@iowarp/clio-coder 0.4.7 → 0.4.9

package/src/domains/dispatch/host-verification.ts

@@ -5,15 +5,15 @@ import { dirname, join, resolve } from "node:path";
 import { PATH_BOUNDARY_MAX_ENTRIES, pathBoundaryCovers, resolvePathBoundary } from "../../core/path-boundary.js";
 import { withStateFileLockSync } from "../../core/state-file-lock.js";
 import { clioStateDir } from "../../core/xdg.js";
-import { judgeNumericTexts, judgePerfTexts } from "../../tools/verify/scripts.js";
+import { JUDGED_CHECK_MAX_OUTPUT_BYTES, judgeNumericTexts, judgePerfTexts } from "../../tools/verify/scripts.js";
 import { FLEET_COMMAND_BASE_ENV, type FleetCommand } from "../agents/fleet-commands.js";
-import { runCodeStep } from "./code-step.js";
+import { CODE_STEP_CAPTURE_MAX_BYTES, runCodeStep } from "./code-step.js";
 import type { DispatchRequest } from "./contract.js";
 import type { RunHostVerification, RunHostVerificationAttribution, RunHostVerificationCheck } from "./types.js";
 import { captureWorkspaceSnapshot } from "./write-boundary.js";
 
 const OUTPUT_TAIL_BYTES = 2_048;
-const MEMO_VERSION = 2;
+const MEMO_VERSION = 3;
 
 type ResolvedCheck = NonNullable<DispatchRequest["resolvedVerification"]>[number];
 
@@ -164,6 +164,7 @@ function judgeResolvedCheck(
 			referenceText,
 			resolvedCheck.numeric.tolerance,
 			`reference '${resolvedCheck.numeric.reference}'`,
+			resolvedCheck.numeric.reference,
 		);
 		if (report instanceof Error) return { exitCode: 1, outputTail: `numeric-compare: ${report.message}` };
 		return { exitCode: report.passed ? 0 : 1, report, outputTail: outputTail(report.summary) };
@@ -214,20 +215,25 @@ async function runResolvedCheck(input: {
 			outputExcerpt: "",
 		};
 	}
+	const judged = resolvedCheck.kind === "numeric-compare" || resolvedCheck.kind === "perf-budget";
+	const captureMaxBytes = judged ? JUDGED_CHECK_MAX_OUTPUT_BYTES : CODE_STEP_CAPTURE_MAX_BYTES;
 	const outcome = await runCodeStep({
 		stepId: `verification-${input.index + 1}-${resolvedCheck.check.replace(/[^a-z0-9._-]/giu, "_")}`,
 		command,
 		workspaceRoot: resolvedCheck.cwd,
 		artifactDir: join(input.stateDir, "artifacts", input.runId, "verification"),
 		env: input.env,
+		maxOutputBytes: captureMaxBytes,
 	});
 	const artifactPath = outcome.record.artifactPaths[0];
-	const judgement = judgeResolvedCheck(
-		resolvedCheck,
-		outcome.record.exitCode,
-		outcome.record.durationMs,
-		outcome.stdout,
-	);
+	// outputTruncated also covers the report excerpt; only capture loss prevents judgement.
+	const judgement =
+		judged && outcome.record.outputTruncated && outcome.record.outputBytes > captureMaxBytes
+			? {
+					exitCode: 1,
+					outputTail: `verify: ${resolvedCheck.kind} command output exceeded ${captureMaxBytes} bytes before judgement; captured output was truncated`,
+				}
+			: judgeResolvedCheck(resolvedCheck, outcome.record.exitCode, outcome.record.durationMs, outcome.stdout);
 	const check: RunHostVerificationCheck = {
 		check: resolvedCheck.check,
 		argv: [...outcome.record.argv],
@@ -307,11 +313,7 @@ function checkDedupeKey(resolvedCheck: ResolvedCheck): string {
 					: {
 							reference: numeric.reference,
 							referenceDigest: sha256(JSON.stringify(readSealedFile(numeric.reference) ?? null)),
-							tolerance: {
-								absolute: numeric.tolerance.absolute,
-								relative: numeric.tolerance.relative,
-								ulp: numeric.tolerance.ulp,
-							},
+							tolerance: numeric.tolerance,
 						},
 			perf:
 				perf === undefined

package/src/domains/dispatch/index.ts

@@ -22,6 +22,7 @@ export type {
 	DispatchAssignment,
 } from "./assignment.js";
 export type { AssignmentVerdictOwner, DurableAssignmentRecord } from "./assignment-store.js";
+export { endpointCapacityUsage } from "./capacity-lease.js";
 export type { CodeStepOutcome, CodeStepRecord, CodeStepRunInput } from "./code-step.js";
 export {
 	canonicalCodeReport,

package/src/domains/dispatch/orphan-recovery.ts

@@ -78,6 +78,7 @@ function envelopeFromReceipt(receipt: RunReceipt, status: RunStatus, receiptPath
 	};
 	if (receipt.cacheReadTokenCount !== undefined) envelope.cacheReadTokenCount = receipt.cacheReadTokenCount;
 	if (receipt.cacheWriteTokenCount !== undefined) envelope.cacheWriteTokenCount = receipt.cacheWriteTokenCount;
+	if (receipt.cacheWrite1hTokenCount !== undefined) envelope.cacheWrite1hTokenCount = receipt.cacheWrite1hTokenCount;
 	if (receipt.reasoningTokenCount !== undefined) envelope.reasoningTokenCount = receipt.reasoningTokenCount;
 	if (receipt.inputTokenCount !== undefined) envelope.inputTokenCount = receipt.inputTokenCount;
 	if (receipt.outputTokenCount !== undefined) envelope.outputTokenCount = receipt.outputTokenCount;

package/src/domains/dispatch/receipt-findings.ts

@@ -1,8 +1,7 @@
 /**
- * Cheap, pure findings classifier for the durable receipt summary (v0.2.7
- * Slice 3). It maps the signals already present on a receipt draft and its
- * ledger envelope -- outcome, outcomeDetail, exitCode, toolStats, toolActivity
- * -- to a conservative subset of the canonical EvidenceTag taxonomy.
+ * Cheap, pure findings classifier for the durable receipt summary. It maps
+ * outcome, outcomeDetail, exitCode, toolStats, and toolActivity from the receipt
+ * draft and ledger envelope to a conservative subset of the EvidenceTag taxonomy.
  *
  * This is deliberately NOT buildEvidence. The forensic aggregator reads the
  * persisted receipt, so calling it at record time would create a cycle. This

package/src/domains/dispatch/receipt-integrity.ts

@@ -114,6 +114,7 @@ export const RECEIPT_INTEGRITY_FIELD_COVERAGE = {
 	outputTokenCount: true,
 	cacheReadTokenCount: true,
 	cacheWriteTokenCount: true,
+	cacheWrite1hTokenCount: true,
 	reasoningTokenCount: true,
 	upstreamResponses: true,
 	output: true,
@@ -211,6 +212,7 @@ function ledgerDigestFields(envelope: RunEnvelope): Record<string, unknown> {
 		tokenCount: envelope.tokenCount,
 		cacheReadTokenCount: envelope.cacheReadTokenCount,
 		cacheWriteTokenCount: envelope.cacheWriteTokenCount,
+		cacheWrite1hTokenCount: envelope.cacheWrite1hTokenCount,
 		reasoningTokenCount: envelope.reasoningTokenCount,
 		staticShellHash: envelope.staticShellHash,
 		sessionShellHash: envelope.sessionShellHash,
@@ -366,6 +368,7 @@ function firstLedgerMismatch(receipt: RunReceipt, envelope: RunEnvelope): string
 		["tokenCount", receipt.tokenCount, envelope.tokenCount],
 		["cacheReadTokenCount", receipt.cacheReadTokenCount ?? 0, envelope.cacheReadTokenCount ?? 0],
 		["cacheWriteTokenCount", receipt.cacheWriteTokenCount ?? 0, envelope.cacheWriteTokenCount ?? 0],
+		["cacheWrite1hTokenCount", receipt.cacheWrite1hTokenCount ?? 0, envelope.cacheWrite1hTokenCount ?? 0],
 		["reasoningTokenCount", receipt.reasoningTokenCount ?? 0, envelope.reasoningTokenCount ?? 0],
 		["staticShellHash", receipt.staticShellHash ?? null, envelope.staticShellHash ?? null],
 		["sessionShellHash", receipt.sessionShellHash ?? null, envelope.sessionShellHash ?? null],

package/src/domains/dispatch/reservation-store.ts

@@ -36,9 +36,9 @@ export type ReservationMemberStatus = "held" | "consumed" | "released";
 export type ReservationStatus = "active" | "released" | "rolled_back" | "expired";
 
 /**
- * A reservation holds four scarce things and nothing else: a global
- * concurrency slot, a per-node slot, an inference-endpoint slot, and a budget
- * upper bound. Node and endpoint identity matter only because slots bind on
+ * A reservation holds global, per-node, and inference-endpoint concurrency
+ * slots and records an advisory cost upper bound. Node and endpoint identity
+ * matter only because slots bind on
  * those dimensions. Agent, target, model, and runtime
  * identity are route identity, which the failover envelope owns
  * (`assertRouteWithinApprovedEnvelope`); pinning them here made a
@@ -330,12 +330,10 @@ export function transferDispatchReservationToLease(input: {
 }
 
 /**
- * Move a member's held capacity to the node a retry actually resolved, and
- * re-check the aggregate budget against the retry's own estimate. The durable
- * lease moves the capacity slot on a retry, but nothing else re-checks money, so
- * a retry that resolves a costlier route would otherwise run outside what the
- * plan reserved. Atomic under
- * the state-file lock: the old node's slot is released and the new one acquired
+ * Move a member's held capacity to the node a retry actually resolved and
+ * record the retry's own cost estimate. Allocation rechecks capacity while
+ * retaining cost as advisory accounting. Atomic under the state-file lock:
+ * the old node's slot is released and the new one acquired
  * in a single write, so a concurrent plan can never observe both held. Fails
  * closed with a named reason, which the caller surfaces as an admission denial
  * rather than letting the attempt escape its reservation.

package/src/domains/dispatch/route-facts.ts

@@ -102,7 +102,7 @@ export function evaluateRouteFacts(
 		if (requirement.mode === "shadow") return { ok: true, unknowns };
 		return {
 			ok: false,
-			reason: `no probe fact for target '${requirement.targetId}' on node '${requirement.nodeId}'; run 'clio-coder doctor'`,
+			reason: `no probe fact for target '${requirement.targetId}' on node '${requirement.nodeId}'; run 'clio-coder doctor --fix'`,
 			unknowns,
 		};
 	}

package/src/domains/dispatch/state.ts

@@ -1,5 +1,5 @@
 /**
- * Dispatch run ledger with atomic writes (Phase 6 slice 2).
+ * Dispatch run ledger with atomic writes.
  *
  * On-disk layout under `clioStateDir()`:
  *   runs.json                    JSON array of RunEnvelope, newest first
@@ -9,8 +9,8 @@
  * mutate memory only; `persist()` writes the settings-bounded ring (default
  * 1000) atomically via engine.atomicWrite.
  *
- * No worker spawning, no domain wire-up, no SafeEventBus emission yet. Those
- * land in P6S3 and P6S5. This slice is a pure persistence primitive.
+ * This module owns persistence. The dispatch extension wires worker spawning,
+ * cross-domain coordination, and event emission around this ledger.
  *
  * A crash between recordReceipt and persist leaves the receipt JSON on disk
  * without a ledger entry. The dispatch extension closes that gap at startup by
@@ -239,7 +239,6 @@ function capRuns(all: RunEnvelope[], maxRuns: number): RunEnvelope[] {
 }
 
 export function openLedger(opts?: LedgerOptions): Ledger {
-	const maxRuns = resolveMaxRuns(opts?.maxRuns);
 	let runs: RunEnvelope[] = readRuns();
 	// Ids this process has written since the last successful persist. See
 	// mergeRunsById: this is what separates our writes from a sibling's rows we
@@ -369,7 +368,7 @@ export function openLedger(opts?: LedgerOptions): Ledger {
 				if (stateRootRemoved()) return;
 				const diskRuns = readRuns();
 				const merged = mergeRunsById(diskRuns, runs, dirty);
-				const capped = capRuns(merged, maxRuns);
+				const capped = capRuns(merged, resolveMaxRuns(opts?.maxRuns));
 				runs = capped;
 				atomicWrite(target, JSON.stringify(capped, null, 2));
 				// A run that left the ring has no ledger row to view any more, so its

package/src/domains/dispatch/types.ts

@@ -1,6 +1,6 @@
 import type { WorkerContextProvenance } from "../context/worker/contract.js";
 /**
- * Shared run + receipt types for the dispatch domain (Phase 6 slice 2).
+ * Shared run + receipt types for the dispatch domain.
  *
  * RunEnvelope is the live record kept in the ledger (runs.json). RunReceipt is
  * the per-run artifact written under receipts/<runId>.json on completion. Both
@@ -504,6 +504,7 @@ export interface RunEnvelope {
 	reasoningTokenCount?: number;
 	cacheReadTokenCount?: number;
 	cacheWriteTokenCount?: number;
+	cacheWrite1hTokenCount?: number;
 	staticShellHash?: string | null;
 	sessionShellHash?: string | null;
 	dynamicHash?: string | null;
@@ -872,6 +873,7 @@ export interface RunReceipt {
 	outputTokenCount?: number;
 	cacheReadTokenCount?: number;
 	cacheWriteTokenCount?: number;
+	cacheWrite1hTokenCount?: number;
 	reasoningTokenCount?: number;
 	upstreamResponses?: RunReceiptUpstreamResponse[];
 	/** Bounded final/partial assistant output; absent when none was captured. */

package/src/domains/eval/metrics/tracked.ts

@@ -42,6 +42,7 @@ export interface BuildEvalTrackedMetricsInput {
 }
 
 interface AssistantCall {
+	turnId: string;
 	timestamp: string | null;
 	payload: Record<string, unknown>;
 	promptCache: Record<string, unknown> | null;
@@ -175,7 +176,7 @@ export function buildEvalTrackedMetrics(input: BuildEvalTrackedMetricsInput): Ev
 			receiptToolErrors === undefined
 				? { value: ledgerToolErrors, source: "ledger" }
 				: { value: receiptToolErrors, source: "receipt" },
-		ttftMsFirstCall: firstCallTtft(calls),
+		ttftMsFirstCall: firstCallTtft(calls, input.ledgerEntries),
 		wallClockMs: wallClockMetric(input.receipt, input.fallbackWallClockMs),
 		contextTokensAtEnd: contextTokensAtEnd(calls, compactionEntries),
 		compactions: { value: compactionEntries.length, source: "ledger" },
@@ -210,6 +211,7 @@ function assistantCalls(entries: ReadonlyArray<SessionEntry>): AssistantCall[] {
 		if (promptCache === null && timing === null && usage === null) return [];
 		return [
 			{
+				turnId: entry.turnId,
 				timestamp: entry.payload.timestampEstimated === true ? null : entry.timestamp,
 				payload: entry.payload,
 				promptCache,
@@ -279,7 +281,24 @@ function reasoningMetric(
 	return measured ? { value: total, source: "ledger" } : { value: null, source: "estimated" };
 }
 
-function firstCallTtft(calls: ReadonlyArray<AssistantCall>): EvalSourcedNullableNumber {
+function firstCallTtft(
+	calls: ReadonlyArray<AssistantCall>,
+	entries: ReadonlyArray<SessionEntry>,
+): EvalSourcedNullableNumber {
+	// Parent links are causal evidence; wall-clock corrections must not promote
+	// a later call in the same session. Compare timestamps only across roots.
+	const parents = new Map(entries.map((entry) => [entry.turnId, entry.parentTurnId]));
+	const callIds = new Set(calls.map((call) => call.turnId));
+	const hasEarlierCall = (call: AssistantCall): boolean => {
+		const visited = new Set<string>([call.turnId]);
+		let parent = parents.get(call.turnId);
+		while (parent != null && !visited.has(parent)) {
+			if (callIds.has(parent)) return true;
+			visited.add(parent);
+			parent = parents.get(parent);
+		}
+		return false;
+	};
 	// Session directories are read by name, not by call time. Select without
 	// reordering the evidence or borrowing a later call's available timing.
 	let first: AssistantCall | undefined;
@@ -288,6 +307,7 @@ function firstCallTtft(calls: ReadonlyArray<AssistantCall>): EvalSourcedNullable
 		if (call.timestamp === null) return { value: null, source: "estimated" };
 		const at = Date.parse(call.timestamp);
 		if (!Number.isFinite(at)) return { value: null, source: "estimated" };
+		if (hasEarlierCall(call)) continue;
 		if (at < firstAt) {
 			first = call;
 			firstAt = at;

package/src/domains/evidence/build.ts

@@ -2,6 +2,7 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { rawDurationMs } from "../../core/timers.js";
 import { isProjectVerifierCheckId, isVerificationScriptName } from "../../core/verification-scripts.js";
+import { effectiveToolCall } from "../../tools/surface.js";
 import type {
 	RunEnvelope,
 	RunKind,
@@ -573,7 +574,12 @@ function validationToolCallCandidate(
 	runSources: ReadonlyArray<EvidenceRunSource>,
 ): ValidationToolCallCandidate | null {
 	const call = extractSessionToolCall(entry, linked);
-	if (validationToolCallSummary(call.tool, call.args) === null) return null;
+	// The capability a gateway call reached is what ran; a validation command
+	// is recognized under that name, never under `gateway`.
+	const effective = effectiveToolCall(call.tool, call.args);
+	if (validationToolCallSummary(effective.toolName, effective.viaGateway ? effective.args : call.args) === null) {
+		return null;
+	}
 	return {
 		toolCallId: call.id,
 		runId: validationRunIdFor(linked, runSources),
@@ -1025,7 +1031,15 @@ function extractSessionToolCall(entry: MessageEntry, linked: LinkedSessionEntry)
 		block?.arguments ??
 		block?.args ??
 		undefined;
-	return { id, tool, args, timestamp: entry.timestamp, link: linked.link, sessionId: linked.sessionId };
+	const effective = effectiveToolCall(tool, args);
+	return {
+		id,
+		tool: effective.toolName,
+		args: effective.args ?? args,
+		timestamp: entry.timestamp,
+		link: linked.link,
+		sessionId: linked.sessionId,
+	};
 }
 
 function extractSessionToolResult(entry: MessageEntry, linked: LinkedSessionEntry): SessionToolResult {
@@ -1047,10 +1061,18 @@ function extractSessionToolResult(entry: MessageEntry, linked: LinkedSessionEntr
 		payload?.out ??
 		payload?.content ??
 		(contentText.length > 0 ? contentText : entry.payload);
+	const effective = effectiveToolCall(tool, undefined, payloadObject(result)?.details ?? payload?.details);
+	const resultObject = payloadObject(result);
+	const details = payloadObject(resultObject?.details);
+	let projectedResult = result;
+	if (effective.viaGateway && resultObject && details) {
+		const { capability: _capability, ...innerDetails } = details;
+		projectedResult = { ...resultObject, details: innerDetails };
+	}
 	return {
 		id,
-		tool,
-		result,
+		tool: effective.toolName,
+		result: projectedResult,
 		isError: payload?.isError === true || payload?.error === true,
 		timestamp: entry.timestamp,
 		link: linked.link,
@@ -1351,8 +1373,13 @@ function renderTranscript(
 	}
 	if (sessionLinks.entries.length > 0) {
 		lines.push("", "## Linked Session Transcript");
+		const calls = new Map<string, string>();
 		for (const linked of sessionLinks.entries) {
-			lines.push(...renderSessionTranscriptEntry(linked));
+			if (linked.entry.kind === "message" && linked.entry.role === "tool_call") {
+				const call = extractSessionToolCall(linked.entry, linked);
+				calls.set(call.id, call.tool);
+			}
+			lines.push(...renderSessionTranscriptEntry(linked, calls));
 		}
 	}
 	lines.push("");
@@ -1379,7 +1406,7 @@ function transcriptRunLink(link: SessionRunLink): string {
 	return "";
 }
 
-function renderSessionTranscriptEntry(linked: LinkedSessionEntry): string[] {
+function renderSessionTranscriptEntry(linked: LinkedSessionEntry, calls: ReadonlyMap<string, string>): string[] {
 	const entry = linked.entry;
 	const prefix = `- ${entry.timestamp} session=${linked.sessionId}${transcriptRunLink(linked.link)}`;
 	if (entry.kind === "message") {
@@ -1391,7 +1418,8 @@ function renderSessionTranscriptEntry(linked: LinkedSessionEntry): string[] {
 			const result = extractSessionToolResult(entry, linked);
 			const id = result.id === null ? "" : ` id=${result.id}`;
 			const error = result.isError ? " error=true" : "";
-			return [`${prefix} tool_result ${result.tool}${id}${error}: ${previewUnknown(result.result)}`];
+			const tool = result.id === null ? result.tool : (calls.get(result.id) ?? result.tool);
+			return [`${prefix} tool_result ${tool}${id}${error}: ${previewUnknown(result.result)}`];
 		}
 		const text = collapseWhitespace(extractTextFromPayload(entry.payload));
 		const rendered = text.length > 0 ? truncateText(text, TRANSCRIPT_TEXT_MAX_CHARS) : previewUnknown(entry.payload);

package/src/domains/extensions/operator-runtime.ts

@@ -297,7 +297,9 @@ export class OperatorExtensionRuntime {
 				message: `operator generation ${next}: ${ready} ready, ${degraded} degraded; tool schemas remain frozen${hooks ? `; hooks/snapshot generation ${hooks.generation}` : ""}`,
 			};
 		} catch (error) {
-			for (const process of staged.values()) this.retire(process, "reload-rejected");
+			for (const process of new Set([...this.processes.values(), ...staged.values()])) {
+				this.retire(process, "reload-rejected");
+			}
 			this.processes.clear();
 			result = {
 				status: this.generation === next ? "committed" : "rejected",