: no swap outstanding. */
+  holds?: string[];
+  /** Whether `POST /undrain` already asked for the lift while holds stood:
+   *  the record then clears itself on the last hold's report instead of
+   *  waiting for a second lift. */
+  liftAsked?: boolean;
 }
 
 /** The longest a drain may run, and the default, from the one clock table
@@ -88,7 +99,50 @@ export function liveDrain(stored: unknown, now: number): DrainRecord | null {
     return null;
   const until = Date.parse(r.until);
   if (!Number.isFinite(until) || until <= now) return null;
-  return { since: r.since, until: r.until, by: r.by, reason: r.reason };
+  const holds = Array.isArray(r.holds) ? r.holds.filter((h): h is string => typeof h === "string") : [];
+  return {
+    since: r.since,
+    until: r.until,
+    by: r.by,
+    reason: r.reason,
+    ...(holds.length > 0 ? { holds } : {}),
+    ...(r.liftAsked === true ? { liftAsked: true } : {}),
+  };
+}
+
+/** The record with the named residents held (issue 1931): the deploy's
+ *  reconcile could not verify their running containers on the new image, so
+ *  the fleet must not reopen onto them until each reports. Deduplicated;
+ *  an empty set changes nothing. */
+export function holdDrain(record: DrainRecord, resources: readonly string[]): DrainRecord {
+  const holds = [...new Set([...(record.holds ?? []), ...resources])];
+  if (holds.length === 0) return record;
+  return { ...record, holds };
+}
+
+/** `POST /undrain`'s decision over the stored record: with no holds the drain
+ *  clears; with holds outstanding the fleet STAYS closed — the record keeps
+ *  standing with `liftAsked`, so the last container's new-image report lifts
+ *  it (a fact, never a timer; `until` remains the backstop for a report that
+ *  never comes). */
+export function liftDrain(record: DrainRecord): { cleared: true } | { cleared: false; record: DrainRecord } {
+  const holds = record.holds ?? [];
+  if (holds.length === 0) return { cleared: true };
+  return { cleared: false, record: { ...record, liftAsked: true } };
+}
+
+/** One resident's word that its running container is on the deploy's image:
+ *  its hold drops; when it was the last hold and the lift was already asked,
+ *  the drain lifts here — the reopen fires on the last container's report. */
+export function reportImageCurrent(
+  record: DrainRecord,
+  resource: string,
+): { lifted: boolean; record: DrainRecord | null } {
+  const holds = (record.holds ?? []).filter((h) => h !== resource);
+  const next: DrainRecord = { ...record, ...(holds.length > 0 ? { holds } : {}) };
+  if (holds.length === 0) delete next.holds;
+  if (holds.length === 0 && record.liftAsked === true) return { lifted: true, record: null };
+  return { lifted: false, record: next };
 }
 
 /** The `/attach` answer while the fleet is drained: a 503 whose body carries

package/dist/assets/deploy/cloudflare-resident/levels.ts

@@ -0,0 +1,84 @@
+// The resident's level reports (record 0064; the orchestration plane's
+// resident conditions) — the PURE half, kept free of the Sandbox SDK and DO
+// storage so it runs under plain-Node vitest (levels.test.ts) like gc.ts,
+// drain.ts and memoryGuard.ts. The Worker owns the readings (the user pool's
+// allocation, the memory guard's last sample, its own incarnation) and feeds
+// this module the numbers; every `/attach`, `/exec` and `/status` answer
+// carries the document, and the bot forwards a change to the plane's
+// `POST /plane/level`.
+//
+// Why an outbox and not a push: the resident never holds a credential for the
+// state Worker, so it posts nothing itself — a crossing between calls is kept
+// as a post and re-offered on every answer until a newer crossing of the same
+// name supersedes it. The plane's level write is idempotent per (resident,
+// name), so a post forwarded twice lands once.
+
+import { MEMORY_SOFT_LIMIT_PCT } from "./memoryGuard.js";
+
+/** Which side of its line a level reads: `above` closes the door (an exhausted
+ *  pool, the gate's soft side), `below` opens it. */
+export type LevelSide = "below" | "above";
+
+/** One level post for the plane: the crossing (or a boot's re-statement) the
+ *  bot forwards to `POST /plane/level`. */
+export interface LevelPost {
+  /** `drain` is the registry's fleet-drain post; the residents post the other two. */
+  name: "seat" | "memory" | "drain";
+  side: LevelSide;
+  generation: string;
+  at: string;
+}
+
+/** The compact sides of one sample, persisted so the next sample can judge a
+ *  crossing; `generation` names the incarnation the sample came from. */
+export interface LevelSample {
+  seat: LevelSide;
+  memory: LevelSide;
+  generation: string;
+}
+
+/** The document every resident answer carries as `levels` (record 0064). */
+export interface ResidentLevelsDoc {
+  seat: { side: LevelSide; used: number; total: number };
+  memory: { side: LevelSide; percent: number | null };
+  generation: string;
+  at: string;
+  /** The outbox: crossings not yet superseded, re-offered on every answer. */
+  posts: LevelPost[];
+}
+
+/** The seat's side: the pool is a hard count, so `above` is exactly "no free
+ *  user" — the next attach or op would be refused `user-pool-exhausted`. */
+export function seatSide(used: number, total: number): LevelSide {
+  return used >= total ? "above" : "below";
+}
+
+/** The memory side is the gate's soft line (resident-repos item 70): at or
+ *  past `MEMORY_SOFT_LIMIT_PCT` a NEW attach is refused, so that is where the
+ *  plane's `memory` condition sits. No reading, or no cap, gates nothing. */
+export function memorySide(percent: number | null): LevelSide {
+  return percent !== null && percent >= MEMORY_SOFT_LIMIT_PCT ? "above" : "below";
+}
+
+/** The posts one fresh sample owes the plane: each name whose side crossed
+ *  since the previous sample — and, with no previous sample or one from
+ *  another generation (a boot, a replaced runtime), both names re-stated
+ *  (record 0064: "a boot re-states it"), whatever their sides. */
+export function levelPosts(prev: LevelSample | null, next: LevelSample, at: string): LevelPost[] {
+  const restate = prev === null || prev.generation !== next.generation;
+  const posts: LevelPost[] = [];
+  if (restate || prev.seat !== next.seat)
+    posts.push({ name: "seat", side: next.seat, generation: next.generation, at });
+  if (restate || prev.memory !== next.memory)
+    posts.push({ name: "memory", side: next.memory, generation: next.generation, at });
+  return posts;
+}
+
+/** Merge fresh posts into the outbox: a newer post of a name supersedes the
+ *  older one — the plane only needs the current side, and the bot forwarding
+ *  a superseded post would only be overwritten by the next. The outbox never
+ *  grows past one post per name. */
+export function mergeOutbox(outbox: LevelPost[], posts: LevelPost[]): LevelPost[] {
+  const superseded = new Set(posts.map((p) => p.name));
+  return [...outbox.filter((p) => !superseded.has(p.name)), ...posts];
+}

package/dist/assets/deploy/cloudflare-resident/prepare-commit-msg

@@ -0,0 +1,17 @@
+#!/bin/sh
+# The agent trailer (docs/reference/specs/execution.md): every commit made in a
+# Switchboard image carries `Co-Authored-By: <bot pair>`, so the agent's hand
+# stays visible even when the author is the requester. The pair is read from
+# GIT_COMMITTER_NAME/GIT_COMMITTER_EMAIL at commit time — the bot fills them
+# per exec — so the image stays installation-agnostic; without them the
+# image's own git identity stands (its fallback address is off the GitHub
+# domain, so it never renders as a GitHub account). Idempotent: a message that
+# already carries this exact trailer is left unchanged; a foreign
+# Co-Authored-By does not stop it (the identity rewrite scrubs those).
+set -e
+msg="$1"
+name="${GIT_COMMITTER_NAME:-$(git config user.name || true)}"
+email="${GIT_COMMITTER_EMAIL:-$(git config user.email || true)}"
+[ -n "$name" ] && [ -n "$email" ] || exit 0
+git interpret-trailers --in-place --if-exists addIfDifferent \
+  --trailer "Co-Authored-By: $name <$email>" "$msg"