@vzn/vx 0.0.12 → 0.0.15

package/src/orchestrator/metrics.ts

@@ -1380,6 +1380,357 @@ export function getFlakiestTasks(db: Database, limit = 25): FlakyTask[] {
     .slice(0, clampInt(limit, 1, 200))
 }
 
+// ---------------------------------------------------------------------------
+// Regressions — "which tasks just started failing across branches?"
+// ---------------------------------------------------------------------------
+
+/**
+ * A task that is currently failing on one or more branches and USED to pass —
+ * a regression, distinct from a flaky task (nondeterministic) or a task that
+ * has always been broken. "Across branches" is the key signal: a task failing
+ * on several branches at once points at a real break in that task or in shared
+ * code, not one developer's work-in-progress branch.
+ */
+export interface RegressedTask {
+  id: string
+  project: string
+  task: string
+  /** Distinct branches whose MOST-RECENT run in the window failed. */
+  branchesFailing: number
+  /** Distinct branches the task ran on in the window. */
+  branchesTotal: number
+  /** The currently-failing branch names (capped). */
+  branches: string[]
+  /**
+   * True if the task has any prior successful run — it regressed, rather than
+   * being perpetually broken. A regression is the more urgent signal.
+   */
+  regressed: boolean
+  /** Earliest failed run in the window (ms epoch) — ≈ when it started failing. */
+  firstFailedAt: number
+  /** Most-recent run in the window (ms epoch). */
+  lastRunAt: number
+  /** Failed runs in the window. */
+  failures: number
+  /** Total runs in the window. */
+  runs: number
+}
+
+export interface RegressionArgs {
+  /** Look-back window in days. Default 7. */
+  sinceDays?: number
+  /** Minimum distinct currently-failing branches to surface. Default 2
+   *  ("across branches"); pass 1 to include single-branch regressions. */
+  minBranches?: number
+  limit?: number
+}
+
+const PASS_STATUSES = "('success', 'cache-hit', 'cache-hit-remote')"
+const BRANCH_CAP = 12
+
+export function getRegressions(db: Database, args: RegressionArgs = {}): RegressedTask[] {
+  const sinceDays = args.sinceDays ?? 7
+  const minBranches = Math.max(1, args.minBranches ?? 2)
+  const limit = clampInt(args.limit ?? 25, 1, 200)
+  const since = Date.now() - sinceDays * 86_400_000
+
+  // The most-recent non-skipped run per (task, branch) in the window: its
+  // status is that task's CURRENT state on that branch. Skipped/aborted runs
+  // never finished on their own terms, so they're excluded from the state.
+  const latest = db
+    .query(
+      `WITH windowed AS (
+         SELECT r.project AS project, r.task AS task, inv.branch AS branch,
+                r.status AS status,
+                ROW_NUMBER() OVER (
+                  PARTITION BY r.project, r.task, inv.branch
+                  ORDER BY r.started_at DESC, r.run_id DESC
+                ) AS rn
+         FROM runs r JOIN invocations inv ON r.run_id = inv.run_id
+         WHERE inv.branch IS NOT NULL
+           AND r.started_at >= ?
+           AND r.status IN ('success', 'failed', 'cache-hit', 'cache-hit-remote')
+       )
+       SELECT project, task, branch, status FROM windowed WHERE rn = 1`,
+    )
+    .all(since) as { project: string; task: string; branch: string; status: string }[]
+
+  // Aggregate the latest-per-branch rows into per-task failing/total branch
+  // sets. `failing` = the task's most recent run on that branch failed.
+  const byTask = new Map<
+    string,
+    { project: string; task: string; failing: string[]; total: Set<string> }
+  >()
+  for (const r of latest) {
+    const id = `${r.project}#${r.task}`
+    let agg = byTask.get(id)
+    if (agg === undefined) {
+      agg = { project: r.project, task: r.task, failing: [], total: new Set() }
+      byTask.set(id, agg)
+    }
+    agg.total.add(r.branch)
+    if (r.status === 'failed') agg.failing.push(r.branch)
+  }
+
+  const out: RegressedTask[] = []
+  for (const [id, agg] of byTask) {
+    if (agg.failing.length < minBranches) continue
+    // Per-task follow-ups (the getFlakiestTasks pattern) — the regressed set
+    // is small, so a couple of point queries each is cheap.
+    const win = db
+      .query(
+        `SELECT COUNT(*) AS runs,
+                SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) AS failures,
+                MIN(CASE WHEN status = 'failed' THEN started_at END) AS first_failed,
+                MAX(started_at) AS last_run
+         FROM runs WHERE project = ? AND task = ? AND started_at >= ?`,
+      )
+      .get(agg.project, agg.task, since) as {
+      runs: number
+      failures: number | null
+      first_failed: number | null
+      last_run: number | null
+    }
+    const everPassed =
+      db
+        .query(
+          `SELECT 1 FROM runs WHERE project = ? AND task = ? AND status IN ${PASS_STATUSES} LIMIT 1`,
+        )
+        .get(agg.project, agg.task) !== null
+    out.push({
+      id,
+      project: agg.project,
+      task: agg.task,
+      branchesFailing: agg.failing.length,
+      branchesTotal: agg.total.size,
+      branches: agg.failing.sort().slice(0, BRANCH_CAP),
+      regressed: everPassed,
+      firstFailedAt: win.first_failed ?? 0,
+      lastRunAt: win.last_run ?? 0,
+      failures: win.failures ?? 0,
+      runs: win.runs,
+    })
+  }
+  // Regressions (used-to-pass) first, then most branches affected, then the
+  // most recently-started failures — the "act on this now" ordering.
+  return out
+    .sort(
+      (a, b) =>
+        Number(b.regressed) - Number(a.regressed) ||
+        b.branchesFailing - a.branchesFailing ||
+        b.firstFailedAt - a.firstFailedAt,
+    )
+    .slice(0, limit)
+}
+
+// ---------------------------------------------------------------------------
+// Period-over-period analysis — "how is CI trending vs the previous window,
+// and which tasks moved the most?" Two adjacent equal-length windows.
+// ---------------------------------------------------------------------------
+
+export interface PeriodStats {
+  /** Distinct runs (invocations) in the window. */
+  runs: number
+  /** Task executions recorded (rows). */
+  taskRuns: number
+  /** Executions that actually ran (not a cache hit). */
+  executed: number
+  /** Failed task executions. */
+  failures: number
+  /** Cache-hit task executions (local or remote). */
+  cacheHits: number
+  /** Sum of executed-task durations (ms). */
+  totalDurationMs: number
+  /** Mean duration of successful executed tasks (ms). */
+  avgDurationMs: number
+  p50DurationMs: number | undefined
+  p95DurationMs: number | undefined
+  /** failures / taskRuns. */
+  failureRate: number
+  /** cacheHits / taskRuns. */
+  cacheHitRate: number
+}
+
+export interface TaskMover {
+  id: string
+  project: string
+  task: string
+  currentAvgMs: number
+  previousAvgMs: number
+  /** current − previous (positive = slower / regressed). */
+  deltaMs: number
+  /** (current − previous) / previous, as a fraction. */
+  deltaPct: number
+  currentRuns: number
+  previousRuns: number
+}
+
+export interface PeriodComparison {
+  windowDays: number
+  current: { from: number; to: number; stats: PeriodStats }
+  previous: { from: number; to: number; stats: PeriodStats }
+  /**
+   * Tasks whose average executed duration moved the most between the two
+   * windows, by absolute impact (biggest ms shift first; positive = slower).
+   * Only tasks with >= minRuns successful executions in BOTH windows qualify,
+   * so a mover reflects a real trend, not one-off noise.
+   */
+  movers: TaskMover[]
+}
+
+export interface PeriodComparisonArgs {
+  /** Length of each window in days. Default 7 (this week vs last week). */
+  windowDays?: number
+  /** End of the CURRENT window (ms). Default now — override for tests. */
+  endMs?: number
+  /** Min successful executions in EACH window for a mover to qualify. Default 3. */
+  minRuns?: number
+  /** Max movers returned. Default 8. */
+  limit?: number
+  /** Scope to one project — the project-detail "did MY project trend?" view. */
+  project?: string
+  /** Scope to one task within `project` — the task-detail trend. */
+  task?: string
+}
+
+/** Optional per-project/task scoping shared by the two window queries. */
+interface PeriodScope {
+  project?: string
+  task?: string
+}
+
+function scopeSql(scope: PeriodScope): { sql: string; params: string[] } {
+  let sql = ''
+  const params: string[] = []
+  if (scope.project !== undefined) {
+    sql += ' AND project = ?'
+    params.push(scope.project)
+  }
+  if (scope.task !== undefined) {
+    sql += ' AND task = ?'
+    params.push(scope.task)
+  }
+  return { sql, params }
+}
+
+function periodStats(db: Database, from: number, to: number, scope: PeriodScope): PeriodStats {
+  const { sql, params } = scopeSql(scope)
+  const agg = db
+    .query(
+      // COALESCE every SUM: over an empty window SQLite SUM() returns NULL, and
+      // the previous window is empty for any workspace younger than the window
+      // (a fresh serve, a quiet prior week) — a bare SUM would ship `null` where
+      // PeriodStats declares `number`, throwing on the client's `.toFixed()`.
+      `SELECT COUNT(*) AS taskRuns,
+              COUNT(DISTINCT run_id) AS runs,
+              COALESCE(SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END), 0) AS failures,
+              COALESCE(SUM(CASE WHEN cache_hit = 1 THEN 1 ELSE 0 END), 0) AS cacheHits,
+              COALESCE(SUM(CASE WHEN cache_hit IS NULL OR cache_hit = 0 THEN 1 ELSE 0 END), 0) AS executed,
+              COALESCE(SUM(CASE WHEN cache_hit IS NULL OR cache_hit = 0 THEN duration_ms ELSE 0 END), 0) AS totalDurationMs
+       FROM runs WHERE started_at >= ? AND started_at < ?${sql}`,
+    )
+    .get(from, to, ...params) as {
+    taskRuns: number
+    runs: number
+    failures: number
+    cacheHits: number
+    executed: number
+    totalDurationMs: number
+  }
+  const durs = (
+    db
+      .query(
+        `SELECT duration_ms AS d FROM runs
+         WHERE started_at >= ? AND started_at < ?
+           AND (cache_hit IS NULL OR cache_hit = 0) AND status = 'success'${sql}
+         ORDER BY duration_ms`,
+      )
+      .all(from, to, ...params) as { d: number }[]
+  ).map((r) => r.d)
+  const taskRuns = agg.taskRuns
+  return {
+    runs: agg.runs,
+    taskRuns,
+    executed: agg.executed,
+    failures: agg.failures,
+    cacheHits: agg.cacheHits,
+    totalDurationMs: agg.totalDurationMs,
+    avgDurationMs: durs.length > 0 ? Math.round(durs.reduce((a, b) => a + b, 0) / durs.length) : 0,
+    p50DurationMs: pickPercentile(durs, 0.5),
+    p95DurationMs: pickPercentile(durs, 0.95),
+    failureRate: taskRuns > 0 ? agg.failures / taskRuns : 0,
+    cacheHitRate: taskRuns > 0 ? agg.cacheHits / taskRuns : 0,
+  }
+}
+
+function avgByTask(
+  db: Database,
+  from: number,
+  to: number,
+  scope: PeriodScope,
+): Map<string, { avg: number; runs: number; project: string; task: string }> {
+  const { sql, params } = scopeSql(scope)
+  const rows = db
+    .query(
+      `SELECT project, task, AVG(duration_ms) AS avg, COUNT(*) AS runs
+       FROM runs
+       WHERE started_at >= ? AND started_at < ?
+         AND (cache_hit IS NULL OR cache_hit = 0) AND status = 'success'${sql}
+       GROUP BY project, task`,
+    )
+    .all(from, to, ...params) as { project: string; task: string; avg: number; runs: number }[]
+  return new Map(
+    rows.map((r) => [
+      `${r.project}#${r.task}`,
+      { avg: r.avg, runs: r.runs, project: r.project, task: r.task },
+    ]),
+  )
+}
+
+export function getPeriodComparison(
+  db: Database,
+  args: PeriodComparisonArgs = {},
+): PeriodComparison {
+  const windowDays = Math.max(1, args.windowDays ?? 7)
+  const minRuns = Math.max(1, args.minRuns ?? 3)
+  const limit = clampInt(args.limit ?? 8, 1, 100)
+  const scope: PeriodScope = {
+    ...(args.project !== undefined ? { project: args.project } : {}),
+    ...(args.task !== undefined ? { task: args.task } : {}),
+  }
+  const to = args.endMs ?? Date.now()
+  const win = windowDays * 86_400_000
+  const curFrom = to - win
+  const prevTo = curFrom
+  const prevFrom = curFrom - win
+
+  const cur = avgByTask(db, curFrom, to, scope)
+  const prev = avgByTask(db, prevFrom, prevTo, scope)
+  const movers: TaskMover[] = []
+  for (const [id, c] of cur) {
+    const p = prev.get(id)
+    if (p === undefined || c.runs < minRuns || p.runs < minRuns) continue
+    movers.push({
+      id,
+      project: c.project,
+      task: c.task,
+      currentAvgMs: Math.round(c.avg),
+      previousAvgMs: Math.round(p.avg),
+      deltaMs: Math.round(c.avg - p.avg),
+      deltaPct: p.avg > 0 ? (c.avg - p.avg) / p.avg : 0,
+      currentRuns: c.runs,
+      previousRuns: p.runs,
+    })
+  }
+  movers.sort((a, b) => Math.abs(b.deltaMs) - Math.abs(a.deltaMs))
+  return {
+    windowDays,
+    current: { from: curFrom, to, stats: periodStats(db, curFrom, to, scope) },
+    previous: { from: prevFrom, to: prevTo, stats: periodStats(db, prevFrom, prevTo, scope) },
+    movers: movers.slice(0, limit),
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Bottlenecks — "if you sped up X, you'd save Y per week"
 // ---------------------------------------------------------------------------

package/src/orchestrator/options.ts

@@ -2,7 +2,7 @@
 // so internals like prepare.ts can import them without an upward
 // import of index.ts — the module entry must stay cycle-free.
 
-import type { CachePolicy } from '../cache/index.js'
+import type { CachePolicy, RemoteCacheLayer } from '../cache/index.js'
 import type { ContinueMode } from '../graph/index.js'
 import type { TaskOutcome } from '../graph/index.js'
 import type { EventBus } from './events.js'
@@ -72,14 +72,17 @@ export interface RunOptions {
    * executed + cacheable task is re-run after its save and its outputs are
    * content-compared: a divergence means the task is non-hermetic and its
    * cache entry is provably unsafe (see docs/design/cache-correctness).
-   * `allow` (from `--verify-allow=<pkg#task>,…`) exempts known-nondeterministic
-   * tasks from failing the run. A pure side-channel — never folded into a
-   * cache key; the re-run never saves. Undefined = off (a plain run is
-   * byte-identical).
+   * `fingerprint` computes + ships an output-tree fingerprint on executed
+   * tasks (no re-run — the cross-machine diff feed; `--verify`/`=all` set
+   * it too, for free). `allow` (from `--verify-allow=<pkg#task>,…`) exempts
+   * known-nondeterministic tasks from failing the run. A pure side-channel —
+   * never folded into a cache key; the re-run never saves. Undefined = off
+   * (a plain run is byte-identical).
    */
   verify?: {
     determinism: boolean
     inputs: boolean
+    fingerprint: boolean
     allow: ReadonlySet<string>
   }
   /**
@@ -91,6 +94,14 @@ export interface RunOptions {
    * cached), so a `--timeout` run cache-hits a plain run's entry.
    */
   timeout?: number
+  /**
+   * Memory budget (bytes) that per-task `exec.resources.memory`
+   * reservations pack against (`--memory <size>`). Defaults to
+   * `os.totalmem()` — override it in cgroup-limited containers, where
+   * totalmem() reports the HOST's RAM, not the limit. A per-run
+   * scheduling knob only — never folded into any cache key.
+   */
+  memory?: number
   /**
    * Failure propagation: 'never' stops dispatch on the first failure
    * (in-flight tasks finish; everything queued skips), 'deps-ok'
@@ -168,6 +179,16 @@ export interface RunOptions {
    * record something useful.
    */
   command?: string
+  /**
+   * An injected remote cache layer — the embedder seam mirroring
+   * `telemetrySinks`: a host that already holds a wire client (a
+   * distribution agent, a serve executing on behalf of a submitter)
+   * passes it here and run() composes `LayeredCache(local, injected)`.
+   * Explicit injection WINS over the plugin `cache` capability (the
+   * host knows best; prevents double-wrapping when the workspace also
+   * declares a cache plugin). Undefined → identical to before.
+   */
+  remoteCache?: RemoteCacheLayer
 }
 
 export interface RunSummary {

package/src/orchestrator/plugin-host.ts

@@ -56,26 +56,21 @@ export async function resolveBackend(
 
 /**
  * Resolve the cache layer. First plugin returning a non-undefined `cache`
- * wins; otherwise the caller's `fallback` (today's env-var Turbo-wire
- * `wrapWithRemoteCache`). When a plugin cache wins AND the env vars are
- * also set, a one-line note records that the plugin overrides them
- * (explicit beats ambient). A broken cache factory aborts.
+ * wins; otherwise the caller's `fallback` (the plain local cache — core
+ * ships no wire client; a remote layer comes from a plugin or from
+ * `RunOptions.remoteCache`). A broken cache factory aborts.
  */
 export async function resolveCache(
   plugins: readonly VxPlugin[],
   _localCache: Cache,
   ctx: CacheContext,
-  log: Logger,
+  _log: Logger,
   fallback: () => CacheLayer,
 ): Promise<CacheLayer> {
   for (const plugin of plugins) {
     if (plugin.cache === undefined) continue
     const cache = await safe(plugin, 'cache', () => plugin.cache!(ctx))
-    if (cache !== undefined) {
-      if (process.env.VX_REMOTE_CACHE_URL)
-        log.status(`[vx] plugin '${plugin.name}' cache overrides VX_REMOTE_CACHE_*`)
-      return cache
-    }
+    if (cache !== undefined) return cache
   }
   return fallback()
 }

package/src/orchestrator/prepare.ts

@@ -16,6 +16,7 @@ import {
   type CachePolicy,
   FULL_CACHE_POLICY,
   GitFilesCache,
+  LayeredCache,
   populateGitFilesCache,
 } from '../cache/index.js'
 import {
@@ -33,7 +34,6 @@ import {
   type ProjectEntry,
 } from '../workspace/index.js'
 import { buildTaskGraph, expandRequested, type TaskNode } from '../graph/index.js'
-import { wrapWithRemoteCache } from './remote-cache-setup.js'
 import { resolveCache } from './plugin-host.js'
 import type { VxPlugin } from './plugin.js'
 import { createHashCache, type HashCache } from './task-hash.js'
@@ -197,17 +197,26 @@ export async function prepareRun(options: RunOptions, log: Logger): Promise<Prep
     ? path.resolve(options.cwd, options.cacheDir)
     : resolveCacheDir(workspaceRoot, workspaceConfig)
   const localCache = new Cache(cacheDir, { read: policy.localRead, write: policy.localWrite })
-  // Cache seam: a plugin's `cache` capability takes precedence; otherwise
-  // the env-var Turbo-wire fallback (today's unconditional behavior). With
-  // no cache plugin this is byte-identical to wrapWithRemoteCache.
+  // Cache seam precedence: an EXPLICITLY injected remote layer
+  // (RunOptions.remoteCache — a distribution agent or serve that already
+  // holds a wire client) wins outright; else a plugin's `cache` capability;
+  // else the local cache alone. Core ships no wire client — the remote
+  // cache is a plugin concern (native-cache-wire-2026-07). Injection
+  // winning prevents double-wrapping when the workspace also declares a
+  // cache plugin.
   const plugins = (workspaceConfig?.plugins ?? []) as readonly VxPlugin[]
-  const cache = await resolveCache(
-    plugins,
-    localCache,
-    { workspaceRoot, cacheDir, warn: (m) => log.status(m), localCache, policy },
-    log,
-    () => wrapWithRemoteCache(localCache, log, policy),
-  )
+  const cache = options.remoteCache
+    ? new LayeredCache(localCache, options.remoteCache, {
+        policy,
+        onRemoteError: (err) => log.status(`[vx] remote cache: ${err.message}`),
+      })
+    : await resolveCache(
+        plugins,
+        localCache,
+        { workspaceRoot, cacheDir, warn: (m) => log.status(m), localCache, policy },
+        log,
+        () => localCache,
+      )
   const workspaceFingerprint = await computeWorkspaceFingerprint(workspaceRoot)
 
   const gitFilesCache = new GitFilesCache()

package/src/orchestrator/protocol.ts

@@ -28,9 +28,19 @@ export interface RunRequest {
   retries?: number
   /** Run-level task-timeout default (ms); per-task `exec.timeout` wins. */
   timeout?: number
+  /** Explicit `--memory` budget (bytes) for `exec.resources` packing; the
+   *  default (executing side's os.totalmem()) resolves where tasks run. */
+  memory?: number
   /** Cache-correctness verification (`--verify`); `allow` as an array (Sets
-   *  don't serialize). */
-  verify?: { determinism: boolean; inputs: boolean; allow: readonly string[] }
+   *  don't serialize). `fingerprint` is additive-optional — an old serve
+   *  ignores it, so a delegated `=fingerprint` run against an old serve
+   *  degrades to a harmless no-op verify. */
+  verify?: {
+    determinism: boolean
+    inputs: boolean
+    fingerprint?: boolean
+    allow: readonly string[]
+  }
   flow?: 'focused' | 'broad'
   outputLogs?: 'full' | 'errors-only' | 'none'
   excludeDependencies?: 'all' | readonly string[]
@@ -89,10 +99,12 @@ export function optionsToRequest(options: RunOptions): RunRequest {
   if (options.frozen !== undefined) req.frozen = options.frozen
   if (options.retries !== undefined) req.retries = options.retries
   if (options.timeout !== undefined) req.timeout = options.timeout
+  if (options.memory !== undefined) req.memory = options.memory
   if (options.verify !== undefined)
     req.verify = {
       determinism: options.verify.determinism,
       inputs: options.verify.inputs,
+      fingerprint: options.verify.fingerprint,
       allow: [...options.verify.allow],
     }
   if (options.flow !== undefined) req.flow = options.flow
@@ -122,10 +134,12 @@ export function requestToOptions(request: RunRequest): RunOptions {
   if (request.frozen !== undefined) options.frozen = request.frozen
   if (request.retries !== undefined) options.retries = request.retries
   if (request.timeout !== undefined) options.timeout = request.timeout
+  if (request.memory !== undefined) options.memory = request.memory
   if (request.verify !== undefined)
     options.verify = {
       determinism: request.verify.determinism,
       inputs: request.verify.inputs,
+      fingerprint: request.verify.fingerprint ?? false,
       allow: new Set(request.verify.allow),
     }
   if (request.flow !== undefined) options.flow = request.flow

package/src/orchestrator/resources.ts

@@ -0,0 +1,59 @@
+// Resolve `exec.resources` declarations into absolute per-task costs the
+// scheduler's 2-D admission gate packs against. Pure and budget-
+// parameterized — percent forms resolve here, ONCE per run, so the
+// scheduler's inner loop only ever does a Map.get. The loader has already
+// validated every form (this module trusts internal code); an
+// unparseable value can't reach it from a real config.
+
+import type { ResourceCost, TaskNode } from '../graph/index.js'
+import { parseSize } from '../util/index.js'
+
+const PERCENT_RE = /^(\d+(?:\.\d+)?)%$/
+
+/**
+ * `cpus` → CPU units. A number is itself (fractional ok); `"<n>%"` is
+ * percent of the CPU budget, kept fractional (rounding is display-only).
+ * Absent → 0 = reserve nothing.
+ */
+export function resolveCpu(v: number | string | undefined, cpuBudget: number): number {
+  if (v === undefined) return 0
+  if (typeof v === 'number') return v
+  const m = v.match(PERCENT_RE)
+  if (m) return (Number(m[1]) / 100) * cpuBudget
+  return 0
+}
+
+/**
+ * `memory` → bytes. A number is bytes; a size string goes through
+ * `parseSize` (`"2GB"`, `"512MB"`); `"<n>%"` is percent of the memory
+ * budget. Absent → 0 = reserve nothing.
+ */
+export function resolveMem(v: number | string | undefined, memBudget: number): number {
+  if (v === undefined) return 0
+  if (typeof v === 'number') return v
+  const m = v.match(PERCENT_RE)
+  if (m) return (Number(m[1]) / 100) * memBudget
+  return parseSize(v) ?? 0
+}
+
+/**
+ * Resolve the whole graph's declared reservations, OMITTING zero-cost
+ * tasks: an empty map means "no reservations declared", the single gate
+ * the scheduler (and run.ts's option threading) keys off to keep every
+ * current run byte-identical.
+ */
+export function resolveResourceCosts(
+  nodes: ReadonlyMap<string, TaskNode>,
+  cpuBudget: number,
+  memBudget: number,
+): Map<string, ResourceCost> {
+  const out = new Map<string, ResourceCost>()
+  for (const node of nodes.values()) {
+    const declared = node.config.exec?.resources
+    if (declared === undefined) continue
+    const cpu = resolveCpu(declared.cpus, cpuBudget)
+    const mem = resolveMem(declared.memory, memBudget)
+    if (cpu > 0 || mem > 0) out.set(node.id, { cpu, mem })
+  }
+  return out
+}