@zq-silk/yui 0.15.11 → 0.15.12

package/dist/controller/globalInputDelivery.js

@@ -2,6 +2,8 @@ import { sendAgentHostRunControl, AGENT_HOST_CONTROL_PROTOCOL } from "../runtime
 import { currentProviderConversation } from "../runtime/providerRuntimeIdentity.js";
 import { hasRuntimeCleanupObligation, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { markGlobalRoleMessageNotDelivered } from "../message/message.js";
+import { providerRetryPending } from "../runtime/providerRetry.js";
+import { settleGlobalRetryInput } from "../message/globalProviderRetry.js";
 /** Messages are the only queue. Host's atomic begin arbitrates native writers. */
 export async function deliverGlobalInputs(home, store, ensure, onError) {
     for (const role of store.listGlobalRoles()) {
@@ -11,6 +13,15 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
             if (pending.length === 0 || hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget({ scope: "global", roleName: role.name }))))
                 continue;
             let sessions = store.getGlobalRoleSessionSet(role.name);
+            if (sessions?.providerBinding?.retry !== undefined && !providerRetryPending(sessions.providerBinding)) {
+                store.transaction(tx => settleGlobalRetryInput(tx, role.name, tx.getGlobalRoleSessionSet(role.name)?.providerBinding, new Date()));
+                pending = store.listGlobalRoleMessages(role.name).filter(message => message.delivery === undefined && message.notDelivered === undefined
+                    && (message.inputControl?.action === "queue" || message.interruptThen !== undefined));
+                if (pending.length === 0)
+                    continue;
+            }
+            if (providerRetryPending(sessions?.providerBinding))
+                continue;
             const current = sessions?.providerBinding?.run;
             const obsolete = pending.filter(message => {
                 const claim = message.interruptThen;
@@ -99,6 +110,8 @@ export async function deliverGlobalInputs(home, store, ensure, onError) {
                     if (latest === undefined || latest.delivery !== undefined || latest.notDelivered !== undefined)
                         return;
                     const turn = tx.getGlobalRoleSessionSet(role.name)?.providerBinding?.run;
+                    if (providerRetryPending(tx.getGlobalRoleSessionSet(role.name)?.providerBinding))
+                        return;
                     // A later canonical acceptance wins over transport diagnostics.
                     if (turn?.attemptId === attemptId && ["accepted", "completed", "failed", "cancelled"].includes(turn.status))
                         return;

package/dist/controller/providerRetryAdmission.js

@@ -0,0 +1,100 @@
+import { admitProviderRetry, cancelProviderRetry, providerRetryAttemptId, providerRetryPending } from "../runtime/providerRetry.js";
+import { blockingProviderContinuations } from "../runtime/runtimeContinuationProjection.js";
+import { validateExactRunReviewRound } from "../lifecycle/exactRunTerminalization.js";
+import { isDeepStrictEqual } from "node:util";
+export function ownedProviderInput(input) {
+    if (input.runId !== undefined && input.taskId !== undefined) {
+        return { kind: "run", taskId: input.taskId, runId: input.runId };
+    }
+    const wake = /^notification:([^/]+)\/([^/]+)\//u.exec(input.attemptId);
+    if (wake !== null && wake[1] === input.taskId) {
+        return { kind: "wake", taskId: wake[1], wakeId: wake[2] };
+    }
+    const message = /^global-input:([^/]+)\/([^/]+)$/u.exec(input.attemptId);
+    if (message !== null && message[1] === input.roleName && input.taskId === undefined) {
+        return { kind: "message", roleName: input.roleName, messageId: message[2] };
+    }
+    return input.boundedText === undefined ? undefined : { kind: "text", text: input.boundedText };
+}
+export function retryIntentBlocker(store, input, retry) {
+    if (input.taskId === undefined) {
+        const role = store.getGlobalRole(input.roleName);
+        const sessions = store.getGlobalRoleSessionSet(input.roleName);
+        if (role === null || sessions?.activeAgentId !== role.activeAgentId)
+            return "role-changed";
+        if (sessions.sessions[sessions.activeAgentId]?.effective.sourceDesiredRevision !== role.launchRevision)
+            return "role-configuration-changed";
+        if (store.listGlobalRoleMessages(input.roleName).some(message => Date.parse(message.createdAt) > Date.parse(retry.intentAt)
+            && message.delivery === undefined && message.notDelivered === undefined))
+            return "new-user-input";
+        return undefined;
+    }
+    const task = store.getTask(input.taskId);
+    if (task === null || !["active", "draft"].includes(task.status)
+        || task.executionGate.state !== "enabled")
+        return "task-execution-stopped";
+    const role = store.getRole(input.taskId, input.roleName);
+    const sessions = store.getTaskRoleSessionSet(input.taskId, input.roleName);
+    if (role === null || sessions?.activeAgentId !== role.activeAgentId)
+        return "role-changed";
+    if (sessions.sessions[sessions.activeAgentId]?.effective.sourceDesiredRevision !== role.launchRevision)
+        return "role-configuration-changed";
+    if (store.listMessages(input.taskId).some(message => (message.kind === "operator" || message.kind === "user")
+        && Date.parse(message.createdAt) > Date.parse(retry.intentAt)))
+        return "new-user-input";
+    if (blockingProviderContinuations(store.listEvents(input.taskId)).some(c => c.roleName === input.roleName && c.identity.conversationId === retry.nativeSessionId)) {
+        return "background-work-unsettled";
+    }
+    return undefined;
+}
+/** Shared by automatic recovery and every ordinary Host submit. The native
+ * writer CAS remains the only grant; a scheduled successor is not a grant. */
+export function admitOwnedProviderInput(store, binding, input) {
+    const retry = binding.retry;
+    const sameReviewSuccessor = retry?.successorReviewRoundId !== undefined && input.taskId !== undefined && input.runId !== undefined
+        && store.getRun(input.taskId, input.runId)?.reviewRoundId === retry.successorReviewRoundId;
+    if (retry !== undefined && !providerRetryPending(binding)
+        && (input.attemptId.startsWith("provider-retry:") || input.runId !== undefined && input.runId === retry.successorRunId
+            || sameReviewSuccessor)) {
+        throw new Error(`Provider retry is ${retry.status}; this scheduled successor cannot regain admission.`);
+    }
+    if (!providerRetryPending(binding) || retry === undefined)
+        return binding;
+    const automatic = input.attemptId === providerRetryAttemptId(retry)
+        || input.runId !== undefined && input.runId === retry.successorRunId
+        || input.runId !== undefined && input.taskId !== undefined && retry.successorReviewRoundId !== undefined
+            && store.getRun(input.taskId, input.runId)?.reviewRoundId === retry.successorReviewRoundId
+        || retry.status === "in-flight" && input.attemptId === retry.currentAttemptId;
+    if (!automatic)
+        return cancelProviderRetry(binding, "superseded-by-explicit-input", input.now.getTime());
+    const blocker = retryIntentBlocker(store, input, retry);
+    if (blocker !== undefined)
+        throw new Error(`Provider retry admission stopped: ${blocker}.`);
+    if (input.retrySupported !== true)
+        throw new Error("This Host cannot prove safe same-Session recovery; use explicit recovery.");
+    if (binding.goal?.status === "active")
+        throw new Error("Provider still owns an autonomous Goal; inspect its exact continuation.");
+    if (input.taskId !== undefined && input.runId !== undefined) {
+        const run = store.getRun(input.taskId, input.runId);
+        const sessions = store.getTaskRoleSessionSet(input.taskId, input.roleName);
+        if (run === null || run.status !== "active"
+            || !isDeepStrictEqual(run.effective, sessions?.sessions[input.agentId]?.effective)) {
+            throw new Error("Retry execution no longer matches its fixed native Session.");
+        }
+        if (run.workspace !== undefined && !isDeepStrictEqual(store.getManagedWorkspace(run.workspace.owner), run.workspace)) {
+            throw new Error("Retry workspace authority changed.");
+        }
+        if (run.workItemId !== undefined) {
+            const item = store.getWorkItem(input.taskId, run.workItemId);
+            if (item?.status !== "open" || run.purpose !== "review" && run.executionLaneId === undefined
+                && item.assignee !== run.roleName)
+                throw new Error("Retry WorkItem responsibility changed.");
+        }
+        if (validateExactRunReviewRound(store, run).disposition !== "applied") {
+            throw new Error("Retry Review no longer matches its exact Round and frozen candidate.");
+        }
+    }
+    const admitted = admitProviderRetry(binding, { attemptId: input.attemptId, at: input.now.getTime() });
+    return input.runId === undefined ? admitted
+        : { ...admitted, retry: { ...admitted.retry, successorRunId: input.runId } };
+}

package/dist/controller/providerRetryDelivery.js

@@ -0,0 +1,218 @@
+import { performance } from "node:perf_hooks";
+import { runTaskCommand } from "../commands/taskCommands.js";
+import { retryIntentBlocker } from "./providerRetryAdmission.js";
+import { cancelProviderRetry, providerRetryAttemptId, providerRetryPending } from "../runtime/providerRetry.js";
+import { currentProviderConversation } from "../runtime/providerRuntimeIdentity.js";
+import { runtimeLifecycleTarget, hasRuntimeCleanupObligation } from "../runtime/lifecycleReservation.js";
+import { sendAgentHostRunControl, inspectAgentHostSocket, agentHostControlSocketPath, AGENT_HOST_CONTROL_PROTOCOL } from "../runtime/agentHost.js";
+import { redactAgentErrorText } from "../runtime/agentError.js";
+import { createTaskEvent } from "../event/taskEvent.js";
+import { enqueueWork } from "../coordination/workMailboxQueue.js";
+import { settleGlobalRetryInput } from "../message/globalProviderRetry.js";
+/** Hooks in the existing Controller pass and nearest-deadline timer. SQLite's
+ * current Provider input is the only pending intent; nothing is queued here. */
+export function createProviderRetryHooks(home, store, ports = {}) {
+    const anchors = new Map();
+    const inspectedUnknown = new Set();
+    const inspect = ports.inspect ?? ((target) => inspectAgentHostSocket(agentHostControlSocketPath(target), 250));
+    const now = (retry) => {
+        const wall = (ports.now ?? (() => new Date()))().getTime();
+        const monotonic = (ports.monotonicNow ?? (() => performance.now()))();
+        let anchor = anchors.get(retry.chainId);
+        if (anchor === undefined) {
+            anchor = { wall: Math.max(wall, Date.parse(retry.updatedAt)), monotonic };
+            anchors.set(retry.chainId, anchor);
+        }
+        return Math.max(wall, anchor.wall + Math.max(0, monotonic - anchor.monotonic));
+    };
+    const load = (owner) => owner.scope === "task"
+        ? store.getTaskRoleSessionSet(owner.taskId, owner.roleName) : store.getGlobalRoleSessionSet(owner.roleName);
+    const save = (set) => {
+        if (set.owner.scope === "task")
+            store.saveTaskRoleSessionSet(set);
+        else
+            store.saveGlobalRoleSessionSet(set);
+    };
+    const stop = (set, reason, at, exhausted = false) => {
+        store.transaction(() => {
+            const current = load(set.owner);
+            if (current === null || current.providerBinding?.retry?.chainId !== set.providerBinding?.retry?.chainId)
+                return;
+            const binding = current.providerBinding;
+            if (!providerRetryPending(binding))
+                return;
+            const cancelled = cancelProviderRetry(binding, reason, at);
+            save({ ...current, providerBinding: exhausted
+                    ? { ...cancelled, retry: { ...cancelled.retry, status: "exhausted" } } : cancelled });
+            const owner = set.owner;
+            if (owner.scope === "global")
+                settleGlobalRetryInput(store, owner.roleName, load(owner)?.providerBinding, new Date(at));
+            if (owner.scope === "task") {
+                const event = createTaskEvent(store.nextEventId(owner.taskId), owner.taskId, "provider.retry-stopped", {
+                    roleName: owner.roleName, chainId: binding.retry.chainId, reason
+                }, new Date(at));
+                store.saveEvent(owner.taskId, event);
+                enqueueWork(store, owner.roleName === "leader" ? { kind: "operator" }
+                    : { kind: "role", taskId: owner.taskId, roleName: "leader" }, "provider-retry-needs-attention", new Date(at), [{ type: "event", taskId: owner.taskId, id: event.id }]);
+            }
+        });
+    };
+    const key = (set) => set.owner.scope === "task"
+        ? `role:${encodeURIComponent(set.owner.taskId)}/${encodeURIComponent(set.owner.roleName)}`
+        : `global-role:${encodeURIComponent(set.owner.roleName)}`;
+    return {
+        deadlines() {
+            return store.listProviderRetrySessions().flatMap(set => {
+                const retry = set.providerBinding.retry;
+                if (retry.status !== "waiting")
+                    return [];
+                // Busy or already-queued work awaits the next ordinary pass without a
+                // zero-delay timer loop. Waiting never consumes an execution attempt.
+                const wall = (ports.now ?? (() => new Date()))().getTime();
+                const effective = now(retry);
+                return [{ key: key(set), at: wall + Math.max(250, (retry.successorAutomatic === false ? Date.parse(retry.nextEligibleAt)
+                            : Math.min(Date.parse(retry.nextEligibleAt), Date.parse(retry.deadline))) - effective) }];
+            });
+        },
+        async reconcile() {
+            const current = store.listProviderRetrySessions();
+            const activeChains = new Set(current.map(set => set.providerBinding.retry.chainId));
+            for (const id of anchors.keys())
+                if (!activeChains.has(id))
+                    anchors.delete(id);
+            const pendingAttempts = new Set(current.map(set => set.providerBinding.retry.currentAttemptId));
+            for (const id of inspectedUnknown)
+                if (!pendingAttempts.has(id))
+                    inspectedUnknown.delete(id);
+            for (const set of current) {
+                const owner = set.owner;
+                const binding = set.providerBinding;
+                const retry = binding.retry;
+                const at = now(retry);
+                const scoped = { ...(owner.scope === "task" ? { taskId: owner.taskId } : {}), roleName: owner.roleName };
+                const session = set.sessions[set.activeAgentId];
+                const blocker = retryIntentBlocker(store, scoped, retry);
+                if (blocker !== undefined && blocker !== "background-work-unsettled") {
+                    stop(set, blocker, at);
+                    continue;
+                }
+                if (binding.retryDisabled && retry.successorAutomatic !== false || binding.authority.owner !== "controller"
+                    || binding.authority.epoch !== retry.authorityEpoch
+                    || currentProviderConversation(binding).conversationId !== retry.nativeSessionId
+                    || session?.status !== "active" || session.nativeSessionId !== retry.nativeSessionId
+                    || hasRuntimeCleanupObligation(store.getWorkMailbox(runtimeLifecycleTarget(owner)))) {
+                    stop(set, "session-or-authority-changed", at);
+                    continue;
+                }
+                // Never replay an admitted attempt. Existing exact runtime queries and
+                // terminal ingress resolve it, even across Controller restart.
+                if (retry.status === "in-flight") {
+                    if (binding.run?.status === "delivery-unknown" && retry.currentAttemptId !== undefined
+                        && !inspectedUnknown.has(retry.currentAttemptId)) {
+                        inspectedUnknown.add(retry.currentAttemptId);
+                        let detail;
+                        try {
+                            const host = await inspect({ home, ...scoped, scope: owner.scope });
+                            detail = host.nativeSessionId === retry.nativeSessionId && host.attemptId === retry.currentAttemptId
+                                ? `Exact Host query: ${host.state}; awaiting original canonical Provider evidence.`
+                                : "Host query did not prove the original Session/input identity; no replay.";
+                        }
+                        catch (error) {
+                            detail = `Original Host query unavailable; no replay: ${redactAgentErrorText(error instanceof Error ? error.message : String(error))}`;
+                        }
+                        store.transaction(() => {
+                            const latest = load(owner);
+                            if (latest === null || latest.providerBinding == null || latest.providerBinding.run === null
+                                || latest.providerBinding.run.attemptId !== retry.currentAttemptId
+                                || latest.providerBinding.run.status !== "delivery-unknown")
+                                return;
+                            save({ ...latest, providerBinding: { ...latest.providerBinding,
+                                    retry: { ...latest.providerBinding.retry, reason: detail } } });
+                            if (owner.scope === "task") {
+                                const event = createTaskEvent(store.nextEventId(owner.taskId), owner.taskId, "provider.retry-unconfirmed", {
+                                    roleName: owner.roleName, attemptId: retry.currentAttemptId, nativeSessionId: retry.nativeSessionId, detail
+                                }, new Date(at));
+                                store.saveEvent(owner.taskId, event);
+                                enqueueWork(store, owner.roleName === "leader" ? { kind: "operator" }
+                                    : { kind: "role", taskId: owner.taskId, roleName: "leader" }, "provider-retry-needs-attention", new Date(at), [{ type: "event", taskId: owner.taskId, id: event.id }]);
+                            }
+                        });
+                    }
+                    continue;
+                }
+                if (retry.successorAutomatic !== false && at >= Date.parse(retry.deadline)) {
+                    stop(set, "deadline-exhausted", at, true);
+                    continue;
+                }
+                if (at < Date.parse(retry.nextEligibleAt) || blocker !== undefined || binding.goal?.status === "active")
+                    continue;
+                if (binding.run?.attemptId !== retry.failedAttemptId) {
+                    stop(set, "superseded-input", at);
+                    continue;
+                }
+                try {
+                    if (owner.scope === "task" && retry.previousRunId !== undefined) {
+                        if (retry.successorRunId !== undefined || retry.successorReviewRoundId !== undefined)
+                            continue;
+                        const previous = store.getRun(owner.taskId, retry.previousRunId);
+                        if (previous?.status === "active")
+                            continue; // ordinary rejected-delivery terminal fold
+                        if (previous?.status !== "failed") {
+                            stop(set, "run-no-longer-failed", at);
+                            continue;
+                        }
+                        const actualTaskReviewCandidate = await ports.snapshotTaskCandidate?.(previous);
+                        store.transaction(() => {
+                            const latest = load(owner)?.providerBinding?.retry;
+                            if (latest?.chainId !== retry.chainId || latest.failedAttemptId !== retry.failedAttemptId
+                                || latest.status !== "waiting")
+                                return;
+                            const reason = retryIntentBlocker(store, scoped, latest);
+                            if (reason !== undefined)
+                                throw new Error(reason);
+                            runTaskCommand(["run", "retry", `${owner.taskId}/${previous.id}`], store, {
+                                now: () => new Date(at), environment: {}, providerRetryChainId: retry.chainId,
+                                ...(actualTaskReviewCandidate === undefined ? {} : { actualTaskReviewCandidate })
+                            });
+                        });
+                    }
+                    else {
+                        const original = retry.input.kind === "text" ? retry.input.text
+                            : retry.input.kind === "wake"
+                                ? `Yui Task notification: task=${retry.input.taskId} wake=${retry.input.wakeId}.\nRead current Task context and that fixed wake window, including original Messages in full. This is not an execution assignment.`
+                                : retry.input.kind === "message"
+                                    ? `Yui Global Message: role=${retry.input.roleName} message=${retry.input.messageId}.\nRead your Session Context and referenced original Message in full.`
+                                    : undefined;
+                        if (original === undefined) {
+                            stop(set, "original-input-unavailable", at);
+                            continue;
+                        }
+                        const result = await (ports.submit ?? sendAgentHostRunControl)({
+                            home, ...scoped, scope: owner.scope,
+                            control: {
+                                protocol: AGENT_HOST_CONTROL_PROTOCOL, type: "submit-turn", nativeSessionId: retry.nativeSessionId,
+                                authority: { epoch: binding.authority.epoch, owner: "controller", holderId: binding.authority.holderId },
+                                run: { attemptId: providerRetryAttemptId(retry), boundedText: original }
+                            }
+                        });
+                        // Durable settlement belongs to Host/Controller ingress. In
+                        // particular a lost response is never a reason to replay.
+                        if (result.outcome === "rejected" && result.failure?.registrationDisposition === "not-committed"
+                            && result.failure.errorName !== "ProviderTurnBusyError") {
+                            stop(set, result.failure.detail, at);
+                        }
+                    }
+                }
+                catch (error) {
+                    // A send failure may have applied. A durable submitting/unknown
+                    // identity fences it; do not manufacture a successor to uncertainty.
+                    const latest = load(owner);
+                    if (latest?.providerBinding?.run?.attemptId === retry.failedAttemptId) {
+                        stop(set, error instanceof Error ? error.message : String(error), at);
+                    }
+                    ports.onError?.(error);
+                }
+            }
+        }
+    };
+}

package/dist/controller/runtime.js

@@ -46,6 +46,8 @@ import { classifyRuntimeProcessExit, validateRuntimeProcessExitObservation } fro
 import { replayRuntimeProcessExitOutbox } from "../runtime/processExitOutbox.js";
 import { appendGlobalProcessExitObservation } from "../runtime/globalProcessExitStore.js";
 import { deliverGlobalInputs } from "./globalInputDelivery.js";
+import { providerRetryPrompt } from "../runtime/providerRetry.js";
+import { createProviderRetryHooks } from "./providerRetryDelivery.js";
 import { createGlobalRoleMessage } from "../message/message.js";
 import { builtinAgentDriverRegistry } from "../runtime/builtinAgentDrivers.js";
 import { createRuntimeObservation, runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
@@ -470,6 +472,26 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
             now: options.now,
             onError: options.onError,
             lifecycleHost,
+            providerRetry: createProviderRetryHooks(home, store, {
+                now: options.now,
+                onError: options.onError,
+                snapshotTaskCandidate: async (run) => {
+                    if (run.purpose !== "review" || run.reviewRoundId === undefined)
+                        return undefined;
+                    const round = store.getReviewRound(run.taskId, run.reviewRoundId);
+                    if (round?.scope !== "task")
+                        return undefined;
+                    const task = store.getTask(run.taskId);
+                    const workspace = store.getTaskWorkspace(run.taskId);
+                    if (task === null || workspace === null || !(workspacePreparer instanceof FileTaskWorkspacePreparer)) {
+                        throw new Error("Task-final retry requires an observable authoritative Task workspace.");
+                    }
+                    const snapshot = await workspacePreparer.snapshotDirectTaskMain(workspace, task.projectBindings.map(p => p.projectId));
+                    return { schemaVersion: 1, projects: snapshot.projects.map(p => ({
+                            projectId: p.projectId, commit: p.headCommit
+                        })) };
+                }
+            }),
             jobSupervisor,
             globalInputDelivery: () => deliverGlobalInputs(home, store, async (roleName) => {
                 await lifecycleDispatcher("runtime.ensure-role-session", { scope: "global", roleName });
@@ -617,6 +639,8 @@ export function createRuntimeLifecycleDispatcher(store, schedulerStore, sessionH
                     authorityEpoch: value.authorityEpoch,
                     authorityOwner: value.authorityOwner,
                     holderId: value.holderId,
+                    boundedText: value.boundedText,
+                    retrySupported: value.retrySupported,
                     now: value.now
                 });
             }
@@ -628,7 +652,15 @@ export function createRuntimeLifecycleDispatcher(store, schedulerStore, sessionH
                 }
                 throw error;
             }
-            return { recorded: true };
+            const binding = (value.taskId === undefined
+                ? store.getGlobalRoleSessionSet(value.roleName)
+                : store.getTaskRoleSessionSet(value.taskId, value.roleName))?.providerBinding;
+            const retry = binding?.retry;
+            return { recorded: true, ...(retry?.currentAttemptId === value.attemptId && value.boundedText !== undefined
+                    ? { retryInput: {
+                            text: providerRetryPrompt(retry, value.boundedText),
+                            ...(retry.failedNativeTurnId === undefined ? {} : { expectedFailedNativeTurnId: retry.failedNativeTurnId })
+                        } } : {}) };
         }
         if (method === "runtime.provider-turn-submission-resolve") {
             const value = providerTurnControlParams(params);
@@ -648,6 +680,7 @@ export function createRuntimeLifecycleDispatcher(store, schedulerStore, sessionH
                 status,
                 reason,
                 raw,
+                noProviderWrite: params.providerWrite === "not-issued",
                 now: value.now
             });
             return { recorded: true };
@@ -1207,6 +1240,8 @@ function providerTurnControlParams(params) {
         authorityEpoch: authorityEpoch,
         authorityOwner,
         holderId: requiredParam(value.holderId),
+        ...(value.boundedText === undefined ? {} : { boundedText: requiredParam(value.boundedText) }),
+        ...(value.retrySupport === undefined ? {} : { retrySupported: value.retrySupport === "codex-failed-turn-v1" }),
         now: new Date(observedAt)
     };
 }

package/dist/integration/gitIntegrationService.js

@@ -76,7 +76,7 @@ export class GitIntegrationService {
     #resourceRegistrar() {
         return this.#resourceRegistrarValue ??= new ResourceRegistrar(this.home, this.now);
     }
-    async integrate(taskId, integrationId) {
+    async integrate(taskId, integrationId, signal) {
         let initial = requireIntegration(this.store, taskId, integrationId);
         if (!["running", "conflicted", "blocked", "validating"].includes(initial.status)) {
             throw new Error(`Integration cannot continue from ${initial.status}.`);
@@ -86,7 +86,7 @@ export class GitIntegrationService {
         // CAS. A concurrent `project migrate` must not switch the catalog path or
         // remove the old checkout mid-Integration, so the per-Project maintenance
         // fence is held across every Git effect and released only on exit.
-        const release = acquireProjectMaintenanceLocks(this.home, [initial.projectId]);
+        const release = await acquireProjectMaintenanceLocks(this.home, [initial.projectId], { signal });
         try {
             // A concurrent abort may have settled the attempt while this caller was
             // acquiring the same Project fence. Never execute a pre-fence snapshot.
@@ -260,9 +260,9 @@ export class GitIntegrationService {
     /** Abandon under the same fence as Git/CAS, not just a status whitelist.
      * A delivered validating candidate is recorded as committed; a provably
      * unadvanced one may be abandoned without requiring obsolete check settings. */
-    async abort(taskId, integrationId, reason, authorize) {
+    async abort(taskId, integrationId, reason, authorize, signal) {
         const initial = requireIntegration(this.store, taskId, integrationId);
-        const release = acquireProjectMaintenanceLocks(this.home, [initial.projectId]);
+        const release = await acquireProjectMaintenanceLocks(this.home, [initial.projectId], { signal });
         try {
             const attempt = requireIntegration(this.store, taskId, integrationId);
             authorize(this.store, taskId);
@@ -338,12 +338,25 @@ export class GitIntegrationService {
             release();
         }
     }
-    async cleanup(integration) {
+    async cleanup(integration, options = {}) {
         // The whole cleanup is one Git transaction against the Project's
         // repository, mirroring integrate(): a concurrent `project migrate` must
         // not switch the catalog path or remove the old checkout mid-cleanup.
-        const release = acquireProjectMaintenanceLocks(this.home, [integration.projectId]);
+        const release = await acquireProjectMaintenanceLocks(this.home, [integration.projectId], { signal: options.signal });
         try {
+            options.authorize?.();
+            const current = requireIntegration(this.store, integration.taskId, integration.id);
+            if (current.projectId !== integration.projectId
+                || !["committed", "superseded", "failed"].includes(current.status)) {
+                throw new Error("Integration changed before cleanup; read its current record.");
+            }
+            integration = current;
+            const activeJob = this.store.listDurableJobs(integration.taskId).find(job => job.owner.kind === "integration-attempt" && job.owner.integrationAttemptId === integration.id
+                && (job.status === "queued" || job.status === "running"
+                    || (job.status === "unknown-needs-attention" && job.acknowledgedAt === undefined)));
+            if (activeJob !== undefined) {
+                throw new Error(`Integration ${integration.id} has an active DurableJob: ${activeJob.id}/${activeJob.status}.`);
+            }
             const task = this.store.getTask(integration.taskId);
             if (task === null || !task.projectBindings.some(({ projectId }) => projectId === integration.projectId)) {
                 throw new Error(`Integration Task Project is unavailable: ${integration.id}.`);

package/dist/lifecycle/exactRunTerminalization.js

@@ -1,5 +1,6 @@
 import { isDeepStrictEqual } from "node:util";
 import { createTaskMessage } from "../message/message.js";
+import { providerRetryPending } from "../runtime/providerRetry.js";
 import { captureRoleRunDispatch, enqueueWork, settleRoleRunDispatch } from "../coordination/workMailboxQueue.js";
 import { finishReviewRound, updateReviewExecutionGroup } from "../review/reviewRound.js";
 import { completeRun, failRun, runPurposeAdmitsTaskState } from "../agentRun/agentRun.js";
@@ -394,7 +395,9 @@ export function terminalizeExactTaskRun(store, input, now) {
         const message = createTaskMessage(store.nextMessageId(terminal.taskId), terminal.taskId, `Execution ${terminal.id} ${terminal.status}.`, "role-result", { type: "role", roleName: terminal.roleName }, now, { resultRef: { type: "agent-run-result", runId: terminal.id }, ...(terminal.workItemId === undefined
                 ? {} : { workItemId: terminal.workItemId }) });
         store.saveMessage(terminal.taskId, message);
-        enqueueWork(store, { kind: "role", taskId: terminal.taskId, roleName: "leader" }, "role-result", now, [{ type: "message", taskId: terminal.taskId, id: message.id }], { source: "task-event", dedupeKey: `result:${terminal.taskId}/${terminal.id}` });
+        if (!providerRetryPending(store.getTaskRoleSessionSet(terminal.taskId, terminal.roleName)?.providerBinding)) {
+            enqueueWork(store, { kind: "role", taskId: terminal.taskId, roleName: "leader" }, "role-result", now, [{ type: "message", taskId: terminal.taskId, id: message.id }], { source: "task-event", dedupeKey: `result:${terminal.taskId}/${terminal.id}` });
+        }
     }
     const dispatchIdentity = {
         taskId: terminal.taskId,

package/dist/message/globalProviderRetry.js

@@ -0,0 +1,15 @@
+import { markGlobalRoleMessageNotDelivered } from "./message.js";
+/** Settle the original queue entry when recovery ends with exact nondelivery.
+ * Cancellation of a submitted/unknown request is not negative Provider proof. */
+export function settleGlobalRetryInput(store, roleName, binding, now) {
+    const retry = binding?.retry;
+    if (retry === undefined || retry.input.kind !== "message" || retry.input.roleName !== roleName
+        || !["cancelled", "exhausted", "needs-attention"].includes(retry.status)
+        || binding?.run == null || ["submitting", "accepted", "delivery-unknown"].includes(binding.run.status))
+        return;
+    const messageId = retry.input.messageId;
+    const message = store.listGlobalRoleMessages(roleName).find(m => m.id === messageId);
+    if (message === undefined || message.delivery !== undefined || message.notDelivered !== undefined)
+        return;
+    store.updateGlobalRoleMessage(markGlobalRoleMessageNotDelivered(message, `provider-retry-${retry.status}: ${retry.reason ?? retry.failureRef}`, now));
+}

package/dist/observability/executionAudit.js

@@ -15,6 +15,7 @@ import { join } from "node:path";
 import { openCurrentTaskStore } from "../storage/currentTaskStore.js";
 import { resolveTaskStoreBackendForHome } from "../storage/sqliteStore.js";
 import { runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
+import { projectTaskUsageMetrics } from "../runtime/taskUsageMetrics.js";
 import { classifyRunFailure, classifyIntegrationAttempt, classifyReviewRound, countFaultClasses } from "./faultClassification.js";
 import { RUNTIME_LAUNCH_KINDS, RUNTIME_LAUNCH_PHASES } from "../runtime/launchDiagnostics.js";
 import { UNSUPPORTED } from "./runtimeIdentity.js";
@@ -192,6 +193,7 @@ export function runExecutionAudit(home, options = {}, ports = createProductionEx
             agentErrors: section,
             workItems: section,
             orchestration: section,
+            usage: section,
             storage: section,
             runtimeProtocol: section,
             topLongRunning: section
@@ -658,6 +660,22 @@ export function runExecutionAudit(home, options = {}, ports = createProductionEx
             return failed(error);
         }
     })();
+    const usage = (() => {
+        try {
+            return ok(taskIds.map((taskId) => {
+                const task = store.getTask(taskId);
+                if (task === null)
+                    throw new Error(`Task not found: ${taskId}.`);
+                return projectTaskUsageMetrics({
+                    task, events: store.listEvents(taskId), runs: store.listRuns(taskId),
+                    now: new Date(generatedAt)
+                });
+            }));
+        }
+        catch (error) {
+            return failed(error);
+        }
+    })();
     const storage = (() => {
         try {
             let stateJsonBytes = UNSUPPORTED;
@@ -796,6 +814,7 @@ export function runExecutionAudit(home, options = {}, ports = createProductionEx
         agentErrors,
         workItems,
         orchestration,
+        usage,
         storage,
         runtimeProtocol,
         topLongRunning