clearotron 0.5.0-beta.2 → 0.5.0-beta.3

package/driver/gateway.mjs

@@ -224,7 +224,8 @@ export function toolWrittenArtifact(p) {
     ?? TOOL_WRITTEN_PATTERNS.find((r) => r.re.test(base))
     ?? null;
 }
-import { buildGatherMcpConfig, allowedToolsFor, toolGroupsForStage, recordAxisFor, seatWritesForGroups } from "./engine/mcp/gather-config.mjs";
+import { buildGatherMcpConfig, allowedToolsFor, toolGroupsForStage, recordAxisFor, seatWritesForGroups, withSendUntil } from "./engine/mcp/gather-config.mjs";
+import { sendReserveMs } from "../providers/_shared/send-until.mjs";   // each turn's plan calls stop sending ahead of its deadline
 import { everyToolCallRefused } from "./engine/tool-refusal.mjs";   // one definition, shared with the engine probe
 export { everyToolCallRefused };
 // The profiles STORE root, for the write boundary only — read from the module that owns it, never
@@ -297,11 +298,11 @@ export function isEmbeddedFallback(json, stderr = "") {
 // nonzero exit (the v14 delivery failure, previously mislabelled `nonzero_exit_1`); (3) any nonzero
 // exit whose wall already reached the configured budget. Distinguished from transient errors so the
 // retry policy can give a slow stage ONE longer shot instead of 3 identical doomed attempts.
-export function isTimeout({ killed, code, wall, stderr = "", timeoutSec }) {
-  if (killed) return true;
-  if (/EmbeddedAttemptSessionTakeoverError|request timed out|\bETIMEDOUT\b/i.test(stderr)) return true;
-  if (code !== 0 && wall >= timeoutSec) return true;
-  return false;
+export const isTimeout = (facts) => timeoutCause(facts) !== null;
+export function timeoutCause({ killed, code, wall, stderr = "", timeoutSec }) {   // which signal fired, or null
+  if (killed) return "killed";
+  if (/EmbeddedAttemptSessionTakeoverError|request timed out|\bETIMEDOUT\b/i.test(stderr)) return "stderr";
+  return code !== 0 && wall >= timeoutSec ? "wall" : null;
 }
 
 // A LANE WEDGE: a timeout whose turn moved ZERO tokens — the gateway never admitted it to a command lane (the
@@ -942,6 +943,9 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
       }
     }
   }
+  // EACH TURN'S OWN COPY of the stage's tool config, carrying that turn's time to stop sending: ahead of the turn's
+  // deadline by the reserve, so a plan call returns what it holds while the turn can still write it (send-until.mjs).
+  const turnConfig = (sec) => withSendUntil(gatherMcpConfig, Date.now() + sec * 1000 - sendReserveMs(sec));
   let lastFail;
   // — WHAT ACTUALLY RAN, carried out to the caller. The attempt rows have held the truth all along
   // (`modelActual` from the wire, `modelUsed` from the engine's own resolver); the ladder simply never
@@ -1125,13 +1129,14 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // the snapshot, which only widens the window by their own time: an earlier attempt's refusals all
     // precede its own settle, so they stay outside it.
     const dispatchedAt = Date.now();
+    const mcpConfig = turnConfig(effTimeout);   // this turn's copy, with its time to stop sending
     for (const line of describeMethodologyDrift(witnessStageMethodology(runDir, name, effMessage, engineResolveSkill)))
       note(`[${name}] ${line}`);
     // — the frozen judged-by set, hashed into THIS PROCESS'S MEMORY before the seat runs. Never
     // written to disk before the comparison, so the thing being watched cannot reach it. See
     // run-integrity.mjs for why it is not a manifest file and why the append-only journals are excluded.
     const integrityBefore = frozenSnapshot(runDir);
-    const turn = await engine.runTurn({ agent, sessionKey: key, message: effMessage, grantDispatch: base, model, thinking, timeoutSec: effTimeout, resumeRef: warm ? lastSessionRef : undefined, codexHome: stageCodexHome, mcpConfig: gatherMcpConfig, allowedTools: gatherAllowedTools, seatWrites: gatherSeatWrites, skillsDir: engineSkillsDir, skillsGrantRoots: engineSkillsGrantRoots, profilesDir: profilesStoreDir, resolveSkill: engineResolveSkill, runDir, stallSec,
+    const turn = await engine.runTurn({ agent, sessionKey: key, message: effMessage, grantDispatch: base, model, thinking, timeoutSec: effTimeout, resumeRef: warm ? lastSessionRef : undefined, codexHome: stageCodexHome, mcpConfig, allowedTools: gatherAllowedTools, seatWrites: gatherSeatWrites, skillsDir: engineSkillsDir, skillsGrantRoots: engineSkillsGrantRoots, profilesDir: profilesStoreDir, resolveSkill: engineResolveSkill, runDir, stallSec,
       progressFiles: files,   // the no-progress watchdog's artifact-advance signal (anthropic-agent; other adapters ignore it)
       // The raw stream of this session, beside its dispatch record (engine/session-record.mjs). The engines
       // keep it while the disk has room and say on the tuple's `stream` what landed.
@@ -1282,7 +1287,10 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     let fail = null;
     let stampedQuantity = null;   //: a validator's own exact count, when it stamped one (see below)
     let failingFile = null;       //: the artifact the validator rejected — the repair's only target
-    if (isTimeout({ killed, code, wall, stderr, timeoutSec: effTimeout })) fail = "timeout";
+    // A TURN THAT COMPLETED IS JUDGED ON WHAT IT WROTE, whatever its stderr says about a request inside it
+    // (attemptTimedOut). Which signal fired is kept on the row either way.
+    const timedOutBy = timeoutCause({ killed, code, wall, stderr, timeoutSec: effTimeout });
+    if (attemptTimedOut({ cause: timedOutBy, code, json })) fail = "timeout";
     else if (isEmbeddedFallback(json, stderr)) fail = "embedded_fallback";
     else if (code !== 0) fail = `nonzero_exit_${code}`;
     else if (!json) fail = "unparseable_json";
@@ -1354,7 +1362,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
       // under the run dir to win the grant back, and warmPatchMessage renders the target through rel();
       // a relative path there would silently strip the write root off the one turn that needs it most.
       const rt = await engine.runTurn({ agent, sessionKey: key, message: repairMessage, model, thinking,
-        timeoutSec: effTimeout, resumeRef: repairRef, codexHome: stageCodexHome, mcpConfig: gatherMcpConfig, allowedTools: gatherAllowedTools,
+        timeoutSec: effTimeout, resumeRef: repairRef, codexHome: stageCodexHome, mcpConfig: turnConfig(effTimeout), allowedTools: gatherAllowedTools,
         skillsDir: engineSkillsDir, skillsGrantRoots: engineSkillsGrantRoots, profilesDir: profilesStoreDir, resolveSkill: engineResolveSkill, runDir, stallSec,
         progressFiles: files, streamFile: streamFilePath(runDir, name, attempt, formRepairsUsed + 1) });
       repairRef = rt.sessionRef ?? repairRef;
@@ -1819,6 +1827,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // `followup` matters too: a followup success PATCHES the prior session's output, it never
         // supersedes a taint the way a fresh full pass does.
         killed: killed || undefined,
+        timeoutCause: timedOutBy ?? undefined,   // — which of the three timeout signals fired: killed, stderr or wall
         signals: turn.signals ?? undefined,
         //: how long every declared artifact had been untouched when the turn settled. Present on any
         // hard-wall kill the wall rescue looked at — INCLUDING the ones it refused, so "considered and
@@ -1899,7 +1908,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}), cliSource: cli.source,
         cliFloor: cli.floor ?? null, cliBelowFloor: cli.belowFloor ?? null,
           wrote, warm: warm || undefined, warmEscalated: attempt === warmEscalatedAt || undefined,
-          rescued: rescued ?? undefined, killed: killed || undefined,
+          rescued: rescued ?? undefined, killed: killed || undefined, timeoutCause: timedOutBy ?? undefined,
           quiescentMs: Number.isFinite(quiescentMs) ? Math.round(quiescentMs) : undefined,   // — see the per-stage row
           rescueRefused: rescueRefused ?? undefined,   // — the cause, when the rescue looked and refused
           rescueRefusedFile: rescueRefusedFile ?? undefined, rescueRefusedReason: rescueRefusedReason ?? undefined,
@@ -3735,3 +3744,15 @@ function toolCallCounts(turn) {
   return { toolCallsRefused: n(turn?.toolCallsRefused), commandToolCalls: n(turn?.commandToolCalls), mcpToolCalls: n(turn?.mcpToolCalls),
     toolCallsErroredByName: errored && typeof errored === "object" && !Array.isArray(errored) ? { ...errored } : null };
 }
+
+/**
+ * IS THIS ATTEMPT A TIMEOUT? A kill and a run past the limit with a non-zero exit always are. A timed-out request named
+ * in stderr is one only when the turn did not complete: a turn that exited 0 with its engine's status ok outlived the
+ * request, which was a call inside it (a web lookup, a tool), and is judged on what it wrote like any finished turn.
+ * Recorded as a timeout, it was run again whole: on one test run a writer finished in 14.7 minutes of its 43, exited 0
+ * with its output written, and paid a second attempt of 20.3 minutes. `cause` is `timeoutCause`'s answer. PURE.
+ */
+export function attemptTimedOut({ cause, code, json }) {
+  if (!cause) return false;
+  return !(cause === "stderr" && code === 0 && json?.status === "ok");
+}

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.5.0-beta.2",
+  "version": "0.5.0-beta.3",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/parts-not-completed.mjs

@@ -17,35 +17,40 @@
 //
 // ONCE PER PART. The catch never writes a part whose record already exists: a failure on the pass that delivers
 // without it ends the run as it always did, with the stop notice, and the record is removed then, so a later resume
-// tries the part again.
+// tries the part again. The searches are the one part whose record grows: each failure names the slices it could not
+// prove ran, and a failure that names a slice the record does not hold yet adds it; one that names none new ends the
+// run, so the run still ends.
 //
-// A pure leaf: node:fs, node:path and shared/driver-dir.mjs only.
+// A pure leaf: node:fs, node:path, shared/driver-dir.mjs and shared/slices-taken-out.mjs (node:fs and the same) only.
 import { readFileSync, writeFileSync, renameSync, rmSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { driverDir, ensureDriverDir } from "../shared/driver-dir.mjs";
+// Where the record sits is stated with the band readers outside the driver, which read the searches' record too.
+import { NOT_COMPLETED_DIR, notCompletedPath } from "../shared/slices-taken-out.mjs";
 
-export const NOT_COMPLETED_DIR = "not-completed";
+export { NOT_COMPLETED_DIR, notCompletedPath };
 
 // The covered parts. `assessment` is the run's overall assessment: placement, the register write-up and synthesis, and
 // everything built from them. `review` is the first review of the assessment, whose verdict the sign-off is. `overview`
 // is the report overview, the conclusion under the rating. `delivery` is the
 // changed-material check before publishing: it never delivers past staleness, and its record buys the report one more
-// assembly from the current material instead of the stop notice.
-export const NOT_COMPLETED_PARTS = Object.freeze(["assessment", "review", "overview", "delivery"]);
-
-/** The record's path for `part`. */
-export function notCompletedPath(runDir, part) {
-  return driverDir(runDir, NOT_COMPLETED_DIR, `${part}.json`);
-}
+// assembly from the current material instead of the stop notice. `searches` is the register's searches: the slices a
+// check could not prove ran, each with its axis, its qid and the reason it is open, taken out of the band and
+// delivered as open rows; the axes whose pass was killed at its time limit, read as the last pass left them and
+// disclosed, their clean claims open (`disclosed_axes`); and the units that wrote no result once their attempts were
+// spent, delivered as their bands stand and not sent again (`unfinished_units`).
+export const NOT_COMPLETED_PARTS = Object.freeze(["assessment", "review", "overview", "delivery", "searches"]);
 
 /**
  * Record that `part` could not be completed. `stage` is the stage that failed, `reason` its cause for the run's record
  * (never a reader's cell), `sig` and `terminalKind` what the recovery decision said. Written through a temporary file
  * and a rename, so a reader never sees half a record. Returns the record.
  */
-export function writePartNotCompleted(runDir, part, { stage = null, reason = null, sig = null, terminalKind = null } = {}) {
+export function writePartNotCompleted(runDir, part, { stage = null, reason = null, sig = null, terminalKind = null, slices = null, disclosedAxes = null, unfinishedUnits = null } = {}) {
   if (!NOT_COMPLETED_PARTS.includes(part)) throw new Error(`parts-not-completed: "${part}" is not a covered part`);
   const record = { part, stage, reason: reason == null ? null : String(reason).slice(0, 600), sig, terminalKind,
+    ...(Array.isArray(slices) ? { slices } : {}), ...(Array.isArray(disclosedAxes) && disclosedAxes.length ? { disclosed_axes: disclosedAxes } : {}),
+    ...(Array.isArray(unfinishedUnits) && unfinishedUnits.length ? { unfinished_units: unfinishedUnits } : {}),
     ts: new Date().toISOString() };
   const path = notCompletedPath(runDir, part);
   ensureDriverDir(runDir, NOT_COMPLETED_DIR);
@@ -76,6 +81,42 @@ export function partsNotCompleted(runDir) {
   return NOT_COMPLETED_PARTS.filter((p) => names.includes(`${p}.json`)).map((p) => readPartNotCompleted(runDir, p));
 }
 
+/**
+ * The slices of `failed` that `record` does not hold yet, each `{axis, qid, reason}`, or `{axis, query, reason}` for a
+ * slice with no qid, which its query names: what a failure of the searches adds to their record. [] when it adds
+ * none. PURE.
+ */
+export function slicesNotYetRecorded(record, failed) {
+  const keyOf = (s) => `${s?.axis}\u0000${s?.qid ? `qid:${s.qid}` : `query:${s?.query}`}`;
+  const held = new Set((Array.isArray(record?.slices) ? record.slices : []).map(keyOf));
+  const out = [];
+  for (const s of Array.isArray(failed) ? failed : []) {
+    if (!s?.axis || (!s?.qid && !s?.query) || held.has(keyOf(s))) continue;
+    held.add(keyOf(s));
+    out.push(s.qid ? { axis: String(s.axis), qid: String(s.qid), reason: String(s.reason ?? "") }
+      : { axis: String(s.axis), query: String(s.query), reason: String(s.reason ?? "") });
+  }
+  return out;
+}
+
+/**
+ * The axes of `failed` that `record` does not list as disclosed yet: a pass on each was killed at its time limit and its
+ * recovery is spent, so the delivering pass reads its band as it stands and discloses it. [] when it adds none. PURE.
+ */
+export function axesNotYetDisclosed(record, failed) {
+  const held = new Set(Array.isArray(record?.disclosed_axes) ? record.disclosed_axes : []);
+  return [...new Set((Array.isArray(failed) ? failed : []).map((a) => String(a ?? "").trim()).filter((a) => a && !held.has(a)))];
+}
+
+/**
+ * The units of `failed` that `record` does not list as unfinished yet: each wrote no result once its attempts were spent,
+ * so the delivering pass takes it as its band stands instead of sending it again. [] when it adds none. PURE.
+ */
+export function unitsNotYetRecorded(record, failed) {
+  const held = new Set(Array.isArray(record?.unfinished_units) ? record.unfinished_units : []);
+  return [...new Set((Array.isArray(failed) ? failed : []).map((a) => String(a ?? "").trim()).filter((a) => a && !held.has(a)))];
+}
+
 /** Remove one part's record, once that part has completed after all. */
 export function clearPartNotCompleted(runDir, part) {
   try { rmSync(notCompletedPath(runDir, part), { force: true }); } catch { /* none */ }

package/driver/pipeline-knockout.mjs

@@ -64,7 +64,7 @@ import { writeRunStatus, readRunStatus, rollupStatus, atomicWrite, identitySeed
 import { batchMarkName } from "./mark-name.mjs";
 import { runLog, note, outputMeta } from "./log.mjs";
 import { defaultTerritoryState } from "./effective-scope.mjs";   // the stored-defaults reading — one producer, shared with the clearance lane
-import { AGENT_WHATSAPP, whatsappRouting } from "./stages.mjs";
+import { whatsappRouting } from "./stages.mjs";
 import { writeOutboxPacket } from "./outbox.mjs";
 import { rollupTokens, stampTokenRollup } from "./tokens.mjs";
 import { recordRunConsumption } from "./consumption-ledger.mjs";
@@ -1205,8 +1205,9 @@ export async function knockoutInner(ctx, job, opts = {}) {
       // two existing. Where no number is held the packet now SAYS so in `whatsappToReason` rather than
       // substituting the operator silently.
       //
-      // The failure notice below deliberately keeps `AGENT_WHATSAPP[agent]`: 289 ruled on the COMPLETION
-      // notice, and a stage failure is an operational page rather than an answer the requester ordered.
+      // The failure notice below routes the same way (buildFailurePacket). It used to keep `AGENT_WHATSAPP[agent]` as an
+      // operational page, but the courier relays it to the requester, who is owed it as they are owed a report, and the
+      // operator keeps the page as the copy beside it.
       ...whatsappRouting(job, agent),
       // ONE LINE, N LINKS. This said "Report: <one url>" and on a batch that url is now null, which would
       // have read "Report: null" — the fail-visible shape doing its job, and still not a line to send. A
@@ -1350,7 +1351,7 @@ export async function knockoutInner(ctx, job, opts = {}) {
     try {
       const rich = buildFailurePacket({
         runId, agent, job, failedStage, shortReason, terminalKind,
-        reasonVerbatim: String(reason).slice(0, 1000), whatsappTo: AGENT_WHATSAPP[agent] ?? null,
+        reasonVerbatim: String(reason).slice(0, 1000),
       });
       const packet = {
         kind: "run-failed", ...rich,