audit-tools 0.32.7 → 0.32.9

package/dist/remediate/steps/nextStep.js

@@ -2,7 +2,7 @@ import { existsSync, statSync } from "node:fs";
 import { mkdir, readFile, rename } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { StateStore } from "../state/store.js";
-import { readOptionalJsonFile, writeJsonFile, writeTextFile, buildAuditDeliverablePair, formatValidationIssues, isRecord, withFsRetry, RunLogger, DISPATCH_PROMPT_HANDOFF_NOTE, renderQuotaCoverageNudge, renderTokenBudgetView, coerceJsonObjectArg, createRollingDispatcher, setQuotaStateDir, interpretFreeFormIntent, advance, decideFrictionTriage, buildFrictionTriageBlock, planHybridDispatch, readSettledPools, addSettledPool, sourceByPoolId, classifyProvider, selectDispatchDriver, renderDispatchDriverInstruction, HostSessionQuotaSource, buildProviderModelKey, captureStepBoundaryFriction, LENSES, SEVERITIES } from "audit-tools/shared";
+import { readOptionalJsonFile, writeJsonFile, writeTextFile, buildAuditDeliverablePair, formatValidationIssues, isRecord, withFsRetry, RunLogger, DISPATCH_PROMPT_HANDOFF_NOTE, renderQuotaCoverageNudge, renderTokenBudgetView, coerceJsonObjectArg, driveRolling, resolveLedgerBudgets, setQuotaStateDir, interpretFreeFormIntent, advance, decideFrictionTriage, buildFrictionTriageBlock, planHybridDispatch, readSettledPools, addSettledPool, sourceByPoolId, classifyProvider, selectDispatchDriver, renderDispatchDriverInstruction, HostSessionQuotaSource, buildProviderModelKey, captureStepBoundaryFriction, LENSES, SEVERITIES } from "audit-tools/shared";
 import { applyPlanPipeline, buildCoverageLedger } from "../phases/plan.js";
 import { groundExtractedFindings } from "../phases/grounding.js";
 import { runTriagePhase } from "../phases/triage.js";
@@ -10,7 +10,6 @@ import { runClosePhase } from "../phases/close.js";
 import { validateRemediationPlan } from "../validation/remediationState.js";
 import { mergeImplementResults, prepareImplementDispatch, readExtractedPlanIfPresent, buildConfirmedPools, executeNodeInWorktree, blockScopesFromPlan, declaredPathsFromPlan, targetedCommandsForBlock, } from "./dispatch.js";
 import { makeProviderNodeDispatcher } from "./providerNodeDispatch.js";
-import { ownershipSubWaves } from "../dispatch/ownershipScheduler.js";
 import { prepareHostRollingDispatch, nodeClaimRegistry, nodeSettledPoolsPath } from "./rollingSession.js";
 import { ClaimRegistry } from "../../shared/quota/claimRegistry.js";
 import { claimWithBackoff, withClaimHeartbeat } from "../../shared/quota/claimLease.js";
@@ -339,9 +338,9 @@ function blockedByUnsatisfiedDependency(state) {
 // The rolling scheduler replaced the wave-batch shim: instead of dispatching one
 // fixed-size wave per next-step and folding back through `implementing`, a node
 // becomes eligible the instant every dependency reaches a verified-complete
-// disposition (INV-RS-01). Concurrency is owned entirely by the quota scheduler
-// (the `dispatch-quota.json` max_concurrent_agents from `scheduleWave` /
-// `computeDispatchCapacity` — INV-S05 / INV-QD-11), never a separate wave cap.
+// disposition (INV-RS-01). Concurrency is emergent from admission control (the
+// `dispatch-quota.json` `admission.granted_packet_ids` the tool admits against the
+// live budget — INV-S05 / INV-QD-11), never a computed wave cap.
 // A shared rebuild is interposed between dependency levels so a downstream node
 // typechecks/runs against the freshly-built upstream `audit-tools/shared`
 // surface; the rebuild is single-flight (CE-001) so the same package is never
@@ -495,103 +494,69 @@ export async function driveRollingDispatch(levels, options) {
         setQuotaStateDir(options.quotaStateDir);
     }
     const estimateTokens = options.estimateTokens ?? (() => 2000);
-    const out = { levels: [], rebuilds: 0 };
-    let rebuildInFlight = false; // single-flight guard (CE-001)
-    for (let levelIndex = 0; levelIndex < levels.length; levelIndex++) {
-        const level = levels[levelIndex];
-        // Interpose the shared rebuild BEFORE every level after the first. Guarded so
-        // it can never run twice or concurrently for the same boundary.
-        if (levelIndex > 0) {
-            if (rebuildInFlight) {
-                throw new Error("driveRollingDispatch: shared rebuild already in flight — single-flight invariant violated (CE-001).");
-            }
-            rebuildInFlight = true;
-            try {
-                await options.rebuildSharedBetweenLevels();
-                out.rebuilds += 1;
-            }
-            finally {
-                rebuildInFlight = false;
+    const scopeForBlock = options.scopeForBlock ?? ((b) => b.touched_files ?? []);
+    const allBlocks = levels.flat();
+    const blockById = new Map(allBlocks.map((b) => [b.block_id, b]));
+    const hostSession = options.hostSession;
+    // Admission control: when a metered pool reports a finite absolute budget, the shared
+    // reservation ledger leases each node's cost before dispatch, so co-located dispatch
+    // loops on one account (a second IDE, the host + its subagents) never collectively
+    // over-admit. On the claude-code host (percent-only quota, no finite ceiling) the ledger
+    // is omitted and the reactive 429 floor is the safety — no per-dispatch lock overhead.
+    const ledgerCfg = resolveLedgerBudgets({
+        pools: options.confirmedPools,
+        sessionConfig: options.sessionConfig,
+        pendingItemTokens: allBlocks.map((b) => estimateTokens(b)),
+    });
+    // The remediate terminal adapter over the unified shared driver. What stays here is
+    // remediate's projection: a block → its ownership node (declared write-scope, so the
+    // shared `ownershipSubWaves` serializes same-file nodes / parallelizes disjoint ones)
+    // and → its dispatch packet; the shared rebuild between dependency levels; and the
+    // host-session escalation wiring. The loop, sub-wave split, and quota_paused/empty_pool
+    // terminal merge are the unified driver's.
+    const run = await driveRolling({
+        levels,
+        confirmedPools: options.confirmedPools,
+        sessionConfig: options.sessionConfig,
+        ...(ledgerCfg.reservationLedger
+            ? {
+                reservationLedger: ledgerCfg.reservationLedger,
+                resolvePoolBudget: ledgerCfg.resolvePoolBudget,
+                resolveOutputReservation: (_packet, poolId) => ledgerCfg.resolveOutputReservation(poolId),
             }
-        }
-        const blockByPacketId = new Map(level.map((b) => [b.block_id, b]));
-        const scopeForBlock = options.scopeForBlock ?? ((b) => b.touched_files ?? []);
-        // File-ownership-disjoint admission (INV-SOO): split the level into ordered
-        // sub-waves, each a maximal file-disjoint subset (deterministic block_id
-        // tie-break AFTER the disjointness filter, INV-SOO-08). Same-file nodes land
-        // in successive sub-waves (serialize, INV-SOO-01/02) and a freed file becomes
-        // schedulable for the next sub-wave; different-file nodes share a sub-wave and
-        // parallelize up to the quota cap the dispatcher enforces (INV-SOO-03/05).
-        const subWaves = ownershipSubWaves(level.map((b) => ({
+            : {}),
+        toNode: (b) => ({
             block_id: b.block_id,
             write_paths: scopeForBlock(b),
             ...(b.cofile_parallel_safe !== undefined
                 ? { cofile_parallel_safe: b.cofile_parallel_safe }
                 : {}),
-        })), options.root);
-        const levelResults = [];
-        for (const wave of subWaves) {
-            const packets = wave.map((node) => ({
-                id: node.block_id,
-                payload: { block_id: node.block_id },
-                estimatedTokens: estimateTokens(blockByPacketId.get(node.block_id)),
-                complexity: 0.5,
-            }));
-            const hostSession = options.hostSession;
-            const dispatcher = createRollingDispatcher({
-                confirmedPools: options.confirmedPools,
-                sessionConfig: options.sessionConfig,
-                dispatchPacket: async (packet, slot) => {
-                    const block = blockByPacketId.get(packet.payload.block_id);
-                    return options.dispatchNode(block, slot);
-                },
-                // Host-session escalation: feed recordLimit (write) at the rate_limited
-                // observation point and read isEscalated (strand-not-requeue). The SAME
-                // instance sized the pools, so the bounded re-limit count is account-wide.
-                ...(hostSession
-                    ? {
-                        recordRateLimit: (packet, result) => hostSession.recordLimit(result.rateLimit?.channel ?? "error", result.rateLimit?.text ?? "", packet.id),
-                        isPacketEscalated: (packetId) => hostSession.isEscalated(packetId),
-                    }
-                    : {}),
-            });
-            dispatcher.enqueue(packets);
-            levelResults.push(...(await dispatcher.run()));
-            // Piece D: surface the wave's partial-completion terminal (quota_paused /
-            // empty_pool). Aggregate across waves keeping the EARLIEST-reset quota_paused
-            // terminal (a paused wave is retryable and should resume soonest); union the
-            // stranded ids so a later step re-dispatches all of them. An empty_pool
-            // terminal only stands when no quota_paused terminal was seen.
-            out.terminal = mergePartialTerminals(out.terminal, dispatcher.getTerminal());
-        }
-        out.levels.push({ blockIds: level.map((b) => b.block_id), results: levelResults });
-    }
-    return out;
-}
-/**
- * Fold a newly-observed partial-completion terminal into the run's aggregate
- * (piece D). Prefers `quota_paused` (retryable) over `empty_pool`; among
- * quota_paused terminals keeps the EARLIEST `earliest_reset_at`; always unions the
- * stranded ids so no stranded node is lost across waves.
- */
-function mergePartialTerminals(prior, next) {
-    if (!next)
-        return prior;
-    if (!prior)
-        return next;
-    const strandedIds = [...new Set([...prior.stranded_ids, ...next.stranded_ids])];
-    const priorPaused = prior.reason === "quota_paused";
-    const nextPaused = next.reason === "quota_paused";
-    if (priorPaused || nextPaused) {
-        const resets = [prior.earliest_reset_at, next.earliest_reset_at].filter((r) => typeof r === "string");
-        const earliest = resets.length > 0 ? resets.sort()[0] : undefined;
-        return {
-            reason: "quota_paused",
-            stranded_ids: strandedIds,
-            ...(earliest ? { earliest_reset_at: earliest } : {}),
-        };
-    }
-    return { reason: prior.reason, stranded_ids: strandedIds };
+        }),
+        toPacket: (b) => ({
+            id: b.block_id,
+            payload: { block_id: b.block_id },
+            estimatedTokens: estimateTokens(b),
+            complexity: 0.5,
+        }),
+        dispatchPacket: async (packet, slot) => options.dispatchNode(blockById.get(packet.payload.block_id), slot),
+        ...(options.root !== undefined ? { root: options.root } : {}),
+        // Single-flight (CE-001) is enforced by the unified driver.
+        rebuildBetweenLevels: options.rebuildSharedBetweenLevels,
+        // Host-session escalation: feed recordLimit (write) at the rate_limited observation
+        // point and read isEscalated (strand-not-requeue). The SAME instance sized the pools,
+        // so the bounded re-limit count is account-wide.
+        ...(hostSession
+            ? {
+                recordRateLimit: (packet, result) => hostSession.recordLimit(result.rateLimit?.channel ?? "error", result.rateLimit?.text ?? "", packet.id),
+                isPacketEscalated: (packetId) => hostSession.isEscalated(packetId),
+            }
+            : {}),
+    });
+    return {
+        levels: run.levels.map((l) => ({ blockIds: l.nodeIds, results: l.results })),
+        rebuilds: run.rebuilds,
+        ...(run.terminal ? { terminal: run.terminal } : {}),
+    };
 }
 /**
  * Backends the orchestrator can drive IN-PROCESS as the per-node implement worker
@@ -665,6 +630,10 @@ export async function driveRollingImplementDispatch(options) {
         hostModelId: options.waveOptions?.hostModelId,
         // Each node runs in its own worktree, so its prompt is rooted there.
         worktreeRootedPrompts: true,
+        // The in-process rolling engine admits + leases per-packet itself, so the
+        // dispatch-quota grant here must NOT lease (a host grant lease would
+        // double-count the same work against the shared account budget).
+        grantLeases: false,
     });
     if (plan.items.length === 0) {
         return null;
@@ -1366,7 +1335,10 @@ async function buildImplementDispatchStep(ctx) {
         const driverSelection = selectDispatchDriver({
             classification: classifyProvider(hostProvider),
             eligibleItemCount: rolling.session.frontier.length,
-            slots: rolling.session.slots,
+            // The granted set's size IS the instantaneous admission width — there is no
+            // separate concurrency number. The whole granted set runs at once, so the
+            // driver-selection "slots" is the granted-set size.
+            slots: rolling.session.frontier.length,
         });
         const rollMerge = loaderCommand(`merge-implement-results --run-id ${runId}`);
         const rollNext = loaderCommand("next-step");
@@ -1383,21 +1355,23 @@ async function buildImplementDispatchStep(ctx) {
                 prompt: `
 # Dispatch Implementation Work (host-subagent rolling, worktree-isolated)
 
-Each eligible node runs in its OWN git worktree (hard isolation between nodes). The
+Each granted node runs in its OWN git worktree (hard isolation between nodes). The
 TOOL owns commit -> verify -> merge + write-scope; you only spawn a subagent per
 node and call \`accept-node\` as each finishes.
 
-Concurrency target: **${rolling.session.slots}** subagents at once (the quota
-scheduler's \`max_concurrent_agents\`), NOT a wave cap.
+The tool ADMITTED this set against the live budget (and any declared in-flight cap):
+dispatch EXACTLY the ${rolling.session.frontier.length} node(s) below and no more.
+Their count is the whole grant — there is no separate concurrency cap. When they are
+all accepted, merge and re-invoke next-step; the tool re-grants the pending remainder.
 
-${renderDispatchDriverInstruction(driverSelection, `**${rolling.session.slots}**`)}
+${renderDispatchDriverInstruction(driverSelection, `the ${rolling.session.frontier.length} granted node(s)`)}
 
-Spawn ONE subagent for EACH initial node below. Give the subagent that node's
+Spawn ONE subagent for EACH granted node below. Give the subagent that node's
 \`prompt\`, and set its working directory to the node's **worktree** path. The
 subagent edits source files INSIDE that worktree and writes ONLY its result file.
 Do NOT let any subagent edit the main repository tree.
 
-Initial nodes (worktrees already created):
+Granted nodes (worktrees already created):
 ${nodeLines}
 
 As EACH subagent finishes, run (substituting the finished node's block id):
@@ -1406,11 +1380,8 @@ As EACH subagent finishes, run (substituting the finished node's block id):
 
 It runs the commit -> verify -> merge lifecycle for that node and prints a JSON
 directive on stdout:
-- \`{"directive":"dispatch","node":{...},"worktree_root":"..."}\` — spawn a subagent
-  for that next node (its worktree is already created), keeping up to
-  ${rolling.session.slots} running.
-- \`{"directive":"wait",...}\` — other nodes are still in flight; do not spawn more yet.
-- \`{"directive":"done",...}\` — every node has been accepted. Then run:
+- \`{"directive":"wait",...}\` — other granted nodes are still in flight; do not spawn more.
+- \`{"directive":"done",...}\` — every granted node has been accepted. Then run:
 
 \`${rollMerge}\`
 
@@ -1431,8 +1402,8 @@ ${DISPATCH_PROMPT_HANDOFF_NOTE}
     }
     // Rolling per-node dispatch: prepare EVERY currently-eligible node (deps all
     // verified-complete), never a single artificially-serialized block. There is
-    // no wave-size cap — concurrency is owned by the quota scheduler
-    // (`dispatch-quota.json` max_concurrent_agents). `prepareImplementDispatch`
+    // no wave-size cap — concurrency is emergent from admission control
+    // (`dispatch-quota.json` `admission.granted_packet_ids`). `prepareImplementDispatch`
     // itself only admits verified-complete-eligible blocks
     // (`dependencyVerifiedComplete`), so this is the rolling-eligible frontier.
     const dispatchPlan = await prepareImplementDispatch({ root, artifactsDir }, runId, undefined, waveOptsImpl);
@@ -1504,15 +1475,17 @@ Read the dispatch plan and quota JSONs:
 \`${implQuotaPath}\`
 
 Every item in \`items\` is a node whose dependencies are all VERIFIED-COMPLETE
-(INV-RS-01), so all of them are eligible to run now. Concurrency is owned by the
-quota scheduler — maintain up to \`max_concurrent_agents\` subagents running
-simultaneously (from the quota file), with no separate wave-size cap. Each item's
+(INV-RS-01). The tool admitted a budget-bounded subset: dispatch EXACTLY the block
+ids in the quota file's \`admission.granted_packet_ids\` and no others — that granted
+set is the whole grant (there is no separate concurrency cap). Each item's
 \`model_hint.tier\` suggests which model to use (small/standard/deep). If your
 provider has rate limits, pace launches accordingly.
 
-For each item in \`items\`, dispatch one subagent with that item's
-\`prompt_path\`. Each subagent may edit source files needed for that bounded
-block and must write only its assigned \`result_path\`.
+For each GRANTED item in \`items\` (its \`block_id\` in \`admission.granted_packet_ids\`),
+dispatch one subagent with that item's \`prompt_path\`. Each subagent may edit source
+files needed for that bounded block and must write only its assigned \`result_path\`.
+After the granted set is merged and you run next-step, the tool re-grants the pending
+remainder.
 
 ${SHARED_REBUILD_BETWEEN_LEVELS_NOTE}