@happyvertical/smrt-ingestion 0.57.44 → 0.57.46

package/FEEDBACK.md

@@ -18,6 +18,15 @@ judgment. A second successor conflicts. Revised actions make old bindings
 ineligible. Approval and successful execution never imply that extracted fields
 are correct.
 
+Optional `feedback.onRecorded({ db, scope, receipt, input })` (#4522) runs
+inside the transaction that stores an explicit judgment, on the same executor,
+after the judgment row (and its `supersedesId` link) is written and before the
+final `capture` recheck. Write the host's own activity entry there: it commits
+or rolls back with the judgment, and a throw rolls the judgment back and
+rejects `recordFeedback` with that error. `receipt` and `input` are copies. It
+is not called for an idempotent replay (already committed) or for
+`observeFeedback`; like `policy.adopt`, it must write only host-owned rows.
+
 Decision and downstream execution facts are captured inside their owning
 transaction, keyed by immutable event ID and signal, when the configured capture
 authority allows the optional memory projection and it fits the configured byte
@@ -290,6 +299,15 @@ displayed binding is current again. Hosts must authenticate that callback and co
 maintained browser fixture demonstrates this transport with CSRF protection and
 rejects substituted revisions.
 
+With `enableFeedback`, `createIntakeReviewHost` also loads each action's
+`ReviewAction.feedback` (#4503): this reviewer's own current (not superseded)
+judgment at the displayed revision and binding (`id`, `judgment`, `comment`,
+`recordedAt`), read through `IngestionService.listOwnFeedback`. The chosen
+button is `aria-pressed`, `ingestion.feedbackSent` shows after a judgment, and
+a further judgment sends `supersedesId` (the loaded id, else the receipt id the
+callback returned). Another reviewer's judgment is never shown as pressed; a
+failed read only leaves the pressed state off.
+
 See [the behavior matrix](../../docs/test-matrix/3676-ingestion-feedback.md) for
 validation and the frozen learning protocol, and the
 [routing projection matrix](../../docs/test-matrix/3732-ingestion-routing-projection.md)
@@ -299,6 +317,18 @@ production improvement. Real-provider evaluation belongs to #3677. There are no
 sampled automatic outcomes in this feature; reporting that stratum as unavailable
 avoids inventing correctness labels from successful jobs.
 
+`authorize` distinguishes two read operations (#4504). `retrieve` covers
+picking new examples and revalidating a selection at the provider boundary.
+`verify` covers re-checking the stored lineage of an existing generation (the
+examples it was produced with) whenever its actions are read, reviewed,
+labelled or applied, including `getAction`/`listReviews`, and whenever the
+stored generation snapshot is read (`getCompletedAnalysis`, the review host's
+`load`, instructions, splits and Try again). A host that switches
+learning off refuses `retrieve` and keeps allowing `verify`, so items analysed
+while learning was on still load. Fail-safe for authorizers that predate
+`verify`: when `verify` returns `false` the same check is asked as `retrieve`,
+and only a refusal of both fails closed ("Feedback unavailable") as before.
+
 When interpretation requests optional examples, an explicit denial of feedback
 retrieval degrades to generation without examples or feedback provenance. Direct
 `retrieveFeedback` calls still reject denied reads. Other authorization errors

package/PROPOSALS.md

@@ -468,6 +468,35 @@ Like `failureCapture`, the hook is not public read configuration and never enter
 frozen configuration or digests. Hosts keep it synchronous-cheap: it runs inside
 the generation lease.
 
+### Retry and concurrency (opt-in, #4504)
+
+```ts
+proposals: {
+  // ...
+  retry: {
+    attempts: 3,                                  // total calls, 1..10; default 1
+    backoffMs: (attempt) => 500 * 2 ** (attempt - 2), // or a number, 0..60000; default 0
+    retryable: (error) => (error as { status?: number }).status === 529,
+  },
+  concurrency: 4,                                 // 1..1000; default unlimited
+},
+```
+
+`retry` retries a rejected `generator.generate` call; absent (or
+`attempts: 1`) keeps one call as before. `retryable(error, attempt)` sees the
+generator's rejection (default: retry every rejection; a throwing predicate
+means no). Each call gets its own `limits.timeoutMs` deadline; a timeout is
+final, as are validation failures of a returned reply. A retry is skipped when
+the analysis lease could not cover the backoff plus another full deadline, and
+a malformed `backoffMs` answer ends the retries. Only the final rejection is
+recorded (`provider_error`, category `unavailable`, value-free reason).
+`concurrency` bounds `generate` calls in flight across every service built
+from the same configuration object (FIFO); a queued call's deadline starts
+when it gets a slot. Both are validated at `IngestionService` construction and,
+like `reviewSuggestion`, never enter frozen configuration, digests or
+`proposalReadConfiguration`. A reviewer can still re-run a finally failed item
+with "Try again" (REVIEW.md, `retryInterpretation`).
+
 ### Failed-attempt capture (opt-in, #4285)
 
 The value-free reason cannot show what the model actually sent. A host that

package/REVIEW.md

@@ -363,6 +363,24 @@ streaming channel; status is read through the existing item/analysis APIs. The
 maintained fixture records the instruction durably and then runs the stages in
 the background so the browser proof exercises the in-place update.
 
+**Try again (#4504).** `retryInterpretation({itemId, attemptId,
+expectedRevision, requestId})` re-runs an item whose interpretation failed (the
+displayed generation is `provider_error`, or later work failed or never
+started) with no new instruction. It uses the same anchor, guards, `process`
+authority and fresh extraction plus interpretation as an instruction, carries
+the item's current configuration (an instruction or split already in effect
+included) unchanged, and records nothing in the instruction history. Superseded
+anchors, work in flight and items that did not fail throw
+`ReviewerInstructionStaleError`. A replay of the same intent (item, anchor,
+revision, `requestId`, actor) returns the first append under current `process`
+authority; the same `requestId` with another intent is a request conflict.
+`createIntakeReviewHost` exposes it as `IntakeReviewHost.retry` (stale resolves
+`{ stale: true }`) and wakes the worker through `onRetry`, else `onInstruct`.
+`ReviewView` draws a "Try again" button (`ingestion.tryAgain`) beside the
+instruction box when `host.retry` exists, the item is open, nothing is in
+flight and the interpretation failed; it binds like the instruction
+(`instruction.binding`, else the displayed generation).
+
 `feedback` is an optional explicit correctness callback, separate from approval
 choice and execution success. No learning, feedback storage or rule promotion is
 implemented by these components; #3676 owns those services. Do not pass feedback
@@ -451,6 +469,45 @@ provider. The UI picker shows the offered catalog, so a handler hidden from it i
 only reachable by a reviewer who already holds `review` authority for it. The maintained
 browser fixture serves both operations behind CSRF and the same session scope.
 
+## Review screen presentation (#4503)
+
+All presentation only; no new authority.
+
+- **Handler labels.** A handler registration may declare `label`. It is carried
+  on the reviewer catalog only (`listHandlers`, `ItemReviewView.catalog`), never
+  on generation input, catalog digests or bindings, so adding one never stales
+  existing work. The proposal heading, action heading and "Start action as…"
+  select draw it, falling back to the handler id.
+- **State labels.** Review states draw `ingestion.reviewState.<state>` and
+  generation outcomes `ingestion.outcome.<outcome>`; an unknown value is drawn
+  as is.
+- **Arguments as fields.** Where a handler `argsSchema` declares top-level
+  `string` (plain, `date`, `date-time`), `number`, `integer`, `boolean` or
+  enum properties, or `references` declares a candidate/evidence field, the
+  suggestion draft, the action's arguments and the start form draw those as
+  fields (`title` as the label, `*` when required). A candidate reference is a
+  search box over `host.candidates`, filtered to the reference's model, showing
+  the candidate's label (the generation's offered candidates label the current
+  value); an evidence reference picks among the item's originals. The JSON text
+  stays the source of truth: fields rewrite it, and it remains editable under a
+  collapsed "Advanced" disclosure for everything else (objects, arrays,
+  unions). Without such properties the plain JSON textarea (and the
+  destination picker) are drawn as before. Server validation is unchanged.
+- **Effects.** `action.review.display` is drawn as a `<dl>`: the handler's
+  preview fields (`display.preview`, or `display.step.preview` for a plan step;
+  a flat record as is), then non-empty `dependencies`/`plan` metadata as JSON,
+  named `metadata.<key>` when a preview field already has that name
+  (`displayEntries` in `view-utils`).
+- **Assignees.** An optional `IntakeReviewHost.assignees(query)` (adapter
+  option `assignees`) answers `{ id, label }[]`; the inbox then draws a search
+  picker for the filter and each row instead of the free-text "Assignee ID".
+  `assign` still receives the id and still authorizes. A failed search offers
+  nothing.
+- **Feedback state.** `ReviewAction.feedback` (see FEEDBACK.md) presses the
+  current judgment; a further judgment supersedes it and
+  `ingestion.feedbackSent` confirms it.
+- **Confidence.** Nothing is drawn when the provider reports no confidence.
+
 ## Single-page triage workspace
 
 `IntakeWorkspace` (#4215) composes the existing pieces so a reviewer works the
@@ -586,6 +643,16 @@ model only, exactly as in `IntakeReview`.
   goes through the item pane and advances.
 
 
+**List following and refresh (#4504).** Every listed row (other than the open
+item) whose entry shows a stage in flight is followed like an item left
+mid-stage, up to `WATCH_CAP` rows, `WATCH_LIMIT` reads per tick on the pane's
+backoff, so rows no longer keep "Interpreting…" until Refresh. Opt-in
+`listPollMs` on `IntakeWorkspace`/`IntakeInbox` also re-reads the listed page
+under its listed filter while any row is processing (skipped while a read or
+operation is pending or Load more appended pages). Both components export
+`refresh()` (`bind:this`), which re-reads the first page like the Refresh
+button and resolves `{ items, result: 'shown' | 'failed' | 'pending' }`.
+
 ## Maintained browser proof
 
 `pnpm test:components` runs real Svelte component tests; `pnpm test:e2e` runs the
@@ -811,6 +878,18 @@ The factory unwraps this into `ItemReviewView.generation`. Stale generation is
 omitted while authorized saved reviews remain available; access denials propagate.
 The reference application still owns its fixture provisioning and HTTP transport.
 
+## Upload refusals and accepted types (#4502)
+
+`IntakeWorkspace`/`IntakeInbox` take `accept` (an `<input accept>` value)
+for their file picker, defaulting to `IntakeReviewHost.uploadAccept` (adapter
+option `uploadAccept`); it is a hint only, `upload` still enforces the host's
+allowlist. When `upload` throws `IntakeUploadRefusedError` (from `/svelte`) or
+any error with a string `userMessage` (or an error named
+`IntakeUploadRefusedError` / with `code: 'INTAKE_UPLOAD_REFUSED'`, whose
+`message` is then shown), the inbox shows that reason (trimmed, at most 500
+characters) and keeps its rows; `uploadRefusalMessage(error)` applies the same
+rule. Any other error still fails the list closed with `ingestion.error`.
+
 ## Explicit upload retries
 
 The inbox retains selected original files and the receive request identity when

package/agents/execution.md

@@ -11,7 +11,9 @@ service surface and create `IngestionScope` from the session.
 ## Catalog and authority
 
 Applications supply a trusted `IntakeExecutionOptions.handlers` catalog.
-`OperationHandler` has qualified ID, immutable version, description, object JSON
+`OperationHandler` has qualified ID, immutable version, description, optional
+reviewer-facing `label` (presentation only, carried on the reviewer catalog and
+never on generation input or digests; REVIEW.md), object JSON
 schemas for arguments/results, allowlisted `resultModels`, `validate`, `preview`,
 a registered `{model, action, version}` operation and explicit effect/idempotency/
 open-world capability declaration. Preview returns display, exact normalized

package/dist/chunks/{execution-DKWz2cz0.js → execution-Clcmi0sj.js}

@@ -7144,7 +7144,7 @@ var IntakeExecutionService = class IntakeExecutionService {
 		if (!Array.isArray(references)) throw new Error("Feedback lineage unavailable");
 		if (references.length === 0) return;
 		if (!this.options.feedback) throw new Error("Feedback configuration unavailable");
-		const { IntakeFeedbackService } = await import("./feedback-DHcSKgVU.js").then((n) => n.r);
+		const { IntakeFeedbackService } = await import("./feedback-hDSMYjiG.js").then((n) => n.r);
 		await new IntakeFeedbackService(this.options, this).assertActionLineage(String(bound.action.id), db, String(bound.proposal.id));
 	}
 	async getAction(actionId) {
@@ -8729,4 +8729,4 @@ async function continueIntakeReview(service, actionId, task) {
 //#endregion
 export { __toESM as A, storedFailureCapture as C, generationSnapshotRead as D, discoveryTransaction as E, listReadGate as O, prepareFailureCapture as S, completeWithFailureCapture as T, HandlerArgumentsInvalidError as _, resolveIntakePolicy as a, FAILURE_CAPTURE_MAX_BYTES as b, HANDLER_ARGUMENT_ISSUE_LIMIT as c, schemaOwnedPath as d, require_ajv as f, GenerationSourceStaleError as g, GenerationSnapshotStaleError as h, intakeBindingDigest as i, __exportAll as k, HANDLER_ARGUMENT_PATH_LIMIT as l, redactedCeiling as m, IntakeExecutionService as n, feedbackActionTransaction as o, UNFINISHED_ACTION_STATES as p, continueIntakeReview as r, feedbackDiscoveryContext as s, IntakeAccessDeniedError as t, describeArgumentRefusal as u, ProposalsNotConfiguredError as v, analysisLeaseRemaining as w, assertFailureCapture as x, FAILURE_CAPTURE_DEFAULT_MAX_BYTES as y };
 
-//# sourceMappingURL=execution-DKWz2cz0.js.map
+//# sourceMappingURL=execution-Clcmi0sj.js.map