@dsh-enhanced/assistant-evaluation 0.1.66 → 0.1.68

package/lib/service.js

@@ -4,10 +4,11 @@ import { acceptanceDigest, goalDefinitionSituation, validateTaskAcceptanceContra
 import { EvaluationStore, EvaluationStoreError, canonicalEvaluationScope, evaluationLearningProjectionDigest, } from './store.js';
 import { registerEvaluationTools } from './tools.js';
 import { normalizeAttentionCohort, } from './attention-tuning.js';
-import { ATTENTION_OWNER_QUESTION_SOURCE_ID, attentionOwnerQuestionIdempotencyKey, attentionOwnerQuestionText, } from './attention-owner-questions.js';
+import { ATTENTION_OWNER_QUESTION_SOURCE_ID, attentionOwnerQuestionIdempotencyKey, attentionOwnerQuestionText, parseAttentionOwnerQuestionChoice, ATTENTION_OWNER_QUESTION_REPLY_PROTOCOL, } from './attention-owner-questions.js';
 import { validateWorkItemOwnerFeedbackProof } from './work-item-owner-proof.js';
-import { computeIntakeAttentionAgreement, INTAKE_ATTENTION_AGREEMENT_SCAN_LIMIT, isIntakeProvenanceSource } from './intake-attention-agreement.js';
+import { computeIntakeAttentionAgreement, createIntakeAttentionAgreementSnapshot, INTAKE_ATTENTION_AGREEMENT_HISTORY_PROTOCOL, INTAKE_ATTENTION_AGREEMENT_SCAN_LIMIT, isIntakeProvenanceSource, } from './intake-attention-agreement.js';
 import { executionStatuses, objectiveStatuses, outcomeSourceKinds, TRUSTED_EVALUATION_PRODUCER_PROTOCOL, } from './types.js';
+const PERSIST_DISABLED = Object.freeze({ recorded: false, replayed: false, reason: 'disabled' });
 const OWNER_NOTIFICATION_WITHDRAWAL_PROTOCOL = 'assistant-delivery/owner-notification-withdrawal/v1';
 function isOwnerQuestionDeliveryPort(value) {
     const port = value;
@@ -15,6 +16,10 @@ function isOwnerQuestionDeliveryPort(value) {
         && typeof port.validateOwnerRoute === 'function' && typeof port.resolveOwnerRoute === 'function'
         && typeof port.inspectOwnerNotification === 'function' && typeof port.registerOwnerNotificationWithdrawal === 'function';
 }
+function isOwnerQuestionReplyPort(value) {
+    const port = value;
+    return typeof port === 'object' && port !== null && typeof port.registerOwnerNotificationReply === 'function';
+}
 export const ASSISTANT_EVALUATION_SKILL = `# Personal assistant self-evaluation
 
 Use this workflow only to assess whether an already-finished task met its objective. A self-assessment is diagnostic evidence, never ground truth and never permission to change production behavior.
@@ -52,6 +57,7 @@ const configSchema = Schema.object({
     notificationSyncIntervalMs: Schema.number().step(1).min(0).max(86_400_000).default(60_000),
     attentionTuningAutoAdopt: Schema.boolean().default(false),
     intakeAttentionAgreementEnabled: Schema.boolean().default(false),
+    intakeAttentionAgreementPersistIntervalMs: Schema.number().step(1).min(60_000).max(604_800_000),
     attentionTuningCohorts: Schema.array(Schema.object({
         lane: Schema.string().required(),
         sourceId: Schema.string().required(),
@@ -248,8 +254,13 @@ export class AssistantEvaluationService extends Service {
     projectionTimer;
     notificationFacts;
     lastNotificationSyncAt = Number.NEGATIVE_INFINITY;
+    lastIntakeAgreementPersistAt = Number.NEGATIVE_INFINITY;
+    /** Rotates across scopes when one database serves several (bounded one row per tick). */
+    intakeAgreementPersistCursor;
     ownerQuestionWithdrawal;
     activeOwnerQuestionWithdrawals = new WeakSet();
+    ownerQuestionReply;
+    activeOwnerQuestionReplies = new WeakSet();
     attentionCohorts;
     active = true;
     constructor(ctx, input, options = {}) {
@@ -272,6 +283,15 @@ export class AssistantEvaluationService extends Service {
         if (this.config.intakeAttentionAgreementEnabled && !this.config.notificationOutcomesEnabled) {
             throw new Error('assistant-evaluation: intakeAttentionAgreementEnabled requires notificationOutcomesEnabled');
         }
+        if (this.config.intakeAttentionAgreementPersistIntervalMs !== undefined) {
+            const value = this.config.intakeAttentionAgreementPersistIntervalMs;
+            if (!Number.isSafeInteger(value) || value < 60_000 || value > 604_800_000) {
+                throw new Error('assistant-evaluation: intakeAttentionAgreementPersistIntervalMs must be between 60000 and 604800000');
+            }
+            if (!this.config.intakeAttentionAgreementEnabled || !this.config.notificationOutcomesEnabled) {
+                throw new Error('assistant-evaluation: intakeAttentionAgreementPersistIntervalMs requires intakeAttentionAgreementEnabled and notificationOutcomesEnabled');
+            }
+        }
         if (this.config.attentionTuningAutoAdopt && !this.config.notificationOutcomesEnabled) {
             throw new Error('assistant-evaluation: attentionTuningAutoAdopt requires notificationOutcomesEnabled');
         }
@@ -401,6 +421,8 @@ export class AssistantEvaluationService extends Service {
         if (this.config.attentionOwnerQuestionDeliveryEnabled) {
             this.bindOwnerQuestionWithdrawal(currentDelivery);
             ctx.inject(['assistantDelivery'], deliveryCtx => this.bindOwnerQuestionWithdrawal(deliveryCtx.get('assistantDelivery')));
+            this.bindOwnerQuestionReply(currentDelivery);
+            ctx.inject(['assistantDelivery'], deliveryCtx => this.bindOwnerQuestionReply(deliveryCtx.get('assistantDelivery')));
         }
         const currentVerifier = ctx.get('assistantVerifier');
         if (isTrustedVerifierEvaluationProducer(currentVerifier))
@@ -437,6 +459,14 @@ export class AssistantEvaluationService extends Service {
                         this.reconcileAttentionOwnerQuestions();
                     }
                     catch { /* retried on a later sync */ }
+                    const agreementInterval = this.config.intakeAttentionAgreementPersistIntervalMs;
+                    if (agreementInterval !== undefined && now - this.lastIntakeAgreementPersistAt >= agreementInterval) {
+                        this.lastIntakeAgreementPersistAt = now;
+                        try {
+                            this.reconcileIntakeAttentionAgreementPersistence();
+                        }
+                        catch { /* retried on a later sync */ }
+                    }
                 }
                 void this.reconcileProjections().catch(() => { });
             }, this.config.projectionIntervalMs);
@@ -449,6 +479,7 @@ export class AssistantEvaluationService extends Service {
             this.projectionTimer = undefined;
             this.notificationFacts = undefined;
             this.ownerQuestionWithdrawal?.dispose();
+            this.ownerQuestionReply?.dispose();
             disposeCurrentProjector?.();
             this.automationBinding?.dispose();
             this.deliveryBinding?.dispose();
@@ -630,6 +661,14 @@ export class AssistantEvaluationService extends Service {
         this.assertActive();
         return this.store.getForegroundLearningProjection(exactEvaluationHostScope(input.scope), hostIdentifier(input.inboxId, 'inboxId', 1_000));
     }
+    /**
+     * Host-only resource metrics of one trusted outcome. Kept out of the
+     * learning-projection receipt so historical digests stay unchanged.
+     */
+    inspectTrustedOutcomeMetrics(input) {
+        this.assertActive();
+        return this.store.inspectTrustedOutcomeMetrics(exactEvaluationHostScope(input.scope), hostIdentifier(input.outcomeId, 'outcomeId', 200));
+    }
     /** Host-only exact current owner result for one durable work item. */
     getTrustedWorkItemLearningProjection(input) {
         this.assertActive();
@@ -928,11 +967,82 @@ export class AssistantEvaluationService extends Service {
             throw new AssistantEvaluationError('invalid-input', 'intake attention agreement window is invalid');
         }
         const { scope } = canonicalEvaluationScope(input.scope);
+        return this.#intakeAttentionAgreement(scope, from, to);
+    }
+    /** Shared read model for the ad hoc inspect and the E1 persistence snapshot. */
+    #intakeAttentionAgreement(scope, from, to) {
         const heads = this.store.notifications.workItemHeads(scope, from, to, INTAKE_ATTENTION_AGREEMENT_SCAN_LIMIT);
         const workItems = this.ctx.get('assistantWorkItems');
         return computeIntakeAttentionAgreement({ scope, fromNotifiedAt: from, toNotifiedAt: to, records: heads.records,
             truncated: heads.truncated, source: isIntakeProvenanceSource(workItems) ? workItems : undefined });
     }
+    /**
+     * WP22 E1, default off: persist at most one agreement snapshot per call,
+     * using one aligned interval bucket. The window is
+     * `[bucketEnd - defaultSummaryWindowMs, bucketEnd)`, so a retry inside the
+     * same bucket computes the same window and the store replays the existing
+     * digest; a late outcome revision changes the digest and appends one
+     * immutable revision row for the same window. When the database serves
+     * several scopes the method rotates deterministically; one call writes at
+     * most one row and one credential-free scan.
+     *
+     * It never sends, adopts, authorizes intake/auto or changes the read model.
+     * Without a WorkItems peer it writes nothing and says so; with a peer that
+     * throws per item (including WorkItems' intake ledger off) the item is
+     * counted as `unresolved` inside a normal snapshot.
+     */
+    reconcileIntakeAttentionAgreementPersistence() {
+        this.assertActive();
+        const interval = this.config.intakeAttentionAgreementPersistIntervalMs;
+        if (interval === undefined)
+            return PERSIST_DISABLED;
+        if (!this.config.notificationOutcomesEnabled || !this.config.intakeAttentionAgreementEnabled)
+            return PERSIST_DISABLED;
+        const workItems = this.ctx.get('assistantWorkItems');
+        if (!isIntakeProvenanceSource(workItems))
+            return Object.freeze({ recorded: false, replayed: false, reason: 'work-items-unavailable' });
+        const scopes = this.store.notifications.workItemScopes(100);
+        if (scopes.length === 0)
+            return Object.freeze({ recorded: false, replayed: false, reason: 'no-work-item-notifications' });
+        const scopeKeys = scopes.map(scope => canonicalEvaluationScope(scope).scopeKey);
+        const cursor = this.intakeAgreementPersistCursor;
+        const next = cursor === undefined ? 0 : scopeKeys.findIndex(key => key > cursor);
+        const index = next === -1 ? 0 : next;
+        const scope = scopes[index];
+        const scopeKey = scopeKeys[index];
+        const now = this.now();
+        const to = Math.floor(now / interval) * interval;
+        const from = Math.max(0, to - this.config.defaultSummaryWindowMs);
+        if (to <= from)
+            return Object.freeze({ recorded: false, replayed: false, reason: 'outside-window' });
+        this.intakeAgreementPersistCursor = scopeKey;
+        const agreement = this.#intakeAttentionAgreement(scope, from, to);
+        if (agreement.scanned === 0)
+            return Object.freeze({ recorded: false, replayed: false, reason: 'no-work-item-notifications', scope });
+        const snapshot = createIntakeAttentionAgreementSnapshot({ agreement, computedAt: now,
+            windowMs: this.config.defaultSummaryWindowMs, scanLimit: INTAKE_ATTENTION_AGREEMENT_SCAN_LIMIT });
+        const result = this.store.intakeAttentionAgreement.record(scope, snapshot);
+        return Object.freeze({ recorded: !result.replayed, replayed: result.replayed, scope, snapshot: result.record });
+    }
+    /**
+     * WP22 E1 read-only history, newest first. Undefined when
+     * `intakeAttentionAgreementEnabled` is off; persisted rows are returned only
+     * for the exact owner scope. No snapshot is a causal claim and none may
+     * authorize intake/auto.
+     */
+    inspectIntakeAttentionAgreementHistory(input) {
+        this.assertActive();
+        if (!this.config.intakeAttentionAgreementEnabled)
+            return undefined;
+        const limit = input.limit ?? 20;
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
+            throw new AssistantEvaluationError('invalid-input', 'intake attention agreement history limit is invalid');
+        }
+        const { scope } = canonicalEvaluationScope(input.scope);
+        const snapshots = this.store.intakeAttentionAgreement.list(scope, limit);
+        return Object.freeze({ protocol: INTAKE_ATTENTION_AGREEMENT_HISTORY_PROTOCOL, causal: false,
+            scope: Object.freeze({ workspace: scope.workspace, preset: scope.preset }), snapshots: Object.freeze(snapshots) });
+    }
     #attentionPolicy() {
         return Object.freeze({
             minSample: this.config.attentionTuningMinSample,
@@ -942,7 +1052,14 @@ export class AssistantEvaluationService extends Service {
         });
     }
     #looseningOptions() {
-        return this.config.attentionLooseningEnabled ? Object.freeze({ replayWindowMs: this.config.attentionLooseningReplayWindowMs }) : undefined;
+        if (!this.config.attentionLooseningEnabled)
+            return undefined;
+        return Object.freeze({
+            replayWindowMs: this.config.attentionLooseningReplayWindowMs,
+            ...(this.config.attentionOwnerQuestionDeliveryEnabled
+                ? { ownerQuestionReplyLoop: Object.freeze({ noticeTtlMs: this.config.attentionOwnerQuestionNoticeTtlMs }) }
+                : {}),
+        });
     }
     #attentionCohort(input) {
         let cohort;
@@ -1095,6 +1212,95 @@ export class AssistantEvaluationService extends Service {
         this.ownerQuestionWithdrawal = binding;
         return binding.dispose;
     }
+    /**
+     * Register (once per Delivery instance) the slice-5 reply consumer. A
+     * Delivery without the reply port is treated as absent: slice-4 notice
+     * delivery keeps working, only replies are not read. A registration error
+     * only disables replies; it never blocks notice delivery.
+     */
+    bindOwnerQuestionReply(source) {
+        if (!this.active || !isOwnerQuestionReplyPort(source))
+            return undefined;
+        if (this.ownerQuestionReply?.source === source)
+            return undefined;
+        const registration = Object.freeze({
+            protocol: ATTENTION_OWNER_QUESTION_REPLY_PROTOCOL,
+            authority: 'assistantEvaluation',
+            sourceId: ATTENTION_OWNER_QUESTION_SOURCE_ID,
+            idempotencyKeyPrefix: attentionOwnerQuestionIdempotencyKey(''),
+            consume: (input) => this.#consumeOwnerQuestionReply(input),
+        });
+        this.activeOwnerQuestionReplies.add(registration);
+        let unregister;
+        try {
+            unregister = source.registerOwnerNotificationReply(registration)?.unregister;
+        }
+        catch (error) {
+            this.activeOwnerQuestionReplies.delete(registration);
+            this.ctx.logger.warn(`assistant-evaluation: owner-question reply registration failed; replies are not read: ${String(error)}`);
+            return undefined;
+        }
+        if (typeof unregister !== 'function') {
+            this.activeOwnerQuestionReplies.delete(registration);
+            this.ctx.logger.warn('assistant-evaluation: owner-question reply registration returned no unregister; replies are not read');
+            return undefined;
+        }
+        const release = unregister;
+        this.ownerQuestionReply?.dispose();
+        let live = true;
+        const binding = Object.freeze({ source, registration, dispose: () => {
+                if (!live)
+                    return;
+                live = false;
+                this.activeOwnerQuestionReplies.delete(registration);
+                try {
+                    release();
+                }
+                catch { /* Delivery already gone */ }
+                if (this.ownerQuestionReply === binding)
+                    this.ownerQuestionReply = undefined;
+            } });
+        this.ownerQuestionReply = binding;
+        return binding.dispose;
+    }
+    /**
+     * Synchronous Delivery callback for one authenticated reply to an exact
+     * owner-question notice. Only exact whole-phrase choices are accepted; a
+     * recognized choice is consumed even when its question is no longer open,
+     * so a stale "authorize-once" never reaches the Agent. Storage errors are
+     * `transient` and leave Delivery's Inbox pending for a bounded retry.
+     */
+    #consumeOwnerQuestionReply(input) {
+        if (!this.active || !this.config.attentionOwnerQuestionDeliveryEnabled)
+            return 'ignored';
+        if (typeof input?.idempotencyKey !== 'string' || typeof input.text !== 'string')
+            return 'ignored';
+        const prefix = attentionOwnerQuestionIdempotencyKey('');
+        if (!input.idempotencyKey.startsWith(prefix))
+            return 'ignored';
+        const questionId = input.idempotencyKey.slice(prefix.length);
+        const choice = parseAttentionOwnerQuestionChoice(input.text);
+        if (choice === undefined || questionId.length === 0)
+            return 'ignored';
+        try {
+            for (const cohort of this.attentionCohorts) {
+                for (const scope of this.store.attention.scopes(cohort)) {
+                    const latest = this.store.attention.latestOwnerQuestion(scope, cohort);
+                    if (latest === undefined || latest === 'unverifiable' || latest.questionId !== questionId)
+                        continue;
+                    this.applyAttentionOwnerQuestionReply({ scope, cohort, questionId, choice });
+                    return 'applied';
+                }
+            }
+            // The notice was genuinely issued under this source and key, but the
+            // local ledger no longer holds that exact question: consume the
+            // recognized choice instead of sending it to the Agent.
+            return 'applied';
+        }
+        catch {
+            return 'transient';
+        }
+    }
     /**
      * Send-time answer for one owner-question notice. It stays sendable only
      * while its question is still the cohort's latest, open, unanswered, inside
@@ -1171,6 +1377,9 @@ export class AssistantEvaluationService extends Service {
                     continue;
                 }
                 this.bindOwnerQuestionWithdrawal(delivery);
+                // A replaced Delivery instance needs the reply consumer bound as well;
+                // the tick is the existing retry point, so no extra loop is added.
+                this.bindOwnerQuestionReply(delivery);
                 // Only queue (or adopt) while this service's own withdrawal check is
                 // bound to this exact Delivery instance; otherwise a closed question
                 // could be sent unchecked.
@@ -1232,7 +1441,7 @@ export class AssistantEvaluationService extends Service {
                         scope: { principalId: owner.principalId, ...principal, workspace: scope.workspace, preset: scope.preset },
                         sessionId,
                         idempotencyKey,
-                        text: attentionOwnerQuestionText(question, scope),
+                        text: attentionOwnerQuestionText(question, scope, { repliesRead: true }),
                         expiresAt,
                         attention: { purpose: 'result' },
                         withdrawable: true,
@@ -1255,8 +1464,10 @@ export class AssistantEvaluationService extends Service {
     }
     /**
      * Host-internal record-only owner reply to the cohort's latest question.
-     * It never records a grant or changes a tuning version; an owner who
-     * authorizes still records a grant through `grantAttentionLoosening`.
+     * It never records a grant or changes a tuning version, and it is not the
+     * slice-5 apply path; an owner who authorizes uses
+     * `applyAttentionOwnerQuestionReply` (the only path the Delivery reply
+     * consumer calls) or records a host grant through `grantAttentionLoosening`.
      */
     recordAttentionOwnerQuestionReply(input) {
         this.assertActive();
@@ -1272,6 +1483,23 @@ export class AssistantEvaluationService extends Service {
             || this.now() >= latest.question.createdAt + this.config.attentionOwnerQuestionNoticeTtlMs;
         return this.store.attentionQuestions.recordReply(input.scope, cohort, latest.questionId, input.choice, latest.open, expired);
     }
+    /**
+     * Slice 5 evidence-backed apply path for one exact owner reply; the
+     * Delivery consumer and Host callers use this instead of the record-only
+     * seam. `authorize-once` records the reply and creates one bounded one-time
+     * grant for exactly the questioned proposal (parent/candidate bounds, the
+     * proposal's step size, one adoption); the next tuning tick still re-runs
+     * the independent holdout replay before adopting. `decline` closes the
+     * proposal. A proposal that already had an immutable decision returns
+     * `proposal-terminal` and nothing adopts.
+     */
+    applyAttentionOwnerQuestionReply(input) {
+        this.assertActive();
+        const cohort = this.#attentionCohort(input.cohort);
+        if (!this.config.attentionOwnerQuestionDeliveryEnabled)
+            return Object.freeze({ status: 'rejected', reason: 'delivery-disabled' });
+        return this.store.attention.applyOwnerQuestionReply(input.scope, cohort, input.questionId, input.choice, { noticeTtlMs: this.config.attentionOwnerQuestionNoticeTtlMs });
+    }
     /** Per-question delivery decisions and recorded replies for one cohort. */
     attentionOwnerQuestionStatus(input) {
         this.assertActive();
@@ -1303,6 +1531,14 @@ export class AssistantEvaluationService extends Service {
         return this.active && typeof registration === 'object' && registration !== null
             && this.activeOwnerQuestionWithdrawals.has(registration);
     }
+    /**
+     * Delivery's slot-anchored proof that the slice-5 reply consumer under the
+     * `assistantEvaluation` authority is this live service's own registration.
+     */
+    ownsOwnerNotificationReply(registration) {
+        return this.active && typeof registration === 'object' && registration !== null
+            && this.activeOwnerQuestionReplies.has(registration);
+    }
     /** Delivery uses the same ownership boundary as Automations. */
     ownsTrustedDeliveryEvaluationRegistration(registration) {
         return this.active && typeof registration === 'object' && registration !== null