@dsh-enhanced/assistant-work-items 0.1.66 → 0.1.68

package/lib/service.js

@@ -1,6 +1,7 @@
+import { acceptanceDigest } from '@dsh-enhanced/task-acceptance-contract';
 import { WorkItemEngineeringTargets } from './engineering-context.js';
 import { Service } from '@deepseek-ai/cordis';
-import { classifyIntake, intakeSourcePolicy } from './intake.js';
+import { classifyIntake, intakeAcceptanceOf, intakeObjectiveOf, intakeSourcePolicy, MAX_INTAKE_OBJECTIVE_BYTES } from './intake.js';
 import { authenticatesIntakeText, WorkItemIntakeEvaluationRuntime } from './intake-evaluation-runtime.js';
 import { WorkItemIntakeAdmissionBridge } from './intake-admission.js';
 import { WorkItemAdmission } from './admission.js';
@@ -14,7 +15,8 @@ import { settleOutcomes as runSettlement } from './settlement.js';
 import { WorkItemOwnerRecall } from './owner-recall.js';
 import { MALFORMED_ACCEPTANCE_BINDING, WorkItemStore } from './store.js';
 import { normalizeFollowUp, normalizePolicyChange, noticePolicyChange } from './policy-notice.js';
-import { resolveAcceptanceBinding, settleAcceptance, workerRunTaskRef } from './acceptance-binding.js';
+import { parseStoredContinuationPlan } from './reply-contract.js';
+import { hasFreshAcceptanceReceipt, resolveAcceptanceBinding, settleAcceptance, workerRunTaskRef } from './acceptance-binding.js';
 import { WorkItemSignalIntake, } from './signals.js';
 import { registerWorkItemTools, workItemReportKey } from './tools.js';
 import { TERMINAL_STATES, WorkItemError } from './types.js';
@@ -75,6 +77,10 @@ const WORKER_RUN_BIND_SKIP_LIMIT = 1_000;
 const WORKER_RUN_DRIFT_WARN_AFTER = 5;
 /** Held reports released per scheduler wake; a full page advances the in-memory round-robin cursor. */
 const HELD_REPORT_RELEASE_LIMIT = 10;
+/** Meta cursor: last fully-noticed Policy configuration digest. */
+const POLICY_NOTICE_VERSION_META = 'policy.notice.version';
+/** Bound one wake's Policy-notice paging; an incomplete pass retries next wake. */
+const POLICY_NOTICE_PAGE_LIMIT = 10;
 /**
  * `bindWorkerRun` refusals that cannot change while the item keeps its
  * occurrence: an expired, mismatched (ref, owner scope, digest), settled or
@@ -151,6 +157,9 @@ export class AssistantWorkItemsService extends Service {
     workItemsMalformedBindingWarned = new Set();
     workItemsOwnerReads;
     workItemsOwnerContinuations;
+    /** Bounded, memory-only producer hints for inferred auto admission; never persisted. */
+    workItemsIntakeHints = new Map();
+    static MAX_INTAKE_HINTS = 256;
     constructor(ctx, input) {
         super(ctx, 'assistantWorkItems');
         this.workItemsConfig = Object.freeze(normalizeConfig(input, Date.now()));
@@ -170,6 +179,13 @@ export class AssistantWorkItemsService extends Service {
             store: () => this.workItemsClosed ? undefined : this.workItemsComponents?.store,
             // The public Host path, so an admitted item wakes its worker like any decision.
             admit: decision => this.admitDecision(decision),
+            hint: (source, sourceEventId) => {
+                const hint = this.workItemsIntakeHints.get(this.intakeHintKey(source, sourceEventId));
+                if (hint?.objective === undefined)
+                    return undefined;
+                return Object.freeze({ objective: hint.objective,
+                    ...(hint.acceptance === undefined ? {} : { acceptance: hint.acceptance }) });
+            },
             log: message => ctx.logger.debug(message),
         });
         this.workItemsOwnerReads = new WorkItemOwnerRecall({ ...ownerDependencies, access });
@@ -543,6 +559,9 @@ export class AssistantWorkItemsService extends Service {
             catch (error) {
                 this.ctx.logger.warn(`assistant-work-items: acceptance auto-settle scan failed: ${describe(error)}`);
             }
+            // P1-1: resolve outcome windows and followed-thread closures on the same
+            // bounded wake instead of waiting for an unrelated claim or Host call.
+            this.workItemsSettleQuietly(components);
             // Release only after auto-settle, so a verdict that arrived on this wake
             // decides the same pass whether the held report is sent or blocked.
             try {
@@ -551,9 +570,61 @@ export class AssistantWorkItemsService extends Service {
             catch (error) {
                 this.ctx.logger.warn(`assistant-work-items: acceptance held-report scan failed: ${describe(error)}`);
             }
+            // P1-1: materialize terminal follow-up releases on the same bounded wake.
+            // The store derives them from durable state, so this is restart-safe and a
+            // second pass releases nothing new. Delivery still owns the authenticated
+            // reply text and decides whether a released follow-up re-enters judgment.
+            try {
+                const released = components.store.releaseEndedFollowUps(100);
+                if (released.length > 0) {
+                    this.ctx.logger.debug(`assistant-work-items: released ${released.length} ended follow-up(s)`);
+                }
+            }
+            catch (error) {
+                this.ctx.logger.warn(`assistant-work-items: terminal follow-up release scan failed: ${describe(error)}`);
+            }
+            try {
+                this.workItemsNoticePolicyChange(components);
+            }
+            catch (error) {
+                this.ctx.logger.warn(`assistant-work-items: policy notice scan failed: ${describe(error)}`);
+            }
             this.workItemsSchedulerWaking = false;
         }
     }
+    /**
+     * P1-1: a changed Policy configuration notices every live item whose frozen
+     * mandate basis no longer matches. The digest is read from the detached Policy
+     * host snapshot; no Policy audit or budget is consumed. Notices are durable
+     * and idempotent, and this path never cancels, parks or wakes an item.
+     */
+    workItemsNoticePolicyChange(components) {
+        const version = components.authority.policyVersion();
+        if (version === null || components.store.meta(POLICY_NOTICE_VERSION_META) === version)
+            return;
+        let after;
+        for (let page = 0; page < POLICY_NOTICE_PAGE_LIMIT; page += 1) {
+            const result = noticePolicyChange(components.store, components.authority, {
+                protocol: 'work-items/policy-change/v1', policyVersion: version,
+                ...(after === undefined ? {} : { after }),
+            });
+            if (result.outcome !== 'noticed')
+                return;
+            if (result.next === null) {
+                // A transient Policy failure leaves affected items unassessed. Do not
+                // record the version as complete: the next wake must retry the same
+                // configuration so those items still get their notices after recovery.
+                if (result.unavailable.length > 0)
+                    return;
+                components.store.setMeta(POLICY_NOTICE_VERSION_META, version);
+                if (result.notified.length > 0) {
+                    this.ctx.logger.debug(`assistant-work-items: recorded ${result.notified.length} Policy-change notice(s)`);
+                }
+                return;
+            }
+            after = result.next;
+        }
+    }
     /**
      * WP21 slice 6: on the same native wake, bind at most `maxPerTick`
      * dispatched items to the acceptance contract their own worker run froze.
@@ -573,12 +644,13 @@ export class AssistantWorkItemsService extends Service {
         if (bind === undefined || worker === null || this.workItemsClosed || this.workItemsVerifier() === undefined
             || typeof automations?.inspectOccurrenceAcceptance !== 'function')
             return;
+        const continuation = this.workItemsConfig.ownerContinuation?.automationId;
         const limit = bind.maxPerTick;
         const skips = this.workItemsBindWorkerRunSkips;
         const seen = new Set();
         let processed = 0, scanned = 0, wrapped = this.workItemsBindWorkerRunCursor === null, done = false;
         while (!done && processed < limit && scanned < WORKER_RUN_BIND_SCAN_LIMIT && !this.workItemsClosed) {
-            const page = components.store.listLateAcceptanceCandidates(worker, this.workItemsBindWorkerRunCursor, 10);
+            const page = components.store.listLateAcceptanceCandidates(worker, this.workItemsBindWorkerRunCursor, 10, continuation === worker ? undefined : continuation);
             if (page.length === 0) {
                 if (wrapped)
                     break;
@@ -792,86 +864,63 @@ export class AssistantWorkItemsService extends Service {
     /**
      * WP21 slice 8 (`acceptance.holdReport`): the mandate binding, or else the
      * latest late binding while it still belongs to the item's current
-     * occurrence. A malformed late row throws `storage`; callers decide whether
-     * to hold (fail closed) or treat the item as unbound.
+     * occurrence. A malformed late row throws `storage` and cannot release a report.
      */
     workItemsAcceptanceBinding(components, item) {
         const mandate = item.authority?.mandate?.acceptance;
-        if (mandate !== undefined)
+        if (mandate !== undefined) {
+            if (item.attempt > 1 && !this.workItemsRetryContractMatches(item, mandate))
+                return undefined;
             return mandate;
+        }
         const late = components.store.lateAcceptanceBinding(item.id);
         return late !== undefined && late.occurrenceId === item.occurrenceId ? late.binding : undefined;
     }
-    /**
-     * Whether this report must be held instead of dispatched: `holdReport` is
-     * on, it is the terminal `ready` self-report of an executed item, the status
-     * is notifiable, and the item already has an independent acceptance binding.
-     * An item that has not been bound yet (for example a run that reports before
-     * the wake that binds it) is reported normally, exactly as today.
-     *
-     * A verdict recorded for an earlier generation can never settle this report
-     * (the store keeps at most one verdict per item and excludes settled items
-     * from auto-settle), so holding it would just wait out `holdTimeoutMs` before
-     * releasing it unverified. It is dispatched now, exactly like flag-off.
-     * An unreadable verdict row fails closed and holds, like a malformed binding.
-     */
+    /** An admission-time contract does not carry over to a new worker occurrence. */
+    workItemsRetryContractMatches(item, binding) {
+        return item.occurrenceId !== null && binding.taskKind === 'automation-run'
+            && binding.taskDigest === acceptanceDigest({ kind: 'automation-run', ref: workerRunTaskRef(item.occurrenceId) });
+    }
+    /** Hold the worker's terminal self-report even when its contract is not visible yet. */
     workItemsHoldsReport(components, item, report) {
-        if (this.workItemsConfig.acceptanceHoldReport === undefined || this.workItemsClosed
-            || report.status !== 'ready' || item.state !== 'ready' || item.observed)
-            return false;
-        if (!components.dispatch.shouldNotify(report))
-            return false;
-        if (this.workItemsAcceptanceBinding(components, item) === undefined)
+        return !this.workItemsClosed && item.attempt >= 1 && item.state === 'ready' && !item.observed
+            && report.status === 'ready' && report.deliveryState === null
+            && (this.workItemsConfig.acceptanceHoldReport !== undefined || this.workItemsContinuationRequiresAcceptance(components, item));
+    }
+    /** Read the requirement frozen at admission, including after live configuration changes. */
+    workItemsContinuationRequiresAcceptance(components, item) {
+        if (item.kind !== 'owner-continuation')
             return false;
-        let verdict;
         try {
-            verdict = components.store.acceptanceVerdict(item.id);
+            const record = components.store.getContinuation(item.id);
+            if (record === undefined)
+                return true;
+            return parseStoredContinuationPlan(record.planJson).contract.acceptance !== undefined;
         }
-        catch {
+        catch (error) {
+            this.ctx.logger.warn(`assistant-work-items: continuation acceptance plan for ${item.id} is unreadable: ${describe(error)}`);
             return true;
         }
-        return verdict === undefined || (verdict.attempt === item.attempt && verdict.occurrenceId === item.occurrenceId);
     }
-    /**
-     * Whether this `ready` report is still held. Used to imply the verdict gate
-     * for held items even when `acceptance.verdictGate` itself is off: the gate
-     * must move the item before the held report can be replaced by the blocked
-     * one. A malformed binding row fails closed (treated as bound).
-     */
+    /** The held report implies the verdict gate for this executed item. */
     workItemsReportIsHeld(components, item) {
-        if (this.workItemsConfig.acceptanceHoldReport === undefined || item.state !== 'ready' || item.observed)
+        if (this.workItemsClosed || item.observed
+            || (this.workItemsConfig.acceptanceHoldReport === undefined && item.kind !== 'owner-continuation'))
             return false;
         const report = components.store.lastReport(item.id);
-        if (report === undefined || report.status !== 'ready' || report.deliveryState !== null)
-            return false;
-        try {
-            return this.workItemsAcceptanceBinding(components, item) !== undefined;
-        }
-        catch {
-            return true;
-        }
+        return report !== undefined && this.workItemsHoldsReport(components, item, report);
     }
     /**
-     * WP21 slice 8: on the same native wake, release at most
-     * `HELD_REPORT_RELEASE_LIMIT` held reports through an in-memory
-     * `(recordedAt, itemId)` round-robin cursor. A full page advances the cursor
-     * past rows that are still waiting, so they cannot starve a releasable row
-     * behind them; a short page resets it and the next wake restarts from the
-     * oldest row. Achievement sends the ordinary report; any other settled
-     * verdict (or a verdict-gate `blocked` item) sends a blocked report instead;
-     * a still-pending item stays held, and one whose `holdTimeoutMs` elapsed is
-     * sent marked unverified. A row with no acceptance binding any more was never
-     * really held and is recovered as an ordinary report instead of stranded.
-     * One unreadable row (a malformed binding or verdict event) is warned about
-     * and skipped without aborting the remaining releases; the fail-closed hold
-     * itself is unchanged.
+     * Revisit undelivered terminal reports after binding and settlement on the
+     * same scheduler wake. The bounded cursor lets waiting rows share the scan
+     * with reports ready to release, including after a restart.
      */
     workItemsReleaseHeldReports(components) {
         const hold = this.workItemsConfig.acceptanceHoldReport;
-        if (hold === undefined || this.workItemsClosed)
+        if (this.workItemsClosed)
             return;
         const now = Date.now();
-        const page = components.store.listHeldAcceptanceReports(HELD_REPORT_RELEASE_LIMIT, this.workItemsHeldReportCursor ?? undefined);
+        const page = components.store.listHeldAcceptanceReports(HELD_REPORT_RELEASE_LIMIT, this.workItemsHeldReportCursor ?? undefined, hold === undefined);
         // Only a full page proves there may be rows this wake did not examine; a
         // short page ends the rotation so the next wake starts from the oldest.
         if (page.length < HELD_REPORT_RELEASE_LIMIT)
@@ -885,31 +934,21 @@ export class AssistantWorkItemsService extends Service {
                 break;
             let release;
             try {
-                let bound;
-                try {
-                    bound = this.workItemsAcceptanceBinding(components, item) !== undefined;
-                }
-                catch (error) {
-                    if (!this.workItemsWarnMalformedLateBinding(item.id, error)) {
-                        this.ctx.logger.debug(`assistant-work-items: held report of ${item.id} cannot read its acceptance binding: ${describe(error)}`);
-                    }
-                    bound = true;
+                if (hold !== undefined)
+                    release = this.workItemsHeldRelease(components, item);
+                else if (this.workItemsContinuationRequiresAcceptance(components, item)) {
+                    release = { kind: 'blocked', reason: 'acceptance-disabled' };
                 }
-                // No binding any more means the row was never actually held (the report
-                // committed before its pending delivery write, Delivery was missing,
-                // `notifyOn` excluded `ready`, or a re-arm lost the binding). Recovery
-                // sends the ordinary report instead of leaving it undelivered forever.
-                release = bound
-                    ? this.workItemsHeldRelease(components, item, report, now, hold.holdTimeoutMs)
-                    : Object.freeze({ kind: 'plain' });
             }
             catch (error) {
-                // One poison row (a malformed binding or verdict event) must not abort
-                // the scan: warn and keep releasing the remaining rows.
                 if (!this.workItemsWarnMalformedLateBinding(item.id, error)) {
                     this.ctx.logger.warn(`assistant-work-items: held report of ${item.id} cannot be decided: ${describe(error)}`);
                 }
-                continue;
+            }
+            // A missing, stale or unreadable binding/verdict proves no achievement.
+            // The same deadline applies whether or not independent checking began.
+            if (release === undefined && hold !== undefined && now >= report.recordedAt + hold.holdTimeoutMs) {
+                release = { kind: 'unverified', timeoutMs: hold.holdTimeoutMs };
             }
             if (release === undefined)
                 continue;
@@ -924,23 +963,26 @@ export class AssistantWorkItemsService extends Service {
             });
         }
     }
-    /** Decide one held report without writing: release it, or wait for a later wake. */
-    workItemsHeldRelease(components, item, report, now, timeoutMs) {
-        if (item.state === 'blocked') {
-            // The store query only returns acceptance-gated blocked rows.
+    /** Release only a verdict for this execution and its still-current contract. */
+    workItemsHeldRelease(components, item) {
+        const required = this.workItemsContinuationRequiresAcceptance(components, item);
+        if (item.state === 'blocked' && (!required || item.stateReason === 'acceptance-needs-attention')) {
+            // Needs-attention has no verdict. A persisted negative verdict for a
+            // required task must pass the same freshness checks as an achievement.
             return { kind: 'blocked', reason: item.stateReason ?? 'acceptance-blocked' };
         }
+        const binding = this.workItemsAcceptanceBinding(components, item);
+        if (binding === undefined || !storedBasisHolds(item))
+            return undefined;
         const verdict = components.store.acceptanceVerdict(item.id);
-        // Only the verdict of this executed generation decides this report; an
-        // older generation's verdict cannot be moved by the gate either, so the
-        // held report waits for this run's verdict or the timeout.
-        if (verdict !== undefined && verdict.attempt === item.attempt && verdict.occurrenceId === item.occurrenceId) {
-            return verdict.objectiveStatus === 'achieved'
-                ? { kind: 'achieved' }
-                : { kind: 'blocked', reason: `acceptance-${verdict.objectiveStatus}` };
-        }
-        // A released report is never held again; the owning revision records the send.
-        return now >= report.recordedAt + timeoutMs ? { kind: 'unverified', timeoutMs } : undefined;
+        if (verdict === undefined || verdict.attempt !== item.attempt || verdict.occurrenceId !== item.occurrenceId
+            || verdict.contractId !== binding.contractId || verdict.contractDigest !== binding.contractDigest)
+            return undefined;
+        if (required && !hasFreshAcceptanceReceipt(this.workItemsVerifier(), verdict))
+            return undefined;
+        return verdict.objectiveStatus === 'achieved'
+            ? { kind: 'achieved' }
+            : { kind: 'blocked', reason: `acceptance-${verdict.objectiveStatus}` };
     }
     get enabled() {
         return this.workItemsConfig.enabled;
@@ -1202,6 +1244,9 @@ export class AssistantWorkItemsService extends Service {
         }
         if (binding === undefined)
             fail('invalid-state', 'work item has no independent acceptance binding');
+        if (this.workItemsConfig.acceptanceHoldReport !== undefined && item.attempt > 1
+            && !this.workItemsRetryContractMatches(item, binding))
+            fail('invalid-state', 'acceptance contract is not for the current retry occurrence');
         // The stored mandate must still be intact for this exact item; checked
         // locally so a pull-based settle never writes Policy audit.
         if (!storedBasisHolds(item))
@@ -1215,7 +1260,7 @@ export class AssistantWorkItemsService extends Service {
         // item before the held report is replaced by the blocked one.
         const gate = this.workItemsConfig.acceptanceVerdictGate === true || this.workItemsReportIsHeld(components, item)
             ? Object.freeze({ attempt: item.attempt, occurrenceId: item.occurrenceId }) : undefined;
-        const result = settleAcceptance(components.store, this.workItemsVerifier(), item, binding, gate);
+        const result = settleAcceptance(components.store, this.workItemsVerifier(), item, binding, gate, this.workItemsContinuationRequiresAcceptance(components, item));
         // WP21 slice 7: the verifier's needs-attention writes no verdict, but with
         // the gate on it still moves this executed generation to `blocked`.
         if (gate !== undefined && result.outcome === 'needs-attention'
@@ -1283,13 +1328,51 @@ export class AssistantWorkItemsService extends Service {
         if (sourceText !== undefined && !authenticatesIntakeText(sourceText, candidate.contentDigest)) {
             fail('invalid-input', 'intake source text must be at most 65,536 UTF-16 units and match the content digest');
         }
+        // Producer extensions are validated before any ledger write; an over-limit
+        // objective or malformed handle rejects the whole call instead of being
+        // truncated or stripped.
+        const objective = intakeObjectiveOf(input, sourceText);
+        // The objective becomes the work-item brief; admission truncates to
+        // admission.maxBriefBytes, so a longer objective is rejected here rather
+        // than silently truncated later.
+        if (objective !== undefined && Buffer.byteLength(objective.text, 'utf8') > Math.min(MAX_INTAKE_OBJECTIVE_BYTES, this.workItemsConfig.admission.maxBriefBytes)) {
+            fail('invalid-input', 'intake objective exceeds the configured admission brief limit');
+        }
+        const acceptance = intakeAcceptanceOf(input);
         const result = this.workItemsAvailable().store.recordIntake(candidate);
+        this.rememberIntakeHint(result.record.source, result.record.sourceEventId, objective, acceptance);
         // `sourceText` is the authenticated text the content digest covers; with
         // evaluation off it is ignored, with it on it is held in memory only.
         if (sourceText !== undefined)
             this.workItemsIntakeEvaluation?.observe(result.record, sourceText);
         return result;
     }
+    intakeHintKey(source, sourceEventId) {
+        return `${source}\u0000${sourceEventId}`;
+    }
+    /**
+     * Remember producer-supplied objective/acceptance for at most
+     * `MAX_INTAKE_HINTS` candidates. The text is deliberately memory-only:
+     * restart loses it and auto admission fails closed to observe, rather than
+     * opening a new plaintext ledger for owner messages.
+     */
+    rememberIntakeHint(source, sourceEventId, objective, acceptance) {
+        if (objective === undefined && acceptance === undefined)
+            return;
+        const key = this.intakeHintKey(source, sourceEventId);
+        const previous = this.workItemsIntakeHints.get(key);
+        this.workItemsIntakeHints.delete(key);
+        this.workItemsIntakeHints.set(key, Object.freeze({
+            ...(objective === undefined ? (previous?.objective === undefined ? {} : { objective: previous.objective }) : { objective }),
+            ...(acceptance === undefined ? (previous?.acceptance === undefined ? {} : { acceptance: previous.acceptance }) : { acceptance }),
+        }));
+        while (this.workItemsIntakeHints.size > AssistantWorkItemsService.MAX_INTAKE_HINTS) {
+            const oldest = this.workItemsIntakeHints.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.workItemsIntakeHints.delete(oldest);
+        }
+    }
     /**
      * Host-only: register the injectable WP20 inferred-evaluation supplier
      * (Policy snapshot + model call). Requires `intakeLedger.evaluation`.
@@ -1473,18 +1556,7 @@ export class AssistantWorkItemsService extends Service {
             try {
                 // A held report is simply not dispatched this pass: the same scheduler
                 // wake that settles the binding releases it in `workItemsReleaseHeldReports`.
-                let held = false;
-                try {
-                    held = this.workItemsHoldsReport(components, result.item, result.report);
-                }
-                catch (error) {
-                    // A malformed late binding fails closed: keep holding; the timeout
-                    // still releases it unverified rather than dropping the report.
-                    if (!this.workItemsWarnMalformedLateBinding(item.id, error)) {
-                        this.ctx.logger.debug(`assistant-work-items: report hold for ${item.id} cannot read its acceptance binding: ${describe(error)}`);
-                    }
-                    held = this.workItemsConfig.acceptanceHoldReport !== undefined && result.report.status === 'ready';
-                }
+                const held = this.workItemsHoldsReport(components, result.item, result.report);
                 notified = held ? false : await components.dispatch.notify(result.item, result.report);
             }
             catch (error) {