@stigmer/server 3.37.0 → 3.37.1

package/src/temporal/agentexecution/__tests__/replay.test.ts

@@ -32,8 +32,10 @@ const historyFiles = readdirSync(HISTORY_DIR).filter((name) =>
 describe("invoke-agent-execution replay determinism", () => {
   it("has committed histories to replay (the gate cannot be empty)", () => {
     // 3 from #18 (happy, HITL, pause/resume) + the parented HITL history
-    // that pins the #23 child_approval_required sender.
-    expect(historyFiles.length).toBeGreaterThanOrEqual(4);
+    // that pins the #23 child_approval_required sender + the runner-failed
+    // and user-cancel histories captured before stigmer#980 changed the
+    // payloads (never the command sequence) of those two paths.
+    expect(historyFiles.length).toBeGreaterThanOrEqual(6);
   });
 
   it("replays every committed history deterministically", async () => {

package/src/temporal/agentexecution/runner-result.ts

@@ -56,3 +56,19 @@ export function getErrorFromResult(
   const error = result["error"];
   return typeof error === "string" ? error : "";
 }
+
+/**
+ * The runner reported the turn FAILED (its result's phase), as opposed to
+ * the flow breaking around it. The runner has then already persisted the
+ * failed transcript with its own explanation rows (the runner's terminal
+ * table), so the workflow's failure-path status write carries phase and
+ * error only and adds no second explanation (stigmer#980). The message is
+ * the one the workflow always threw here, so the parent callback and the
+ * workflow failure read as before.
+ */
+export class RunnerReportedFailure extends Error {
+  constructor(runnerError: string) {
+    super(`agent execution failed: ${runnerError}`);
+    this.name = "RunnerReportedFailure";
+  }
+}

package/src/temporal/agentexecution/workflows/invoke-agent-execution.ts

@@ -31,6 +31,16 @@
  *     context): CANCELLED persist (quiet terminal, NO status.error —
  *     stigmer#282), callback completion with "execution cancelled", EC
  *     delete.
+ *   - Stop and failure copy (stigmer#980): the runner cannot tell a Pause
+ *     from a Cancel (both reach its activity as the same cancellation), so
+ *     this workflow, which knows which stop it runs, writes the stop row
+ *     (platform-rows.ts) and the merge keeps it last. When the runner
+ *     reported the turn FAILED it already explained the failure in the
+ *     transcript, so the failure-path write adds no lines; only a flow
+ *     that broke without a runner verdict gets the platform's two lines.
+ *     Both are payload changes to activities scheduled as before, pinned
+ *     by the runner-failed, user-cancel and pause-resume replay
+ *     histories.
  *   - Recovery is terminate-and-start-fresh ONLY (stigmer#200); no
  *     version gates (OD-6 — no Go-era history can replay here).
  *
@@ -42,8 +52,9 @@
  * WORKFLOW-BUNDLE IMPORT DISCIPLINE: this file runs in Temporal's
  * deterministic sandbox. Only @temporalio/workflow, @temporalio/common,
  * @bufbuild/protobuf, generated protos, and verified-pure domain modules
- * (filereview/gate.js by DIRECT path — its sibling digest.ts pulls
- * node:crypto) may be imported. The SDK bundler hard-fails otherwise.
+ * (filereview/gate.js and platform-rows.js by DIRECT path — gate.js's
+ * sibling digest.ts pulls node:crypto) may be imported. The SDK bundler
+ * hard-fails otherwise.
  */
 import { create, fromJson, toJson } from "@bufbuild/protobuf";
 import type { JsonValue } from "@bufbuild/protobuf";
@@ -83,6 +94,10 @@ import {
   hasDecidedAwaitingReconcile,
   unresolvedGateCount,
 } from "../../../domain/agentexecution/filereview/gate.js";
+import {
+  CANCEL_STOP_ROW,
+  PAUSE_STOP_ROW,
+} from "../../../domain/agentexecution/platform-rows.js";
 import {
   isWorkerShutdown,
   WORKER_SHUTDOWN_STATUS_ERROR,
@@ -107,6 +122,7 @@ import {
 import {
   getErrorFromResult,
   getPhaseFromResult,
+  RunnerReportedFailure,
   type RunnerActivityResult,
 } from "../runner-result.js";
 import type { InvokeAgentExecutionWorkflowInput } from "../workflow-input.js";
@@ -764,13 +780,16 @@ async function runWithPauseAndRecovery(
         pauseCycle,
       });
 
-      // Defense-in-depth: the Pause RPC already set PAUSED in the DB, but
-      // this also folds the latest messages/tool_calls from the
-      // activity's final gRPC update.
+      // Defense-in-depth for the phase (the Pause RPC already set PAUSED)
+      // and the one writer of the pause row: the runner settles its
+      // transcript without a row because it cannot tell this stop from a
+      // cancel, and the merge appends the row and keeps it last across
+      // the runner's settle write, whichever lands first (stigmer#980).
       await persistFinalStatus(
         executionId,
         create(AgentExecutionStatusSchema, {
           phase: ExecutionPhase.EXECUTION_PAUSED,
+          messages: [{ type: MessageType.MESSAGE_SYSTEM, content: PAUSE_STOP_ROW }],
         }),
         "Failed to persist PAUSED status (non-fatal)",
       );
@@ -850,7 +869,7 @@ async function runWithPauseAndRecovery(
       }),
       "Failed to persist fallback FAILED status",
     );
-    throw new Error(`agent execution failed: ${finalError}`);
+    throw new RunnerReportedFailure(finalError);
   }
 
   return finalResult;
@@ -1130,7 +1149,11 @@ async function executeWithHitlLoop(
  * persist the honest platform-failure copy instead of raw Temporal
  * internals ("Worker is shutting down and this activity did not complete
  * in time" reached users in the 2026-08-08 incident, #776) — the raw text
- * stays in the workflow log; status.error is a user surface.
+ * stays in the workflow log; status.error is a user surface. The two
+ * transcript lines are the platform's explanation, sent only when the
+ * flow broke without the runner's verdict: a RunnerReportedFailure's
+ * transcript already carries the runner's own (stigmer#980), and the
+ * merge appends these rather than replacing the transcript.
  */
 async function updateStatusOnFailure(
   executionId: string,
@@ -1145,17 +1168,20 @@ async function updateStatusOnFailure(
   const failedStatus = create(AgentExecutionStatusSchema, {
     phase: ExecutionPhase.EXECUTION_FAILED,
     error: statusError,
-    messages: [
-      {
-        type: MessageType.MESSAGE_SYSTEM,
-        content:
-          "Internal system error occurred during execution. Please contact support if this issue persists.",
-      },
-      {
-        type: MessageType.MESSAGE_SYSTEM,
-        content: `Error details: ${statusError}`,
-      },
-    ],
+    messages:
+      originalError instanceof RunnerReportedFailure
+        ? []
+        : [
+            {
+              type: MessageType.MESSAGE_SYSTEM,
+              content:
+                "Internal system error occurred during execution. Please contact support if this issue persists.",
+            },
+            {
+              type: MessageType.MESSAGE_SYSTEM,
+              content: `Error details: ${statusError}`,
+            },
+          ],
   });
 
   await failurePathActivities[UPDATE_EXECUTION_STATUS_ACTIVITY_NAME](
@@ -1200,9 +1226,10 @@ async function handleCancellation(
  * CANCELLED persist. Deliberately sets NO status.error: a user-initiated
  * cancel is a quiet terminal state, not a failure (stigmer#282) — display
  * layers key error styling on phase, so a sentinel here would render the
- * stop as a red failure. The muted MESSAGE_SYSTEM line is the durable
- * in-transcript marker. Regular activity for the same replay-safety
- * reasons as updateStatusOnFailure.
+ * stop as a red failure. The muted stop row is the durable in-transcript
+ * marker, written only here (stigmer#980): the merge appends it and keeps
+ * it last across the runner's settle write. Regular activity for the same
+ * replay-safety reasons as updateStatusOnFailure.
  */
 async function updateStatusOnCancellation(executionId: string): Promise<void> {
   const cancelledStatus = create(AgentExecutionStatusSchema, {
@@ -1210,7 +1237,7 @@ async function updateStatusOnCancellation(executionId: string): Promise<void> {
     messages: [
       {
         type: MessageType.MESSAGE_SYSTEM,
-        content: "Execution was cancelled.",
+        content: CANCEL_STOP_ROW,
       },
     ],
   });

package/src/domain/agentexecution/__tests__/execution-usage-report.test.ts

@@ -1,78 +0,0 @@
-/**
- * Pins getExecutionUsageReport's store-fault mapping in LoadExecution — the
- * composed suite (agentexecution.test.ts) reaches only the real store, which
- * cannot fail selectively:
- *
- *   - a typed ResourceNotFoundError answers the domain's NotFound copy,
- *     `agent_execution not found: <id>` (stigmer/stigmer#859);
- *   - any other store failure is an infrastructure fault: a sanitized
- *     Internal whose wire text never carries the cause, never a NotFound
- *     that would tell a client the execution does not exist.
- */
-import { create } from "@bufbuild/protobuf";
-import { Code, ConnectError } from "@connectrpc/connect";
-import { describe, expect, it } from "vitest";
-
-import { AgentExecutionQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/query_pb";
-
-import { createLogger } from "../../../boot/logger.js";
-import type { Authorizer } from "../../../extensions/authorizer.js";
-import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
-import { ResourceNotFoundError } from "../../../store/interface.js";
-import type { Store } from "../../../store/interface.js";
-
-import { getExecutionUsageReport } from "../usage.js";
-
-const silentLogger = createLogger({
-  level: "error",
-  pretty: false,
-  write: () => {},
-});
-
-const allowingAuthorizer: Authorizer = {
-  authorize: () => Promise.resolve({ kind: "allow" }),
-};
-
-/** A store whose one read the chain makes fails with the given error. */
-function failingStore(error: Error): Store {
-  return {
-    getResource: () => Promise.reject(error),
-  } as unknown as Store;
-}
-
-async function reportError(store: Store): Promise<ConnectError> {
-  const error = await getExecutionUsageReport(
-    {
-      store,
-      logger: silentLogger,
-      authorizer: allowingAuthorizer,
-      listReadScope: undefined,
-    },
-    create(AgentExecutionQueryController.method.getExecutionUsageReport.input, {
-      executionId: "aex_missing",
-    }),
-    testCallerIdentity(),
-  ).catch((e: unknown) => e);
-  expect(error).toBeInstanceOf(ConnectError);
-  return error as ConnectError;
-}
-
-describe("getExecutionUsageReport — LoadExecution store faults", () => {
-  it("a missing execution answers NotFound with the domain's copy", async () => {
-    const error = await reportError(
-      failingStore(new ResourceNotFoundError("agent_execution/aex_missing")),
-    );
-
-    expect(error.code).toBe(Code.NotFound);
-    expect(error.rawMessage).toBe("agent_execution not found: aex_missing");
-  });
-
-  it("any other store failure answers a sanitized Internal, never NotFound", async () => {
-    const error = await reportError(
-      failingStore(new Error("SQLITE_BUSY: database is locked")),
-    );
-
-    expect(error.code).toBe(Code.Internal);
-    expect(error.rawMessage).toBe("failed to load agent execution");
-  });
-});