@inflexa-ai/harness 0.31.0 → 0.32.0

package/dist/report-render/views/references-view.d.ts

@@ -16,10 +16,26 @@ import { type DerivationChains, type ReferenceLedger } from "../references.js";
  *
  * A bracket reads as a reference inside prose, and it stays a span beside the words. One notation serves
  * every kind, thus one list answers every marker.
+ *
+ * Every grounded kind renders its marker here. Thus the lineage control has one emission point, and a
+ * marker that names no place carries no control. The page shows the control only where a stamp gives the
+ * script a key to walk.
  */
-export declare function Marker({ n }: {
+export declare function Marker({ n, lineage }: {
     n: number;
+    lineage?: number;
 }): import("hono/jsx/jsx-dev-runtime").JSX.Element;
+/**
+ * The count of hash characters that a chain line shows.
+ *
+ * A content hash is 64 hex characters, and a line that carries three whole ones reads as noise. The head
+ * identifies the bytes, and it matches the count that a staged file name carries. Thus a reader compares the
+ * two by sight.
+ *
+ * The appendix line and the hop of the lineage popover both cut a hash to this count. Thus one hash reads
+ * the same in the two places.
+ */
+export declare const CHAIN_HASH_CHARS = 12;
 /**
  * The one appendix list: one entry for each distinct reference of the page, in the order of the ladder.
  *

package/dist/report-render/views/references-view.js

@@ -1,14 +1,19 @@
-import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "hono/jsx/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "hono/jsx/jsx-runtime";
 import { citationRecordOf } from "../../report-model/reference-resolver.js";
 import { citationKeyOf } from "../references.js";
+import { LineageControl } from "./lineage.js";
 /**
  * One evidence marker as a bracket number that links to its appendix entry.
  *
  * A bracket reads as a reference inside prose, and it stays a span beside the words. One notation serves
  * every kind, thus one list answers every marker.
+ *
+ * Every grounded kind renders its marker here. Thus the lineage control has one emission point, and a
+ * marker that names no place carries no control. The page shows the control only where a stamp gives the
+ * script a key to walk.
  */
-export function Marker({ n }) {
-    return (_jsx("span", { class: "report-marker", children: _jsx("a", { href: `#ref-${n}`, children: `[${n}]` }) }));
+export function Marker({ n, lineage }) {
+    return (_jsxs("span", { class: "report-marker", children: [_jsx("a", { href: `#ref-${n}`, children: `[${n}]` }), lineage !== undefined ? _jsx(LineageControl, { place: lineage }) : null] }));
 }
 /** The kind label of one reference entry. */
 function RefKind({ children }) {
@@ -32,8 +37,11 @@ function HashCode({ children }) {
  * A content hash is 64 hex characters, and a line that carries three whole ones reads as noise. The head
  * identifies the bytes, and it matches the count that a staged file name carries. Thus a reader compares the
  * two by sight.
+ *
+ * The appendix line and the hop of the lineage popover both cut a hash to this count. Thus one hash reads
+ * the same in the two places.
  */
-const CHAIN_HASH_CHARS = 12;
+export const CHAIN_HASH_CHARS = 12;
 /** The head of one content hash: the hex after the algorithm name, cut to the shown length. */
 function hashHead(hash) {
     return hash.slice(hash.lastIndexOf(":") + 1).slice(0, CHAIN_HASH_CHARS);

package/dist/report-render/views/values.d.ts

@@ -26,6 +26,7 @@
 import type { CitationBlock, FigureBlock, MetricBlock, TableBlock } from "../../contracts/report-blocks.js";
 import { type ArtifactTableReference } from "../../contracts/report-reference.js";
 import type { CitationRecord } from "../../report-model/reference-resolver.js";
+import { type ViewOptions } from "./lineage.js";
 import { type ReferenceLedger } from "../references.js";
 import type { ColumnDisplay } from "../table-data.js";
 import type { RenderValue } from "../types.js";
@@ -76,8 +77,11 @@ type FigureValue = Extract<RenderValue, {
  * The value binding joins the reference ladder, thus the label line carries the marker and the appendix
  * names the cell. The marker sits on the label and never on the value, because the value line is the one
  * figure that a reader takes from the card.
+ *
+ * `view.lineage` states that the page carries a provenance document. The card then stamps its keys, and the
+ * marker carries the control that opens the chain.
  */
-export declare function renderMetric(block: MetricBlock, ledger: ReferenceLedger, value: ScalarValue): string;
+export declare function renderMetric(block: MetricBlock, ledger: ReferenceLedger, value: ScalarValue, view?: ViewOptions): string;
 /**
  * Wrap a run of stat cards in one responsive grid. The caller renders each card first, and it passes the
  * markup as one already-escaped string, thus `raw()` inserts it byte for byte. The grid carries its own
@@ -141,8 +145,11 @@ export declare function tableStatusText(shown: number, total: number): string;
  * The whole-table binding joins the reference ladder, thus the title line carries the marker and the
  * appendix names the artifact. Every evidentiary block ledgers this way, and a card with no title still
  * shows its marker on the same line.
+ *
+ * `view.lineage` states that the page carries a provenance document. The card then stamps its keys, and the
+ * marker carries the control that opens the chain.
  */
-export declare function renderTable(block: TableBlock, ledger: ReferenceLedger, rowCount: number, total?: number): string;
+export declare function renderTable(block: TableBlock, ledger: ReferenceLedger, rowCount: number, total?: number, view?: ViewOptions): string;
 /**
  * Render a figure block as a corner-accent card. The source rides the `src` attribute, and the caption
  * renders below the image. The caption also fills the `alt` attribute, thus the escape keeps a hostile
@@ -151,8 +158,11 @@ export declare function renderTable(block: TableBlock, ledger: ReferenceLedger,
  * The whole-file binding joins the reference ladder, thus the caption line carries the marker and the
  * appendix names the image. A figure with no caption still shows its marker on that line. The marker stays
  * out of the `alt` text, because a screen reader reads the alt as the picture and not as a footnote.
+ *
+ * `view.lineage` states that the page carries a provenance document. The card then stamps its keys, and the
+ * marker carries the control that opens the chain.
  */
-export declare function renderFigure(block: FigureBlock, ledger: ReferenceLedger, value: FigureValue): string;
+export declare function renderFigure(block: FigureBlock, ledger: ReferenceLedger, value: FigureValue, view?: ViewOptions): string;
 /**
  * Render a citation block as a bibliography card. The binding joins the one reference ladder like a claim
  * binding, thus one shared source keeps one bracket number. The card shows the marker, the short citation
@@ -161,6 +171,9 @@ export declare function renderFigure(block: FigureBlock, ledger: ReferenceLedger
  * The short citation of a `pmid:` record carries the PubMed link of its identifier. A key of another
  * identifier space shows the citation as text. A key with no pinned record shows the key and the note
  * alone, because absence is a normal condition and no text stands in for the paper.
+ *
+ * `view.lineage` states that the page carries a provenance document. The card then stamps the identity of
+ * the external record in place of a pin, because a paper is no artifact and no data chain reaches it.
  */
-export declare function renderCitation(block: CitationBlock, ledger: ReferenceLedger, record?: CitationRecord): string;
+export declare function renderCitation(block: CitationBlock, ledger: ReferenceLedger, record?: CitationRecord, view?: ViewOptions): string;
 export {};

package/dist/report-render/views/values.js

@@ -27,6 +27,7 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "hono/jsx/jsx-
 import { raw } from "hono/html";
 import { declaredForColumn } from "../../contracts/report-reference.js";
 import { stagedSource, tableSidecarName } from "../assets.js";
+import { DEFAULT_VIEW_OPTIONS, lineagePlace, lineageStamp } from "./lineage.js";
 import { Marker } from "./references-view.js";
 import { formatNumberCell, formatTableCell, holdsANumber, selectColumnKind, selectNumberKind, smallestPositiveValue } from "../number-format.js";
 import { citationKeyOf } from "../references.js";
@@ -67,11 +68,14 @@ const DOWNLOAD_LABEL = "Download";
  * The value binding joins the reference ladder, thus the label line carries the marker and the appendix
  * names the cell. The marker sits on the label and never on the value, because the value line is the one
  * figure that a reader takes from the card.
+ *
+ * `view.lineage` states that the page carries a provenance document. The card then stamps its keys, and the
+ * marker carries the control that opens the chain.
  */
-export function renderMetric(block, ledger, value) {
+export function renderMetric(block, ledger, value, view = DEFAULT_VIEW_OPTIONS) {
     const n = ledger.mark(block.value);
     const shown = formatNumberCell(value.value, selectNumberKind(block.label, value.value));
-    return String(_jsxs("div", { class: "stat-card corner-accents", children: [_jsx("div", { class: "stat-card-value", title: shown.full, children: shown.text }), _jsxs("div", { class: "stat-card-label", children: [block.label, _jsx(Marker, { n: n })] })] }));
+    return String(_jsxs("div", { class: "stat-card corner-accents", ...lineageStamp(view.lineage, block.id, [block.value]), children: [_jsx("div", { class: "stat-card-value", title: shown.full, children: shown.text }), _jsxs("div", { class: "stat-card-label", children: [block.label, _jsx(Marker, { n: n, lineage: lineagePlace(view.lineage, block.value) })] })] }));
 }
 /**
  * Wrap a run of stat cards in one responsive grid. The caller renders each card first, and it passes the
@@ -199,13 +203,16 @@ export function tableStatusText(shown, total) {
  * The whole-table binding joins the reference ladder, thus the title line carries the marker and the
  * appendix names the artifact. Every evidentiary block ledgers this way, and a card with no title still
  * shows its marker on the same line.
+ *
+ * `view.lineage` states that the page carries a provenance document. The card then stamps its keys, and the
+ * marker carries the control that opens the chain.
  */
-export function renderTable(block, ledger, rowCount, total) {
+export function renderTable(block, ledger, rowCount, total, view = DEFAULT_VIEW_OPTIONS) {
     const binding = block.binding;
     const n = ledger.mark(binding);
     const download = tableSidecarName(binding.hash, binding.path);
     const bound = boundText(binding);
-    return String(_jsxs("div", { class: "report-table", children: [_jsxs("div", { class: "report-table-title", children: [block.title, _jsx(Marker, { n: n })] }), _jsxs("div", { class: "corner-accents", children: [_jsx("div", { class: "report-grid", [GRID_MOUNT_ATTRIBUTE]: block.id }), _jsxs("div", { class: "report-table-footer", children: [_jsxs("div", { class: "report-table-footer-row", children: [_jsxs("span", { class: "report-table-status", children: [_jsx("span", { class: GRID_COUNT_CLASS, children: tableStatusText(rowCount, total ?? rowCount) }), bound !== undefined ? _jsx("span", { class: "report-table-bound", children: bound }) : null] }), _jsx("a", { class: "report-table-download", href: stagedSource(download), download: download, children: downloadLabel(binding.path) })] }), _jsx("div", { class: GRID_NOTE_CLASS })] })] }), block.caption !== undefined ? _jsx("p", { class: "report-caption", children: block.caption }) : null] }));
+    return String(_jsxs("div", { class: "report-table", ...lineageStamp(view.lineage, block.id, [binding]), children: [_jsxs("div", { class: "report-table-title", children: [block.title, _jsx(Marker, { n: n, lineage: lineagePlace(view.lineage, binding) })] }), _jsxs("div", { class: "corner-accents", children: [_jsx("div", { class: "report-grid", [GRID_MOUNT_ATTRIBUTE]: block.id }), _jsxs("div", { class: "report-table-footer", children: [_jsxs("div", { class: "report-table-footer-row", children: [_jsxs("span", { class: "report-table-status", children: [_jsx("span", { class: GRID_COUNT_CLASS, children: tableStatusText(rowCount, total ?? rowCount) }), bound !== undefined ? _jsx("span", { class: "report-table-bound", children: bound }) : null] }), _jsx("a", { class: "report-table-download", href: stagedSource(download), download: download, children: downloadLabel(binding.path) })] }), _jsx("div", { class: GRID_NOTE_CLASS })] })] }), block.caption !== undefined ? _jsx("p", { class: "report-caption", children: block.caption }) : null] }));
 }
 /**
  * Render a figure block as a corner-accent card. The source rides the `src` attribute, and the caption
@@ -215,11 +222,14 @@ export function renderTable(block, ledger, rowCount, total) {
  * The whole-file binding joins the reference ladder, thus the caption line carries the marker and the
  * appendix names the image. A figure with no caption still shows its marker on that line. The marker stays
  * out of the `alt` text, because a screen reader reads the alt as the picture and not as a footnote.
+ *
+ * `view.lineage` states that the page carries a provenance document. The card then stamps its keys, and the
+ * marker carries the control that opens the chain.
  */
-export function renderFigure(block, ledger, value) {
+export function renderFigure(block, ledger, value, view = DEFAULT_VIEW_OPTIONS) {
     const n = ledger.mark(block.binding);
     const caption = block.caption;
-    return String(_jsxs("figure", { class: "report-figure corner-accents", children: [_jsx("img", { src: value.src, alt: caption !== undefined ? caption : "", class: "report-figure-image" }), _jsxs("figcaption", { class: "report-caption", children: [caption, _jsx(Marker, { n: n })] })] }));
+    return String(_jsxs("figure", { class: "report-figure corner-accents", ...lineageStamp(view.lineage, block.id, [block.binding]), children: [_jsx("img", { src: value.src, alt: caption !== undefined ? caption : "", class: "report-figure-image" }), _jsxs("figcaption", { class: "report-caption", children: [caption, _jsx(Marker, { n: n, lineage: lineagePlace(view.lineage, block.binding) })] })] }));
 }
 /**
  * The PubMed address of one identifier. The address is deterministic, and an anchor loads nothing, thus a
@@ -234,10 +244,13 @@ const PUBMED_BASE = "https://pubmed.ncbi.nlm.nih.gov/";
  * The short citation of a `pmid:` record carries the PubMed link of its identifier. A key of another
  * identifier space shows the citation as text. A key with no pinned record shows the key and the note
  * alone, because absence is a normal condition and no text stands in for the paper.
+ *
+ * `view.lineage` states that the page carries a provenance document. The card then stamps the identity of
+ * the external record in place of a pin, because a paper is no artifact and no data chain reaches it.
  */
-export function renderCitation(block, ledger, record) {
+export function renderCitation(block, ledger, record, view = DEFAULT_VIEW_OPTIONS) {
     const n = ledger.mark(block.binding);
     const binding = block.binding;
     const key = citationKeyOf(binding);
-    return String(_jsxs("div", { class: "report-citation corner-accents", children: [_jsx(Marker, { n: n }), record !== undefined ? (_jsxs(_Fragment, { children: [" ", binding.idKind === "pmid" ? (_jsx("a", { class: "report-citation-source", href: `${PUBMED_BASE}${encodeURIComponent(binding.id)}/`, children: record.citation })) : (_jsx("span", { class: "report-citation-source", children: record.citation }))] })) : null, block.note !== undefined ? (_jsxs(_Fragment, { children: [" ", _jsx("span", { class: "report-citation-note", children: block.note })] })) : null, " ", _jsx("span", { class: "report-citation-key", children: key })] }));
+    return String(_jsxs("div", { class: "report-citation corner-accents", ...lineageStamp(view.lineage, block.id, [binding]), children: [_jsx(Marker, { n: n, lineage: lineagePlace(view.lineage, binding) }), record !== undefined ? (_jsxs(_Fragment, { children: [" ", binding.idKind === "pmid" ? (_jsx("a", { class: "report-citation-source", href: `${PUBMED_BASE}${encodeURIComponent(binding.id)}/`, children: record.citation })) : (_jsx("span", { class: "report-citation-source", children: record.citation }))] })) : null, block.note !== undefined ? (_jsxs(_Fragment, { children: [" ", _jsx("span", { class: "report-citation-note", children: block.note })] })) : null, " ", _jsx("span", { class: "report-citation-key", children: key })] }));
 }

package/dist/runtime/assemble.d.ts

@@ -34,6 +34,7 @@ import { type CitationResolverConfig } from "../citations/resolve.js";
 import type { CitationResolver } from "../citations/types.js";
 import type { AuthContext } from "../auth/types.js";
 import type { ReferenceResolver } from "../report-model/reference-resolver.js";
+import type { ProvenanceSeam } from "../provenance/seam.js";
 import type { MakeSessionPagePublisher, ResolvePageAsset, ResolvePageUrl } from "../tools/report-session/index.js";
 /** Registered child sandbox-step callable the parent's child dispatch closes over. */
 export type SandboxStepCallable = (input: SandboxStepInput) => Promise<SandboxStepResult>;
@@ -160,6 +161,27 @@ export interface CoreRuntimeDeps {
      * the eyes tool of a report session then reports that condition.
      */
     readonly eyes?: AcquireEyes;
+    /**
+     * The provenance seam. Each act of a session — the creation of the session, the block operations, the
+     * title, the derivation, the preview, and the record — rides the session emit as one typed event, and
+     * the embedder lands the events in the record of the analysis that it owns. The emit is
+     * fire-and-forget: it gives no result, a throw of the realization reaches the log alone, and an unbound
+     * member emits nothing. Thus a composition that binds none behaves the same as one that never had the
+     * seam.
+     *
+     * The document read gives the signed document of the analysis back, as opaque text. The preview of a
+     * report session carries a frozen copy into the page, and the page then shows the chain of a grounded
+     * block with no host and no network. The harness parses nothing. Absence is a normal result: an unbound
+     * member, and a bound member that holds no document for the analysis, both give a page with no
+     * provenance and no other change.
+     *
+     * Each member is optional alone, thus a composition binds the members that it records.
+     *
+     * The assembly reaches two consumers with the seam: the report agent, and the conversation agent, whose
+     * start tool passes it to the spawn. The creation of a conversation thread rides `prepareChatTurn`,
+     * which an embedder calls on its own. Thus that composition binds the seam there as well.
+     */
+    readonly provenance?: ProvenanceSeam;
 }
 /**
  * The refusal a thread type carries no agent yet. `report` is a valid

package/dist/runtime/assemble.js

@@ -124,6 +124,9 @@ export function assembleCoreRuntime(deps) {
         usageRecorder,
         citationResolver,
         ...(eyes ? { eyes } : {}),
+        // The start tool passes it to the spawn, which emits the creation of a
+        // report session. The same seam reaches the report agent below.
+        ...(deps.provenance ? { provenance: deps.provenance } : {}),
     });
     // The report agent is a singleton over the conversation deps, the same way the
     // session runtime is. Its preview tool writes the page into the analysis tree
@@ -173,6 +176,7 @@ export function assembleCoreRuntime(deps) {
         ...(deps.resolveReportPageAsset ? { resolvePageAsset: deps.resolveReportPageAsset } : {}),
         ...(deps.makeSessionPagePublisher ? { makeSessionPages: deps.makeSessionPagePublisher } : {}),
         ...(deps.resolveReportPageUrl ? { resolvePageUrl: deps.resolveReportPageUrl } : {}),
+        ...(deps.provenance ? { provenance: deps.provenance } : {}),
         ...(conversation.logger ? { logger: conversation.logger } : {}),
     });
     // The single registration point for every typed agent. A future thread type's

package/dist/sandbox/k8s-client.d.ts

@@ -60,11 +60,6 @@ export interface K8sClientConfig {
     tolerations?: V1Toleration[];
     /** RuntimeClass for runtime isolation (e.g. `gvisor`). Omit for the default runtime. */
     runtimeClassName?: string;
-    /**
-     * The `/proc/cpuinfo` text that the cpu ConfigMap of each Job is cut from.
-     * Defaults to the file of the host of this process, read once. Injected for tests.
-     */
-    readHostCpuinfo?: () => Promise<string | undefined>;
     /** Injected for tests. */
     batchApi?: BatchV1Api;
     coreApi?: CoreV1Api;

package/dist/sandbox/k8s-client.js

@@ -17,7 +17,6 @@ import { ResultAsync, err, ok } from "neverthrow";
 import { trySandbox } from "./sandbox-error.js";
 import { buildMountPlan, buildSessionSubPaths } from "./mount-plan.js";
 import { threadLimitEnv } from "./thread-env.js";
-import { CPU_ONLINE_PATH, CPUINFO_PATH, cpuFiles, readHostCpuinfoOnce } from "./cpu-files.js";
 import { createNoopLogger } from "../lib/console-logger.js";
 /** Read the originating HTTP status off any `SandboxError` variant that carries one. */
 function statusOf(e) {
@@ -26,8 +25,6 @@ function statusOf(e) {
 const SESSION_VOLUME_NAME = "session";
 const LIBS_VOLUME_NAME = "libs";
 const REFS_VOLUME_NAME = "refs";
-/** The ConfigMap volume that holds the two cpu files of the sandbox (`cpu-files.ts`). */
-const CPU_VOLUME_NAME = "cpu";
 const SANDBOX_SERVER_PORT = 8765;
 const POD_READY_TIMEOUT_MS = 5 * 60_000;
 const POD_POLL_INTERVAL_MS = 1_000;
@@ -63,19 +60,6 @@ export function sanitizeLabelValue(value) {
 function readOwnerWorkflowId(metadata) {
     return metadata?.annotations?.[OWNER_WORKFLOW_ANNOTATION] ?? null;
 }
-function deleteConfigMapIgnoreMissing(coreApi, namespace, name) {
-    return trySandbox(async () => {
-        await coreApi.deleteNamespacedConfigMap({ namespace, name });
-    }, (status, cause) => ({
-        type: "teardown_failed",
-        op: "k8s.teardown",
-        sandboxId: name,
-        status,
-        cause,
-    })).orElse((e) => 
-    // A 404 means the owner reference removed it with the Job already.
-    statusOf(e) === 404 ? ok(undefined) : err(e));
-}
 function deleteJobIgnoreMissing(batchApi, namespace, name) {
     return trySandbox(async () => {
         await batchApi.deleteNamespacedJob({
@@ -124,7 +108,7 @@ function workspaceSubPathFor(config, analysisId) {
     }
     return posix;
 }
-function buildJobSpec(meta, config, identity, cpu) {
+function buildJobSpec(meta, config, identity) {
     const { sandboxId } = identity;
     const plan = buildMountPlan(meta, {
         libs: !!config.libStorePvc,
@@ -205,16 +189,6 @@ function buildJobSpec(meta, config, identity, cpu) {
             readOnly: true,
         });
     }
-    // The cpu files ride in a ConfigMap named after the Job (`ensureCpuConfigMap`).
-    // A `subPath` mount of one key over one kernel path is accepted by the API
-    // server, the kubelet, and gVisor. Under gVisor the sandbox sees no cgroup
-    // at all, thus these two files are the only source of the quota for
-    // `parallel::detectCores()` and `os.cpu_count()`.
-    volumes.push({ name: CPU_VOLUME_NAME, configMap: { name: sandboxId } });
-    volumeMounts.push({ name: CPU_VOLUME_NAME, mountPath: CPU_ONLINE_PATH, subPath: "online", readOnly: true });
-    if (cpu.hasCpuinfo) {
-        volumeMounts.push({ name: CPU_VOLUME_NAME, mountPath: CPUINFO_PATH, subPath: "cpuinfo", readOnly: true });
-    }
     const podSpec = {
         automountServiceAccountToken: false,
         restartPolicy: "Never",
@@ -385,9 +359,6 @@ function waitForJobGone(batchApi, namespace, name) {
  * means an (astronomically rare) name collision with a *different* step —
  * adopting its pod would HMAC-fail every callback, and deleting its Job would
  * kill a live sibling. Refuse loudly instead.
- *
- * The result is the uid of the Job that the pod belongs to, for the owner
- * reference of the cpu ConfigMap.
  */
 function createOrAdoptJob(batchApi, coreApi, namespace, sandboxId, ownerWorkflowId, job) {
     const createFailed = (status, cause) => ({
@@ -400,7 +371,7 @@ function createOrAdoptJob(batchApi, coreApi, namespace, sandboxId, ownerWorkflow
     return new ResultAsync((async () => {
         const created = await trySandbox(() => batchApi.createNamespacedJob({ namespace, body: job }), createFailed);
         if (created.isOk())
-            return ok(created.value?.metadata?.uid);
+            return ok(undefined);
         if (statusOf(created.error) !== 409)
             return err(created.error);
         const existingRead = await trySandbox(() => batchApi.readNamespacedJob({ namespace, name: sandboxId }), createFailed);
@@ -428,92 +399,21 @@ function createOrAdoptJob(batchApi, coreApi, namespace, sandboxId, ownerWorkflow
             const recreated = await trySandbox(() => batchApi.createNamespacedJob({ namespace, body: job }), createFailed);
             if (recreated.isErr())
                 return err(recreated.error);
-            return ok(recreated.value?.metadata?.uid);
-        }
-        return ok(existingRead.value.metadata?.uid);
-    })());
-}
-/**
- * Make the cpu ConfigMap of a Job, or bring an existing one up to date.
- *
- * The ConfigMap comes after the Job, because the Job is its owner. Thus the
- * TTL of the Job and a Foreground delete both remove the ConfigMap with it.
- * The pod waits at its mount until the ConfigMap exists, and that wait is
- * shorter than the schedule of the pod.
- *
- * A `409 AlreadyExists` is the recovery re-run of the spawn step, or a
- * ConfigMap whose prior owner Job is not yet collected. Both cases get the
- * same data and the current owner through a replace.
- */
-function ensureCpuConfigMap(coreApi, namespace, sandboxId, jobUid, files) {
-    const createFailed = (status, cause) => ({
-        type: "container_create_failed",
-        op: "k8s.createNamespacedConfigMap",
-        sandboxId,
-        status,
-        cause,
-    });
-    const body = {
-        apiVersion: "v1",
-        kind: "ConfigMap",
-        metadata: {
-            name: sandboxId,
-            namespace,
-            labels: {
-                [MANAGED_BY_LABEL]: MANAGED_BY_VALUE,
-                role: "sandbox",
-                "cortex/sandbox-id": sandboxId,
-            },
-            ...(jobUid !== undefined && {
-                ownerReferences: [{ apiVersion: "batch/v1", kind: "Job", name: sandboxId, uid: jobUid }],
-            }),
-        },
-        data: {
-            online: files.online,
-            ...(files.cpuinfo !== undefined && { cpuinfo: files.cpuinfo }),
-        },
-    };
-    return new ResultAsync((async () => {
-        const created = await trySandbox(() => coreApi.createNamespacedConfigMap({ namespace, body }), createFailed);
-        if (created.isOk())
             return ok(undefined);
-        if (statusOf(created.error) !== 409)
-            return err(created.error);
-        const existing = await trySandbox(() => coreApi.readNamespacedConfigMap({ namespace, name: sandboxId }), createFailed);
-        if (existing.isErr())
-            return err(existing.error);
-        const replaced = await trySandbox(() => coreApi.replaceNamespacedConfigMap({
-            namespace,
-            name: sandboxId,
-            body: { ...body, metadata: { ...body.metadata, resourceVersion: existing.value.metadata?.resourceVersion } },
-        }), createFailed);
-        if (replaced.isErr())
-            return err(replaced.error);
+        }
         return ok(undefined);
     })());
 }
 export function createK8sSandboxOps(config) {
     const { batchApi, coreApi } = config.batchApi && config.coreApi ? { batchApi: config.batchApi, coreApi: config.coreApi } : buildKubeApi();
-    const readHostCpuinfo = config.readHostCpuinfo ?? readHostCpuinfoOnce;
     return {
         createSandbox(meta, identity) {
             return new ResultAsync((async () => {
                 const { sandboxId } = identity;
-                // The same floor as `threadLimitEnv`: a fraction of a core still
-                // keeps one thread busy, and a count of zero is not representable.
-                const threads = Math.max(1, Math.floor(meta.resources.cpu));
-                const files = cpuFiles(threads, await readHostCpuinfo());
-                const job = buildJobSpec(meta, config, identity, { hasCpuinfo: files.cpuinfo !== undefined });
+                const job = buildJobSpec(meta, config, identity);
                 const adopted = await createOrAdoptJob(batchApi, coreApi, config.namespace, sandboxId, meta.childWorkflowId, job);
                 if (adopted.isErr())
                     return err(adopted.error);
-                const cpuMap = await ensureCpuConfigMap(coreApi, config.namespace, sandboxId, adopted.value, files);
-                if (cpuMap.isErr()) {
-                    // A pod whose ConfigMap never comes stays at ContainerCreating
-                    // until the ready wait expires. Fail now, with the real cause.
-                    await cleanupFailedJob(batchApi, coreApi, config.namespace, sandboxId, config.logger ?? createNoopLogger());
-                    return err(cpuMap.error);
-                }
                 // A Job whose pod never schedules (quota rejection, no nodes, spot
                 // reclaim) is reaped by neither backoffLimit (an admission rejection
                 // creates no pod to count) nor ttlSecondsAfterFinished (the Job never
@@ -537,22 +437,20 @@ export function createK8sSandboxOps(config) {
                         cause,
                     }));
                     if (registered.isErr()) {
-                        await cleanupFailedJob(batchApi, coreApi, config.namespace, sandboxId, config.logger ?? createNoopLogger());
+                        await cleanupFailedJob(batchApi, config.namespace, sandboxId, config.logger ?? createNoopLogger());
                         return err(registered.error);
                     }
                     return ok(ref);
                 }
-                await cleanupFailedJob(batchApi, coreApi, config.namespace, sandboxId, config.logger ?? createNoopLogger());
+                await cleanupFailedJob(batchApi, config.namespace, sandboxId, config.logger ?? createNoopLogger());
                 return err(ready.error);
             })());
         },
-        // The owner reference removes the cpu ConfigMap with the Job. The explicit
-        // delete covers a ConfigMap that got no owner, and it is a no-op on 404.
         teardown(ref) {
-            return deleteJobIgnoreMissing(batchApi, config.namespace, ref.sandboxId).andThen(() => deleteConfigMapIgnoreMissing(coreApi, config.namespace, ref.sandboxId));
+            return deleteJobIgnoreMissing(batchApi, config.namespace, ref.sandboxId);
         },
         teardownById(sandboxId) {
-            return deleteJobIgnoreMissing(batchApi, config.namespace, sandboxId).andThen(() => deleteConfigMapIgnoreMissing(coreApi, config.namespace, sandboxId));
+            return deleteJobIgnoreMissing(batchApi, config.namespace, sandboxId);
         },
         listManagedSandboxes() {
             return trySandbox(() => batchApi.listNamespacedJob({
@@ -613,13 +511,9 @@ export function createK8sSandboxOps(config) {
  * matters; a delete error here is logged and swallowed so it never masks the
  * create error returned to the caller.
  */
-async function cleanupFailedJob(batchApi, coreApi, namespace, sandboxId, logger) {
+async function cleanupFailedJob(batchApi, namespace, sandboxId, logger) {
     const deleted = await deleteJobIgnoreMissing(batchApi, namespace, sandboxId);
     if (deleted.isErr()) {
         logger.named("k8s-client").error("failed to delete Job after startup failure", { sandboxId, err: deleted.error });
     }
-    const deletedMap = await deleteConfigMapIgnoreMissing(coreApi, namespace, sandboxId);
-    if (deletedMap.isErr()) {
-        logger.named("k8s-client").error("failed to delete cpu ConfigMap after startup failure", { sandboxId, err: deletedMap.error });
-    }
 }

package/dist/sandbox/thread-env.d.ts

@@ -2,26 +2,32 @@
  * Thread-count env for a sandbox container.
  *
  * Each backend turns the `ResourceSpec` of a step into a hard cgroup limit:
- * `NanoCpus` and `Memory` on Docker, `limits.cpu` and `limits.memory` on K8s. A
- * cgroup quota is invisible to most runtimes inside it. `parallel::detectCores()`
- * greps `/proc/cpuinfo`, and `os.cpu_count()` reads
- * `/sys/devices/system/cpu/online`. Both files describe the host. Thus a step
- * with 2 CPUs on a host of 12 cores forks 12 workers into a cgroup of 2 CPUs,
- * and each fork copies its working set until the memory limit stops it.
+ * `NanoCpus` and `Memory` on Docker, `limits.cpu` and `limits.memory` on K8s.
+ * The mounted cpu files show the quota to `parallel::detectCores()` and to
+ * `os.cpu_count()`. Thus the fork count of a step follows the quota by default.
  *
- * The env below publishes the quota to each library that reads a thread count
- * from the environment. `parallelly::availableCores()` and `joblib.cpu_count()`
- * read the cgroup quota on their own, thus they need no value here.
+ * The thread pools get a different default. A fork copies the pool size of its
+ * parent, and no R runtime divides it. Thus a pool at the quota turns into
+ * `workers * quota` threads inside one cgroup. The env below pins each pool to
+ * one thread, which is the convention of Snakemake and of the HPC sites. A
+ * thread-parallel step raises the value per command, through the `env`
+ * parameter of `execute_command`. The rule for the agent is one line: workers
+ * times threads must not go above the quota.
+ *
+ * The two worker-count names stay at the quota. They cap process workers, not
+ * threads, and a worker with one thread is safe at each count up to the quota.
+ * joblib divides its own budget by its worker count, and a value of one in
+ * `OMP_NUM_THREADS` gives each of its workers one thread as well.
  *
  * `MC_CORES` is absent on purpose. R defaults `mclapply` to 2 workers, not to
  * the core count. A value there raises the fork count instead of a decrease.
  */
 import type { ResourceSpec } from "../config/resource-limits.js";
 /**
- * Env that binds each parallel library in the container to `spec.cpu`.
+ * Env that makes each parallel library in the container safe under `spec.cpu`.
  *
- * A fractional CPU request floors to one thread. A pool of zero is not
- * representable, and two threads on half a core only add context switches.
+ * A fractional CPU request floors to one worker. A pool of zero is not
+ * representable, and two workers on half a core only add context switches.
  *
  * The caller puts these before `plan.env` and before the `extraEnv` of the
  * embedder, thus a host that knows more about a step keeps the last word.

package/dist/sandbox/thread-env.js

@@ -2,48 +2,59 @@
  * Thread-count env for a sandbox container.
  *
  * Each backend turns the `ResourceSpec` of a step into a hard cgroup limit:
- * `NanoCpus` and `Memory` on Docker, `limits.cpu` and `limits.memory` on K8s. A
- * cgroup quota is invisible to most runtimes inside it. `parallel::detectCores()`
- * greps `/proc/cpuinfo`, and `os.cpu_count()` reads
- * `/sys/devices/system/cpu/online`. Both files describe the host. Thus a step
- * with 2 CPUs on a host of 12 cores forks 12 workers into a cgroup of 2 CPUs,
- * and each fork copies its working set until the memory limit stops it.
+ * `NanoCpus` and `Memory` on Docker, `limits.cpu` and `limits.memory` on K8s.
+ * The mounted cpu files show the quota to `parallel::detectCores()` and to
+ * `os.cpu_count()`. Thus the fork count of a step follows the quota by default.
  *
- * The env below publishes the quota to each library that reads a thread count
- * from the environment. `parallelly::availableCores()` and `joblib.cpu_count()`
- * read the cgroup quota on their own, thus they need no value here.
+ * The thread pools get a different default. A fork copies the pool size of its
+ * parent, and no R runtime divides it. Thus a pool at the quota turns into
+ * `workers * quota` threads inside one cgroup. The env below pins each pool to
+ * one thread, which is the convention of Snakemake and of the HPC sites. A
+ * thread-parallel step raises the value per command, through the `env`
+ * parameter of `execute_command`. The rule for the agent is one line: workers
+ * times threads must not go above the quota.
+ *
+ * The two worker-count names stay at the quota. They cap process workers, not
+ * threads, and a worker with one thread is safe at each count up to the quota.
+ * joblib divides its own budget by its worker count, and a value of one in
+ * `OMP_NUM_THREADS` gives each of its workers one thread as well.
  *
  * `MC_CORES` is absent on purpose. R defaults `mclapply` to 2 workers, not to
  * the core count. A value there raises the fork count instead of a decrease.
  */
 /**
- * Env that binds each parallel library in the container to `spec.cpu`.
+ * Env that makes each parallel library in the container safe under `spec.cpu`.
  *
- * A fractional CPU request floors to one thread. A pool of zero is not
- * representable, and two threads on half a core only add context switches.
+ * A fractional CPU request floors to one worker. A pool of zero is not
+ * representable, and two workers on half a core only add context switches.
  *
  * The caller puts these before `plan.env` and before the `extraEnv` of the
  * embedder, thus a host that knows more about a step keeps the last word.
  */
 export function threadLimitEnv(spec) {
-    const threads = String(Math.max(1, Math.floor(spec.cpu)));
+    const workers = String(Math.max(1, Math.floor(spec.cpu)));
     return {
+        // Thread pools: one thread each. The agent raises a value per command.
         // OpenMP: the compiled code of R and Python packages.
-        OMP_NUM_THREADS: threads,
+        OMP_NUM_THREADS: "1",
         // OpenBLAS keeps a private pool. A pthread build reads this name first.
-        OPENBLAS_NUM_THREADS: threads,
+        OPENBLAS_NUM_THREADS: "1",
         // MKL reads this name before OMP_NUM_THREADS.
-        MKL_NUM_THREADS: threads,
+        MKL_NUM_THREADS: "1",
+        // data.table defaults to half of the visible cores.
+        R_DATATABLE_NUM_THREADS: "1",
+        // The Python numerical stack.
+        NUMBA_NUM_THREADS: "1",
+        NUMEXPR_MAX_THREADS: "1",
+        POLARS_MAX_THREADS: "1",
+        RAYON_NUM_THREADS: "1",
+        // Worker counts: the quota.
         // BiocParallel sizes `bpparam()` from this name. DESeq2 `parallel=TRUE`
         // and the other Bioconductor packages size their workers from `bpparam()`.
-        BIOCPARALLEL_WORKER_NUMBER: threads,
-        // data.table defaults to half of the host cores.
-        R_DATATABLE_NUM_THREADS: threads,
-        // The Python numerical stack.
-        NUMBA_NUM_THREADS: threads,
-        NUMEXPR_MAX_THREADS: threads,
-        LOKY_MAX_CPU_COUNT: threads,
-        POLARS_MAX_THREADS: threads,
-        RAYON_NUM_THREADS: threads,
+        // `parallelly::availableCores()` reads it too, and under gVisor, where no
+        // cgroup is visible, it is the only bound that library sees.
+        BIOCPARALLEL_WORKER_NUMBER: workers,
+        // loky caps its worker default at this name.
+        LOKY_MAX_CPU_COUNT: workers,
     };
 }