@ngocsangairvds/vsaf 3.2.16 → 4.0.0

package/tools/vds-scripts/scheduler_orchestrator/src/vds_scheduler_orchestrator/security/secret_scanner.py

@@ -1,126 +0,0 @@
-"""
-secret_scanner.py — Payload regex set for detecting accidental credential leaks.
-
-Scans event payloads before outbox insert to reject payloads containing
-known credential patterns (API keys, connection strings, tokens). Never logs
-the matched content — only records a SHA-256 digest of the violating span.
-
-Pattern classes (per design.md §Security & Capabilities):
-  1. AWS access keys       (AKIA[0-9A-Z]{16})
-  2. Anthropic API keys    (sk-ant-...)
-  3. OpenAI API keys       (sk-...)
-  4. Postgres DSNs         (postgresql://... or postgresql+asyncpg://...)
-  5. Bearer tokens         (Bearer <token>)
-  6. GitHub PATs           (gh[opsu]_<36+ alphanumeric>)              [v2.0.15 G21]
-  7. JWTs                  (eyJ<base64url>.<base64url>.<base64url>)   [v2.0.15 G21]
-  8. Slack tokens          (xox[abopsr]-<base64url>)                  [v2.0.15 G21]
-  9. GCP API keys          (AIza[0-9A-Za-z_-]{35})                    [v2.0.15 G21]
- 10. Stripe live/test keys (sk_(live|test)_<24+ alphanumeric>)        [v2.0.15 G21]
-
-Usage:
-    from vds_scheduler_orchestrator.security.secret_scanner import (
-        scan_payload, SecretBlockedError
-    )
-    try:
-        scan_payload(payload_dict)
-    except SecretBlockedError as e:
-        # e.pattern_name — which class was matched
-        # e.sha256_of_span — hex digest, never the plaintext
-"""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import re
-
-
-class SecretBlockedError(ValueError):
-    """
-    Raised when scan_payload() detects a known secret pattern.
-
-    Attributes:
-        pattern_name:     which of the 5 pattern classes matched
-                          (aws_key | anthropic_key | openai_key |
-                           postgres_dsn | bearer_token)
-        sha256_of_span:   hex SHA-256 of the matched span — never the
-                          plaintext. Safe to log/store in audit trails.
-    """
-
-    def __init__(self, pattern_name: str, sha256_of_span: str) -> None:
-        self.pattern_name = pattern_name
-        self.sha256_of_span = sha256_of_span
-        super().__init__(
-            f"Event payload contains {pattern_name} — publish blocked. sha256_of_violating_span={sha256_of_span}"
-        )
-
-
-# ── Pattern definitions ───────────────────────────────────────────────────────
-# Ordered: more-specific patterns first to avoid partial shadowing.
-# OpenAI pattern is AFTER Anthropic so sk-ant- doesn't match sk- first.
-
-_PATTERN_NAMES: list[str] = [
-    "aws_key",
-    "anthropic_key",
-    "openai_key",
-    "postgres_dsn",
-    "bearer_token",
-    # v2.0.15 G21 — additional canonical patterns
-    "github_pat",
-    "jwt",
-    "slack_token",
-    "gcp_api_key",
-    "stripe_key",
-]
-
-_PATTERNS: list[re.Pattern[str]] = [
-    # AWS access key ID: AKIA followed by 16 uppercase alphanumeric chars
-    re.compile(r"AKIA[0-9A-Z]{16}"),
-    # Anthropic API key: sk-ant- followed by ≥90 base64url chars
-    re.compile(r"sk-ant-[A-Za-z0-9_\-]{90,}"),
-    # OpenAI API key: sk- followed by ≥32 alphanumeric chars
-    re.compile(r"sk-[A-Za-z0-9]{32,}"),
-    # Postgres DSN: postgresql[+asyncpg]://user:pass@host/...
-    re.compile(r"postgresql(?:\+asyncpg)?://[^@\s]+@[^/\s]+"),
-    # Bearer token in Authorization header value or JSON field
-    re.compile(r"Bearer\s+[A-Za-z0-9_\-\.]{8,}"),
-    # v2.0.15 G21: GitHub PATs — ghp_/gho_/ghs_/ghu_ + 36+ alphanumeric.
-    # The four prefixes cover personal-access / OAuth / server / user tokens.
-    re.compile(r"\bgh[opsu]_[A-Za-z0-9]{36,}\b"),
-    # v2.0.15 G21: JWT — three base64url segments separated by dots, header
-    # always starts with `eyJ` (base64url-encoded `{"`). Anchored to the eyJ
-    # prefix so it doesn't false-positive on any base64-encoded payload.
-    re.compile(r"\beyJ[A-Za-z0-9_-]+?\.[A-Za-z0-9_-]+?\.[A-Za-z0-9_-]+\b"),
-    # v2.0.15 G21: Slack tokens — xoxa- (app), xoxb- (bot), xoxo- (oauth),
-    # xoxp- (user), xoxs- (workflow), xoxr- (refresh). 10+ chars after prefix.
-    re.compile(r"\bxox[abopsr]-[A-Za-z0-9-]{10,}\b"),
-    # v2.0.15 G21: GCP API keys — AIza followed by exactly 35 chars
-    # (Google's documented format).
-    re.compile(r"\bAIza[0-9A-Za-z_\-]{35}\b"),
-    # v2.0.15 G21: Stripe live/test keys — sk_live_/sk_test_ + 24+ alphanumeric.
-    # Distinct from OpenAI's `sk-` (Stripe uses underscore separator).
-    re.compile(r"\bsk_(?:live|test)_[A-Za-z0-9]{24,}\b"),
-]
-
-
-def scan_payload(payload: dict) -> None:
-    """
-    Scan a payload dict for known secret patterns.
-
-    Serialises the payload to a JSON string and tests all 5 regex classes
-    in order. The first match short-circuits the scan and raises
-    SecretBlockedError with the SHA-256 of the matched span (never plaintext).
-
-    Args:
-        payload: the event body dict to scan
-
-    Raises:
-        SecretBlockedError: on first pattern match
-    """
-    serialized = json.dumps(payload, ensure_ascii=False)
-    for name, pattern in zip(_PATTERN_NAMES, _PATTERNS, strict=False):
-        m = pattern.search(serialized)
-        if m:
-            span = m.group(0)
-            digest = hashlib.sha256(span.encode("utf-8")).hexdigest()
-            raise SecretBlockedError(pattern_name=name, sha256_of_span=digest)

package/tools/vds-scripts/scheduler_orchestrator/src/vds_scheduler_orchestrator/workflows/__init__.py

@@ -1 +0,0 @@
-"""workflows — DBOS workflow envelope, queue declarations, LangGraph step wrapper (TSK-1.4+)."""

package/tools/vds-scripts/scheduler_orchestrator/src/vds_scheduler_orchestrator/workflows/agent_step.py

@@ -1,30 +0,0 @@
-"""agent_step.py — Re-export shim for relocated run_langgraph (v0.2.0).
-
-The canonical implementation now lives at
-`vds_agent_core.workflows.langgraph_runner` per ADR-DCP-1 of
-vds-scheduler v0.2.0. This module preserves the old
-import path for backward compatibility through the v0.2.x line; remove in
-v0.3.0 with a deprecation note.
-
-Background
-──────────
-TSK-4.4 originally placed `run_langgraph` here so audit workflows could call
-it from inside their `@DBOS.workflow` bodies. With the audit-scheduler
-event-bus decoupling effort, audit workflows now depend on the generic
-`vds_agent_core.workflows` library instead of scheduler internals; this
-module is now an internal re-export to avoid breaking downstream importers.
-
-Two-checkpointer architecture (DBOS step output + LangGraph supernode state)
-remains identical — see `vds_agent_core/workflows/langgraph_runner.py`.
-"""
-
-from __future__ import annotations
-
-# Re-export the canonical run_langgraph + build_agent_workflow.
-# The @DBOS.step decoration fires when langgraph_runner.py is imported (here).
-from vds_agent_core.workflows.langgraph_runner import (
-    build_agent_workflow,
-    run_langgraph,
-)
-
-__all__ = ["build_agent_workflow", "run_langgraph"]

package/tools/vds-scripts/scheduler_orchestrator/src/vds_scheduler_orchestrator/workflows/anomaly.py

@@ -1,67 +0,0 @@
-"""Adaptive anomaly detection using 7-day rolling z-score.
-
-Complements static thresholds with statistical anomaly detection for
-volume metrics that vary by day-of-week.
-"""
-
-from __future__ import annotations
-
-import statistics
-from typing import Any
-
-
-def _z_score(value: float, history: list[float]) -> float | None:
-    """Return the z-score of *value* against *history*.
-
-    Returns ``None`` when *history* has fewer than 2 data points or
-    zero standard deviation.
-    """
-    if len(history) < 2:
-        return None
-    mean = statistics.mean(history)
-    try:
-        std = statistics.stdev(history)
-    except statistics.StatisticsError:
-        return None
-    if std == 0:
-        return None
-    return (value - mean) / std
-
-
-def adaptive_anomaly_check(
-    current: dict[str, Any],
-    history_rows: list[dict[str, Any]],
-) -> list[str]:
-    """Flag volume metrics whose z-score exceeds ±2.5 over the last 7 days.
-
-    Parameters
-    ----------
-    current:
-        Today's metrics dict.
-    history_rows:
-        Last N rows from ``sched.ecosystem_report_runs`` (newest first).
-
-    Returns
-    -------
-    list[str]
-        Human-readable anomaly strings.
-    """
-    anomalies: list[str] = []
-
-    # Volume metrics to check with z-score
-    checks = [
-        ("error_24h", "Error count"),
-        ("success_24h", "Success count"),
-        ("pending_depth", "Pending depth"),
-        ("enqueued_depth", "Enqueued depth"),
-    ]
-
-    for key, label in checks:
-        value = current.get(key, 0)
-        hist = [row.get(key, 0) for row in history_rows if row.get(key) is not None]
-        z = _z_score(float(value), [float(h) for h in hist])
-        if z is not None and abs(z) >= 2.5:
-            direction = "spike" if z > 0 else "drop"
-            anomalies.append(f"{label} {direction}: z={z:+.2f} (today={value}, 7d μ={statistics.mean(hist):.1f})")
-
-    return anomalies

package/tools/vds-scripts/scheduler_orchestrator/src/vds_scheduler_orchestrator/workflows/autoscale.py

@@ -1,452 +0,0 @@
-"""
-autoscale.py — Queue-depth autoscaler for the VDS Ecosystem Scheduler.
-
-TSK-16.1 (metric-only): DBOS scheduled workflow that polls dbos.workflow_status
-(filtered by status='ENQUEUED') every 10 seconds, computes a target_replicas
-recommendation using the Dosu production pattern, updates the
-vds_scheduler_queue_depth Prometheus gauge, and logs the recommendation.
-(Pre-v2.0.13 drafts targeted a hypothetical dbos.workflow_queue table — DBOS
-2.19.x has no such table; the correct enqueued count comes from workflow_status.
-See v2.0.13 TSK-N.22.)
-
-TSK-16.2 (deploy-platform integration): When VDS_SCHEDULER_AUTOSCALE_BACKEND
-is set, the workflow also invokes the configured scaling backend:
-  - "compose"     → scheduler_orchestrator/scripts/autoscale/scale-compose.sh
-  - "k8s" | "kubernetes" → kubectl scale (Kubernetes HPA path; see
-                       scheduler_orchestrator/docs/autoscaling-k8s-hpa.yaml)
-
-The scaling formula (Dosu pattern, design.md §Worker autoscaling):
-    target_replicas = min(20, max(3, ceil(queue_depth / 50)))
-
-NOTE: No actual scaling happens unless VDS_SCHEDULER_AUTOSCALE_BACKEND is set.
-The workflow is safe to deploy in metric-only mode (the default) and can be
-promoted to active scaling by setting the env var without a code change.
-
-Architecture
-────────────
-  autoscale_check_workflow(@DBOS.workflow)
-    ├─ _poll_queue_depth(@DBOS.step)   → queries dbos.workflow_status WHERE status='ENQUEUED' via asyncpg
-    └─ _maybe_scale(@DBOS.step)        → invokes backend subprocess if configured
-
-Schedule
-  alias:    scheduler.autoscale
-  cron:     */10 * * * * *    (every 10 s — 6-field DBOS cron, seconds-first)
-  queue:    ops-default        (no LLM cost; fast DB query + optional subprocess)
-  overlap:  skip               (new tick dropped while previous is still running)
-
-Bootstrap
-  Call bootstrap_autoscale_schedule() from app.py lifespan AFTER DBOS.launch().
-  It registers the alias + schedule idempotently.
-
-Acceptance criteria (TSK-16.1):
-  - autoscale_check_workflow() is @DBOS.workflow decorated.
-  - _poll_queue_depth() queries dbos.workflow_status WHERE status='ENQUEUED'
-    and returns an int (v2.0.13 TSK-N.22 corrected the table name from the
-    non-existent dbos.workflow_queue in DBOS 2.19.x).
-  - target_replicas computed as min(20, max(3, ceil(depth / 50))) in workflow body.
-  - vds_scheduler_queue_depth metric updated each tick.
-  - With VDS_SCHEDULER_AUTOSCALE_BACKEND unset, _maybe_scale returns "no_action".
-
-Acceptance criteria (TSK-16.2):
-  - With backend="compose", scale-compose.sh is invoked with target_replicas.
-  - With backend="k8s"/"kubernetes", kubectl scale is invoked.
-  - Subprocess errors are caught and surfaced in the return dict (non-fatal).
-"""
-
-from __future__ import annotations
-
-import math
-import os
-import subprocess
-from datetime import datetime
-from pathlib import Path
-from typing import Any
-
-import structlog
-from dbos import DBOS
-
-logger = structlog.get_logger(__name__)
-
-# ── Schedule constants ────────────────────────────────────────────────────────
-#
-# 6-field cron (DBOS seconds-first format): */10 * * * * * → every 10 seconds.
-# DBOS supports 6-field cron for sub-minute schedules per its scheduler docs.
-# The domain layer (schedules.create) enforces 5-field only — this schedule
-# bypasses the domain layer and calls DBOS.create_schedule() directly, which
-# is appropriate for internal operational infrastructure.
-_AUTOSCALE_CRON = "*/10 * * * * *"
-_AUTOSCALE_ALIAS = "scheduler.autoscale"
-_AUTOSCALE_SCHEDULE_NAME = "scheduler-autoscale"
-_AUTOSCALE_QUEUE = "ops-default"
-
-# Scaling formula constants (Dosu pattern — design.md §Worker autoscaling)
-_TARGET_MIN = 3
-_TARGET_MAX = 20
-_DEPTH_DIVISOR = 50
-
-# Path to the compose scale script (relative to the scheduler_orchestrator root)
-_SCALE_COMPOSE_SCRIPT = Path(__file__).parent.parent.parent.parent.parent / "scripts" / "autoscale" / "scale-compose.sh"
-
-
-# ── DBOS step: poll queue depth ───────────────────────────────────────────────
-
-
-@DBOS.step(retries_allowed=True, max_attempts=3)
-async def _poll_queue_depth() -> int:
-    """
-    Query dbos.workflow_status for the total count of enqueued workflows.
-
-    Updates the vds_scheduler_queue_depth Prometheus gauge for all queues
-    aggregated (label "all"). Individual per-queue depths require iterating
-    queue names — that enhancement is Phase 5 scope.
-
-    Returns:
-        int — number of workflows currently in 'ENQUEUED' state.
-
-    NOTE: DBOS 2.19.x schema uses `dbos.workflow_status` with status column
-    values ('ENQUEUED', 'SUCCESS', 'ERROR', etc.). An earlier iteration of
-    this step queried `dbos.workflow_queue` — that table does not exist in
-    DBOS 2.19.x and was likely a pre-release name (v2.0.13 TSK-N.22 fix).
-    If the query fails (e.g. DBOS schema drift in a future version), the
-    step returns 0 rather than raising — a safe metric-only default.
-    """
-    import asyncpg  # type: ignore[import]
-
-    from vds_scheduler_orchestrator.config import get_config
-    from vds_scheduler_orchestrator.observability.metrics import set_queue_depth
-
-    cfg = get_config()
-    dsn = cfg.vds_scheduler_database_url
-    if not dsn:
-        logger.warning("autoscale.poll_queue_depth.no_dsn")
-        return 0
-
-    depth = 0
-    try:
-        conn = await asyncpg.connect(dsn)
-        try:
-            row = await conn.fetchrow("SELECT count(*) AS depth FROM dbos.workflow_status WHERE status = 'ENQUEUED'")
-            depth = int(row["depth"]) if row and row["depth"] is not None else 0
-        finally:
-            await conn.close()
-    except Exception as exc:
-        # Non-fatal: log the error but return 0 so the autoscaler does not
-        # over-scale due to a monitoring blind spot.  The step will be retried
-        # up to max_attempts=3 before the workflow records an error.
-        logger.warning("autoscale.poll_queue_depth.error", error=str(exc))
-        depth = 0
-
-    # Update the Prometheus gauge (label="all" = aggregated across queues).
-    # Per-queue breakdown is a Phase 5 enhancement.
-    set_queue_depth("all", depth)
-    logger.debug("autoscale.queue_depth_polled", depth=depth)
-    return depth
-
-
-# ── DBOS step: invoke scaling backend ─────────────────────────────────────────
-
-
-@DBOS.step(retries_allowed=False, max_attempts=1)
-async def _maybe_scale(target_replicas: int) -> dict[str, Any]:
-    """
-    Invoke the configured scaling backend, or return metric-only result.
-
-    Reads VDS_SCHEDULER_AUTOSCALE_BACKEND from the environment:
-      - unset / empty → metric-only mode ("no_action")
-      - "compose"     → invoke scripts/autoscale/scale-compose.sh <target>
-      - "k8s" / "kubernetes" → kubectl scale deployment/<name> --replicas=<N>
-                               (deployment name from VDS_SCHEDULER_K8S_DEPLOYMENT)
-
-    Non-fatal: subprocess errors are captured and returned in the "error" key
-    so the workflow does not fail — the autoscaler is an advisory layer, not
-    a hard gate. Operators should monitor vds_scheduler_queue_depth for
-    sustained high depth if scaling errors occur.
-
-    Args:
-        target_replicas: the computed target from the autoscale formula.
-
-    Returns:
-        dict with keys:
-          backend    — the resolved backend name ("no_action" | "compose" | "k8s")
-          invoked    — True if the script/kubectl was called
-          error      — error message string if subprocess failed, else None
-    """
-    backend = os.environ.get("VDS_SCHEDULER_AUTOSCALE_BACKEND", "").strip().lower()
-
-    if not backend:
-        return {"backend": "no_action", "invoked": False, "error": None}
-
-    if backend == "compose":
-        return await _scale_via_compose(target_replicas)
-
-    if backend in ("k8s", "kubernetes"):
-        return await _scale_via_k8s(target_replicas)
-
-    logger.warning(
-        "autoscale.unknown_backend",
-        backend=backend,
-        known=["compose", "k8s", "kubernetes"],
-    )
-    return {"backend": backend, "invoked": False, "error": f"unknown backend: {backend!r}"}
-
-
-async def _scale_via_compose(target_replicas: int) -> dict[str, Any]:
-    """Invoke scale-compose.sh with target_replicas as positional argument."""
-    script_path = str(_SCALE_COMPOSE_SCRIPT)
-
-    if not Path(script_path).exists():
-        msg = f"scale-compose.sh not found at {script_path}"
-        logger.error("autoscale.compose.missing_script", path=script_path)
-        return {"backend": "compose", "invoked": False, "error": msg}
-
-    try:
-        result = subprocess.run(
-            ["/usr/bin/env", "bash", script_path, str(target_replicas)],
-            capture_output=True,
-            text=True,
-            timeout=30,
-        )
-        if result.returncode != 0:
-            error_msg = result.stderr.strip() or f"exit code {result.returncode}"
-            logger.error(
-                "autoscale.compose.scale_failed",
-                target=target_replicas,
-                error=error_msg,
-            )
-            return {"backend": "compose", "invoked": True, "error": error_msg}
-
-        logger.info(
-            "autoscale.compose.scaled",
-            target=target_replicas,
-            stdout=result.stdout.strip(),
-        )
-        return {"backend": "compose", "invoked": True, "error": None}
-
-    except subprocess.TimeoutExpired:
-        msg = "scale-compose.sh timed out after 30s"
-        logger.exception("autoscale.compose.timeout", target=target_replicas)
-        return {"backend": "compose", "invoked": True, "error": msg}
-    except Exception as exc:
-        logger.exception("autoscale.compose.exception", error=str(exc))
-        return {"backend": "compose", "invoked": True, "error": str(exc)}
-
-
-async def _scale_via_k8s(target_replicas: int) -> dict[str, Any]:
-    """
-    Invoke kubectl to scale the scheduler worker deployment.
-
-    Deployment name is read from VDS_SCHEDULER_K8S_DEPLOYMENT (default:
-    "vds-scheduler-worker"). Namespace from VDS_SCHEDULER_K8S_NAMESPACE
-    (default: "vds").
-
-    NOTE: This is a direct kubectl call. In production, prefer the Kubernetes
-    HPA (docs/autoscaling-k8s-hpa.yaml) which scales automatically based on
-    custom metrics — use this path only for manual override or environments
-    without Prometheus metrics adapter.
-    """
-    deployment = os.environ.get("VDS_SCHEDULER_K8S_DEPLOYMENT", "vds-scheduler-worker")
-    namespace = os.environ.get("VDS_SCHEDULER_K8S_NAMESPACE", "vds")
-
-    cmd = [
-        "kubectl",
-        "scale",
-        "deployment",
-        deployment,
-        f"--replicas={target_replicas}",
-        f"--namespace={namespace}",
-    ]
-
-    try:
-        result = subprocess.run(
-            cmd,
-            capture_output=True,
-            text=True,
-            timeout=15,
-        )
-        if result.returncode != 0:
-            error_msg = result.stderr.strip() or f"exit code {result.returncode}"
-            logger.error(
-                "autoscale.k8s.scale_failed",
-                deployment=deployment,
-                namespace=namespace,
-                target=target_replicas,
-                error=error_msg,
-            )
-            return {"backend": "k8s", "invoked": True, "error": error_msg}
-
-        logger.info(
-            "autoscale.k8s.scaled",
-            deployment=deployment,
-            namespace=namespace,
-            target=target_replicas,
-        )
-        return {"backend": "k8s", "invoked": True, "error": None}
-
-    except FileNotFoundError:
-        msg = "kubectl not found — install kubectl or switch to compose backend"
-        logger.exception("autoscale.k8s.kubectl_missing")
-        return {"backend": "k8s", "invoked": False, "error": msg}
-    except subprocess.TimeoutExpired:
-        msg = "kubectl scale timed out after 15s"
-        logger.exception("autoscale.k8s.timeout", target=target_replicas)
-        return {"backend": "k8s", "invoked": True, "error": msg}
-    except Exception as exc:
-        logger.exception("autoscale.k8s.exception", error=str(exc))
-        return {"backend": "k8s", "invoked": True, "error": str(exc)}
-
-
-# ── DBOS workflow ─────────────────────────────────────────────────────────────
-
-
-@DBOS.workflow()
-async def autoscale_check_workflow(
-    scheduled_time: datetime,
-    context: Any,
-) -> dict[str, Any]:
-    """
-    DBOS durable workflow: poll queue depth and emit a scaling recommendation.
-
-    Args follow the DBOS scheduled-workflow contract (`Callable[[datetime, Any], ...]`
-    in `dbos._scheduler.ScheduledWorkflow`): when invoked via `DBOS.create_schedule`,
-    DBOS passes `(scheduled_at, context)` positionally — the second arg is the
-    deserialized `context` passed to `DBOS.create_schedule(context=...)`, NOT a
-    second datetime. Earlier docs (v2.0.12 G6 fix) named this `actual_time: datetime`
-    which was wrong type-wise; v2.0.16 G25/TSK-N.33 renamed for accuracy.
-    Both are unused by the autoscale tick (the queue-depth poll is purely about
-    state at the moment of firing). They MUST be present in the signature; without
-    them DBOS raises `TypeError: ... takes 0 positional arguments but 2 were given`.
-
-    Triggered every 10 seconds by the scheduler.autoscale cron schedule.
-    Delegates all I/O to durable DBOS steps so the computation is checkpointed
-    and can be replayed safely on worker restart.
-
-    Scaling formula (Dosu pattern — design.md §Worker autoscaling):
-        target_replicas = min(20, max(3, ceil(queue_depth / 50)))
-
-    The target_replicas computation is deterministic and pure (no I/O), so it
-    is performed in the workflow body between steps — DBOS will replay it
-    identically on any retry using the checkpointed step outputs.
-
-    Overlap policy (skip): if the previous tick's workflow is still running when
-    the next cron fires, the new tick is dropped. This prevents pile-up under
-    persistent high queue depth.
-
-    Returns:
-        dict with keys:
-          queue_depth       — int, current enqueued workflow count
-          target_replicas   — int, computed scaling target (3-20)
-          backend           — str, "no_action" | "compose" | "k8s"
-          invoked           — bool, whether the backend was actually called
-          error             — str | None, error from backend invocation
-    """
-    del scheduled_time, context  # accepted to satisfy DBOS contract; not used
-    queue_depth = await _poll_queue_depth()
-
-    # Deterministic formula — safe in workflow body (no I/O, no randomness).
-    target_replicas = min(_TARGET_MAX, max(_TARGET_MIN, math.ceil(queue_depth / _DEPTH_DIVISOR)))
-
-    scale_result = await _maybe_scale(target_replicas)
-
-    result: dict[str, Any] = {
-        "queue_depth": queue_depth,
-        "target_replicas": target_replicas,
-        **scale_result,
-    }
-
-    logger.info(
-        "autoscale.tick",
-        queue_depth=queue_depth,
-        target_replicas=target_replicas,
-        backend=scale_result.get("backend"),
-        invoked=scale_result.get("invoked"),
-        error=scale_result.get("error"),
-    )
-    return result
-
-
-# ── Bootstrap ─────────────────────────────────────────────────────────────────
-
-
-def bootstrap_autoscale_schedule(
-    *,
-    workflow_session: Any = None,
-) -> None:
-    """
-    Idempotent startup hook: register the autoscale workflow alias and schedule.
-
-    Call from app.py lifespan AFTER DBOS.launch(). Safe to call multiple
-    times — DuplicateAliasError and any DBOS-level duplicate schedule error
-    are silenced and logged at DEBUG level.
-
-    Steps
-    -----
-    1. Register alias ``"scheduler.autoscale"`` → Python FQN in
-       ``sched.workflow_registry``.
-    2. Call ``DBOS.create_schedule()`` directly with the 6-field cron
-       ``*/10 * * * * *`` (every 10 s). The domain layer (schedules.create)
-       is intentionally bypassed here because it enforces 5-field-only cron
-       expressions for user-visible schedules. The autoscale schedule is
-       internal operational infrastructure and uses a seconds-level cadence.
-
-    Args:
-        workflow_session: Optional SQLAlchemy Session for the alias registry.
-            Injected by unit tests to avoid a live DB connection.
-    """
-    from vds_scheduler_orchestrator.config import get_config
-    from vds_scheduler_orchestrator.workflows.registry import (
-        DuplicateAliasError,
-        register_workflows,
-    )
-
-    cfg = get_config()
-
-    # Step 1: workflow alias registration
-    try:
-        register_workflows(
-            {_AUTOSCALE_ALIAS: ("vds_scheduler_orchestrator.workflows.autoscale.autoscale_check_workflow")},
-            orchestrator="scheduler_orchestrator",
-            version=cfg.dbos_app_version,
-            session=workflow_session,
-        )
-        logger.info("autoscale.bootstrap: workflow alias registered")
-    except DuplicateAliasError:
-        logger.debug("autoscale.bootstrap: workflow alias already registered (idempotent)")
-
-    # Step 2: register the 6-field cron schedule directly with DBOS.
-    # DBOS.create_schedule accepts 6-field cron (seconds-first) per its docs:
-    #   docs.dbos.dev/python/tutorials/scheduled-workflows
-    # The 5-field restriction is a domain-layer policy for user schedules only.
-    #
-    # Phase 220.W (2026-04-29): removed the pre-existence check that skipped
-    # wrapping on warm boots. DBOS.create_schedule() is idempotent, and the
-    # wrapping in wrap_with_last_run_at_writeback() populates the global
-    # registry used by _check_strict_registration(). The broad except below
-    # stays as backstop for DBOS-internal idempotency drift.
-
-    try:
-        from vds_scheduler_orchestrator.scheduler.state_pg import PgScheduleStateWriter
-        from vds_scheduler_orchestrator.scheduler.writeback import wrap_with_last_run_at_writeback
-
-        writer = PgScheduleStateWriter()
-        wrapped_fn = wrap_with_last_run_at_writeback(autoscale_check_workflow, _AUTOSCALE_SCHEDULE_NAME, writer)
-
-        DBOS.create_schedule(
-            schedule_name=_AUTOSCALE_SCHEDULE_NAME,
-            workflow_fn=wrapped_fn,
-            schedule=_AUTOSCALE_CRON,
-            queue_name=_AUTOSCALE_QUEUE,
-            context={},
-            automatic_backfill=False,
-        )
-        logger.info(
-            "autoscale.bootstrap: schedule created",
-            cron=_AUTOSCALE_CRON,
-            queue=_AUTOSCALE_QUEUE,
-        )
-    except Exception as exc:
-        # Treat all exceptions as "already exists or non-fatal" — the most
-        # likely cause is a duplicate name on a warm restart.
-        logger.debug(
-            "autoscale.bootstrap: schedule registration skipped",
-            reason=str(exc),
-        )