@mmerterden/multi-agent-pipeline 12.6.0 → 12.7.0

package/pipeline/scripts/validate-triage.mjs

@@ -25,7 +25,12 @@ import { readFileSync } from "node:fs";
 
 const ALLOWED_REVIEWERS = new Set(["fable", "opus", "sonnet", "gpt"]);
 const ALLOWED_SEVERITIES = new Set(["blocking", "important", "suggestion"]);
-const ALLOWED_CONSENSUS_VERDICTS = new Set(["unanimous-pass", "unanimous-block", "split", "unverified"]);
+const ALLOWED_CONSENSUS_VERDICTS = new Set([
+  "unanimous-pass",
+  "unanimous-block",
+  "split",
+  "unverified",
+]);
 const ALLOWED_VERIFICATION_RESULTS = new Set(["confirmed", "not-reproduced", "inconclusive"]);
 const OVER_REJECT_THRESHOLD = 0.8;
 const OVER_REJECT_MIN_FINDINGS = 5;
@@ -79,7 +84,9 @@ function validateVerification(v, label, errors) {
     return;
   }
   if (!ALLOWED_VERIFICATION_RESULTS.has(v.result)) {
-    errors.push(`${label}: bad result "${v.result}" (allowed: confirmed|not-reproduced|inconclusive)`);
+    errors.push(
+      `${label}: bad result "${v.result}" (allowed: confirmed|not-reproduced|inconclusive)`,
+    );
     return;
   }
   if (v.result === "confirmed" || v.result === "not-reproduced") {
@@ -115,10 +122,14 @@ function validateConsensus(c, errors) {
     return;
   }
   if (!Number.isInteger(c.reviewerCount) || c.reviewerCount < 1) {
-    errors.push(`consensus: reviewerCount must be an integer >= 1 (got ${JSON.stringify(c.reviewerCount)})`);
+    errors.push(
+      `consensus: reviewerCount must be an integer >= 1 (got ${JSON.stringify(c.reviewerCount)})`,
+    );
   }
   if (!ALLOWED_CONSENSUS_VERDICTS.has(c.verdict)) {
-    errors.push(`consensus: bad verdict "${c.verdict}" (allowed: unanimous-pass|unanimous-block|split|unverified)`);
+    errors.push(
+      `consensus: bad verdict "${c.verdict}" (allowed: unanimous-pass|unanimous-block|split|unverified)`,
+    );
   }
   if (c.disagreements !== undefined) {
     if (!Array.isArray(c.disagreements)) {
@@ -211,7 +222,8 @@ function validate(raw) {
         errors.push('consensus.verdict "unanimous-pass" contradicts an accepted blocking finding');
       }
       if (
-        typeof c.reviewerCount === "number" && c.reviewerCount < 2 &&
+        typeof c.reviewerCount === "number" &&
+        c.reviewerCount < 2 &&
         (c.verdict === "unanimous-pass" || c.verdict === "unanimous-block")
       ) {
         errors.push(

package/pipeline/scripts/write-state.mjs

@@ -5,7 +5,7 @@
  * Why this exists:
  *   Multiple worktrees can run the pipeline concurrently against the same
  *   task id. Two CLI instances writing agent-state.json in the usual
- *   fs.writeFileSync('path', JSON.stringify(...)) pattern is racy  - 
+ *   fs.writeFileSync('path', JSON.stringify(...)) pattern is racy  -
  *   second write wipes the first. This helper uses tmpfile + rename, which
  *   is atomic on POSIX, combined with an advisory .lock file for the tiny
  *   window between "read current state" and "write new state".
@@ -35,8 +35,7 @@ import {
   renameSync,
   existsSync,
   unlinkSync,
-  openSync,
-  closeSync,
+  linkSync,
   statSync,
 } from "fs";
 import { dirname, basename } from "path";
@@ -70,17 +69,36 @@ function parseArgs() {
  * @param {number} timeoutMs
  * @returns {Promise<void>}
  */
-async function acquireLock(path, timeoutMs = Number(process.env.WRITE_STATE_LOCK_TIMEOUT_MS) || 15_000) {
+async function acquireLock(
+  path,
+  timeoutMs = Number(process.env.WRITE_STATE_LOCK_TIMEOUT_MS) || 15_000,
+) {
   const lockPath = `${path}.lock`;
   const staleMs = Number(process.env.WRITE_STATE_LOCK_STALE_MS) || 30_000;
   const deadline = Date.now() + timeoutMs;
+  // The lock file must never be observable without its owning PID inside it.
+  // It used to be created with openSync(wx) and filled on the next line, so
+  // between those two calls it existed and was empty. A writer arriving in
+  // that window read an unparseable PID, concluded the lock was stale, and
+  // deleted a live one - after which two writers held it and one write was
+  // lost. Under CPU load that reproduced 3 times in 15 runs.
+  //
+  // Writing the PID into a private temp file and hard-linking it into place
+  // closes the window: link() fails with EEXIST if the lock is held, and the
+  // instant the lock exists it already has its contents.
+  const stagePath = `${lockPath}.${process.pid}.stage`;
   while (Date.now() < deadline) {
     try {
-      const fd = openSync(lockPath, "wx"); // O_EXCL  -  fails if exists
-      writeFileSync(fd, String(process.pid));
-      closeSync(fd);
+      writeFileSync(stagePath, String(process.pid));
+      linkSync(stagePath, lockPath); // fails EEXIST if another writer holds it
+      unlinkSync(stagePath);
       return;
     } catch (err) {
+      try {
+        unlinkSync(stagePath);
+      } catch {
+        /* already gone */
+      }
       if (err.code !== "EEXIST") throw err;
       if (isLockStale(lockPath, staleMs)) {
         // Holder crashed or the lock outlived any plausible writer  -  reclaim it.
@@ -105,7 +123,7 @@ async function acquireLock(path, timeoutMs = Number(process.env.WRITE_STATE_LOCK
 
 /**
  * A lock is stale when its owning PID is no longer alive, or when the lock
- * file is older than `staleMs` (covers PID reuse and unreadable PIDs).
+ * file is older than `staleMs` (which also covers PID reuse).
  * @param {string} lockPath
  * @param {number} staleMs
  * @returns {boolean}
@@ -121,7 +139,12 @@ function isLockStale(lockPath, staleMs) {
     return false;
   }
   if (Date.now() - mtimeMs > staleMs) return true;
-  if (!Number.isInteger(pid) || pid <= 0) return true;
+  // An unreadable PID is NOT proof of staleness. Treating it as such is what
+  // let a writer delete a live lock and lose another writer's update. With the
+  // link-based acquire above a lock is never observable without its PID, so
+  // this can only be genuine corruption - which the staleMs check reclaims
+  // anyway, without racing a writer that is merely mid-flight.
+  if (!Number.isInteger(pid) || pid <= 0) return false;
   try {
     process.kill(pid, 0); // probe liveness without signalling
     return false; // holder alive