@moretea-labs/forge 1.8.0 → 1.8.1

package/src/runtime/control-plane/global-scheduler/reconciliation.ts

@@ -17,6 +17,7 @@ import { operationReceiptMatchesJobOwnership, readOperationReceipt } from '../..
 import { releaseExecutionLeases, renewExecutionLeases } from '../../resources/leases/store';
 import { isProcessAlive, terminateProcessTree, terminateProcessTreeSync, type ProcessTreeTerminationResult } from '../../shared/process-tree';
 import { settleScheduledExecution } from '../../../../packages/kernel/scheduler/api/index';
+import { isRuntimeWriteFenceError } from '../../root/write-fence';
 
 const WORKER_HEARTBEAT_STALE_MS = 45_000;
 
@@ -64,7 +65,7 @@ function recordIsolatedReconciliationFailure(job: ExecutionJob, error: unknown):
   // Losing the canonical write fence is a Runtime-wide invariant violation,
   // not corrupt state owned by one historical Job. Preserve the Scheduler's
   // fatal path so Runtime Root can stop the complete Runtime.
-  if (message.startsWith('WRITER_FENCED:')) throw error;
+  if (isRuntimeWriteFenceError(error)) throw error;
   process.stderr.write(`${JSON.stringify({
     event: 'forge_scheduler_execution_job_reconciliation_isolated',
     repoId: job.repoId,

package/src/runtime/control-plane/global-scheduler/scheduler.ts

@@ -23,16 +23,15 @@ import { reconcileTerminalWorkCleanups } from '../execution/work-terminal-cleanu
 import { gcTerminalProcesses } from '../../execution/process-runtime/gc';
 import { reconcilePendingWorkValidations } from '../execution/work-validation-reconciler';
 import { reconcilePendingEditValidations } from '../execution/edit-validation-coordinator';
-import { schedulerDispatchAllowed } from '../facade/work-admission-policy';
 import {
-  runSchedulerControllerRoundRecovery,
   runSchedulerPeriodicCleanup,
   runSchedulerValidationReconciliation,
 } from './maintenance';
 import { planSchedulerSourceSampling } from './source-scan';
+import { runSchedulerAutonomousContinuationReconciliation } from './autonomous-continuation';
 import {
   runSchedulerDurableAdmission,
-  schedulerDurableAdmissionRequiresPolicy,
+  SCHEDULE_TICK_INTERVAL_MS,
 } from './durable-admission';
 import { sampleRepositoryGitStatusForRepositories } from '../../projections/git-status-sampler';
 import { selectExecutionJobDispatchRepositories } from '../dispatch-priority';
@@ -98,7 +97,43 @@ export type { SchedulerWorkerCommand, SchedulerWorkerLaunchDescriptor } from './
 export { selectSchedulerSourceScanRepositories } from './source-scan';
 
 const DARWIN_MEMORY_SAMPLE_TTL_MS = 5_000;
+export const SCHEDULER_RECONCILIATION_INTERVAL_MS = 5_000;
 const RUNTIME_CLEANUP_INTERVAL_MS = Math.max(30_000, Number(process.env.FORGE_RUNTIME_CLEANUP_INTERVAL_MS ?? 60_000));
+
+function remainingRecurringDeadlineMs(nowMs: number, lastRanAt: number, intervalMs: number): number {
+  if (lastRanAt <= 0) return intervalMs;
+  const elapsed = Math.max(0, nowMs - lastRanAt);
+  return elapsed < intervalMs ? intervalMs - elapsed : intervalMs;
+}
+
+export function schedulerIdleWaitDelayMs(input: {
+  nowMs: number;
+  lastScheduleTickAt: number;
+}): number {
+  // Idle execution is event-driven. ExecutionJob/lease/policy mutations and
+  // check Process terminal persistence wake the scheduler immediately through
+  // the existing notification revision. The 30-second schedule cadence is the
+  // bounded idle lost-event safety deadline.
+  return remainingRecurringDeadlineMs(
+    input.nowMs,
+    input.lastScheduleTickAt,
+    SCHEDULE_TICK_INTERVAL_MS,
+  );
+}
+
+export function schedulerActiveWaitDelayMs(input: {
+  nowMs: number;
+  lastReconcileAt: number;
+}): number {
+  // Active execution uses the same canonical wake notifications as idle
+  // execution. A full scheduler tick is only the lost-event safety net, bounded
+  // by the existing reconciliation cadence instead of the legacy 250ms poll.
+  return remainingRecurringDeadlineMs(
+    input.nowMs,
+    input.lastReconcileAt,
+    SCHEDULER_RECONCILIATION_INTERVAL_MS,
+  );
+}
 const DARWIN_RECLAIMABLE_PAGE_LABELS = new Set([
   'Pages free',
   'Pages inactive',
@@ -510,7 +545,7 @@ export class GlobalScheduler {
     this.lastTickAt = this.lastHeartbeatAt;
     this.persistState();
     const repositories = this.repositoryList(this.controllerHome).filter((repo) => repo.enabled && !repo.removedAt);
-    let periodicCleanupRan = false;
+    let reconciliationRan = false;
     if (now - this.lastCleanupAt >= RUNTIME_CLEANUP_INTERVAL_MS) {
       // Advance the interval before cleanup so a failing pass cannot create a
       // tight retry loop on every scheduler tick. Canonical Runtime launches the
@@ -531,9 +566,8 @@ export class GlobalScheduler {
           processGc: this.processGc,
         });
       }
-      periodicCleanupRan = true;
     }
-    if (now - this.lastReconcile >= 5_000) {
+    if (now - this.lastReconcile >= SCHEDULER_RECONCILIATION_INTERVAL_MS) {
       await reconcileExecutionJobsAsync(this.controllerHome);
       for (const repository of repositories) {
         try {
@@ -551,6 +585,7 @@ export class GlobalScheduler {
       });
       this.lastReconcile = now;
       this.lastReconcileAt = new Date(now).toISOString();
+      reconciliationRan = true;
     }
     const activeJobSnapshot = listActiveExecutionJobs(this.controllerHome);
     const activeSourceRepoIds = new Set(activeJobSnapshot.map((job) => job.repoId));
@@ -587,34 +622,17 @@ export class GlobalScheduler {
         .map((repository) => [repository.repoId, repository] as const),
     ).values());
     this.sourceScansAvoided += sourceSampling.avoidedRepositoryCount;
-    // Phase 0 reuses one durable Work admission policy. Exclusive-Work mode stops
-    // ordinary schedule/workflow advancement and Worker dispatch while preserving
-    // cleanup and projections. Convergence mode remains dispatchable because new
-    // Work creation is independently fenced at the Work contract authority, so
-    // existing Work continuations can keep draining the backlog.
-    const admissionPolicyRequired = periodicCleanupRan || schedulerDurableAdmissionRequiresPolicy({
-      activeJobs: activeJobSnapshot,
-      nowMs: now,
-      lastScheduleTickAt: this.lastScheduleTick,
-    });
-    if (admissionPolicyRequired && !schedulerDispatchAllowed(this.controllerHome)) {
-      refreshSchedulerRepositoryProjections({
-        controllerHome: this.controllerHome,
-        repositories,
-        sourceScanRepositories: projectionMaintenanceRepositories,
-        projectionRefreshRepoIds: [],
-        controllerPid: this.controllerPid,
-      });
-      this.lastHeartbeatAt = new Date().toISOString();
-      this.persistState(true);
-      return { activeJobs: activeJobSnapshot.length };
-    }
-    if (periodicCleanupRan) {
-      await runSchedulerControllerRoundRecovery({
+    // Migration-era global Work admission gates are retired. Scheduler dispatch
+    // is constrained by durable admission, placement and concrete resource authority.
+    if (reconciliationRan) {
+      const liveness = await runSchedulerAutonomousContinuationReconciliation({
         controllerHome: this.controllerHome,
         nowMs: now,
         repositories,
       });
+      if (liveness.failed > 0) {
+        console.error('[forge liveness] controller progression reconciliation reported ' + liveness.failed + ' failure(s)');
+      }
     }
     const durableAdmission = await runSchedulerDurableAdmission({
       controllerHome: this.controllerHome,
@@ -731,30 +749,38 @@ export class GlobalScheduler {
       this.persistState(true);
     }, this.config.heartbeatIntervalMs);
     heartbeatTimer.unref?.();
-    let idleStreak = 0;
     let activeJobs = 0;
     try {
       while (!signal?.aborted) {
+        let tickFailed = false;
         try {
           activeJobs = (await this.tick()).activeJobs;
-          idleStreak = activeJobs === 0 ? idleStreak + 1 : 0;
         } catch (error) {
           if (this.fatalOnTickError) throw error;
-          idleStreak = 0;
+          tickFailed = true;
           this.lastHeartbeatAt = new Date().toISOString();
           this.lastTickAt = this.lastHeartbeatAt;
           this.persistState(true);
           console.error('[forge scheduler] tick failed:', error);
         }
-        const delayMs = idleStreak > 0
-          ? Math.min(
-            this.config.idleBackoffMaxMs,
-            this.config.pollIntervalMs * (2 ** Math.min(idleStreak, 6)),
-          )
-          : this.config.pollIntervalMs;
+        const now = Date.now();
+        const delayMs = tickFailed
+          ? this.config.pollIntervalMs
+          : activeJobs > 0
+            ? schedulerActiveWaitDelayMs({
+              nowMs: now,
+              lastReconcileAt: this.lastReconcile,
+            })
+            : schedulerIdleWaitDelayMs({
+              nowMs: now,
+              lastScheduleTickAt: this.lastScheduleTick,
+            });
         const wakeRevision = readSchedulerWakeSignal(this.controllerHome).revision;
         const waitResult = await waitForSchedulerWakeSignal(this.controllerHome, wakeRevision, delayMs, signal, {
-          fallbackPollMs: activeJobs > 0 ? 250 : Math.min(1_000, Math.max(500, delayMs)),
+          // fs.watch is authoritative for ordinary wakeups. Polling is only a
+          // lost-event safety net, so active execution must not regress to a
+          // 250ms JSON-read loop after removing the full-tick poll.
+          fallbackPollMs: Math.min(5_000, Math.max(1_000, delayMs)),
         });
         if (waitResult === 'aborted') break;
       }

package/src/runtime/control-plane/global-scheduler/wake-signal.ts

@@ -35,6 +35,35 @@ export function touchSchedulerWakeSignal(controllerHome: string, reason: string)
   return next;
 }
 
+export function isSchedulerWakeSignalEvent(filename: string | Buffer | null | undefined): boolean {
+  // The wake file shares a directory with scheduler health/state persistence.
+  // Atomic writes to those sibling files can emit multiple directory events.
+  // Node/macOS reports the final filename, while Bun/macOS may report only the
+  // wake file's atomic temporary name; both belong to the same wake authority.
+  // Platforms that omit the filename remain conservative and re-check revision.
+  if (filename == null) return true;
+  const observed = filename.toString();
+  return observed === 'wake-signal.json'
+    || (observed.startsWith('wake-signal.json.') && observed.endsWith('.tmp'));
+}
+
+export function shouldWakeForSchedulerEvent(
+  filename: string | Buffer | null | undefined,
+  expectedRevision: number,
+  observedRevision: number,
+): boolean {
+  if (!isSchedulerWakeSignalEvent(filename)) return false;
+  // A null filename is an ambiguous directory event on some Bun/macOS
+  // combinations. Only treat it as a wake when the durable revision changed;
+  // otherwise the Scheduler's own state.json write would wake it immediately
+  // and turn the idle loop into a CPU-consuming self-trigger cycle.
+  if (filename == null) return observedRevision !== expectedRevision;
+  // A named wake-file event is authoritative even when the revision is equal:
+  // concurrent writers may coalesce onto one revision, while the lifecycle
+  // truth remains in the canonical stores.
+  return true;
+}
+
 export async function waitForSchedulerWakeSignal(
   controllerHome: string,
   expectedRevision: number,
@@ -71,7 +100,18 @@ export async function waitForSchedulerWakeSignal(
 
     signal?.addEventListener('abort', onAbort, { once: true });
     try {
-      watcher = watch(dirname(path), maybeWake);
+      watcher = watch(dirname(path), (_eventType, filename) => {
+        if (!shouldWakeForSchedulerEvent(
+          filename,
+          expectedRevision,
+          readSchedulerWakeSignal(controllerHome).revision,
+        )) return;
+        // A named canonical wake-file event is itself the notification. Do not
+        // make event delivery depend on observing a strictly newer JSON
+        // revision: concurrent writers may legitimately coalesce onto one
+        // revision, while lifecycle truth is read from canonical stores.
+        finish('wakeup');
+      });
       watcher.on?.('error', maybeWake);
     } catch {
       watcher = undefined;
@@ -79,7 +119,7 @@ export async function waitForSchedulerWakeSignal(
     // fs.watch is the primary wake path. Polling is only a lost-event safety
     // net, so keep it coarse enough that an idle scheduler does not perform a
     // read/stat storm while still bounding cross-platform wake loss.
-    const fallbackPollMs = Math.min(2_000, Math.max(250, Math.trunc(options.fallbackPollMs ?? 1_000)));
+    const fallbackPollMs = Math.min(10_000, Math.max(250, Math.trunc(options.fallbackPollMs ?? 1_000)));
     poller = setInterval(maybeWake, fallbackPollMs);
     poller.unref?.();
     timer = setTimeout(() => finish('timeout'), Math.max(0, timeoutMs));

package/src/runtime/control-plane/governance/access-policy.ts

@@ -6,6 +6,7 @@ import {
   writeFileSync,
 } from 'fs';
 import { dirname, join, resolve } from 'path';
+import { isWorkspaceScopeKey, workspaceScopeRoot } from '../../../cli/repositories/controller-home';
 
 export const ACCESS_MODES = ['request', 'full_access'] as const;
 export type AccessMode = (typeof ACCESS_MODES)[number];
@@ -75,7 +76,23 @@ export function normalizeAccessMode(value: unknown, fallback: AccessMode = 'full
 }
 
 export function repositoryAccessPolicyPath(controllerHome: string, repoId: string): string {
-  return join(resolve(controllerHome), 'repositories', repoId, 'controller', 'access-policy.json');
+  // A workspace scope keeps its own access policy in the workspace partition
+  // instead of a synthetic repository partition. Repository/controller scopes
+  // keep their established location.
+  return isWorkspaceScopeKey(repoId)
+    ? join(workspaceScopeRoot(controllerHome, repoId), 'controller', 'access-policy.json')
+    : join(resolve(controllerHome), 'repositories', repoId, 'controller', 'access-policy.json');
+}
+
+/**
+ * Bounded migration read: a workspace policy written to the legacy repository
+ * location still applies until it is rewritten in the workspace partition.
+ */
+function readableAccessPolicyPath(controllerHome: string, repoId: string): string {
+  const current = repositoryAccessPolicyPath(controllerHome, repoId);
+  if (existsSync(current) || !isWorkspaceScopeKey(repoId)) return current;
+  const legacy = join(resolve(controllerHome), 'repositories', repoId, 'controller', 'access-policy.json');
+  return existsSync(legacy) ? legacy : current;
 }
 
 function defaultPolicy(repoId: string): RepositoryAccessPolicy {
@@ -90,7 +107,7 @@ function defaultPolicy(repoId: string): RepositoryAccessPolicy {
 }
 
 export function readRepositoryAccessPolicy(controllerHome: string, repoId: string): RepositoryAccessPolicy {
-  const path = repositoryAccessPolicyPath(controllerHome, repoId);
+  const path = readableAccessPolicyPath(controllerHome, repoId);
   if (!existsSync(path)) return defaultPolicy(repoId);
   try {
     const parsed = JSON.parse(readFileSync(path, 'utf-8')) as Partial<RepositoryAccessPolicy>;

package/src/runtime/control-plane/governance/authorization.ts

@@ -1,7 +1,7 @@
 import { randomUUID } from 'crypto';
 import { existsSync, mkdirSync } from 'fs';
 import { join, relative, resolve } from 'path';
-import { repositoryControllerRoot } from '../../../cli/repositories/controller-home';
+import { isWorkspaceScopeKey, repositoryControllerRoot, scopedOperationRoot } from '../../../cli/repositories/controller-home';
 import { readJsonFile, sanitizeFileComponent, writeJsonAtomic } from '../../shared/json-files';
 import type { AccessMode } from './access-policy';
 
@@ -81,7 +81,7 @@ export interface AuthorizationContext {
 }
 
 function requestRoot(controllerHome: string, repoId: string): string {
-  const root = join(repositoryControllerRoot(controllerHome, repoId), 'controller', 'approval-requests');
+  const root = join(scopedOperationRoot(controllerHome, repoId), 'controller', 'approval-requests');
   mkdirSync(root, { recursive: true, mode: 0o700 });
   return root;
 }
@@ -90,6 +90,23 @@ function requestPath(controllerHome: string, repoId: string, requestId: string):
   return join(requestRoot(controllerHome, repoId), `${sanitizeFileComponent(requestId)}.json`);
 }
 
+/**
+ * Bounded migration read: an approval issued for a workspace scope before the
+ * workspace partition existed is still resolvable instead of failing closed as
+ * a missing request.
+ */
+function readableRequestPath(controllerHome: string, repoId: string, requestId: string): string {
+  const current = requestPath(controllerHome, repoId, requestId);
+  if (existsSync(current) || !isWorkspaceScopeKey(repoId)) return current;
+  const legacy = join(
+    repositoryControllerRoot(controllerHome, repoId),
+    'controller',
+    'approval-requests',
+    `${sanitizeFileComponent(requestId)}.json`,
+  );
+  return existsSync(legacy) ? legacy : current;
+}
+
 function scopeMatches(context: AuthorizationContext): boolean {
   if (context.currentRepositoryId && context.repositoryId !== context.currentRepositoryId) return false;
   if (context.workId && context.boundWorkId && context.workId !== context.boundWorkId) return false;
@@ -163,7 +180,7 @@ export function createGoalDelegation(input: Omit<GoalDelegation, 'schemaVersion'
 }
 
 export function readAuthorizationRequest(controllerHome: string, repositoryId: string, approvalRequestId: string): AuthorizationRequestRecord {
-  const path = requestPath(controllerHome, repositoryId, approvalRequestId);
+  const path = readableRequestPath(controllerHome, repositoryId, approvalRequestId);
   if (!existsSync(path)) throw new Error(`APPROVAL_REQUEST_NOT_FOUND: ${approvalRequestId}`);
   const request = readJsonFile<AuthorizationRequestRecord>(path);
   if (request.repositoryId !== repositoryId || request.approvalRequestId !== approvalRequestId) throw new Error('APPROVAL_REQUEST_IDENTITY_MISMATCH');