@event4u/agent-config 13.0.0 → 14.1.0

package/src/scripts/_lib/gh_transient.ts

@@ -0,0 +1,80 @@
+/**
+ * Transient-failure handling for `gh` calls in the release pipeline.
+ *
+ * `gh` does not retry GitHub's 5xx responses — including the pre-flight
+ * "does a PR already exist" GraphQL query it runs before every `pr create`.
+ * The release run therefore dies at whichever step happens to catch the
+ * outage, after the commit and the push already landed.
+ *
+ * Pure over strings and an injected executor so the classifier and the retry
+ * loop are exercised by the fixture tests without a network or a real sleep.
+ */
+
+export interface GhRunResult {
+    returncode: number;
+    stdout: string;
+    stderr: string;
+}
+
+/** Backoff between attempts. Length is the retry budget: three retries, ~23s. */
+export const GH_RETRY_DELAYS_MS = [2_000, 6_000, 15_000] as const;
+
+/**
+ * Retry-worthy failures only. A 4xx is the caller's fault and repeating it
+ * just delays the real message — the one exception is 429, which is the same
+ * wait-and-repeat shape as a 5xx.
+ */
+const _TRANSIENT_RE =
+    /HTTP 5\d\d|HTTP 429|No server is currently available|Something went wrong while executing your query|exceeded a secondary rate limit|\b(?:ETIMEDOUT|ECONNRESET|EAI_AGAIN)\b|TLS handshake timeout/;
+
+/**
+ * Whether `stderr` describes a transient GitHub failure.
+ *
+ * Deliberately reads stderr ALONE. `gh` writes errors there, while stdout on a
+ * failing call can still carry payload the caller asked for (`pr view --json
+ * body`) — and a changelog body that happens to quote `HTTP 500` must not turn
+ * a permanent failure into three pointless retries.
+ */
+export function is_transient_gh_failure(stderr: string): boolean {
+    return _TRANSIENT_RE.test(stderr);
+}
+
+/**
+ * `gh` argv rendered for an error line, long values elided.
+ *
+ * The release-PR body is passed as a single `--body` argument and runs to tens
+ * of thousands of characters. Rendering argv verbatim is what buried the real
+ * one-line `gh` error under a 22k dump on 14.0.0.
+ */
+export function gh_argv_label(args: readonly string[], max = 60): string {
+    return ['gh', ...args].map((a) => (a.length > max ? `${a.slice(0, max - 1)}…` : a)).join(' ');
+}
+
+/**
+ * Run `gh <args>` through `exec`, repeating while the failure is transient and
+ * the budget lasts. Returns the last result — classifying it is the caller's
+ * job, so a `check: false` probe keeps its own fallback behaviour.
+ *
+ * `sleep` and `notify` are injected rather than called directly so the loop is
+ * testable without a real 23-second wait, and so a caller running under a test
+ * exec-override can pass a no-op sleep while the delay sequence itself still
+ * runs and can be asserted.
+ */
+export function gh_retry(
+    args: readonly string[],
+    exec: (argv: readonly string[]) => GhRunResult,
+    opts: { sleep?: (ms: number) => void; notify?: (message: string) => void } = {},
+): GhRunResult {
+    let result = exec(['gh', ...args]);
+    for (let i = 0; result.returncode !== 0 && i < GH_RETRY_DELAYS_MS.length; i++) {
+        if (!is_transient_gh_failure(result.stderr)) {
+            break;
+        }
+        const ms = GH_RETRY_DELAYS_MS[i]!;
+        const first = result.stderr.trim().split('\n')[0] ?? '';
+        opts.notify?.(`↻  ${gh_argv_label(args, 24)} — transient GitHub failure, retry in ${ms / 1_000}s: ${first}`);
+        opts.sleep?.(ms);
+        result = exec(['gh', ...args]);
+    }
+    return result;
+}

package/src/scripts/_lib/release_material.ts

@@ -21,7 +21,18 @@ export interface ChangelogSection {
     body: string;
 }
 
-const _NEXT_HEADING_RE = /^##\s+\[?\d+\.\d+\.\d+/m;
+/**
+ * Where a changelog section ends: the next release entry OR the next era
+ * banner. Era banners are level 1 and release entries level 2+ — the same
+ * invariant the release-validation `changelog-entry` gate relies on, and the
+ * one `lint_changelog_rollback` / `lint_breaking_changes_index` already encode
+ * as `/^##? /`. Without the era arm the newest entry runs to end-of-file after
+ * a split, which leaves it as the last `##` heading above archived banners.
+ *
+ * Exported because release.ts bounds the previous entry the same way, and two
+ * copies of a boundary is how one of them stays wrong.
+ */
+export const NEXT_SECTION_RE = /^(?:##\s+\[?\d+\.\d+\.\d+|# Era:)/m;
 
 function _reEscape(s: string): string {
     return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -29,9 +40,9 @@ function _reEscape(s: string): string {
 
 /**
  * Extract the CHANGELOG section for `version` — heading plus body up to the
- * next version heading (or end of file). Returns null when no heading for
- * `version` exists. Matches both heading shapes the generator emits
- * (`## X.Y.Z (date)` and `## [X.Y.Z](compare-url) (date)`).
+ * next version heading or era banner (or end of file). Returns null when no
+ * heading for `version` exists. Matches both heading shapes the generator
+ * emits (`## X.Y.Z (date)` and `## [X.Y.Z](compare-url) (date)`).
  */
 export function extract_changelog_section(text: string, version: string): ChangelogSection | null {
     const headingRe = new RegExp(`^##\\s+\\[?${_reEscape(version)}\\b.*$`, 'm');
@@ -41,7 +52,7 @@ export function extract_changelog_section(text: string, version: string): Change
     }
     const bodyStart = m.index + m[0].length;
     const rest = text.slice(bodyStart);
-    const next = _NEXT_HEADING_RE.exec(rest);
+    const next = NEXT_SECTION_RE.exec(rest);
     const sectionEnd = bodyStart + (next ? next.index : rest.length);
     const body = text
         .slice(bodyStart, sectionEnd)

package/src/scripts/_lib/review_independence.ts

@@ -0,0 +1,111 @@
+/**
+ * Review independence — a recorded property of a review, never a promise.
+ *
+ * The failure this closes: a review whose members all share a model family
+ * produces an artifact byte-indistinguishable from one backed by independent
+ * models, so a consumer reads "no findings" as acceptance either way. The
+ * self-review gate is the live instance — it calls ONE Anthropic client, and
+ * the ledger it writes says nothing about that.
+ *
+ * Derived, never set by hand: `acceptance_status` follows from
+ * `review_independence`, so a same-family set carrying `accepted` is
+ * unrepresentable rather than merely forbidden. Two fields a producer can set
+ * inconsistently would reintroduce the ambiguity the pair exists to remove.
+ *
+ * Evidence: agents/evidence/eval-findings/metric-loop-s03.md.
+ */
+
+/** The five providers `ai_council/config.ts::_VALID_PROVIDERS` admits. */
+const PROVIDER_FAMILY: Readonly<Record<string, string>> = {
+    anthropic: 'anthropic',
+    openai: 'openai',
+    gemini: 'google',
+    xai: 'xai',
+    perplexity: 'perplexity',
+};
+
+export type ReviewIndependence = 'cross-family' | 'same-family' | 'single-member' | 'unknown';
+export type AcceptanceStatus = 'accepted' | 'provisional';
+
+/**
+ * How much INDEPENDENT evidence backs the verdict — deliberately orthogonal to
+ * how much effort the reviewer spent.
+ *
+ * Collapsing the two is what lets a long, careful, single-model pass read as
+ * acceptance: effort is visible in the artifact (findings, detail, rationale)
+ * and independence is not, so a reader with only one axis substitutes the one
+ * they can see. A five-hour same-family review is `single-pass`, and a terse
+ * two-family one is `independent`. That inversion is the point.
+ */
+export type Assurance = 'unreviewed' | 'single-pass' | 'independent';
+
+export function reviewIndependence(memberNames: readonly string[]): ReviewIndependence {
+    const present = memberNames.map((n) => n.trim()).filter((n) => n.length > 0);
+    if (present.length === 0) return 'unknown';
+    if (present.length === 1) return 'single-member';
+    const families = new Set(present.map((n) => PROVIDER_FAMILY[n] ?? `unknown:${n}`));
+    return families.size > 1 ? 'cross-family' : 'same-family';
+}
+
+/**
+ * Only a cross-family set may be described as acceptance.
+ *
+ * `unknown` maps to `provisional`, not to a third value: an absent member set
+ * is not evidence of independence, and the safe direction on an integrity field
+ * is the weaker claim.
+ */
+export function acceptanceStatus(independence: ReviewIndependence): AcceptanceStatus {
+    return independence === 'cross-family' ? 'accepted' : 'provisional';
+}
+
+export function assuranceFor(independence: ReviewIndependence): Assurance {
+    if (independence === 'cross-family') return 'independent';
+    if (independence === 'unknown') return 'unreviewed';
+    return 'single-pass';
+}
+
+export interface IndependenceFields {
+    readonly review_independence: ReviewIndependence;
+    readonly acceptance_status: AcceptanceStatus;
+    readonly assurance: Assurance;
+    readonly reviewers: readonly string[];
+}
+
+/** The three fields plus the member set they were derived from. */
+export function independenceFields(memberNames: readonly string[]): IndependenceFields {
+    const independence = reviewIndependence(memberNames);
+    return {
+        review_independence: independence,
+        acceptance_status: acceptanceStatus(independence),
+        assurance: assuranceFor(independence),
+        reviewers: [...memberNames],
+    };
+}
+
+/**
+ * Consistency violations for an artifact that already carries the fields.
+ *
+ * The gate's teeth: a producer that hand-set `accepted` beside a same-family
+ * independence is caught here rather than trusted.
+ */
+export function independenceViolations(doc: Record<string, unknown>): string[] {
+    const out: string[] = [];
+    const indep = doc['review_independence'];
+    const accept = doc['acceptance_status'];
+    const assur = doc['assurance'];
+    if (indep === undefined) {
+        out.push('review_independence is absent — an artifact that does not declare its independence reads as acceptance by default');
+        return out;
+    }
+    const expectedAccept = acceptanceStatus(indep as ReviewIndependence);
+    if (accept !== expectedAccept) {
+        out.push(
+            `acceptance_status is ${String(accept)} but review_independence ${String(indep)} derives ${expectedAccept}`,
+        );
+    }
+    const expectedAssur = assuranceFor(indep as ReviewIndependence);
+    if (assur !== undefined && assur !== expectedAssur) {
+        out.push(`assurance is ${String(assur)} but review_independence ${String(indep)} derives ${expectedAssur}`);
+    }
+    return out;
+}

package/src/scripts/_lib/session_register.ts

@@ -212,6 +212,20 @@ export interface SessionRecord {
     started_at: string;
     /** ISO-8601 UTC, rewritten every heartbeat. The liveness signal. */
     last_seen: string;
+    /**
+     * Per-detector turn-end refusals THIS session has taken, or absent when it
+     * has taken none.
+     *
+     * `road-to-stop-gate-honesty` § D-2: the gate refuses turn-ends with "no
+     * per-session visibility into how often it happens", and a refused turn-end
+     * costs the user at least one extra model turn. The counts ride this
+     * existing write — the reader is one small `readFileSync` of a record the
+     * gate already maintains, so the heartbeat gains no spawn.
+     *
+     * Optional on purpose: a record written before this field existed, or by a
+     * session that was never refused, is still a valid record.
+     */
+    turn_end_refusals?: Record<string, number>;
 }
 
 /**

package/src/scripts/_lib/skill_catalogue.ts

@@ -454,10 +454,27 @@ export function observationSourceOf(record: ObservationRecord): ObservationSourc
     return record.observation_source ?? 'self-report';
 }
 
+/**
+ * The self-report path's record.
+ *
+ * `projectedSkillCount` and `projectionMode` are optional in the SAME shape the
+ * two host-event builders use — omitted rather than defaulted, because absence
+ * is not `legacy-all` and never was (see `ObservationRecord.projection_mode`).
+ *
+ * They were missing here until 2026-08-18, and the omission was load-bearing in
+ * one direction: the self-report path is the ONLY one that fills `bare_names`,
+ * so it is the only source the pointable-but-bare join below can read — and
+ * every claude observation in the corpus therefore carried no scope at all,
+ * while the codex records beside them did. A series that changes scope
+ * mid-flight without recording it is not comparable, which is exactly what
+ * claim 7 of the roadmap that asked for the field says.
+ */
 export function buildObservationRecord(
     report: SelectorReport,
     host: string,
     observedAt: string,
+    projectedSkillCount?: number,
+    projectionMode?: ProjectionMode,
 ): ObservationRecord {
     return {
         schema: 1,
@@ -471,6 +488,8 @@ export function buildObservationRecord(
         separating_candidates: report.candidates.filter((c) => c.separates).map((c) => c.id),
         truncation_mode: 'per-entry',
         observation_source: 'self-report',
+        ...(projectedSkillCount === undefined ? {} : { projected_skill_count: projectedSkillCount }),
+        ...(projectionMode === undefined ? {} : { projection_mode: projectionMode }),
     };
 }
 
@@ -1113,3 +1132,4 @@ export function formatReport(report: SelectorReport): string {
     );
     return lines.join('\n');
 }
+