@ixo/oracle-runtime-workers 0.17.1 → 0.19.0

package/src/core/capability-router.ts

@@ -222,6 +222,7 @@ export function createCapabilityRouter(
                 `capability=${verdict.capability ?? '-'} ` +
                 `capabilityConfidence=${verdict.capabilityConfidence?.toFixed(2) ?? '-'} ` +
                 `wouldPreload=${list(verdict.preload)} reason=${verdict.reason} ` +
+                `calibrationProfile=${verdict.calibrationProfileRef ?? '-'} ` +
                 `latencyMs=${now() - started} provider=${evaluation.provider} model=${evaluation.model}`,
             );
             turn.onShadowVerdict?.(verdict.preload);

package/src/core/index.ts

@@ -488,11 +488,27 @@ export function createRuntimeCore(opts: RuntimeCoreOptions): RuntimeCore {
     registries.manifests.register(plugin, manifestOverrides[plugin.name]);
   }
   const manifestErrors: string[] = [];
+  const lintVerbose = opts.env['BOOT_LINT_VERBOSE'] === 'true';
+  const lintCounts = new Map<string, number>();
   for (const { pluginName, manifest } of registries.manifests.collect()) {
     const result = validateManifest(manifest, pluginName);
-    for (const warning of result.warnings) logger.warn(`[boot] ${warning}`);
+    if (lintVerbose)
+      for (const warning of result.warnings) logger.warn(`[boot] ${warning}`);
+    else if (result.warnings.length > 0)
+      lintCounts.set(pluginName, result.warnings.length);
     if (!result.valid) manifestErrors.push(...result.errors);
   }
+  // The soft-rule warnings are the same on every boot of an isolate (one
+  // core per isolate): one summary line, the full list with
+  // BOOT_LINT_VERBOSE=true.
+  if (lintCounts.size > 0)
+    logger.warn(
+      `[boot] manifest lint: ${[...lintCounts.values()].reduce((a, b) => a + b, 0)} soft warning(s) (${[
+        ...lintCounts,
+      ]
+        .map(([plugin, count]) => `${plugin}=${count}`)
+        .join(', ')}); set BOOT_LINT_VERBOSE=true to list them`,
+    );
   const guides = registries.manifests.operatingGuides();
   if (guides.length > 0) {
     logger.log(
@@ -707,9 +723,26 @@ export function createRuntimeCore(opts: RuntimeCoreOptions): RuntimeCore {
           registries.tools,
           registries.subAgents,
         );
-        for (const issue of cross.errors) {
+        if (lintVerbose) {
+          for (const issue of cross.errors) {
+            logger.warn(
+              `[boot] ${issue} (boot-time tools only — ignore if the tool comes from getRequestTools)`,
+            );
+          }
+        } else if (cross.errors.length > 0) {
+          const perPlugin = new Map<string, number>();
+          for (const issue of cross.errors) {
+            const plugin = /^\[([^\]]+)\]/.exec(issue)?.[1] ?? 'unknown';
+            perPlugin.set(plugin, (perPlugin.get(plugin) ?? 0) + 1);
+          }
           logger.warn(
-            `[boot] ${issue} (boot-time tools only — ignore if the tool comes from getRequestTools)`,
+            `[boot] manifest examples: ${cross.errors.length} reference(s) to tools not registered at boot (${[
+              ...perPlugin,
+            ]
+              .map(([plugin, count]) => `${plugin}=${count}`)
+              .join(
+                ', ',
+              )}; ignore those from getRequestTools); set BOOT_LINT_VERBOSE=true to list them`,
           );
         }
       } catch (err) {

package/src/delivery/profile.ts

@@ -135,7 +135,10 @@ export function resolveDeliveryProfile(
   const surface =
     turn.client === 'matrix'
       ? 'matrix'
-      : turn.channel?.provider && DEFAULT_LIMITS[turn.channel.provider]
+      : // An unknown provider id uses the generic profile. `hasOwn`: a
+        // provider id such as `constructor` must not hit the prototype.
+        turn.channel?.provider &&
+          Object.hasOwn(DEFAULT_LIMITS, turn.channel.provider)
         ? turn.channel.provider
         : 'generic';
   const merged: ChatLimits = {

package/src/delivery/schema.ts

@@ -46,7 +46,7 @@ function linkLabel(title: string): string {
 }
 
 /**
- * The plan as one Markdown message: what the Companion room mirror of a
+ * The plan as one Markdown message: what the user's oracle room mirror of a
  * channel turn and gateways that predate plans receive. Never stored as a
  * run's text, which stays the model's own.
  */

package/src/do/contracts.ts

@@ -8,7 +8,10 @@ import type {
   ChannelTurnOutcome,
 } from '../channels/contract';
 import type { TaskExecutionProfile } from '../core/execution-profile';
-import type { CapabilityRouterMode } from '@ixo/common/ai/decisions';
+import type {
+  CapabilityRouterMode,
+  DecisionProviderName,
+} from '@ixo/common/ai/decisions';
 import type { TranscriptPageOptions } from './transcript';
 import type { TurnUsage } from '../core/turn-budget';
 import type { BotStatus, EncryptedFileInfo } from '@ixo/matrix-bot-workers-sdk';
@@ -62,6 +65,7 @@ export interface OracleWorkerEnv {
   UCAN_AUTH_MAX_TTL_SECONDS?: string;
   /** `true` restores the legacy bare-delegation authentication (off by default). */
   UCAN_ALLOW_BARE_DELEGATION_AUTH?: string;
+  /** The channel service DID, or a comma-separated list of them. */
   CHANNEL_SERVICE_DID?: string;
   AUTH_HUB?: Fetcher;
   AUTH_HUB_URL?: string;
@@ -273,10 +277,16 @@ export interface OracleWorkerEnv {
   NEBIUS_API_KEY?: string;
 
   // --- decisions ----------------------------------------------------------
-  /** Bounded semantic Decision provider; unset leaves Decisions unconfigured. `openrouter-jev` reuses `OPEN_ROUTER_API_KEY`. */
-  DECISION_PROVIDER?: 'cloudflare-jev' | 'openrouter-jev';
-  /** Jev model id override (`typesafe/jev` on Workers AI, `typesafe/jev-1.13` on OpenRouter). */
+  /** Bounded semantic Decision provider; unset leaves Decisions unconfigured. `openrouter-jev` reuses `OPEN_ROUTER_API_KEY`; the Databricks lanes need `DATABRICKS_WORKSPACE_URL` + `DATABRICKS_TOKEN`. */
+  DECISION_PROVIDER?: DecisionProviderName;
+  /** Model id override (`typesafe/jev` on Workers AI, `typesafe/jev-1.13` on OpenRouter, the Unity Catalog model service `system.ai.openjev-qwen35-4b` for `databricks-systemone`); not used by `databricks-ai-decide`. */
   DECISION_MODEL?: string;
+  /** Databricks workspace origin (`https://<host>`, no path or query) for both Databricks lanes. */
+  DATABRICKS_WORKSPACE_URL?: string;
+  /** Secret. Databricks workspace token for both Databricks lanes (sent as HTTP Basic `token:<token>`). */
+  DATABRICKS_TOKEN?: string;
+  /** `ai_decide` function API version for `databricks-ai-decide` (default and only accepted value `1.0`). */
+  DATABRICKS_AI_DECIDE_VERSION?: string;
   /** Cloudflare account for `cloudflare-jev` over the REST API; not needed when the `AI` binding is declared. */
   CLOUDFLARE_ACCOUNT_ID?: string;
   /** Workers AI token for `cloudflare-jev` over the REST API; not needed when the `AI` binding is declared. */
@@ -354,7 +364,8 @@ export interface TurnIdentity {
 /** Request the shell / gateway sends to `UserOracleDO` to run one turn. */
 export interface TurnRequest {
   channel?: {
-    provider: 'whatsapp';
+    /** A provider id (`/^[a-z][a-z0-9_-]{0,31}$/`), e.g. `whatsapp`. */
+    provider: string;
     bindingId: string;
     remoteMessageRef: string;
   };
@@ -660,6 +671,16 @@ export interface UserOracleObject extends Rpc.DurableObjectBranded {
     input: ChannelTurnInput,
     requestHash: string,
   ): Promise<ChannelTurnOutcome>;
+  /**
+   * A poll of a channel request whose run exists, answered by a warm
+   * object; `null` = admit it through `channelTurn` (after the binding
+   * check).
+   */
+  channelPoll(
+    identity: TurnIdentity,
+    input: ChannelTurnInput,
+    requestHash: string,
+  ): Promise<ChannelTurnOutcome | null>;
   /** Run a turn and return the final text (used by the Matrix gateway). */
   runTurn(req: TurnRequest): Promise<TurnResult>;
   /**

package/src/do/room-mirror.ts

@@ -43,7 +43,7 @@ export interface MirrorSend {
   threadId: string;
   txnId: string;
   origin?: {
-    provider: 'whatsapp';
+    provider: string;
     bindingId: string;
     remoteMessageRef: string;
   };
@@ -97,8 +97,10 @@ export class RoomMirror {
   /**
    * Queue one mirror behind the session's previous ones. `prepare` runs when
    * the session's earlier mirrors have settled and resolves what to send
-   * (`null` = nothing to mirror, e.g. no room). Never rejects: a mirror that
-   * cannot be posted is logged and the chain moves on.
+   * (`null` = nothing to mirror, e.g. no room). A mirror that cannot be
+   * posted is logged and the chain moves on; a `required` one (a channel
+   * request's, whose receipt records the delivery) rejects its caller
+   * instead, and the chain still moves on.
    */
   enqueue(
     sessionId: string,
@@ -107,7 +109,10 @@ export class RoomMirror {
     required = false,
   ): Promise<void> {
     const previous = this.chains.get(sessionId) ?? Promise.resolve();
+    // Starts once the previous mirror settled either way: a required mirror
+    // that failed (and rejected its own caller) must not skip this one.
     const tracked: Promise<void> = previous
+      .catch(() => undefined)
       .then(() => prepare())
       .then((send) => (send ? this.send(send, label) : undefined))
       .catch((err: unknown) => {

package/src/do/run-store-test-do.ts

@@ -412,8 +412,8 @@ async function legacyPrune(db: DoSqliteDatabase, now: number): Promise<void> {
     await db.transaction(async () => {
       if (row.client === 'channel')
         await db.run(
-          'INSERT OR IGNORE INTO channel_run_tombstones (run_id, status) VALUES (?, ?)',
-          [row.run_id, row.status],
+          'INSERT OR IGNORE INTO channel_run_tombstones (run_id, status, pruned_at) VALUES (?, ?, ?)',
+          [row.run_id, row.status, now],
         );
       for (const table of [
         'turn_tool_marks',

package/src/do/run-store.ts

@@ -486,8 +486,26 @@ export class RunStore {
         state TEXT NOT NULL DEFAULT 'pending'
       ) WITHOUT ROWID`);
     await this.db.run(`CREATE TABLE IF NOT EXISTS channel_run_tombstones (
-      run_id TEXT PRIMARY KEY, status TEXT NOT NULL
+      run_id TEXT PRIMARY KEY, status TEXT NOT NULL, pruned_at INTEGER
     ) WITHOUT ROWID`);
+    // When the run was pruned (epoch ms): tombstones are removed a while
+    // later (`pruneChannelTombstones`). Rows from before the column count
+    // from its migration.
+    const tombstoneColumns = await this.db.exec<{ name: string }>(
+      'PRAGMA table_info(channel_run_tombstones)',
+    );
+    if (!tombstoneColumns.some((c) => c.name === 'pruned_at')) {
+      await this.db.run(
+        'ALTER TABLE channel_run_tombstones ADD COLUMN pruned_at INTEGER',
+      );
+      await this.db.run(
+        'UPDATE channel_run_tombstones SET pruned_at = ? WHERE pruned_at IS NULL',
+        [this.now()],
+      );
+    }
+    await this.db.run(
+      'CREATE INDEX IF NOT EXISTS idx_channel_run_tombstones_pruned ON channel_run_tombstones(pruned_at)',
+    );
     // The Reply Plan a finished chat-surface run delivers (chat delivery).
     await this.db.run(`CREATE TABLE IF NOT EXISTS turn_run_plans (
       run_id TEXT PRIMARY KEY, plan TEXT NOT NULL
@@ -519,9 +537,9 @@ export class RunStore {
     if (await this.db.get(`${stale} LIMIT 1`, [cutoff]))
       await this.db.transaction(async () => {
         await this.db.run(
-          `INSERT OR IGNORE INTO channel_run_tombstones (run_id, status)
-           SELECT run_id, status FROM turn_runs WHERE client = 'channel' AND ${STALE_RUN_FILTER}`,
-          [cutoff],
+          `INSERT OR IGNORE INTO channel_run_tombstones (run_id, status, pruned_at)
+           SELECT run_id, status, ? FROM turn_runs WHERE client = 'channel' AND ${STALE_RUN_FILTER}`,
+          [this.now(), cutoff],
         );
         for (const table of [
           'turn_tool_marks',
@@ -537,8 +555,9 @@ export class RunStore {
       });
     // Every receipt whose run is tombstoned, this boot or an earlier one
     // that stopped before getting here. Driven by the receipts (at most the
-    // retention window of them), one key lookup each into the tombstones,
-    // which are never pruned and never scanned. The table exists once the
+    // retention window of them), one key lookup each into the tombstones
+    // (pruned separately, by age, from the housekeeping alarm through
+    // `pruneChannelTombstones`, never scanned here). The table exists once the
     // object has served a channel turn.
     const receipts = await this.db.get<{ name: string }>(
       `SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'channel_requests'`,
@@ -569,6 +588,22 @@ export class RunStore {
     return row?.plan ?? null;
   }
 
+  /**
+   * Remove up to `limit` tombstones of channel runs pruned before `before`
+   * (epoch ms); returns how many went. A request id reused after its
+   * tombstone is gone is a new request and runs again.
+   */
+  async pruneChannelTombstones(before: number, limit: number): Promise<number> {
+    await this.setup();
+    const pruned = await this.db.run(
+      `DELETE FROM channel_run_tombstones WHERE run_id IN (
+         SELECT run_id FROM channel_run_tombstones WHERE pruned_at < ? LIMIT ?
+       )`,
+      [before, limit],
+    );
+    return pruned.changes;
+  }
+
   async wasChannelRunPruned(runId: string): Promise<boolean> {
     await this.setup();
     return !!(await this.db.get<{ run_id: string }>(