@north-light/crouter 0.3.281 → 0.3.283

package/dist/daemon/reconcilers/broker-supervision.js

@@ -26,17 +26,15 @@ import { formatCard, PARK_SUMMARY_PROMPT } from '../../shared/generated-context.
 import { brokerThresholdsForDaemon } from '../../core/runtime/fleet.js';
 import { readConfig } from '../../core/config.js';
 import { beginPendingPark, consumePendingPark, pendingParkIds, pendingParkStartedAt } from '../park-pending.js';
+import { shouldParkAfterSummary } from '../park-activity.js';
 import { applyParkEvent, parkEvent } from './live-obligation.js';
-import { envNoDaemonAutostart, envTestParkSummaryGraceMs, envTestUnattendedParkMs, envUnattendedParkMs, } from '../../shared/env.js';
+import { envNoDaemonAutostart, envTestUnattendedParkMs, parkSummaryGraceMs, envUnattendedParkMs, } from '../../shared/env.js';
 const execFileAsync = promisify(execFile);
 export const YIELD_STALL_GRACE_MS = 3 * 60_000;
 const KILL_ESCALATE_MS = 20_000;
 export const WEDGE_QUIET_MS = 20 * 60_000;
 export const WEDGE_CPU_MAX_PERCENT = 2;
 const OVER_CAP_WARN_THROTTLE_MS = 5 * 60_000;
-// Longer than a summary turn and shorter than the unattended clock itself, so a
-// stuck parking turn cannot hold a broker for a whole extra clock period.
-const DEFAULT_PARK_SUMMARY_GRACE_MS = 5 * 60_000;
 export function unattendedParkMsForDaemon() {
     // The `CRTR_UNATTENDED_PARK_MS` override wins whenever set, autostart or not.
     const envOverride = envUnattendedParkMs();
@@ -50,7 +48,7 @@ export function unattendedParkMsForDaemon() {
     return envTestUnattendedParkMs() ?? configured;
 }
 export function parkSummaryGraceMsForDaemon() {
-    return envTestParkSummaryGraceMs() ?? DEFAULT_PARK_SUMMARY_GRACE_MS;
+    return parkSummaryGraceMs();
 }
 export function yieldStallVerdict(piPidAlive, intent, busy, stalledFor) {
     if (piPidAlive !== true)
@@ -199,9 +197,7 @@ export class BrokerSupervisionReconciler {
     }
     /** Every condition that resets the unattended clock EXCEPT `isBusy` — the
      *  node is unavailable to park, attended, or has work waiting. Short-circuits
-     *  in cost order so the common tick does no file reads it can avoid.
-     *  Evaluated for a pending park too, where a busy engine is precisely what is
-     *  expected (it is writing the summary) and every other hit aborts. */
+     *  in cost order so the common tick does no file reads it can avoid. */
     parkResetCondition(id, row, livePid, now) {
         if (row.pi_session_id == null
             || row.pi_pid !== livePid
@@ -239,26 +235,21 @@ export class BrokerSupervisionReconciler {
             return;
         }
         const reset = this.parkResetCondition(id, row, livePid, now);
-        // A parking turn is in flight for this node: it owns the decision until it
-        // settles, aborts, or runs out of grace.
+        // A shadow parking turn owns this marker until it completes or runs out of
+        // grace. Both paths take the same main-engine activity verdict before
+        // terminalizing, so input during the summary only keeps the node live.
         const parkingSince = pendingParkStartedAt(id);
         if (parkingSince !== undefined) {
-            if (reset) {
-                // Something worth attending to arrived (or the node became unavailable)
-                // during the summary turn. The node stays live and the park consequence
-                // is discarded; its clock restarts from scratch.
-                consumePendingPark(id);
-                this.unattendedSince.delete(id);
-                return;
-            }
             if (now - parkingSince < parkSummaryGraceMsForDaemon())
                 return;
-            // The degraded path: park anyway, with the marker but no report, exactly
-            // as this clock behaved before the summary turn existed. Status flips
-            // BEFORE the host dies (the crash-safety invariant).
-            if (!consumePendingPark(id))
+            const pending = consumePendingPark(id);
+            if (pending === undefined)
                 return;
             this.unattendedSince.delete(id);
+            if (!shouldParkAfterSummary(id, row, pending))
+                return;
+            // The degraded path has no report. Status flips BEFORE the host dies (the
+            // crash-safety invariant).
             emitEvent({
                 level: 'warn',
                 event: 'broker.park.summary_expired',
@@ -299,26 +290,21 @@ export class BrokerSupervisionReconciler {
             headlessBrokerHost.teardown(id);
             return;
         }
-        // A resident ends its conversation the way a worker ends a task: it gets one
-        // last turn to leave a roadmap and a report behind. Terminalization moves to
-        // broker settlement, which re-evaluates this verdict once that turn ends.
+        // A resident gets one isolated turn to leave a report behind. Its completion
+        // re-evaluates this verdict before terminalizing the node.
         if (!ctx.lifecycle.acceptsDetachedWork())
             return;
         beginPendingPark(id, now);
         ctx.lifecycle.registerDetached(this.requestParkSummary(id));
     }
     /** Deliver the parking prompt over the live broker's serialized frame loop.
-     *  Two outcomes cancel the park immediately: an unreachable broker (nothing
-     *  live to summarize with) falls through to the degraded enactment, and a
-     *  `steer` route means a turn started between the idle gate and the frame, so
-     *  the node is working again and its clock simply restarts. */
+     * An unreachable broker falls through to degraded parking; either prompt route
+     * starts the same isolated turn, so a concurrent main turn stays passive. */
     async requestParkSummary(id) {
         try {
             const route = await deliverLive(id, formatCard('park', {}, PARK_SUMMARY_PROMPT), {
                 origin: { type: 'runtime', kind: 'park' },
             });
-            if (route === 'steer' && consumePendingPark(id))
-                return;
             emitEvent({
                 level: 'info',
                 event: 'broker.park.summary_requested',
@@ -327,7 +313,7 @@ export class BrokerSupervisionReconciler {
             });
         }
         catch (err) {
-            if (!consumePendingPark(id))
+            if (consumePendingPark(id) === undefined)
                 return;
             if (err instanceof BrokerUnreachableError) {
                 applyParkEvent(id, 'park');
@@ -599,7 +585,17 @@ export class BrokerSupervisionReconciler {
                 `Error: ${firstLine}`;
         if (terminalOverflow) {
             try {
-                transition(id, 'crash');
+                transition(id, 'crash', {
+                    reason: 'context_overflow',
+                    outcome: {
+                        detail: {
+                            schema: 'crtr.node-outcome-detail/v1',
+                            message: fault.message,
+                            fault_kind: 'context-overflow',
+                            error_class: 'context_overflow',
+                        },
+                    },
+                });
                 headlessBrokerHost.teardown(id);
             }
             catch {

package/dist/daemon/reconcilers/node-deadline.d.ts

@@ -0,0 +1,5 @@
+/** Enforce absolute spawn deadlines independently of the tick's live-row scan. */
+export declare class NodeDeadlineReconciler {
+    run(now: number): void;
+    private expire;
+}

package/dist/daemon/reconcilers/node-deadline.js

@@ -0,0 +1,82 @@
+import { dueNodeDeadlines, subscribersOf, } from '../../core/canvas/index.js';
+import { emitEvent } from '../../core/events/emit.js';
+import { isProfilePaused } from '../../core/profiles/manifest.js';
+import { operationIdContext } from '../../core/events/operation-id.js';
+import { errorClassFromFault } from '../../core/fault-classifier.js';
+import { fanDoctrineWake } from '../../core/runtime/close.js';
+import { readFault } from '../../core/runtime/fault.js';
+import { requestBrokerTeardown } from '../../core/runtime/host.js';
+import { transition } from '../../core/runtime/lifecycle.js';
+/** Enforce absolute spawn deadlines independently of the tick's live-row scan. */
+export class NodeDeadlineReconciler {
+    run(now) {
+        let rows;
+        try {
+            rows = dueNodeDeadlines(new Date(now).toISOString());
+        }
+        catch (error) {
+            emitEvent({ level: 'error', event: 'node_deadline.scan_failed', error });
+            return;
+        }
+        for (const row of rows) {
+            if (isProfilePaused(row.profile_id))
+                continue;
+            operationIdContext.fresh(() => this.expire(row, now));
+        }
+    }
+    expire(row, now) {
+        const deadlineAt = row.deadline_at;
+        if (deadlineAt === null || deadlineAt === undefined)
+            return;
+        const fault = readFault(row.node_id);
+        const lastFatalFault = fault?.retry.disposition === 'fatal' ? fault : null;
+        let terminal;
+        try {
+            terminal = transition(row.node_id, 'cancel', {
+                reason: 'deadline_exceeded',
+                outcome: {
+                    detail: {
+                        schema: 'crtr.node-outcome-detail/v1',
+                        deadline: { deadline_at: deadlineAt, elapsed_ms: now - Date.parse(deadlineAt) },
+                        ...(lastFatalFault === null ? {} : {
+                            message: lastFatalFault.message,
+                            fault_kind: lastFatalFault.kind,
+                            error_class: errorClassFromFault(lastFatalFault).class,
+                        }),
+                    },
+                },
+            });
+        }
+        catch (error) {
+            emitEvent({ level: 'error', event: 'node_deadline.terminalize_failed', node_id: row.node_id, error, fields: { deadline_at: deadlineAt } });
+            return;
+        }
+        // cancel's requireNoFinalReport gate lets a same-instant canonical final win;
+        // only the terminal write that latched this deadline outcome may reap the host.
+        if (terminal.status !== 'canceled' || terminal.outcome_reason !== 'deadline_exceeded')
+            return;
+        try {
+            requestBrokerTeardown(row.node_id);
+        }
+        catch (error) {
+            emitEvent({ level: 'error', event: 'node_deadline.teardown_failed', node_id: row.node_id, error, fields: { deadline_at: deadlineAt } });
+        }
+        try {
+            fanDoctrineWake(row.node_id, subscribersOf(row.node_id), 'child-deadline-exceeded', { reason: 'child-deadline-exceeded', child: row.node_id });
+        }
+        catch (error) {
+            emitEvent({ level: 'error', event: 'node_deadline.notify_failed', node_id: row.node_id, error, fields: { deadline_at: deadlineAt } });
+        }
+        try {
+            emitEvent({
+                level: 'error',
+                event: 'node_deadline.expired',
+                node_id: row.node_id,
+                fields: { deadline_at: deadlineAt, elapsed_ms: now - Date.parse(deadlineAt) },
+            });
+        }
+        catch {
+            // Event emission must not make a committed deadline outcome retry teardown.
+        }
+    }
+}

package/dist/daemon/reconcilers/node-lifecycle/freeze-lane.js

@@ -134,7 +134,15 @@ export class FreezeLaneReconciler {
                     max_attempts: IDLE_RELEASE_RELAUNCH_MAX_ATTEMPTS,
                 },
             });
-            transition(id, 'crash');
+            transition(id, 'crash', {
+                reason: 'launch_failed',
+                outcome: {
+                    detail: {
+                        schema: 'crtr.node-outcome-detail/v1',
+                        respawn_failures: attempts,
+                    },
+                },
+            });
             fanDoctrineWake(id, subscribersOf(id), `Child crashed — ${fullName(row)} (${id}) failed to relaunch after ${attempts} attempts while trying to ` +
                 `deliver a pending inbox message (no delivery progress across any attempt), and is now dead. It stays ` +
                 `dead until you revive it — \`crtr node lifecycle revive ${id}\`.`, { reason: 'child-crashed', child: id });

package/dist/daemon/reconcilers/node-lifecycle/tick.js

@@ -69,9 +69,14 @@ export class NodeLifecycleReconciler {
                 candidates.push({ row, enact: 'thaw' });
             return;
         }
-        // 1. A fleet handle IS execution. Whatever froze this row is over.
+        // 1. A fleet handle IS execution, except profile pause must stop a broker
+        // that registered after pause's fast scan. The fleet records this exact
+        // interruption before SIGTERM so resume cannot classify it as a crash.
         if (ctx.fleet.has(id)) {
-            this.thawMark(row);
+            if (isProfilePaused(row.profile_id))
+                ctx.fleet.interruptForProfilePause(id);
+            else
+                this.thawMark(row);
             return;
         }
         // A paused profile launches nothing, and its stuck-delivery episode is over
@@ -117,7 +122,11 @@ export class NodeLifecycleReconciler {
         //    mode is delay, never a wrong kill.
         if (recordedPidLiveness(row.pi_pid, row.pi_pid_identity) !== 'dead')
             return;
-        clearRecordedPid(id);
+        // A pause interruption needs two passes after resume: the first consumes
+        // its marker without failure or launch, and retaining the PID lets the
+        // second recognize the same dead row for ordinary recovery.
+        if (!ctx.fleet.hasProfilePauseInterruption(id))
+            clearRecordedPid(id);
         // 7. The invariant-5 policy table, on the same inputs an exit event gives
         //    it. 8. A verdict that needs no broker is enacted right here, because it
         //    costs no slot; a respawn becomes a candidate for the freeze lane.

package/dist/daemon/reconcilers/node-outcome-delivery-lane.d.ts

@@ -0,0 +1,10 @@
+import type { DetachedWorkLifecycle } from './broker-supervision.js';
+/** One daemon-life identity for guarded outcome-delivery claims. */
+export declare const outcomeDeliveryDaemonInstanceId: `${string}-${string}-${string}-${string}-${string}`;
+export interface NodeOutcomeDeliveryLaneContext {
+    lifecycle: DetachedWorkLifecycle;
+}
+/** Admit due outcome deliveries without making the daemon's serial tick await subprocesses. */
+export declare class NodeOutcomeDeliveryLaneReconciler {
+    run(now: number, ctx: NodeOutcomeDeliveryLaneContext): void;
+}

package/dist/daemon/reconcilers/node-outcome-delivery-lane.js

@@ -0,0 +1,41 @@
+import { randomUUID } from 'node:crypto';
+import { claimOutcomeDelivery, dueOutcomeDeliveries } from '../../core/canvas/node-outcome-deliveries.js';
+import { emitEvent } from '../../core/events/emit.js';
+import { operationIdContext } from '../../core/events/operation-id.js';
+import { deliverOutcome } from '../node-outcome/deliver-outcome.js';
+/** One daemon-life identity for guarded outcome-delivery claims. */
+export const outcomeDeliveryDaemonInstanceId = randomUUID();
+/** Admit due outcome deliveries without making the daemon's serial tick await subprocesses. */
+export class NodeOutcomeDeliveryLaneReconciler {
+    run(now, ctx) {
+        if (!ctx.lifecycle.acceptsDetachedWork())
+            return;
+        let due;
+        try {
+            due = dueOutcomeDeliveries(now);
+        }
+        catch (error) {
+            operationIdContext.fresh(() => {
+                emitEvent({ level: 'error', event: 'node_outcome.delivery.scan_failed', error });
+            });
+            return;
+        }
+        for (const candidate of due) {
+            try {
+                const claimed = claimOutcomeDelivery(candidate.nodeId, now, outcomeDeliveryDaemonInstanceId);
+                if (claimed === null)
+                    continue;
+                ctx.lifecycle.registerDetached(deliverOutcome(claimed, outcomeDeliveryDaemonInstanceId).catch((error) => {
+                    operationIdContext.fresh(() => {
+                        emitEvent({ level: 'error', event: 'node_outcome.delivery.failed', error, fields: { node_id: claimed.nodeId } });
+                    });
+                }));
+            }
+            catch (error) {
+                operationIdContext.fresh(() => {
+                    emitEvent({ level: 'error', event: 'node_outcome.delivery.claim_failed', error, fields: { node_id: candidate.nodeId } });
+                });
+            }
+        }
+    }
+}

package/dist/pi-extensions/__tests__/canvas-structured-output.test.js

@@ -1,22 +1,33 @@
 // Run with: node --import tsx/esm --test src/pi-extensions/__tests__/canvas-structured-output.test.ts
 //
-// Regression: strict function schemas require all properties and closed object shapes.
-import { after, test } from 'node:test';
+// The extension injects a pending structured-output request at the END of the
+// system prompt each agent run; submission itself is `crtr push result`
+// (server-side). These cases pin the injection contract: terminal vs one-off
+// wording, no injection for absent/invalid requests, and per-run re-reads.
+import { after, before, beforeEach, test } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { convertResponsesTools } from '@earendil-works/pi-ai/api/openai-responses-shared';
-import { writeOutputSchema } from '../../core/runtime/structured-output.js';
+import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { outputSchemaPath, removeOutputSchema, writeOutputSchema } from '../../core/runtime/structured-output.js';
 import registerCanvasStructuredOutput from '../canvas-structured-output.js';
+const NODE = 'structured-output-test';
+const PROMPT = 'BASE SYSTEM PROMPT';
 const previous = {
     home: process.env['CRTR_HOME'],
     nodeId: process.env['CRTR_NODE_ID'],
 };
 let home;
+before(() => {
+    // macOS limits Unix-socket paths to 104 bytes; keep the home short.
+    home = mkdtempSync('/tmp/crtr-so-');
+    process.env['CRTR_HOME'] = home;
+    process.env['CRTR_NODE_ID'] = NODE;
+});
+beforeEach(() => {
+    rmSync(home, { recursive: true, force: true });
+});
 after(() => {
-    if (home !== undefined)
-        rmSync(home, { recursive: true, force: true });
+    rmSync(home, { recursive: true, force: true });
     if (previous.home === undefined)
         delete process.env['CRTR_HOME'];
     else
@@ -26,63 +37,52 @@ after(() => {
     else
         process.env['CRTR_NODE_ID'] = previous.nodeId;
 });
-test('strict provider schema stays portable while original constraints validate submit', async () => {
-    home = mkdtempSync(join(tmpdir(), 'crtr-structured-output-'));
-    process.env['CRTR_HOME'] = home;
-    process.env['CRTR_NODE_ID'] = 'structured-output-test';
-    const schema = {
-        type: 'object',
-        properties: {
-            status: { type: 'string' },
-            commit: { type: 'string' },
-            verification: { type: 'string' },
-            blocker: { type: 'string' },
-            details: {
-                type: 'object',
-                properties: {
-                    summary: { type: 'string' },
-                },
-                required: ['summary'],
-            },
-            tags: {
-                type: 'array',
-                items: { type: 'string' },
-                minItems: 2,
-                maxItems: 5,
-            },
-        },
-        required: ['status', 'verification', 'details', 'tags'],
-    };
-    writeOutputSchema('structured-output-test', 'oneoff', schema);
-    let definition;
+/** Register the extension against a stub pi and return a run(): the prompt the
+ *  model would see for one agent run. */
+function harness() {
+    let handler;
     registerCanvasStructuredOutput({
-        registerTool(tool) {
-            definition = tool;
-        },
-        on() { },
-    });
-    assert.ok(definition, 'the pending request registers submit');
-    const parameters = definition['parameters'];
-    assert.deepEqual(parameters.required, ['status', 'commit', 'verification', 'blocker', 'details', 'tags']);
-    assert.deepEqual(parameters.properties.commit, { anyOf: [{ type: 'string' }, { type: 'null' }] });
-    assert.deepEqual(parameters.properties.blocker, { anyOf: [{ type: 'string' }, { type: 'null' }] });
-    assert.equal(parameters.additionalProperties, false);
-    assert.equal(parameters.properties.details.additionalProperties, false);
-    assert.equal(parameters.properties.tags['minItems'], undefined);
-    assert.equal(parameters.properties.tags['maxItems'], undefined);
-    assert.match(parameters.properties.tags['description'], /minItems: 2/);
-    assert.match(parameters.properties.tags['description'], /maxItems: 5/);
-    assert.deepEqual(schema.required, ['status', 'verification', 'details', 'tags'], 'the stored request keeps its original constraints');
-    const [providerTool] = convertResponsesTools([definition], {
-        strict: false,
-        supportsStrictMode: true,
+        on: (_event, h) => { handler = h; },
     });
-    assert.equal(providerTool['strict'], true);
-    const execute = definition['execute'];
-    await assert.rejects(execute('call', {
-        status: 'done',
-        verification: 'verified',
-        details: { summary: 'ok' },
-        tags: ['only-one'],
-    }, new AbortController().signal), /must not have fewer than 2 items/);
+    assert.ok(handler, 'extension registered a before_agent_start handler');
+    return (prompt = PROMPT) => handler({ systemPrompt: prompt })?.systemPrompt ?? prompt;
+}
+test('terminal request appends schema, push result, and a final-push prohibition at the end', () => {
+    const run = harness();
+    writeOutputSchema(NODE, 'terminal', { type: 'object', properties: { verdict: { type: 'string' } } });
+    const prompt = run();
+    assert.ok(prompt.startsWith(PROMPT), 'base prompt preserved');
+    const block = prompt.slice(PROMPT.length);
+    assert.match(block, /crtr push result/);
+    assert.match(block, /"verdict"/);
+    assert.match(block, /do NOT call `crtr push final`/i);
+    assert.ok(prompt.trimEnd().endsWith('</structured-output-request>'), 'block sits at the end of the prompt');
+});
+test('one-off request appends continue-after-success wording', () => {
+    const run = harness();
+    writeOutputSchema(NODE, 'oneoff', { type: 'object' });
+    const prompt = run();
+    const block = prompt.slice(PROMPT.length);
+    assert.match(block, /crtr push result/);
+    assert.match(block, /continue working/);
+    assert.doesNotMatch(block, /push final/);
+});
+test('absent request leaves the prompt untouched', () => {
+    const run = harness();
+    assert.equal(run(), PROMPT);
+});
+test('invalid request file leaves the prompt untouched (stop guard owns the error)', () => {
+    const run = harness();
+    const path = outputSchemaPath(NODE);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, 'not json', 'utf8');
+    assert.equal(run(), PROMPT);
+});
+test('request state is re-read every run, never cached', () => {
+    const run = harness();
+    assert.equal(run(), PROMPT);
+    writeOutputSchema(NODE, 'oneoff', { type: 'object' });
+    assert.match(run(), /crtr push result/);
+    removeOutputSchema(NODE);
+    assert.equal(run(), PROMPT);
 });

package/dist/pi-extensions/canvas-structured-output.d.ts

@@ -1,9 +1,13 @@
-type PiEvents = 'before_agent_start' | 'agent_start';
+import { type StructuredOutputRequest } from '../core/runtime/structured-output.js';
+interface BeforeAgentStartEventLike {
+    systemPrompt: string;
+}
 interface PiLike {
-    on: (event: PiEvents, handler: (event: any, ctx: any) => void | Promise<void>) => void;
-    registerTool: (definition: Record<string, unknown>) => void;
-    getActiveTools?: () => string[];
-    setActiveTools?: (tools: string[]) => void;
+    on: (event: 'before_agent_start', handler: (event: BeforeAgentStartEventLike) => {
+        systemPrompt: string;
+    } | void) => void;
 }
+/** Render the prompt block for one valid request. Exported for the test suite. */
+export declare function structuredOutputPromptBlock(request: StructuredOutputRequest): string;
 export declare function registerCanvasStructuredOutput(pi: PiLike): void;
 export default registerCanvasStructuredOutput;