@zq-silk/yui 0.6.13 → 0.6.14

package/dist/review/deltaRecheck.js

@@ -0,0 +1,232 @@
+import { createHash } from "node:crypto";
+import { deltaRecheckMaxChangedFiles, deltaRecheckMaxChangedLines } from "./reviewConfig.js";
+import { validateDeltaRecheckRecord } from "./reviewRound.js";
+/**
+ * Assesses whether a delta-recheck may be attempted.  Every deterministic
+ * gate fails closed here; semantic equivalence is always left to the
+ * Reviewer's explicit disposition.
+ */
+export async function assessDeltaRecheck(input) {
+    const { repositoryPath, previousRound, candidate, git, config } = input;
+    if (previousRound.status !== "completed"
+        || (previousRound.scope ?? "work-item") !== "task") {
+        return {
+            kind: "ineligible",
+            reason: "Delta recheck requires a completed Task-final ReviewRound."
+        };
+    }
+    if (previousRound.taskCandidate === undefined) {
+        return {
+            kind: "ineligible",
+            reason: "Previous Task-final ReviewRound has no frozen candidate."
+        };
+    }
+    const previousByProject = new Map(previousRound.taskCandidate.projects.map((project) => [project.projectId, project.commit]));
+    const diffByProject = {};
+    const changedFiles = [];
+    let addedLines = 0;
+    let deletedLines = 0;
+    let anyChange = false;
+    for (const project of candidate.projects) {
+        const previousHead = previousByProject.get(project.projectId);
+        if (previousHead === undefined) {
+            return {
+                kind: "ineligible",
+                reason: `Delta recheck scope changed: Project ${project.projectId} was not in the previous Review.`
+            };
+        }
+        if (previousHead === project.commit)
+            continue;
+        if (!await git.isAncestor(repositoryPath, previousHead, project.commit)) {
+            return {
+                kind: "ineligible",
+                reason: `Delta recheck requires a contiguous base: ${project.projectId} ${previousHead} `
+                    + `is not an ancestor of ${project.commit}.`
+            };
+        }
+        let files;
+        let numstat;
+        let diffText;
+        try {
+            files = await git.changedFilesBetween({
+                repositoryPath,
+                fromCommit: previousHead,
+                toCommit: project.commit
+            });
+            numstat = await git.diffNumstatBetween({
+                repositoryPath,
+                fromCommit: previousHead,
+                toCommit: project.commit
+            });
+            diffText = await git.diffTextBetween({
+                repositoryPath,
+                fromCommit: previousHead,
+                toCommit: project.commit
+            });
+        }
+        catch (error) {
+            return {
+                kind: "ineligible",
+                reason: `Delta recheck cannot assess the diff for ${project.projectId}: `
+                    + `${error instanceof Error ? error.message : String(error)}`
+            };
+        }
+        diffByProject[project.projectId] = diffText;
+        changedFiles.push(...files);
+        addedLines += numstat.addedLines;
+        deletedLines += numstat.deletedLines;
+        anyChange = true;
+    }
+    if (!anyChange) {
+        return {
+            kind: "ineligible",
+            reason: "Frozen heads are unchanged; the previous acceptance already covers this candidate."
+        };
+    }
+    const maxFiles = deltaRecheckMaxChangedFiles(config);
+    if (changedFiles.length > maxFiles) {
+        return {
+            kind: "ineligible",
+            reason: `Delta recheck attempt threshold exceeded: ${changedFiles.length} changed file(s) > ${maxFiles}.`
+        };
+    }
+    const maxLines = deltaRecheckMaxChangedLines(config);
+    if (addedLines + deletedLines > maxLines) {
+        return {
+            kind: "ineligible",
+            reason: `Delta recheck attempt threshold exceeded: ${addedLines + deletedLines} changed line(s) > ${maxLines}.`
+        };
+    }
+    // Evidence overlap: a diff touching a file the previous Round cited as
+    // evidence cannot be proven equivalent by a delta recheck.
+    const evidencePaths = extractEvidencePaths(previousRound);
+    const overlapping = changedFiles.filter((file) => (evidencePaths.some((evidence) => pathEvidenceMatches(evidence, file))));
+    if (overlapping.length > 0) {
+        return {
+            kind: "ineligible",
+            reason: "Delta recheck cannot prove evidence validity for changed evidence file(s): "
+                + `${overlapping.join(", ")}.`
+        };
+    }
+    const record = validateDeltaRecheckRecord({
+        schemaVersion: 1,
+        previousReviewRoundId: previousRound.id,
+        previousBaseCommit: previousRound.taskCandidate.projects[0].commit,
+        diffDigest: digestDiff(diffByProject),
+        changedFiles,
+        addedLines,
+        deletedLines
+    });
+    return { kind: "eligible", preflight: { record, diffByProject } };
+}
+/** Fails closed when the dispatch diff does not match the recorded digest. */
+export function verifyDeltaRecheckDiff(record, diffByProject) {
+    if (digestDiff(diffByProject) !== record.diffDigest) {
+        throw new Error("Delta recheck diff digest does not match the recorded recheck.");
+    }
+}
+/** Builds the delta-recheck dispatch context block. */
+export function buildDeltaRecheckDispatchContext(input) {
+    const { round, previousRound, diffByProject, ledgerContext } = input;
+    const record = round.deltaRecheck;
+    if (record === undefined) {
+        throw new Error(`ReviewRound is not a delta-recheck: ${round.id}.`);
+    }
+    const lines = [
+        "Review mode: delta-recheck (Issue 07). This is a fresh Review of the new frozen head;",
+        "the previous acceptance is evidence, not a shortcut. You may return exactly one disposition:",
+        "- equivalent-and-accepted: you proved the diff preserves every accepted semantic and",
+        "  every evidence reference below remains valid. State the proof explicitly.",
+        "- finding: the diff introduces a material problem; report it as a finding.",
+        "- requires-full-review: you cannot prove equivalence (uncertainty, cross-scope,",
+        "  semantic change, evidence doubt). This is the safe default.",
+        "Path/line thresholds only allowed this attempt; they never imply safety.",
+        `Previous accepted ReviewRound: ${previousRound.id}@${record.previousBaseCommit}`,
+        `Previous acceptance summary: ${compact(previousRound.summary ?? previousRound.report ?? "")}`,
+        ...(round.taskCandidate?.projects.map((project) => {
+            const previous = previousRound.taskCandidate?.projects
+                .find((entry) => entry.projectId === project.projectId)?.commit;
+            return previous === project.commit
+                ? `Exact boundary for ${project.projectId}: unchanged at ${project.commit}`
+                : `Exact diff for ${project.projectId}: ${previous}..${project.commit}`;
+        }) ?? []),
+        `Changed files: ${record.changedFiles.join(", ") || "none"}`,
+        `Diff size: +${record.addedLines}/-${record.deletedLines} (digest ${record.diffDigest})`,
+        "Precise diff:",
+        ...Object.entries(diffByProject).flatMap(([projectId, diff]) => (diff.trim().length === 0
+            ? []
+            : [`--- ${projectId} ---`, diff])),
+        ...(previousEvidenceReferences(previousRound).length === 0
+            ? []
+            : [
+                "Previous evidence references:",
+                ...previousEvidenceReferences(previousRound).map((entry) => `- ${entry}`)
+            ]),
+        ledgerContext,
+        "Report JSON with deltaDisposition (one of the three values above) and deltaReasoning",
+        "(the explicit proof or the reason a full Review is required). Findings, checks, and",
+        "evidence use the same fields as a full Review."
+    ];
+    return lines.join("\n");
+}
+function compact(text, limit = 600) {
+    const flattened = text.replace(/\s+/gu, " ").trim();
+    return flattened.length <= limit ? flattened : `${flattened.slice(0, limit)}...`;
+}
+function digestDiff(diffByProject) {
+    const canonical = JSON.stringify(Object.entries(diffByProject)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([projectId, diff]) => [projectId, diff]));
+    return createHash("sha256").update(canonical).digest("hex");
+}
+/**
+ * Extracts path-like evidence references from the previous Round's report.
+ * Free-form evidence that is not a path is still passed to the Reviewer in
+ * the dispatch context; only path-like entries drive the deterministic gate.
+ */
+function extractEvidencePaths(round) {
+    return [...new Set(extractEvidenceFromReportJson(round.report ?? ""))]
+        .filter((entry) => isPathLike(entry));
+}
+/** All evidence references from the previous Round's JSON report. */
+function previousEvidenceReferences(round) {
+    return extractEvidenceFromReportJson(round.report ?? "");
+}
+function extractEvidenceFromReportJson(report) {
+    let parsed;
+    try {
+        parsed = JSON.parse(report);
+    }
+    catch {
+        return [];
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+        return [];
+    const evidence = parsed.evidence;
+    if (!Array.isArray(evidence))
+        return [];
+    return evidence
+        .filter((entry) => typeof entry === "string")
+        .map((entry) => entry.trim());
+}
+function isPathLike(value) {
+    if (value.length === 0 || value.length > 512)
+        return false;
+    if (/\s/u.test(value))
+        return false;
+    if (value.includes("://"))
+        return false;
+    // A repo-relative path: at least one slash or a known file extension, no
+    // shell/argument metacharacters.
+    if (/[;&|`$(){}!<>]/u.test(value))
+        return false;
+    return value.includes("/") || /\.[A-Za-z0-9]{1,12}$/u.test(value);
+}
+function pathEvidenceMatches(evidencePath, changedFile) {
+    const normalizedEvidence = evidencePath.replace(/^\.\//u, "");
+    const normalizedFile = changedFile.replace(/^\.\//u, "");
+    if (normalizedEvidence === normalizedFile)
+        return true;
+    // A directory-level evidence reference covers every file under it.
+    return normalizedFile.startsWith(`${normalizedEvidence}/`);
+}

package/dist/review/reviewConfig.js

@@ -6,6 +6,11 @@ export const REVIEW_TRIGGERS = ["always", "leader", "final"];
  * Task completion closed on undispositioned open P1/P2 findings.
  */
 export const REVIEW_FINDING_LEDGER_MODES = ["shadow", "enforce"];
+/** Issue 07: delta-recheck is opt-in per Project review policy. */
+export const REVIEW_DELTA_RECHECK_MODES = ["enabled", "disabled"];
+/** Issue 07: conservative defaults for whether a delta attempt is allowed. */
+export const DEFAULT_DELTA_RECHECK_MAX_CHANGED_LINES = 200;
+export const DEFAULT_DELTA_RECHECK_MAX_CHANGED_FILES = 5;
 /** The Reviewer Role seeded in a new Home by `yui setup`. */
 export const DEFAULT_REVIEWER_ROLE = "reviewer";
 export function validateReviewConfig(config) {
@@ -17,5 +22,31 @@ export function validateReviewConfig(config) {
         && !REVIEW_FINDING_LEDGER_MODES.includes(config.findingLedger)) {
         throw new Error(`Review finding ledger mode is invalid: ${String(config.findingLedger)}.`);
     }
+    if (config.deltaRecheck !== undefined
+        && !REVIEW_DELTA_RECHECK_MODES.includes(config.deltaRecheck)) {
+        throw new Error(`Review delta-recheck mode is invalid: ${String(config.deltaRecheck)}.`);
+    }
+    if (config.deltaRecheckMaxChangedLines !== undefined
+        && (!Number.isInteger(config.deltaRecheckMaxChangedLines)
+            || config.deltaRecheckMaxChangedLines < 1)) {
+        throw new Error("Review delta-recheck max changed lines must be a positive integer.");
+    }
+    if (config.deltaRecheckMaxChangedFiles !== undefined
+        && (!Number.isInteger(config.deltaRecheckMaxChangedFiles)
+            || config.deltaRecheckMaxChangedFiles < 1)) {
+        throw new Error("Review delta-recheck max changed files must be a positive integer.");
+    }
     return config;
 }
+/** Issue 07: resolves the delta-recheck policy; absent config defaults to disabled. */
+export function deltaRecheckEnabled(config) {
+    return config?.deltaRecheck === "enabled";
+}
+/** Issue 07: resolves the line threshold with its conservative default. */
+export function deltaRecheckMaxChangedLines(config) {
+    return config?.deltaRecheckMaxChangedLines ?? DEFAULT_DELTA_RECHECK_MAX_CHANGED_LINES;
+}
+/** Issue 07: resolves the file threshold with its conservative default. */
+export function deltaRecheckMaxChangedFiles(config) {
+    return config?.deltaRecheckMaxChangedFiles ?? DEFAULT_DELTA_RECHECK_MAX_CHANGED_FILES;
+}

package/dist/review/reviewFindingLedger.js

@@ -252,8 +252,12 @@ export function reconcileReviewFindingsAfterReview(store, taskId, roundId, now)
 }
 /** True when a semantic Review could not be reconciled into the ledger. */
 export function reviewFindingLedgerWriteFailed(store, taskId) {
+    return reviewFindingLedgerWriteFailedFromEvents(store.listEvents(taskId));
+}
+/** Pure event-fold variant of {@link reviewFindingLedgerWriteFailed}. */
+export function reviewFindingLedgerWriteFailedFromEvents(events) {
     const latestByRound = new Map();
-    for (const event of store.listEvents(taskId)) {
+    for (const event of events) {
         if (event.type !== REVIEW_FINDINGS_RECONCILE_FAILED_EVENT
             && event.type !== "review.findings-reconciled") {
             continue;

package/dist/review/reviewRound.js

@@ -39,6 +39,35 @@ export function createTaskReviewRound(id, taskId, workItemId, candidateId, revie
         createdAt: now.toISOString()
     });
 }
+/**
+ * Issue 07: creates a delta-recheck Task-final Round.  The Round still targets
+ * the new frozen head and still requires a fresh Reviewer disposition; the
+ * delta record only binds the recheck to the previous acceptance and the exact
+ * diff so the Reviewer can prove equivalence instead of reloading every
+ * first-round evidence.
+ */
+export function createTaskDeltaReviewRound(id, taskId, workItemId, candidateId, reviewerRoleName, requestedBy, taskCandidate, deltaRecheck, now, taskFinalReviewContract, executionGroup) {
+    const candidate = validateTaskReviewCandidate(taskCandidate);
+    return validateReviewRound({
+        schemaVersion: 4,
+        id: requireIdentity(id, "ReviewRound id"),
+        taskId: requireIdentity(taskId, "Task id"),
+        workItemId: requireIdentity(workItemId, "Work Item id"),
+        candidateId: requireIdentity(candidateId, "Candidate id"),
+        reviewerRoleName: requireIdentity(reviewerRoleName, "Reviewer Role"),
+        reviewBaseCommit: candidate.projects[0].commit,
+        scope: "task",
+        taskCandidate: candidate,
+        ...(taskFinalReviewContract === undefined
+            ? {}
+            : { taskFinalReviewContract }),
+        deltaRecheck: validateDeltaRecheckRecord(deltaRecheck),
+        requestedBy: validateReviewRequestSource(requestedBy),
+        status: "pending",
+        ...(executionGroup === undefined ? {} : { executionGroup }),
+        createdAt: now.toISOString()
+    });
+}
 export function attachReviewRoundWorkspace(round, workspace) {
     validateReviewRound(round);
     validateReviewWorkspace(round, workspace);
@@ -72,7 +101,7 @@ export function finishReviewRound(round, status, summary, now, result = {}) {
     if (round.status !== "pending" && round.status !== "running") {
         throw new Error(`ReviewRound is already terminal: ${round.id}.`);
     }
-    return validateReviewRound({
+    const terminal = validateReviewRound({
         ...round,
         status,
         summary: requireText(summary, "Review summary"),
@@ -83,6 +112,29 @@ export function finishReviewRound(round, status, summary, now, result = {}) {
             : { evidenceCommit: requireCommit(result.evidenceCommit, "Review evidence commit") }),
         endedAt: now.toISOString()
     });
+    if (round.deltaRecheck === undefined) {
+        if (result.deltaDisposition !== undefined || result.deltaReasoning !== undefined) {
+            throw new Error(`Only a delta-recheck ReviewRound can carry a delta disposition: ${round.id}.`);
+        }
+        return terminal;
+    }
+    if (status !== "completed") {
+        // A failed delta Round is an infra attempt; it records no disposition and
+        // the candidate stays unaccepted.
+        return terminal;
+    }
+    // Fail closed: a completed delta Round without an explicit, valid
+    // disposition escalates to a full Review.  Uncertainty never accepts.
+    const disposition = result.deltaDisposition ?? "requires-full-review";
+    const reasoning = result.deltaReasoning ?? result.report ?? summary;
+    return validateReviewRound({
+        ...terminal,
+        deltaRecheck: validateDeltaRecheckRecord({
+            ...round.deltaRecheck,
+            disposition,
+            reasoning: requireText(reasoning, "Delta recheck reasoning")
+        })
+    });
 }
 /**
  * Issue 06: retry a failed Task-final execution attempt under the same semantic
@@ -114,6 +166,22 @@ export function retryTaskReviewRound(round) {
         ...(round.taskFinalReviewContract === undefined
             ? {}
             : { taskFinalReviewContract: round.taskFinalReviewContract }),
+        ...(round.deltaRecheck === undefined
+            ? {}
+            // A retried delta Round is still the same semantic recheck: the
+            // disposition is terminal evidence and must not be carried into the
+            // fresh attempt, so only the immutable lineage is preserved.
+            : {
+                deltaRecheck: validateDeltaRecheckRecord({
+                    schemaVersion: 1,
+                    previousReviewRoundId: round.deltaRecheck.previousReviewRoundId,
+                    previousBaseCommit: round.deltaRecheck.previousBaseCommit,
+                    diffDigest: round.deltaRecheck.diffDigest,
+                    changedFiles: round.deltaRecheck.changedFiles,
+                    addedLines: round.deltaRecheck.addedLines,
+                    deletedLines: round.deltaRecheck.deletedLines
+                })
+            }),
         // Keep the historical attempt Group and Lane addressable from AgentRun
         // history while resetting the Lane for another dispatch attempt.
         ...(retryExecutionGroup === undefined ? {} : { executionGroup: retryExecutionGroup }),
@@ -154,12 +222,18 @@ export function parseReviewYieldReport(value) {
     const checks = extractChecks(record.checks);
     const findings = extractFindings(record.findings);
     const evidence = extractEvidence(record.evidence);
+    const deltaDisposition = extractDeltaDisposition(record.deltaDisposition);
     return {
         summary,
         report,
         checks,
         ...(findings.length === 0 ? {} : { findings }),
         ...(evidence.length === 0 ? {} : { evidence }),
+        ...(deltaDisposition === undefined ? {} : { deltaDisposition }),
+        ...(typeof record.deltaReasoning !== "string"
+            || record.deltaReasoning.trim().length === 0
+            ? {}
+            : { deltaReasoning: requireText(record.deltaReasoning, "Delta recheck reasoning") }),
         ...(typeof record.evidenceCommit !== "string"
             ? {}
             : {
@@ -167,6 +241,14 @@ export function parseReviewYieldReport(value) {
             })
     };
 }
+function extractDeltaDisposition(value) {
+    if (value !== "equivalent-and-accepted"
+        && value !== "finding"
+        && value !== "requires-full-review") {
+        return undefined;
+    }
+    return value;
+}
 function extractFindings(value) {
     if (!Array.isArray(value))
         return [];
@@ -300,6 +382,12 @@ export function validateReviewRound(round) {
     if (!["pending", "running", "completed", "failed"].includes(round.status)) {
         throw new Error(`ReviewRound status is invalid: ${String(round.status)}.`);
     }
+    if (round.deltaRecheck !== undefined) {
+        if (scope !== "task") {
+            throw new Error(`Only a Task-final ReviewRound can be a delta-recheck: ${round.id}.`);
+        }
+        validateDeltaRecheckRecord(round.deltaRecheck);
+    }
     if (round.reviewerRunId !== undefined) {
         validateTaskRecordReference({
             taskId: round.taskId,
@@ -345,8 +433,75 @@ export function validateReviewRound(round) {
         }
         requireTimestamp(round.workspaceDisposition.recordedAt, "Review workspace disposition time");
     }
+    if (round.deltaRecheck?.disposition !== undefined) {
+        if (!terminal) {
+            throw new Error("An active delta-recheck ReviewRound cannot have a disposition.");
+        }
+        if (round.deltaRecheck.reasoning === undefined
+            || round.deltaRecheck.reasoning.trim().length === 0) {
+            throw new Error("A terminal delta-recheck ReviewRound requires reasoning.");
+        }
+        if (round.deltaRecheck.escalatedToReviewRoundId !== undefined
+            && round.deltaRecheck.disposition !== "requires-full-review") {
+            throw new Error("Only a requires-full-review delta-recheck can record an escalation.");
+        }
+    }
     return round;
 }
+/** Validates a delta-recheck record's immutable identity and terminal fields. */
+export function validateDeltaRecheckRecord(record) {
+    if (record.schemaVersion !== 1) {
+        throw new Error("Delta recheck record must use schemaVersion 1.");
+    }
+    requireIdentity(record.previousReviewRoundId, "Delta recheck previous ReviewRound id");
+    requireCommit(record.previousBaseCommit, "Delta recheck previous base commit");
+    if (!/^[a-f0-9]{64}$/u.test(record.diffDigest)) {
+        throw new Error("Delta recheck diff digest is invalid.");
+    }
+    if (!Array.isArray(record.changedFiles)
+        || record.changedFiles.some((file) => typeof file !== "string" || file.trim().length === 0)) {
+        throw new Error("Delta recheck changed files are invalid.");
+    }
+    if (!Number.isInteger(record.addedLines) || record.addedLines < 0
+        || !Number.isInteger(record.deletedLines) || record.deletedLines < 0) {
+        throw new Error("Delta recheck line counts are invalid.");
+    }
+    if (record.disposition !== undefined
+        && record.disposition !== "equivalent-and-accepted"
+        && record.disposition !== "finding"
+        && record.disposition !== "requires-full-review") {
+        throw new Error(`Delta recheck disposition is invalid: ${String(record.disposition)}.`);
+    }
+    if (record.reasoning !== undefined) {
+        requireText(record.reasoning, "Delta recheck reasoning");
+    }
+    if (record.escalatedToReviewRoundId !== undefined) {
+        requireIdentity(record.escalatedToReviewRoundId, "Delta recheck escalation ReviewRound id");
+    }
+    return record;
+}
+/** True when this Round is an Issue 07 delta-recheck. */
+export function isDeltaRecheckRound(round) {
+    return round.deltaRecheck !== undefined;
+}
+/** True only when a delta Round explicitly accepted the new head. */
+export function deltaRecheckAccepted(round) {
+    return round.deltaRecheck?.disposition === "equivalent-and-accepted";
+}
+/** True when a delta Round escalated to a full Review. */
+export function deltaRecheckEscalated(round) {
+    return round.deltaRecheck?.disposition === "requires-full-review";
+}
+/**
+ * True when a completed delta Round does NOT accept the new head.  A `finding`
+ * or `requires-full-review` disposition must keep the completion gate closed.
+ */
+export function deltaRecheckBlocksAcceptance(round) {
+    return round.deltaRecheck !== undefined
+        && round.status === "completed"
+        && round.deltaRecheck.disposition !== undefined
+        && round.deltaRecheck.disposition !== "equivalent-and-accepted";
+}
 function validateReviewExecutionGroup(group, round) {
     validateExecutionGroup(group);
     if (group.taskId !== round.taskId || group.purpose !== "review") {

package/dist/run/providerRetry.js

@@ -2,9 +2,16 @@ import { requireIdentity, requireText, requireTimestamp } from "../domain/valida
 export const PROVIDER_RETRY_BASE_DELAY_MS = 1_000;
 export const PROVIDER_RETRY_MAX_DELAY_MS = 60_000;
 /**
- * Bounded exponential backoff. The delay is uncapped in attempt count (Issue
- * 04 retries transient failures indefinitely with backoff) but capped in
- * interval so a hot loop can never occupy the control plane.
+ * Default total budget for one in-place retry lineage. The window starts at
+ * the first classified failure and bounds the total wall-clock time the Run
+ * may stay in `provider-retrying`; once it elapses the Run terminalizes with
+ * one structured failure instead of looping.
+ */
+export const PROVIDER_RETRY_MAX_WINDOW_MS = 600_000;
+/**
+ * Bounded exponential backoff. The delay is capped in interval so a hot loop
+ * can never occupy the control plane; the total retry lineage is bounded by
+ * {@link PROVIDER_RETRY_MAX_WINDOW_MS} (see {@link providerRetryBudgetExhausted}).
  */
 export function nextProviderRetryDelayMs(attempt) {
     if (!Number.isSafeInteger(attempt) || attempt < 1) {
@@ -13,6 +20,17 @@ export function nextProviderRetryDelayMs(attempt) {
     const exponent = Math.min(attempt - 1, 10);
     return Math.min(PROVIDER_RETRY_MAX_DELAY_MS, PROVIDER_RETRY_BASE_DELAY_MS * (2 ** exponent));
 }
+/**
+ * True when the retry lineage has used its total wall-clock budget. The
+ * budget is measured from the first classified failure, so repeated failures
+ * never extend it.
+ */
+export function providerRetryBudgetExhausted(value, now, maxWindowMs = PROVIDER_RETRY_MAX_WINDOW_MS) {
+    if (!Number.isSafeInteger(maxWindowMs) || maxWindowMs <= 0) {
+        throw new Error(`Provider retry max window must be a positive integer: ${String(maxWindowMs)}.`);
+    }
+    return Date.parse(value.firstFailureAt) + maxWindowMs <= now.getTime();
+}
 export function validateAgentRunProviderRetry(value) {
     if (value.schemaVersion !== 1) {
         throw new Error("Agent run providerRetry must use schemaVersion 1.");

package/dist/run/providerRetryConfig.js

@@ -1,65 +1,18 @@
-import { supportedAgentAdapterIds } from "../agent/adapterCatalog.js";
-function parseAdapters(value) {
-    if (value === undefined)
-        return [];
-    const supported = supportedAgentAdapterIds();
-    const supportedSet = new Set(supported);
-    const adapters = [];
-    for (const raw of value.split(",")) {
-        const token = raw.trim().toLowerCase();
-        if (token === "")
-            continue;
-        if (token === "all") {
-            for (const adapter of supported) {
-                if (!adapters.includes(adapter))
-                    adapters.push(adapter);
-            }
-            continue;
-        }
-        if (!/^[a-z0-9][a-z0-9._-]*$/u.test(token)) {
-            throw new Error(`Invalid Provider retry adapter: ${token}.`);
-        }
-        if (!supportedSet.has(token)) {
-            throw new Error(`Unknown Provider retry adapter: ${token}.`);
-        }
-        if (!adapters.includes(token)) {
-            adapters.push(token);
-        }
-    }
-    return adapters;
-}
+import { resolveProviderRetryAdapters, resolveProviderRetryMaxWindowMs, resolveProviderRetryMode, resolveYieldReceiptReplay } from "../config/yuiConfig.js";
 /**
- * Resolves the Issue 04 flags from the process environment.
- *
- * - `YUI_PROVIDER_RETRY_IN_PLACE` — comma-separated adapter ids (`claude`,
- *   `codex`, `all`). Unset/empty disables the feature entirely.
- * - `YUI_PROVIDER_RETRY_MODE` — `shadow` (default when adapters are listed)
- *   records classification and "would retry" facts without changing behavior;
- *   `enforce` keeps the Run active and retries in place.
- * - `YUI_YIELD_RECEIPT_REPLAY` — `0` disables receipt replay; default `1`.
+ * Resolves the retry flags from the durable Yui config. Homes without the
+ * fields get the safe defaults: enforce mode, all supported adapters, receipt
+ * replay on, 10-minute budget.
  */
-export function providerRetryConfig(environment = process.env) {
-    const adapters = parseAdapters(environment.YUI_PROVIDER_RETRY_IN_PLACE);
-    const modeValue = environment.YUI_PROVIDER_RETRY_MODE?.trim().toLowerCase();
-    let mode;
-    if (adapters.length === 0) {
-        mode = "off";
-    }
-    else if (modeValue === "enforce") {
-        mode = "enforce";
-    }
-    else if (modeValue === undefined || modeValue === "" || modeValue === "shadow") {
-        mode = "shadow";
-    }
-    else {
-        throw new Error(`Unknown Provider retry mode: ${modeValue}.`);
-    }
-    const replayValue = environment.YUI_YIELD_RECEIPT_REPLAY?.trim();
-    const yieldReceiptReplay = replayValue === undefined || replayValue === "" || replayValue === "1";
-    if (!["0", "1"].includes(replayValue ?? "1")) {
-        throw new Error(`YUI_YIELD_RECEIPT_REPLAY must be 0 or 1: ${replayValue}.`);
-    }
-    return { mode, adapters, yieldReceiptReplay };
+export function providerRetryConfig(config) {
+    const mode = resolveProviderRetryMode(config.providerRetryMode);
+    const adapters = resolveProviderRetryAdapters(config.providerRetryAdapters);
+    return {
+        mode: adapters.length === 0 ? "off" : mode,
+        adapters,
+        yieldReceiptReplay: resolveYieldReceiptReplay(config.yieldReceiptReplay),
+        maxWindowMs: resolveProviderRetryMaxWindowMs(config.providerRetryMaxWindowMs)
+    };
 }
 /** Whether the adapter has in-place retry enabled in the given mode. */
 export function providerRetryEnabledForAdapter(config, adapterId, mode) {