@coreplane/switchboard 1.255.0 → 1.257.0

package/dist/assets/src/core/authz/policy.ts

@@ -63,6 +63,12 @@ export const POLICY: readonly Rule[] = [
   // NAMED run (`authorizeSteerOwner`, authorization item 16a) — the requester,
   // a linked id, or `runs:write` — which no command-door row can see.
   { action: "steer:write", resource: "command", when: [grant("steer:write")] },
+  // The plane's checkpoint steer (record 0064): the system actor `plane`
+  // (`PLANE_ACTOR_ID`, a `service` actor holding `PLANE_GRANTS`' one standing
+  // `steer:write`) writes the steer into a write-preset run's inbox on the
+  // ledger object itself, sender `plane`; this row records that authority in
+  // the one table even though the object, not the bot, executes the write.
+  { action: "steer:write", resource: "run", actorKinds: ["service"], when: [grant("steer:write")] },
 
   // ── conversations ────────────────────────────────────────────────────────
   // Who may point the bot at another thread (record 0037). Asked for a
@@ -108,6 +114,11 @@ export const POLICY: readonly Rule[] = [
   // read is never a chat baseline, like the costs reads.
   { action: "providers:read", resource: "command", when: [grant("providers:read")] },
 
+  // ── pull requests ──────────────────────────────────────────────────
+  // `pulls rebase` force-pushes the pipeline's branches and can start a paid
+  // fix round (record 0071): a grant, never a chat baseline.
+  { action: "pulls:write", resource: "command", when: [grant("pulls:write")] },
+
   // ── repos ────────────────────────────────────────────────────────────────
   { action: "repo:read", resource: "command", when: [grant("repo:read")] },
   { action: "repo:write", resource: "repo", when: [grant("repo:write")] },
@@ -150,6 +161,10 @@ export const POLICY: readonly Rule[] = [
   // channel-config right — whoever may set the channel may set a thread in it;
   // never a baseline, so membership alone admits nobody.
   { action: "config:write", resource: "config-scope", resourceKind: "thread", when: [grant("config:write")] },
+  // The ORG scope (`config set org --pulls.…`, record 0071) — and a repository
+  // scope, the org setting's per-repository slice — affects every requester:
+  // the same `config:write` grant, never a baseline.
+  { action: "config:write", resource: "config-scope", resourceKind: "org", when: [grant("config:write")] },
   // A user edits only their own scope.
   { action: "config:write", resource: "config-scope", resourceKind: "user", when: [IS_SELF] },
   // The author binding's one trusted write (record 0062, authorization.md item

package/dist/assets/src/core/budgets.ts

@@ -16,6 +16,10 @@
 // Workflow-driven coordinator and the deploy Workers can bundle it — the
 // dependency runs registry → budgets, never the reverse.
 
+export const SECOND_MS = 1_000;
+
+export const secondsToMs = (seconds: number): number => seconds * SECOND_MS;
+
 export const MINUTE_MS = 60_000;
 
 /** Minutes → milliseconds, for a duration a request names in minutes (a drain's
@@ -109,6 +113,14 @@ export const DRAIN = {
   marginMinutes: 5,
   maxMinutes: 90,
   defaultMinutes: 60,
+  /** How long a held drain waits for a container's post-deploy cycle before
+   *  reopening the fleet anyway with the stale container named (issue 2044):
+   *  the platform replaces container processes three to ten minutes after a
+   *  deploy (docs/reference/specs/resident-repos.md item 65), so a cycle that
+   *  has not landed within this bound is not coming on its own — the gate
+   *  asked for the cycle, so it owns the outcome and never holds the fleet
+   *  closed to the drain's whole `until` on a report nothing will send. */
+  cycleBoundMinutes: 10,
 } as const;
 
 /** How long an intake receipt row is kept on the run history object
@@ -143,7 +155,7 @@ export type Preset = LoopPreset | "ship";
  *  that pushes at minute 29 and then runs the repo's whole gate (seven to ten
  *  minutes on a resident) was cut at 45 one run in twelve, so the ask is
  *  double the 90th percentile (31.5) with the gate inside it. Ship's holds
- *  its own loop at the default rounds with a fix round at that ask, not at
+ *  its own loop at the default rounds with a findings round at that ask, not at
  *  its floor (`fit` proves the floor case; the ask leaves room above it). */
 export const ASKS: Readonly<Record<Preset, number>> = {
   general: 5,
@@ -155,17 +167,18 @@ export const ASKS: Readonly<Record<Preset, number>> = {
   conductor: 120,
 };
 
-/** The rounds a ship loop is made of. `fix` is a coding child handed the
+/** The rounds a ship loop is made of. `findings` is a coding child handed the
  *  review's findings; `merge` is the runner's wait on the guards. */
-export type RoundKind = "coding" | "review" | "fix" | "merge";
+export type RoundKind = "coding" | "review" | "findings" | "merge";
 
 /** The least lease in which a round does useful work, in minutes. A carve that
  *  falls under the floor is refused rather than dispatched: a two-minute
- *  review or fix costs an attach and a model turn and finishes nothing.
- *  Review's is the ledger's 90th percentile of completed reviews (5.1 min over
- *  181); coding's is the least a fix round can run the repo's gate in — the
- *  gate alone takes seven to ten minutes on a resident, and a fix that cannot
- *  run it finishes nothing its contract asks; the merge wait's is a guess
+ *  review or findings round costs an attach and a model turn and finishes
+ *  nothing. Review's is the ledger's 90th percentile of completed reviews (5.1
+ *  min over 181); coding's is the least a findings round can run the repo's
+ *  gate in — the gate alone takes seven to ten minutes on a resident, and a
+ *  round that cannot run it finishes nothing its contract asks; the merge
+ *  wait's is a guess
  *  until the ledger says. */
 export const PRESET_FLOORS: Readonly<Record<LoopPreset, number>> = {
   general: 2,
@@ -177,7 +190,7 @@ export const PRESET_FLOORS: Readonly<Record<LoopPreset, number>> = {
 };
 export const FLOORS: Readonly<Record<RoundKind, number>> = {
   coding: PRESET_FLOORS.coding,
-  fix: PRESET_FLOORS.coding,
+  findings: PRESET_FLOORS.coding,
   review: PRESET_FLOORS.review,
   merge: 10,
 };
@@ -186,6 +199,12 @@ export const FLOORS: Readonly<Record<RoundKind, number>> = {
  *  when the remainder allows it. */
 export const MERGE_WAIT_ASK_MINUTES = 60;
 
+/** The sweep's bounds (record 0071, mechanism two): the short lease of the one
+ *  model round a conflicting pull request may buy, and the spend that round is
+ *  capped at per pull request — a round refused at either bound ends the pull
+ *  request's line with the conflict named, never a retry loop. */
+export const PULL_SWEEP = { leaseMinutes: 15, spendCapUsd: 5 } as const;
+
 /** The provider retry ladder (issue 1932): the backoff before each retry of a
  *  transient model-call failure — a gateway 5xx, a stream cut before
  *  `message_stop`, a gateway timeout. Three attempts with growing waits,
@@ -208,7 +227,15 @@ export const SHIP_WAIT = { marginMinutes: 5, chunkMinutes: 5, mergeChunkMinutes:
  *  it, a reservation's window, and the default re-ask cadence — how often a
  *  silent resident something waits on is probed (`plane.reaskMinutes`
  *  overrides it per deployment). */
-export const PLANE = { recentMinutes: 60, reservationMinutes: 2, reaskMinutes: 2 } as const;
+export const PLANE = {
+  recentMinutes: 60,
+  reservationMinutes: 2,
+  reaskMinutes: 2,
+  /** A coding round with no pushed head past this is steered once (record 0064, "The backpressure contract"). */
+  noPushMinutes: 15,
+  /** The line an in-flight call with NO declared bound is judged against for the same steer. */
+  noBoundMinutes: 20,
+} as const;
 
 /** The named amounts a lease holds back, in minutes. Each stands for a step
  *  every run or round pays: `provision` is attach and restore before the
@@ -328,6 +355,12 @@ export function provisionalBearerExpiresAt(now: number, leaseMinutes: number): n
   return now + (ALLOWANCES.provision + leaseMinutes + ALLOWANCES.bearerGrace) * MINUTE_MS;
 }
 
+/** The e2b credential-write exec's own timeout: the store-file write is one
+ *  `printf` plus a `git config` reset, so a minute is generous headroom while
+ *  still failing fast when the micro-VM is wedged
+ *  (docs/reference/specs/execution.md item 5). */
+export const SANDBOX_CREDENTIAL_WRITE_TIMEOUT_MS = MINUTE_MS;
+
 /** The per-command bash budget's rows: the default when a call names none, the
  *  ceiling a call may raise it to, and the floor under which a number is a
  *  typo (docs/reference/specs/execution.md item 11). */
@@ -361,19 +394,20 @@ export interface RoundPosition {
 }
 
 /** The rounds of a loop in order: the coding round, then a review and, after
- *  every review but the last, a fix, then the merge wait. */
+ *  every review but the last, a findings round, then the merge wait. */
 export function loopRounds(loop: Loop): RoundKind[] {
   const rounds: RoundKind[] = ["coding"];
   for (let i = 0; i < loop.maxRounds; i++) {
     rounds.push("review");
-    if (i < loop.maxRounds - 1) rounds.push("fix");
+    if (i < loop.maxRounds - 1) rounds.push("findings");
   }
   rounds.push("merge");
   return rounds;
 }
 
 /** Where a round sits in `loopRounds`: the coding round first; review round
- *  `n` (counted from 1) and the fix that follows it at `2n − 1` and `2n`; the
+ *  `n` (counted from 1) and the findings round that follows it at `2n − 1`
+ *  and `2n`; the
  *  merge wait last. The ship coordinator numbers its rounds this way, so the
  *  reserve it carves with is the one the fit assumed. */
 export function loopPosition(loop: Loop, kind: RoundKind, n = 0): number {
@@ -382,7 +416,7 @@ export function loopPosition(loop: Loop, kind: RoundKind, n = 0): number {
       return 0;
     case "review":
       return 2 * n - 1;
-    case "fix":
+    case "findings":
       return 2 * n;
     case "merge":
       return 2 * loop.maxRounds;
@@ -403,7 +437,7 @@ export function carveChildOfParent(
 }
 
 /** The minutes a round holds back for what must follow it in the loop: the
- *  floor plus provisioning of every later review and fix, and the merge
+ *  floor plus provisioning of every later review and findings round, and the merge
  *  wait's floor. A merge holds nothing back; a round with no loop (a
  *  conductor's child) holds nothing back either. */
 export function reserveMinutes(
@@ -419,12 +453,12 @@ export function reserveMinutes(
   return reserve;
 }
 
-/** What a round asks for: the preset's ask for a coding or fix round, the
+/** What a round asks for: the preset's ask for a coding or findings round, the
  *  review's for a review, the merge wait's own for the merge. */
 export function roundAskMinutes(kind: RoundKind): number {
   switch (kind) {
     case "coding":
-    case "fix":
+    case "findings":
       return ASKS.coding;
     case "review":
       return ASKS.review;

package/dist/assets/src/core/coordinator/contract.ts

@@ -233,6 +233,26 @@ export interface ChecksSettledPayload {
   settledAt: number;
 }
 
+/** The event the merge watch sends a waiting unit when its pull request
+ *  merged, whoever merged (record 0071, mechanism three): the unit ends
+ *  `merged` by other. The type names the unit within the instance, the
+ *  nudge's alphabet and clip rule. */
+export const PULL_MERGED_EVENT_PREFIX = "pr-merged-";
+export function pullMergedEventType(key: { instanceId: string; unit: string }): string {
+  const suffix = `-${key.unit}`;
+  const room = 100 - PULL_MERGED_EVENT_PREFIX.length - suffix.length;
+  return `${PULL_MERGED_EVENT_PREFIX}${key.instanceId.slice(0, room)}${suffix}`;
+}
+
+/** What the merged event carries — the pull request and the merge's facts;
+ *  the waiting unit confirms through its own pr-check before it acts. */
+export interface PullMergedPayload {
+  repo: string;
+  number: number;
+  sha: string;
+  mergedAt: string;
+}
+
 /** What the event carries — ids, a status and a clock; the parent confirms
  *  through `read-record` before it acts, so nothing more rides here. */
 export interface RunFinishedPayload {
@@ -379,17 +399,17 @@ export interface UnitIdle {
   wakes: number;
 }
 
-/** One unit of the plan an instance runs (a task string is a generated plan of
- *  one unit, `U1`): its branch, the units it waits on, and — as the runner
- *  reaches it — its thread, its pull request, the round boundaries the card
- *  drew and how it ended. One row a person can read for "what happened to this
- *  unit". */
 /** What the severity gate caught on a round: the level in force and the gated findings as `id (severity)`. */
 export interface RoundGate {
   level: AddressSeverity;
   findings: string[];
 }
 
+/** One unit of the plan an instance runs (a task string is a generated plan of
+ *  one unit, `U1`): its branch, the units it waits on, and — as the runner
+ *  reaches it — its thread, its pull request, the round boundaries the card
+ *  drew and how it ended. One row a person can read for "what happened to this
+ *  unit". */
 export interface CoordinatorUnit {
   instanceId: string;
   /** `U<n>` as the plan spells it. */
@@ -606,6 +626,26 @@ export async function sendChecksSettled(
   }
 }
 
+/** The one send per merged fact the watch observed (record 0071): best effort
+ *  like `sendRunFinished` — a refusal is answered, never thrown; the waiting
+ *  unit's bounded wait re-asks its own pr-check on its next chunk. */
+export async function sendPullMerged(
+  workflow: WorkflowSender | undefined,
+  key: { instanceId: string; unit: string },
+  payload: PullMergedPayload,
+): Promise<RunFinishedSend> {
+  const instance = key.instanceId;
+  if (!workflow) return { kind: "no-binding", instance };
+  const type = pullMergedEventType(key);
+  try {
+    const handle = await workflow.get(instance);
+    await handle.sendEvent({ type, payload });
+    return { kind: "sent", instance, type };
+  } catch (err) {
+    return { kind: "failed", instance, type, reason: err instanceof Error ? err.message : String(err) };
+  }
+}
+
 /** One deploy-roll signal to the child's parent (run-history item 47a): best
  *  effort like `sendRunFinished` — a refusal is answered, never thrown; a lost
  *  send costs the wait a chunk, never the round. */

package/dist/assets/src/core/coordinator/driver.ts

@@ -61,7 +61,7 @@ import {
   type UnitEnding,
   type UnitPipelineState,
   stepPrefixOf,
-  type UnitSession,
+  type LeaseSegmentProgress,
 } from "../ship/coordinator.js";
 import {
   checksSettledEventType,
@@ -316,7 +316,11 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
   // The hard stop's mark, as the bot's answer carries it (record 0060; issue
   // 1924): a finished child's unit ends stopped on it.
   const stopped = a.body.stopped === true ? { stopped: true as const } : {};
-  if (!run.finished) return { type: "read-record", step, run: { finished: false }, ...stopped, at: a.body.at };
+  // The interrupted child restarted from its request (issue 1903): the bot
+  // answers the live successor's id, and the machine keeps the wait on it.
+  const restarted = typeof a.body.restartedAs === "string" ? { restartedAs: a.body.restartedAs } : {};
+  if (!run.finished)
+    return { type: "read-record", step, run: { finished: false }, ...stopped, ...restarted, at: a.body.at };
   if (typeof run.status !== "string") throw new UnreadableAnswer("read-record", a, "status");
   // The typed artifacts as the bot's record carries them — shape-checked where
   // they were written (the run record's validator), read here as they are.
@@ -337,6 +341,7 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
     costUsd,
     handoffLists,
     failure,
+    interruption,
   } = facts;
   return {
     type: "read-record",
@@ -363,6 +368,11 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
       // The failure by name (run-history item 57), shape-checked: a
       // `provider_transient` drives the round-0 re-run (agent-ship item 9).
       ...(isRecord(failure) && typeof failure.kind === "string" ? { failure: { kind: failure.kind } } : {}),
+      // What ended an interrupted child (issue 1876): the ending's sentence
+      // names the cause instead of claiming a bot restart for every one.
+      ...(interruption === "bot_restart" || interruption === "container_replaced" || interruption === "sandbox_fault"
+        ? { interruption }
+        : {}),
     },
     at: a.body.at,
   };
@@ -441,12 +451,15 @@ function prCheckReturn(step: string, a: BotAnswer): StepReturn {
  *  ask's answer carries `retried` instead: whether the re-run was dispatched,
  *  so the machine never waits on a head an undispatched re-run left unchanged. */
 function checksReturn(step: string, a: BotAnswer): StepReturn {
-  const { ok, checks, retried, at } = a.body;
+  const { ok, checks, draft, retried, at } = a.body;
   if (ok !== true) throw new UnreadableAnswer("checks", a, "ok");
   return {
     type: "checks",
     step,
     ...(isRoundChecks(checks) ? { checks } : {}),
+    // The pull request is a draft (issue 2063): the machine's table holds the
+    // unit for the ready event instead of merging or ending without a cause.
+    ...(draft === true ? { draft: true } : {}),
     ...(typeof retried === "boolean" ? { retried } : {}),
     at,
   };
@@ -681,7 +694,7 @@ async function runUnit(
   instanceId: string,
   node: PlanUnitNode,
   plan: PlanFacts,
-  session?: UnitSession,
+  session?: LeaseSegmentProgress,
 ): Promise<UnitEnding> {
   const unit = node.id;
   // A renewal's segment names its steps under the segment (`U10/s2/…`), so

package/dist/assets/src/core/delivery.ts

@@ -186,7 +186,10 @@ export interface WeekRow extends DeliveryIndicators {
   prs: number[];
 }
 
-export interface UnitRow extends DeliveryIndicators {
+/** One row per board issue the pull requests link — the report's "Issues:"
+ *  block and the Delivery page's table. The JSON field stays `units` (a served
+ *  shape older readers hold); only the words are the issue's. */
+export interface IssueRow extends DeliveryIndicators {
   /** The board issue, or null for the pull requests no issue claims. */
   issue: number | null;
   title: string;
@@ -198,7 +201,7 @@ export interface DeliveryReport {
   repo: string;
   range: DeliveryRange;
   weeks: WeekRow[];
-  units: UnitRow[];
+  units: IssueRow[];
   prs: PullRequestRow[];
   totals: DeliveryIndicators;
   identities: DeliveryIdentities;
@@ -448,7 +451,7 @@ export function buildDeliveryReport(input: DeliveryInput): DeliveryReport {
     const key = p.issue?.number ?? null;
     byIssue.set(key, [...(byIssue.get(key) ?? []), p]);
   }
-  const units: UnitRow[] = [...byIssue.entries()]
+  const units: IssueRow[] = [...byIssue.entries()]
     .sort(([a], [b]) => (a === null ? 1 : b === null ? -1 : a - b))
     .map(([issue, rows]) => {
       const first = rows.find((r) => r.issue !== undefined)?.issue;
@@ -572,7 +575,7 @@ function coverage(report: DeliveryReport): string {
   return `the newest ${report.totals.prsMerged} pull requests only${from}`;
 }
 
-/** One block per week, then the units — single-spaced lines, so chat carries them as they are. */
+/** One block per week, then the issues — single-spaced lines, so chat carries them as they are. */
 export function renderDeliveryReport(report: DeliveryReport, nowMs: number = systemClock()): string {
   const lines: string[] = [
     [
@@ -597,7 +600,7 @@ export function renderDeliveryReport(report: DeliveryReport, nowMs: number = sys
     );
   }
   if (report.units.length > 0) {
-    lines.push("", "Units:");
+    lines.push("", "Issues:");
     for (const u of report.units) {
       const prs = `${u.prs.length === 1 ? "PR" : "PRs"} ${u.prs.join(", ")}`;
       const who = u.issue === null ? "(no issue)" : `${u.issue} ${u.title}`;

package/dist/assets/src/core/pipelineStanding.ts

@@ -130,6 +130,63 @@ export const ENDING_STAGE = {
   blocked: "ended",
 } as const satisfies Record<UnitEnding["kind"] | "blocked", Stage | "hold">;
 
+/** The user's words for a unit's ending (record 0066): what a card, a plan
+ *  summary and the web unit page print instead of the internal token —
+ *  `merge_ready` reads `merge-ready`, `round_cap` reads `round cap reached`,
+ *  never the snake_case kind. Pinned to the union plus `blocked` (the driver's
+ *  never-started status), so a new ending kind fails the build here. */
+export const ENDING_WORDS = {
+  merged: "merged",
+  already_landed: "merged",
+  merge_ready: "merge-ready",
+  held: "held",
+  merge_refused: "not merged",
+  round_cap: "round cap reached",
+  wall_clock_cap: "out of budget",
+  review_pending: "review pending",
+  stopped: "stopped",
+  aborted: "aborted",
+  transient: "aborted",
+  continued: "continuing",
+  no_verdict: "no verdict",
+  interrupted: "interrupted",
+  refused: "refused",
+  idle: "idle",
+  blocked: "blocked",
+} as const satisfies Record<UnitEnding["kind"] | "blocked", string>;
+
+/** The user's words for a round outcome (record 0066): the card's unit line
+ *  prints these beside the round header, never `checks_failed` or another
+ *  internal token. Pinned to the union: a new outcome fails the build here. */
+export const ROUND_OUTCOME_WORDS = {
+  started: "started",
+  pr_opened: "pull request opened",
+  completed: "done",
+  approve: "approved",
+  request_changes: "changes requested",
+  no_verdict: "no verdict",
+  checks_failed: "checks failed",
+  transient: "retried",
+  enqueued: "queued to merge",
+  dequeued: "removed from the merge queue",
+  aborted: "aborted",
+  stopped: "stopped",
+  continued: "continuing",
+  idle: "idle",
+} as const satisfies Record<ShipRoundOutcome, string>;
+
+/** The user's word for any ending or unit-status token — total over strings
+ *  read off a stored row, so an unknown word prints as itself rather than
+ *  throwing on an older record. */
+export function endingWordOf(kind: string): string {
+  return (ENDING_WORDS as Record<string, string>)[kind] ?? kind;
+}
+
+/** The user's word for any round-outcome token, total like `endingWordOf`. */
+export function roundOutcomeWordOf(outcome: string): string {
+  return (ROUND_OUTCOME_WORDS as Record<string, string>)[outcome] ?? outcome;
+}
+
 type ShipEvent = Extract<RunEvent, { type: "ship_round" } | { type: "ship_unit" }>;
 
 function isShipEvent(e: RunEvent): e is ShipEvent {