@iowarp/clio-coder 0.3.7 → 0.3.8

package/src/domains/context/project-rules.ts

@@ -203,12 +203,62 @@ function ruleMatchesAnyPath(rule: ProjectRule, workingPaths: ReadonlyArray<strin
 			continue;
 		}
 		for (const path of workingPaths) {
-			if (regex.test(normalizeGlobInput(path))) return true;
+			const normalized = normalizeGlobInput(path);
+			if (regex.test(normalized)) return true;
+			if (normalized.endsWith("/") && globMatchesInsideDirectory(regex, pattern, normalized)) return true;
 		}
 	}
 	return false;
 }
 
+function materializedGlobVariants(pattern: string): string[] {
+	let variants = [""];
+	const normalized = normalizeGlobInput(pattern);
+	for (let index = 0; index < normalized.length; index += 1) {
+		const character = normalized[index];
+		if (character === undefined) break;
+		if (character === "*" && normalized[index + 1] === "*" && normalized[index + 2] === "/") {
+			variants = variants.flatMap((prefix) => [prefix, `${prefix}x/`]).slice(0, 64);
+			index += 2;
+			continue;
+		}
+		if (character === "*" && normalized[index + 1] === "*") {
+			variants = variants.map((prefix) => `${prefix}x`);
+			index += 1;
+			continue;
+		}
+		if (character === "*" || character === "?") {
+			variants = variants.map((prefix) => `${prefix}x`);
+			continue;
+		}
+		if (character === "[") {
+			const end = normalized.indexOf("]", index + 1);
+			const selected = end === -1 ? "x" : (normalized[index + 1] ?? "x");
+			variants = variants.map((prefix) => `${prefix}${selected}`);
+			index = end === -1 ? index : end;
+			continue;
+		}
+		variants = variants.map((prefix) => `${prefix}${character}`);
+	}
+	return variants;
+}
+
+function globMatchesInsideDirectory(regex: RegExp, pattern: string, directory: string): boolean {
+	const candidates = new Set<string>([`${directory}x`, `${directory}x/x`]);
+	for (const materialized of materializedGlobVariants(pattern)) {
+		if (materialized.startsWith(directory)) candidates.add(materialized);
+		const segments = materialized.split("/");
+		for (let index = 0; index < segments.length; index += 1) {
+			const suffix = segments.slice(index).join("/");
+			if (suffix.length > 0) candidates.add(`${directory}${suffix}`);
+		}
+		for (let index = 0; index < materialized.length; index += 1) {
+			candidates.add(`${directory}${materialized.slice(index)}`);
+		}
+	}
+	return [...candidates].some((candidate) => regex.test(candidate));
+}
+
 /**
  * Select the rules that should load now. Unconditional rules (no `paths`) always
  * load; a path-scoped rule loads only when one of its globs matches a path

package/src/domains/dispatch/assignment-reconcile.ts

@@ -1,8 +1,9 @@
 /**
  * Startup reconciliation for durable assignments. The in-memory retry queue and
- * assignment registry do not survive a restart (Symphony §14.3), so every
- * durable record still marked `running` after a crash is orphaned: no active
- * attempt, no queued retry, and no attached terminal promise can ever settle it.
+ * assignment registry do not survive a restart (Symphony §14.3), so a durable
+ * record whose process owner is gone is orphaned: no active attempt, no queued
+ * retry, and no attached terminal promise can ever settle it. Running records
+ * owned by a live sibling process are deliberately left alone.
  *
  * This pass resolves each orphan deterministically against durable ledger
  * evidence so a later `wait`/`collect` can never observe a stuck `running`
@@ -11,7 +12,7 @@
  */
 
 import type { AssignmentStatus } from "./assignment.js";
-import type { DurableAssignmentRecord } from "./assignment-store.js";
+import type { AssignmentVerdictOwner, DurableAssignmentRecord } from "./assignment-store.js";
 
 /** Minimal terminal view of one attempt's durable ledger row. */
 export interface ReconcileAttemptView {
@@ -25,13 +26,16 @@ export interface ReconcileAttemptView {
 export interface AssignmentReconcileDeps {
 	/** Durable records currently marked `running`. */
 	listRunning: () => ReadonlyArray<DurableAssignmentRecord>;
+	/** Decide liveness from the record's durable pid and process birth token. */
+	ownerAlive: (record: DurableAssignmentRecord) => boolean;
 	/** Resolve one attempt's terminal view from the ledger, or null if pruned. */
 	lookupAttempt: (runId: string) => ReconcileAttemptView | null;
-	/** Persist the reconciled terminal status. */
+	/** Persist the reconciled terminal status, as the record's verdict owner when it has one. */
 	settle: (
 		assignmentId: string,
 		terminalRunId: string,
 		status: Exclude<AssignmentStatus, "running">,
+		owner?: AssignmentVerdictOwner,
 	) => Promise<unknown>;
 }
 
@@ -44,6 +48,10 @@ export interface AssignmentReconcileSummary {
 
 /**
  * Deterministic rule, in priority order:
+ *  -1. a record owned by a live process is not an orphan and remains running;
+ *   0. a record whose verdict belongs to its opener is failed (abandoned): the
+ *      opener died before reaching a verdict, and a green attempt under it is
+ *      one step of a run, never the run's answer;
  *   1. a recovered succeeded terminal attempt wins (`succeeded`);
  *   2. otherwise the last terminal attempt marks the assignment `failed`;
  *   3. otherwise no attempt is recoverable and the assignment is failed
@@ -53,6 +61,15 @@ export async function reconcileOrphanAssignments(deps: AssignmentReconcileDeps):
 	const summary: AssignmentReconcileSummary = { recovered: 0, abandoned: 0 };
 	for (const record of deps.listRunning()) {
 		if (record.status !== "running") continue;
+		if (deps.ownerAlive(record)) continue;
+		if (record.verdictOwner !== undefined) {
+			// Attempts under a claimed row are fleet steps, not the fleet verdict.
+			// Filing a green step as the terminal id of an abandoned fleet would
+			// contradict that step's immutable ledger result.
+			await deps.settle(record.assignmentId, record.assignmentId, "failed", record.verdictOwner);
+			summary.abandoned += 1;
+			continue;
+		}
 		const views = record.attempts
 			.map((runId) => deps.lookupAttempt(runId))
 			.filter((view): view is ReconcileAttemptView => view !== null);

package/src/domains/dispatch/assignment-store.ts

@@ -5,6 +5,7 @@
 
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { BIRTH_TOKEN_SOURCE_AVAILABLE, processAlive, processBirthToken } from "../../core/process-identity.js";
 import { withStateFileLock } from "../../core/state-file-lock.js";
 import { clioStateDir } from "../../core/xdg.js";
 import { atomicWrite } from "../../engine/session.js";
@@ -12,11 +13,54 @@ import type { AssignmentStatus } from "./assignment.js";
 
 const MAX_ASSIGNMENT_RECORDS = 1_000;
 
+/**
+ * Who decides a record's status.
+ *
+ * Absent is the ordinary case: the record is one logical dispatch, so the
+ * attempts filed under it are the only thing that can settle it. A fleet claims
+ * the verdict instead, because a fleet root gathers every step of a run under
+ * one id and no single step is the run's answer. Without the claim the last
+ * step to settle writes the row, which reports a green step of an aborted run
+ * as the run's outcome.
+ */
+export type AssignmentVerdictOwner = "fleet";
+
+/**
+ * Durable identity of the process executing a running assignment. A pid alone
+ * is not enough: the OS may recycle it after a crash, so the process birth
+ * token must still match before another extension treats the owner as live.
+ */
+export interface AssignmentProcessOwner {
+	pid: number;
+	processBirthToken: string;
+	acquiredAt: string;
+}
+
+export interface AssignmentProcessOwnerProbe {
+	birthToken(pid: number): string | null;
+	/** True when a missing birth token proves that the process is gone. */
+	tokenProvesDeath?: boolean;
+	/** Liveness fallback for platforms whose birth token is synthetic. */
+	alive?(pid: number): boolean;
+}
+
+/**
+ * One durable logical-dispatch row.
+ *
+ * `attempts` holds terminal run ids: an agent attempt's receipt id, and for a
+ * fleet also each deterministic step's `code-*` run id, whose evidence lives
+ * under `code-steps/<assignmentId>/`. `status` answers for the whole record,
+ * so for a fleet it answers for the whole run rather than for its last step.
+ */
 export interface DurableAssignmentRecord {
 	assignmentId: string;
 	attempts: string[];
 	terminalRunId: string | null;
 	status: AssignmentStatus;
+	/** Set when something other than the attempts decides `status`. */
+	verdictOwner?: AssignmentVerdictOwner;
+	/** Process lease held only while this record is running. */
+	processOwner?: AssignmentProcessOwner;
 }
 
 interface AssignmentStoreFile {
@@ -28,6 +72,18 @@ function storePath(): string {
 	return join(clioStateDir(), "assignments.json");
 }
 
+function validProcessOwner(value: unknown): value is AssignmentProcessOwner {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const owner = value as Partial<AssignmentProcessOwner>;
+	return (
+		Number.isSafeInteger(owner.pid) &&
+		(owner.pid ?? 0) > 0 &&
+		typeof owner.processBirthToken === "string" &&
+		typeof owner.acquiredAt === "string" &&
+		Number.isFinite(Date.parse(owner.acquiredAt))
+	);
+}
+
 function validRecord(value: unknown): value is DurableAssignmentRecord {
 	if (typeof value !== "object" || value === null) return false;
 	const record = value as Partial<DurableAssignmentRecord>;
@@ -36,6 +92,8 @@ function validRecord(value: unknown): value is DurableAssignmentRecord {
 		Array.isArray(record.attempts) &&
 		record.attempts.every((runId) => typeof runId === "string") &&
 		(record.terminalRunId === null || typeof record.terminalRunId === "string") &&
+		(record.verdictOwner === undefined || record.verdictOwner === "fleet") &&
+		(record.processOwner === undefined || validProcessOwner(record.processOwner)) &&
 		(record.status === "running" ||
 			record.status === "succeeded" ||
 			record.status === "failed" ||
@@ -57,7 +115,32 @@ function readStore(): DurableAssignmentRecord[] {
 }
 
 function copyRecord(record: DurableAssignmentRecord): DurableAssignmentRecord {
-	return { ...record, attempts: [...record.attempts] };
+	return {
+		...record,
+		attempts: [...record.attempts],
+		...(record.processOwner === undefined ? {} : { processOwner: { ...record.processOwner } }),
+	};
+}
+
+const defaultProcessOwnerProbe: AssignmentProcessOwnerProbe = {
+	birthToken: processBirthToken,
+	tokenProvesDeath: BIRTH_TOKEN_SOURCE_AVAILABLE,
+	alive: processAlive,
+};
+
+/** True only when the durable identity still names the same live process. */
+export function assignmentProcessOwnerAlive(
+	record: Pick<DurableAssignmentRecord, "processOwner">,
+	probe: AssignmentProcessOwnerProbe = defaultProcessOwnerProbe,
+): boolean {
+	const owner = record.processOwner;
+	if (owner === undefined) return false;
+	const current = probe.birthToken(owner.pid);
+	if (current === null || current !== owner.processBirthToken) return false;
+	// A synthetic `pid-N` token cannot distinguish pid reuse, so require an
+	// independent liveness signal on platforms without a real birth-token source.
+	if (probe.tokenProvesDeath === false) return probe.alive?.(owner.pid) ?? false;
+	return true;
 }
 
 function writeStore(assignments: ReadonlyArray<DurableAssignmentRecord>): void {
@@ -114,49 +197,103 @@ export async function renameStoredAssignment(
 	return copyRecord(result);
 }
 
-export function registerAssignment(assignmentId: string): Promise<DurableAssignmentRecord> {
-	return updateRecord(
+function currentProcessOwner(): AssignmentProcessOwner {
+	const token = processBirthToken();
+	if (token === null) throw new Error("dispatch: cannot establish assignment owner process birth token");
+	return {
+		pid: process.pid,
+		processBirthToken: token,
+		acquiredAt: new Date().toISOString(),
+	};
+}
+
+function openRecord(assignmentId: string): DurableAssignmentRecord {
+	return {
 		assignmentId,
-		(current) => current ?? { assignmentId, attempts: [], terminalRunId: null, status: "running" },
-	);
+		attempts: [],
+		terminalRunId: null,
+		status: "running",
+		processOwner: currentProcessOwner(),
+	};
+}
+
+function ensureRunningProcessOwner(record: DurableAssignmentRecord): DurableAssignmentRecord {
+	if (record.status !== "running" || record.processOwner !== undefined) return record;
+	return { ...record, processOwner: currentProcessOwner() };
+}
+
+function clearProcessOwner(record: DurableAssignmentRecord): DurableAssignmentRecord {
+	const result = { ...record };
+	delete result.processOwner;
+	return result;
+}
+
+export function registerAssignment(assignmentId: string): Promise<DurableAssignmentRecord> {
+	return updateRecord(assignmentId, (current) => ensureRunningProcessOwner(current ?? openRecord(assignmentId)));
+}
+
+/**
+ * Reserve this record's status for `owner`, opening the record if it is new.
+ * Attempts filed by anyone are still recorded; only the verdict is reserved,
+ * and until the owner settles it the record stays `running`.
+ */
+export function claimAssignmentVerdict(
+	assignmentId: string,
+	owner: AssignmentVerdictOwner,
+): Promise<DurableAssignmentRecord> {
+	return updateRecord(assignmentId, (current) => ({
+		...ensureRunningProcessOwner(current ?? openRecord(assignmentId)),
+		verdictOwner: owner,
+	}));
 }
 
 export function recordAssignmentAttempt(assignmentId: string, runId: string): Promise<DurableAssignmentRecord> {
 	return updateRecord(assignmentId, (current) => {
-		const base = current ?? { assignmentId, attempts: [], terminalRunId: null, status: "running" as const };
+		const base = ensureRunningProcessOwner(current ?? openRecord(assignmentId));
 		return base.attempts.includes(runId) ? base : { ...base, attempts: [...base.attempts, runId] };
 	});
 }
 
 export function failQueuedAssignment(assignmentId: string): Promise<DurableAssignmentRecord> {
 	return updateRecord(assignmentId, (current) => {
-		const base = current ?? { assignmentId, attempts: [], terminalRunId: null, status: "running" as const };
-		return base.status === "running" ? { ...base, status: "failed" } : base;
+		const base = current ?? openRecord(assignmentId);
+		if (base.verdictOwner !== undefined) return base;
+		return base.status === "running" ? clearProcessOwner({ ...base, status: "failed" }) : base;
 	});
 }
 
 export function timeoutStoredAssignment(assignmentId: string): Promise<DurableAssignmentRecord> {
 	return updateRecord(assignmentId, (current) => {
-		const base = current ?? { assignmentId, attempts: [], terminalRunId: null, status: "running" as const };
-		return base.status === "running" ? { ...base, status: "timed_out" } : base;
+		const base = current ?? openRecord(assignmentId);
+		if (base.verdictOwner !== undefined) return base;
+		return base.status === "running" ? clearProcessOwner({ ...base, status: "timed_out" }) : base;
 	});
 }
 
 export function cancelStoredAssignment(assignmentId: string): Promise<DurableAssignmentRecord> {
 	return updateRecord(assignmentId, (current) => {
-		const base = current ?? { assignmentId, attempts: [], terminalRunId: null, status: "running" as const };
-		return base.status === "running" ? { ...base, status: "canceled" } : base;
+		const base = current ?? openRecord(assignmentId);
+		if (base.verdictOwner !== undefined) return base;
+		return base.status === "running" ? clearProcessOwner({ ...base, status: "canceled" }) : base;
 	});
 }
 
+/**
+ * File `terminalRunId` as an attempt and, when the caller owns the verdict, set
+ * the record's status. An attempt settling under a claimed record settles
+ * itself and not the record: one fleet step reaching a green receipt says
+ * nothing about the six steps behind it that never ran.
+ */
 export function settleStoredAssignment(
 	assignmentId: string,
 	terminalRunId: string,
 	status: Exclude<AssignmentStatus, "running">,
+	owner?: AssignmentVerdictOwner,
 ): Promise<DurableAssignmentRecord> {
 	return updateRecord(assignmentId, (current) => {
-		const base = current ?? { assignmentId, attempts: [], terminalRunId: null, status: "running" as const };
+		const base = current ?? openRecord(assignmentId);
 		const attempts = base.attempts.includes(terminalRunId) ? base.attempts : [...base.attempts, terminalRunId];
-		return { ...base, attempts, terminalRunId, status };
+		if (base.verdictOwner !== owner) return { ...base, attempts };
+		return clearProcessOwner({ ...base, attempts, terminalRunId, status });
 	});
 }

package/src/domains/dispatch/contract.ts

@@ -240,7 +240,7 @@ export interface DispatchContract {
 	sealCouncilSynthesis?(input: {
 		group: string;
 		round: number;
-		kind: "none" | "vote";
+		kind: "none" | "vote" | "judge";
 		text: string;
 		subjects: ReadonlyArray<{ runId: string; digest: string | null }>;
 		template: RunReceipt;
@@ -252,6 +252,20 @@ export interface DispatchContract {
 	/** Get a specific immutable attempt envelope. */
 	getRun(runId: string): RunEnvelope | null;
 
+	/**
+	 * Absolute paths this run's own successful tool calls aimed a mutation at,
+	 * or null when the run kept no usable record: an unknown or evicted run, a
+	 * runtime that publishes no tool telemetry, telemetry that came back
+	 * incomplete, or a run that called a tool able to write a path its arguments
+	 * do not name. Null is not an empty list, and a caller that cannot tell them
+	 * apart will read "wrote nothing" off a run nobody watched.
+	 *
+	 * The write boundary reads this to separate what a step changed from what
+	 * changed under it, so the answer must stay a record of observation rather
+	 * than an inference from the checkout.
+	 */
+	observedRunWrites?(runId: string): ReadonlyArray<string> | null;
+
 	/** In-memory logical assignment state and complete finalized-attempt history. */
 	readonly assignments?: {
 		/** Live assignment, including its terminal promise and detailed attempt refs. */

package/src/domains/dispatch/delegation-plan.ts

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { pathBoundaryCovers } from "../../core/path-boundary.js";
 import { normalizeWriteBoundary } from "../agents/write-boundary.js";
 
 export type DelegationTaskMode = "sequential" | "parallel";
@@ -54,10 +55,6 @@ export function buildDelegationProposalBriefing(proposals: ReadonlyArray<{ agent
 
 const ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
 
-function insideBoundary(path: string, boundary: ReadonlyArray<string>): boolean {
-	return boundary.some((root) => (root.endsWith("/") ? path.startsWith(root) : path === root));
-}
-
 function malformed(detail: string): DelegationPlanValidation {
 	return { ok: false, reason: "delegation_plan_malformed", detail };
 }
@@ -116,7 +113,7 @@ export function validateDelegationPlan(input: ValidateDelegationPlanInput): Dele
 		} catch (error) {
 			return malformed(`task '${task.id}' has invalid writes: ${error instanceof Error ? error.message : String(error)}`);
 		}
-		const outside = writes.find((path) => !insideBoundary(path, input.writes));
+		const outside = writes.find((path) => !pathBoundaryCovers(input.writes, path));
 		if (outside !== undefined) {
 			return {
 				ok: false,

package/src/domains/dispatch/execution-role.ts

@@ -172,9 +172,17 @@ export function gateDeciderAgentId(requested: string | undefined): string {
  * the slot. The gate validates that answer and fails closed on a malformed one,
  * so also enforcing an inapplicable recipe postcondition would fail the run
  * before its verdict could be read.
+ *
+ * `synthesis` is the third decider and belongs here for the same reason.
+ * {@link deriveExecutionRole} already resolves it to the `judge` role, and
+ * `isBoundedGateRolePrompt` admits it only under the council judge prompt,
+ * which asks for `{"verdict","text"}`. A council seats the read-only
+ * `researcher` by default, whose recipe declares `research-report`, so leaving
+ * the recipe postcondition on the slot sealed a contract failure on every
+ * correct synthesis and burned the configured retries reproducing it.
  */
 export function appliesRecipeResultContract(gateRole: GateTopologyRole | undefined): boolean {
-	return gateRole !== "reviewer" && gateRole !== "judge";
+	return gateRole !== "reviewer" && gateRole !== "judge" && gateRole !== "synthesis";
 }
 
 /** The route dimensions a gate correlation is measured across. */