@defrex/autobuild 0.8.0 → 0.9.0

package/packages/core/src/processes/orchestrator-tick.ts

@@ -0,0 +1,319 @@
+/**
+ * The dispatcher tick's orchestrator step (AUT-342): resume suspended turns,
+ * reap crashed ones, and wake idle sessions from build attention events.
+ *
+ * Two independent gates keep this inert where it does not belong, and BOTH
+ * are required:
+ *
+ * 1. The step is constructed only in origin mode — the gate lives in
+ *    `processes/dispatcher.ts` on `DispatcherDeps.repoOrigin` (set
+ *    exclusively by origin mode), so a local `ab dispatch` never constructs
+ *    the step at all: an `enabled = true` in a local repository's
+ *    autobuild.toml lists no sessions, builds no registry, and calls no
+ *    model.
+ * 2. In origin mode the step returns immediately unless the repository's
+ *    effective config enables the orchestrator — the disabled-repository
+ *    no-op.
+ *
+ * The wake cursor advances only through the recorded trigger (the reducer
+ * takes `max`), so a crash between scan and start cannot skip or duplicate a
+ * wake; other builds' — and the journal's — matching events re-trigger on
+ * later ticks. One turn per session per tick, never concurrent.
+ */
+import { ORCHESTRATOR_MIN_TURN_SECONDS, type Config } from '../config/schema'
+import { compileEventGlobs } from '../events/globs'
+import type { RepositoryEvent } from '../events/repository'
+import type { TicketSource } from '../ports/types'
+import { buildRegistry, type OperatorToolRegistry } from '../operator/registry'
+import type { OperatorSandboxService } from '../operator/sandbox'
+import { ticketBackendFromSource } from '../operator/ticket-source-backend'
+import { reduceSession, type SessionTurnTrigger } from '../store/session-reducer'
+import { reduceBuild } from '../kernel/reducer'
+import type { AbEvent } from '../events/catalog'
+import type { BuildStore, Clock } from '../store/types'
+import type { IdSource } from '../ids'
+import type { LanguageModel } from 'ai'
+import {
+  createOrchestratorTurnRunner,
+  type OrchestratorTurnRunner,
+  type WakeTurnInput,
+} from '../orchestrator/turn-runner'
+
+/** Minutes an open, unsuspended turn's stream may stay silent before the
+ * reaper fails it: a crashed invocation leaves the session `running` with an
+ * open stream and no runner. Suspended turns are NEVER reaped — a turn
+ * suspended for approval is precisely an open stream that goes quiet for
+ * however long the operator takes. */
+export const ORCHESTRATOR_STALE_TURN_MINUTES = 15
+
+export interface OrchestratorTickOptions {
+  store: BuildStore
+  repo: string
+  config: Config
+  clock: Clock
+  ids: IdSource
+  /** The dispatcher's ticket source, adapted into the registry's ticket
+   * backend so wake and resumed turns keep the full ticket surface. */
+  tickets: TicketSource
+  /** Injected language model; defaults to the configured gateway model. */
+  model?: LanguageModel
+  /** The operator-sandbox backend (AUT-584): when supplied, the tick's turns
+   * serve the `sandbox.*` tools under the same configuration/approval gating
+   * every binding applies. Absent (the compatibility case) → the registry
+   * filters them from advertisement AND dispatch. The origin-mode dispatcher
+   * builds it from its own wired provider; every other caller omits it. */
+  sandbox?: OperatorSandboxService
+  /** Remaining tick budget in seconds at step entry; every turn's deadline
+   * is recomputed from this against the clock, so N sessions draw down the
+   * SAME budget instead of each getting a fresh full slice (f_9c1161ae).
+   * Less than ORCHESTRATOR_MIN_TURN_SECONDS skips the whole step
+   * (suspension state is durable — skipping is safe). */
+  remainingBudgetSeconds?: number
+  log?: (message: string) => void
+}
+
+export interface OrchestratorTickReport {
+  resumed: number
+  reaped: number
+  woken: number
+}
+
+/** The registry the tick's turns run against: the in-process binding over
+ * the dispatcher's store, with the ticket source adapted into the backend
+ * `buildRegistry`'s ticket tools require (`buildMcpTicketBackend` reads a
+ * checkout's autobuild.toml and cannot run in origin mode). */
+export function orchestratorTickRegistry(options: OrchestratorTickOptions): OperatorToolRegistry {
+  return buildRegistry({
+    store: options.store,
+    tickets: ticketBackendFromSource({ source: options.tickets, config: options.config }),
+    ...(options.sandbox !== undefined ? { sandbox: options.sandbox } : {}),
+    clock: options.clock,
+    allowedRepo: options.repo,
+  })
+}
+
+export function orchestratorTickRunner(options: OrchestratorTickOptions): OrchestratorTurnRunner {
+  return createOrchestratorTurnRunner({
+    store: options.store,
+    registry: orchestratorTickRegistry(options),
+    repo: options.repo,
+    config: options.config,
+    clock: options.clock,
+    ids: options.ids,
+    ...(options.model !== undefined ? { model: options.model } : {}),
+    ...(options.remainingBudgetSeconds !== undefined
+      ? { remainingBudgetSeconds: options.remainingBudgetSeconds }
+      : {}),
+  })
+}
+
+/** One pass of the orchestrator step. The caller has already evaluated both
+ * gates (origin mode and `enabled`); this function assumes it may run. */
+export async function runOrchestratorTickStep(
+  options: OrchestratorTickOptions,
+): Promise<OrchestratorTickReport> {
+  const { store, repo, config, clock } = options
+  const report: OrchestratorTickReport = { resumed: 0, reaped: 0, woken: 0 }
+  const entry =
+    options.remainingBudgetSeconds === undefined
+      ? config.orchestrator.invocationBudgetSeconds
+      : options.remainingBudgetSeconds
+  if (entry < ORCHESTRATOR_MIN_TURN_SECONDS) return report
+
+  // The step's deadline, fixed at entry: every turn's slice is recomputed
+  // from the clock against THIS deadline, so the step can only consume the
+  // remaining slack no matter how many sessions it serves. (A fixed
+  // per-session value handed to each turn would let N sessions run
+  // N × remaining seconds past the tick deadline — f_9c1161ae.)
+  const deadlineMs = clock().getTime() + entry * 1000
+  const remainingNow = (): number =>
+    Math.max(0, Math.floor((deadlineMs - clock().getTime()) / 1000))
+
+  const runner = orchestratorTickRunner(options)
+  const sessions = await store.listSessions(repo)
+
+  // ── Resume pass ─────────────────────────────────────────────────────────
+  for (const record of sessions) {
+    const events = await store.getSessionEvents(record.id)
+    const state = reduceSession(events)
+    if (state.status !== 'suspended' || state.openTurn === undefined) continue
+    // Budget suspensions resume always; approval suspensions only once the
+    // answer has landed (`pendingApproval` gone — the answered-approval
+    // fallback when the resuming operator-route invocation died). An
+    // unanswered approval stays put until the operator answers.
+    if (state.pendingApproval !== undefined) continue
+    // An answered approval resumes with the recorded decision, so the
+    // runner recovers the wire approvalId and appends the response part.
+    let approval: { decision: 'approve' | 'deny'; toolCallId: string } | undefined
+    if (state.suspendedCause === 'approval') {
+      for (const event of [...events].reverse()) {
+        if (event.type === 'approval.answered' && event.payload.turn === state.openTurn.turn) {
+          approval = { decision: event.payload.decision, toolCallId: event.payload.toolCallId }
+          break
+        }
+      }
+      if (approval === undefined) continue
+    }
+    // Draw down the shared deadline: a session is skipped — suspension state
+    // is durable, so skipping is always safe — when the step's remaining
+    // slack no longer leaves the floor for a meaningful turn slice.
+    const remaining = remainingNow() - ORCHESTRATOR_MIN_TURN_SECONDS
+    if (remaining < ORCHESTRATOR_MIN_TURN_SECONDS) break
+    const resumed = await runner.resumeTurn(record.id, {
+      ...(approval !== undefined ? { approval } : {}),
+      remainingBudgetSeconds: remaining,
+    })
+    if (resumed.resumed) {
+      report.resumed += 1
+      // One turn per session per tick, never concurrent: the loop outcome
+      // runs to its suspension/completion before the next session.
+      await resumed.outcome
+    }
+  }
+
+  // ── Crash reaper ────────────────────────────────────────────────────────
+  const staleMs = ORCHESTRATOR_STALE_TURN_MINUTES * 60_000
+  for (const record of sessions) {
+    const events = await store.getSessionEvents(record.id)
+    const state = reduceSession(events)
+    // Reap only a session whose reduced status is exactly `running` — an
+    // open turn with no pending approval and no suspension. A late approve
+    // answer must still find its pending approval and its turn.
+    if (state.status !== 'running' || state.openTurn === undefined) continue
+    const lastChunkTs = await lastStreamActivity(store, state.openTurn.stream)
+    if (lastChunkTs === null) continue
+    if (clock().getTime() - Date.parse(lastChunkTs) < staleMs) continue
+    const lastSeq = events[events.length - 1]?.seq ?? 0
+    const reaped = await store
+      .appendSessionEventIfCurrent(record.id, lastSeq, {
+        actor: { kind: 'agent', role: 'orchestrator', session: state.openTurn.turn },
+        type: 'turn.failed',
+        payload: {
+          turn: state.openTurn.turn,
+          kind: 'internal',
+          error: `turn invocation ended without an outcome (no stream activity for ${ORCHESTRATOR_STALE_TURN_MINUTES} minutes)`,
+        },
+      })
+      .catch(() => null)
+    if (reaped === null) continue // a resume landed first
+    await store.closeStream(state.openTurn.stream, 'aborted').catch(() => undefined)
+    report.reaped += 1
+  }
+
+  // ── Wake pass ───────────────────────────────────────────────────────────
+  const builds = (await store.listBuilds()).filter((candidate) => candidate.repo === repo)
+  for (const record of sessions) {
+    const events = await store.getSessionEvents(record.id)
+    const state = reduceSession(events)
+    if (state.status !== 'idle') continue
+    if (state.wakeGlobs.length === 0) continue
+    let filters: RegExp[]
+    try {
+      filters = compileEventGlobs(state.wakeGlobs, {
+        repository: true,
+        usage: '[orchestrator].wake',
+      })
+    } catch {
+      continue // unmatchable settings wake nothing
+    }
+
+    // Scan every build's events after this session's per-build wake cursor,
+    // then the repository journal after its own cursor; select the single
+    // newest matching event across all scanned sources.
+    let newest:
+      | { build: string; event: AbEvent }
+      | { journal: true; event: RepositoryEvent }
+      | undefined
+    for (const build of builds) {
+      const cursor = state.wakeCursors[build.slug] ?? 0
+      const buildEvents = await store.getEvents(build.slug)
+      for (const event of buildEvents) {
+        if (event.seq <= cursor) continue
+        if (!filters.some((regex) => regex.test(event.type))) continue
+        if (
+          newest === undefined ||
+          event.ts > newest.event.ts ||
+          (event.ts === newest.event.ts && event.seq > newest.event.seq)
+        ) {
+          newest = { build: build.slug, event }
+        }
+      }
+    }
+    // The journal's seq space is independent of every build's; a `seq`
+    // tie-break across sources compares numbers from different spaces —
+    // deterministic, and only matters when two sources' newest matches share
+    // a millisecond timestamp.
+    const journalCursor = state.journalWakeCursor
+    const journalEvents = await store.getRepoEvents(repo, journalCursor)
+    for (const event of journalEvents) {
+      if (event.seq <= journalCursor) continue
+      if (!filters.some((regex) => regex.test(event.type))) continue
+      if (
+        newest === undefined ||
+        event.ts > newest.event.ts ||
+        (event.ts === newest.event.ts && event.seq > newest.event.seq)
+      ) {
+        newest = { journal: true, event }
+      }
+    }
+    if (newest === undefined) continue
+
+    // Same drawdown for wake turns: one turn per session per tick, bounded
+    // by the step's shared deadline; past the floor the wake defers to a
+    // later tick.
+    const remaining = remainingNow() - ORCHESTRATOR_MIN_TURN_SECONDS
+    if (remaining < ORCHESTRATOR_MIN_TURN_SECONDS) break
+
+    // A journal wake delivers the frozen event record only — the turn's
+    // operator registry already exposes bounded repository reads, so no
+    // reduced state is coupled in. A build wake delivers the build's reduced
+    // state as before.
+    const event = {
+      seq: newest.event.seq,
+      ts: newest.event.ts,
+      type: newest.event.type,
+      payload: newest.event.payload,
+    }
+    const trigger: SessionTurnTrigger =
+      'journal' in newest
+        ? { kind: 'wake', journal: true, seq: newest.event.seq, type: newest.event.type }
+        : { kind: 'wake', build: newest.build, seq: newest.event.seq, type: newest.event.type }
+    const wake: WakeTurnInput =
+      'journal' in newest
+        ? { event }
+        : {
+            event,
+            buildState: reduceBuild(await store.getEvents(newest.build)) as unknown as Record<
+              string,
+              unknown
+            >,
+          }
+    const start = await runner.startTurn(record.id, trigger, wake, {
+      remainingBudgetSeconds: remaining,
+    })
+    if (start.started) {
+      report.woken += 1
+      // The cursor advances only through the recorded trigger (the reducer
+      // takes `max`), so a crash between scan and start cannot skip or
+      // duplicate a wake — and other builds' matching events re-trigger on
+      // later ticks.
+      await start.outcome
+    }
+  }
+
+  options.log?.(
+    `orchestrator step: resumed=${report.resumed} reaped=${report.reaped} woken=${report.woken}`,
+  )
+  return report
+}
+
+/** The newest chunk timestamp on a stream, or its creation time when the
+ * stream has no chunks yet — the liveness signal the reaper reads. */
+async function lastStreamActivity(store: BuildStore, streamId: string): Promise<string | null> {
+  const read = await store.readStream(streamId).catch(() => null)
+  if (read === null) return null
+  const last = read.chunks[read.chunks.length - 1]
+  if (last !== undefined) return last.ts
+  const record = await store.getStream(streamId)
+  return record?.createdAt ?? null
+}

package/packages/core/src/processes/sandbox-state.ts

@@ -22,6 +22,12 @@ export interface SandboxEnvironmentSnapshot {
    * `[orchestrator].sandbox.idleMinutes`. */
   lastEvidenceTs: string
   sessionId?: string
+  /** The base branch head the fresh provision selected; carried forward
+   * through later lifecycle facts (the base head cannot change without a
+   * fresh provision, which overwrites it) — the publication precondition's
+   * reference point, read by the publish operation. Absent on snapshots
+   * provisioned before this field existed. */
+  baseSha?: string
 }
 
 type MutableSnapshot = {
@@ -31,6 +37,7 @@ type MutableSnapshot = {
   state: SandboxEnvironmentState
   lastEvidenceTs: string
   sessionId?: string
+  baseSha?: string
 }
 
 /** Per-environment sandbox state, keyed deterministically by
@@ -49,6 +56,7 @@ export function sandboxStates(events: readonly RepositoryEvent[]): SandboxEnviro
         state: 'live',
         lastEvidenceTs: ts,
         ...(event.payload.sessionId !== undefined ? { sessionId: event.payload.sessionId } : {}),
+        ...(event.payload.baseSha !== undefined ? { baseSha: event.payload.baseSha } : {}),
       })
     } else if (event.type === 'orchestrator.sandbox.resumed') {
       const previous = byEnvironment.get(event.payload.environmentId)
@@ -63,6 +71,7 @@ export function sandboxStates(events: readonly RepositoryEvent[]): SandboxEnviro
           : previous?.sessionId !== undefined
             ? { sessionId: previous.sessionId }
             : {}),
+        ...(previous?.baseSha !== undefined ? { baseSha: previous.baseSha } : {}),
       })
     } else if (event.type === 'orchestrator.sandbox.activity') {
       const current = byEnvironment.get(event.payload.environmentId)
@@ -94,6 +103,7 @@ export function sandboxStates(events: readonly RepositoryEvent[]): SandboxEnviro
         state: 'released',
         lastEvidenceTs: ts,
         ...(existing?.sessionId !== undefined ? { sessionId: existing.sessionId } : {}),
+        ...(existing?.baseSha !== undefined ? { baseSha: existing.baseSha } : {}),
       })
     }
   }

package/packages/core/src/store/adapter.ts

@@ -16,8 +16,39 @@ export type {
   SessionEventType,
   SessionEventWrite,
 } from '../events/sessions'
+export {
+  DEFAULT_TICKET_ASSET_LIMITS,
+  effectiveTicketAssetLimits,
+  loadTicketAsset,
+  resolvePinnedAsset,
+  storeTicketAssetBlobs,
+  summarizeTicketAsset,
+  TICKET_ASSET_MAX_BYTES,
+  TICKET_ASSET_MAX_ENTRIES,
+  TicketAssetValidationError,
+  validateTicketAssetInput,
+} from './ticket-assets'
+export type {
+  TicketAsset,
+  TicketAssetContentEntry,
+  TicketAssetEntry,
+  TicketAssetEntryInput,
+  TicketAssetInput,
+  TicketAssetLayout,
+  TicketAssetLimits,
+  TicketAssetMeta,
+  TicketAssetSummary,
+} from './ticket-assets'
+export { validateCreatedEvent } from './new-build'
 export { createBuildScopedStore } from './build-scope'
 export { createSessionScopedStore } from './session-handle'
+export { DIGEST_EVENT_TYPES, reduceBuildDigest } from './digest'
+export {
+  projectRepositoryStateEvents,
+  REPOSITORY_RUN_SCOPED_EVENT_TYPES,
+  REPOSITORY_STATE_EVENT_TYPES,
+  readRepoStateEventsWithAnchorRecheck,
+} from './repo-state-events'
 export {
   DEFAULT_ARTIFACT_RETENTION_MAX_REVISIONS,
   DISPATCHER_RETENTION_BUILD_KINDS,
@@ -61,6 +92,7 @@ export type {
   ArtifactInput,
   ArtifactMeta,
   BlobStore,
+  BuildDigest,
   BuildRecord,
   BuildScopedStore,
   BuildStore,

package/packages/core/src/store/build-scope.ts

@@ -13,6 +13,7 @@ import type {
   Artifact,
   ArtifactInput,
   ArtifactMeta,
+  BuildDigest,
   BuildRecord,
   BuildScopedStore,
   BuildStore,
@@ -25,6 +26,13 @@ import type {
   SubscribeOptions,
   Unsubscribe,
 } from './types'
+import type {
+  TicketAsset,
+  TicketAssetInput,
+  TicketAssetLimits,
+  TicketAssetMeta,
+  TicketAssetSummary,
+} from './ticket-assets'
 import type {
   StreamChunk,
   StreamOutcome,
@@ -179,6 +187,12 @@ export function createBuildScopedStore(store: BuildStore, scope: string): BuildS
     getRepoEvents(repo: string, _sinceSeq?: number): Promise<RepositoryEvent[]> {
       return Promise.reject(new BuildScopeError(scope, 'getRepoEvents', repo))
     },
+    getRepoStateEvents(repo: string): Promise<RepositoryEvent[]> {
+      return Promise.reject(new BuildScopeError(scope, 'getRepoStateEvents', repo))
+    },
+    getRepoBuildDigests(repo: string): Promise<Map<string, BuildDigest>> {
+      return Promise.reject(new BuildScopeError(scope, 'getRepoBuildDigests', repo))
+    },
     putRepoArtifact(repo: string, _artifact: ArtifactInput): Promise<RepositoryArtifactMeta> {
       return Promise.reject(new BuildScopeError(scope, 'putRepoArtifact', repo))
     },
@@ -192,6 +206,49 @@ export function createBuildScopedStore(store: BuildStore, scope: string): BuildS
     listRepoArtifacts(repo: string, _kind?: string): Promise<RepositoryArtifactMeta[]> {
       return Promise.reject(new BuildScopeError(scope, 'listRepoArtifacts', repo))
     },
+    ticketAssetLimits(repo: string): Promise<TicketAssetLimits> {
+      return Promise.reject(new BuildScopeError(scope, 'ticketAssetLimits', repo))
+    },
+    putTicketAsset(
+      repo: string,
+      _ticketId: string,
+      _asset: TicketAssetInput,
+    ): Promise<TicketAssetMeta> {
+      return Promise.reject(new BuildScopeError(scope, 'putTicketAsset', repo))
+    },
+    getTicketAsset(
+      repo: string,
+      _ticketId: string,
+      _kind: string,
+      _name: string,
+      _rev?: number,
+    ): Promise<TicketAsset | null> {
+      return Promise.reject(new BuildScopeError(scope, 'getTicketAsset', repo))
+    },
+    async getPinnedTicketAsset(
+      slug: string,
+      kind: string,
+      name: string,
+      rev?: number,
+    ): Promise<TicketAsset | null> {
+      own('getPinnedTicketAsset', slug)
+      return store.getPinnedTicketAsset(slug, kind, name, rev)
+    },
+    listTicketAssets(
+      repo: string,
+      _ticketId: string,
+      _opts?: { revisions?: boolean },
+    ): Promise<TicketAssetSummary[]> {
+      return Promise.reject(new BuildScopeError(scope, 'listTicketAssets', repo))
+    },
+    removeTicketAsset(
+      repo: string,
+      _ticketId: string,
+      _kind: string,
+      _name: string,
+    ): Promise<TicketAssetMeta | null> {
+      return Promise.reject(new BuildScopeError(scope, 'removeTicketAsset', repo))
+    },
     claimRepoLease(repo: string, _holder: string, _ttlMs: number): Promise<boolean> {
       return Promise.reject(new BuildScopeError(scope, 'claimRepoLease', repo))
     },
@@ -216,6 +273,13 @@ export function createBuildScopedStore(store: BuildStore, scope: string): BuildS
     ): Promise<SessionEventEnvelope<T>> {
       return Promise.reject(new BuildScopeError(scope, 'appendSessionEvent', id))
     },
+    appendSessionEventIfCurrent<T extends SessionEventType>(
+      id: string,
+      _expectedSeq: number,
+      _event: SessionEventWrite<T>,
+    ): Promise<SessionEventEnvelope<T> | null> {
+      return Promise.reject(new BuildScopeError(scope, 'appendSessionEventIfCurrent', id))
+    },
     getSessionEvents(id: string, _sinceSeq?: number): Promise<SessionEvent[]> {
       return Promise.reject(new BuildScopeError(scope, 'getSessionEvents', id))
     },