omp-conductor 0.13.0 → 0.14.0

package/src/daemon.ts

@@ -18,11 +18,13 @@ import {
   resolveReleaseGrants,
   stateDir,
 } from "./config.ts";
+import { availabilityState, type AvailabilityState } from "./availability.ts";
 import {
   analyseSettlement,
   formatSettlementFlags,
   settlementFlagSummary,
 } from "./diff-flags.ts";
+import { digestScheduleState, type DigestScheduleState } from "./digest-schedule.ts";
 import { createEscalator, escalationIssueRef } from "./escalate.ts";
 import { pendingCodeGraph, probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
 import { graphHint } from "./graph.ts";
@@ -30,7 +32,11 @@ import { livingDaemon } from "./lifecycle.ts";
 import { STALL_MARKER_FILE } from "./orchestrator-tick.ts";
 import { startOrchestrator } from "./orchestrator.ts";
 import type { OrchestratorHandle } from "./orchestrator.ts";
-import { createReportOutbox, formatOpenReports } from "./reports.ts";
+import {
+  createReportOutbox,
+  enqueueAvailableHeldNotices,
+  formatOpenReports,
+} from "./reports.ts";
 import {
   recordReleaseBlock,
   type ReleaseBlockContext,
@@ -42,11 +48,13 @@ import { classifyRun, providerCreditRefusal, providerTransientFault, type Classi
 import { projectLabels } from "./label-projection.ts";
 import { dbPath, LIVE_STATES, openStore, utcDay } from "./store.ts";
 import { makeTracker, type RateLimitStatus } from "./tracker/github.ts";
-import { RELEASE_SHAPES } from "./types.ts";
+import { DEFAULT_REPORT_POLICY, RELEASE_SHAPES } from "./types.ts";
 import type {
+  BaseHealth,
   AdmissionHoldReason,
   Caps,
   DispatchSummary,
+  DigestBacklog,
   Escalation,
   IssueSnapshot,
   MergedPrInfo,
@@ -167,6 +175,9 @@ interface Deps {
   caps: Caps;
   tracker: Tracker;
   store: Store;
+  /** False after a live config reload fails; autonomous delivery then holds
+   * fail-closed until a later tick validates the config again. */
+  deliveryPolicyValid?: boolean;
   /** Provider-reported plan allowance, cached with a TTL. Resolved once at
    *  startup like every other dep so a tick cannot swap its own meter. */
   usage: UsageSource;
@@ -1402,12 +1413,15 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
     });
     if (await settleStopBeforeSession()) return;
 
+    const repoSlug = githubRepo(r.repo.cloneUrl);
+
     let result: WorkerResult;
     try {
       result = await runWorker({
         brief,
         cwd: worktreePath,
         caps,
+        ...(repoSlug === undefined ? {} : { repoSlug }),
         maxTurns: () => turnLimit?.maxTurns() ?? maxTurns,
         onPauseControl: (control) => {
           workerSessionInstalled = true;
@@ -1804,12 +1818,12 @@ export interface Settlement {
  *
  * - `merged` — the work landed. That is what `merged` was reserved for.
  * - `closed` — a human read the work and said no. Leaving it `pushed-green`
- *   strands the issue forever behind a PR nobody will ever merge, and calling it
- *   `merged` is simply a lie about work that does not exist on the base branch.
- *   `failed` is true — the attempt did not land — and it releases the busy guard,
- *   so an issue a human re-queues can be attempted again. The attempt counter is
- *   untouched either way: this row was a real attempt, and pretending otherwise
- *   would let a rejected issue cycle past `maxAttemptsPerIssue`.
+ *   forever is a lie; `failed` records that it did not land and releases the
+ *   busy guard, so an issue a human re-queues can be attempted again. A row
+ *   that had reached `pushed-green` or `pushed-pending` is classified
+ *   `returned-for-revision` at settlement. A review decision asks for another
+ *   implementation pass, not a failure, so it consumes the continuation budget
+ *   instead of the failed-attempt budget.
  * - `open`, and undefined — nothing changes. Undefined is "could not tell": a
  *   flaky network, a revoked token, a deleted PR. Settling on it would record a
  *   merge that never happened, and the next tick asks again for free. An
@@ -1944,15 +1958,24 @@ export async function watchMergedBase(d: Pick<Deps, "project" | "tracker" | "sto
 
     let workflows;
     try {
-      workflows = await d.tracker.workflowRunsAt(repoIdentity, run.mergeSha);
+      workflows = await d.tracker.workflowRunsAt(repoIdentity, run.mergeSha, {
+        event: "push",
+        branch: run.baseRef,
+      });
     } catch (err) {
       log(`#${run.issue} base check unavailable (${errText(err)}) — retrying next tick`);
       continue;
     }
-    if (workflows === undefined || workflows.length === 0) {
+    if (workflows === undefined) {
       log(`#${run.issue} base check unavailable for ${run.mergeSha} — retrying next tick`);
       continue;
     }
+    if (workflows.length === 0) {
+      log(
+        `#${run.issue} base check: no push-triggered run yet for ${run.mergeSha} — retrying next tick`,
+      );
+      continue;
+    }
     if (workflows.some((workflow) => workflow.status !== "completed")) continue;
 
     const failed = workflows.find(
@@ -2016,6 +2039,110 @@ export async function watchMergedBase(d: Pick<Deps, "project" | "tracker" | "sto
   }
 }
 
+/**
+ * Refresh current base-branch health at each recently merged repository's live
+ * head. This is status and release-gate evidence only; the per-merge audit
+ * above remains the sole path that attributes and escalates a regression.
+ */
+export async function watchBaseHealth(
+  d: Pick<Deps, "project" | "tracker" | "store">,
+): Promise<void> {
+  const now = Date.now();
+  const previousByRepo = new Map(
+    d.store.baseHealth(d.project.name).map((row) => [row.repo, row] as const),
+  );
+  for (const { repo, baseRef } of d.store.mergedRepoBranches(
+    d.project.name,
+    now - BASE_STATUS_WINDOW_MS,
+  )) {
+    const target = d.project.routing.repos[repo];
+    if (target === undefined) {
+      log(`base health skipped: routed repository ${repo} is no longer configured`);
+      continue;
+    }
+    const identity = githubRepo(target.cloneUrl);
+    if (identity === undefined) {
+      log(`base health skipped: routed repository ${repo} has no GitHub identity`);
+      continue;
+    }
+    const branch = baseRef ?? target.defaultBranch;
+
+    let head: string | undefined;
+    try {
+      head = await d.tracker.branchHead(identity, branch);
+    } catch (err) {
+      log(`base ${repo}/${branch} head unavailable (${errText(err)}) — keeping previous health`);
+      continue;
+    }
+    if (head === undefined) {
+      log(`base ${repo}/${branch} head unavailable — keeping previous health`);
+      continue;
+    }
+
+    const previous = previousByRepo.get(repo);
+    if (
+      previous?.branch === branch &&
+      previous.headSha === head &&
+      (previous.verdict === "green" || previous.verdict === "red")
+    ) {
+      continue;
+    }
+
+    let runs;
+    try {
+      runs = await d.tracker.workflowRunsAt(identity, head, { event: "push", branch });
+    } catch (err) {
+      log(`base ${repo}/${branch} workflows unavailable (${errText(err)}) — keeping previous health`);
+      continue;
+    }
+    if (runs === undefined) {
+      log(`base ${repo}/${branch} workflows unavailable — keeping previous health`);
+      continue;
+    }
+
+    let verdict: BaseHealth["verdict"];
+    let detail: string | undefined;
+    if (runs.length === 0) {
+      verdict = "unknown";
+      detail = `no push-triggered workflow run for ${head.slice(0, 8)}`;
+    } else if (runs.some((run) => run.status !== "completed")) {
+      verdict = "pending";
+    } else {
+      const failed = runs.find(
+        (run) =>
+          run.conclusion !== undefined &&
+          FAILING_WORKFLOW_CONCLUSIONS.has(run.conclusion),
+      );
+      if (failed !== undefined) {
+        verdict = "red";
+        detail = `${failed.name} failed at ${head.slice(0, 8)} — ${failed.url}`;
+      } else if (
+        runs.some(
+          (run) =>
+            run.conclusion === undefined ||
+            !SUCCESSFUL_WORKFLOW_CONCLUSIONS.has(run.conclusion),
+        )
+      ) {
+        verdict = "pending";
+      } else {
+        verdict = "green";
+      }
+    }
+
+    const health: BaseHealth = {
+      repo,
+      branch,
+      headSha: head,
+      verdict,
+      runsCount: runs.length,
+      checkedAt: now,
+      ...(detail === undefined ? {} : { detail }),
+    };
+    d.store.upsertBaseHealth(d.project.name, health);
+    previousByRepo.set(repo, health);
+  }
+}
+
 export async function settlePushedGreen(
   d: Pick<Deps, "project" | "tracker" | "store">,
 ): Promise<void> {
@@ -2080,7 +2207,11 @@ export async function settlePushedGreen(
               baseCheck: "pending",
             }),
       };
-      if (settlement.state === "failed") patch.lastError = settlement.reason;
+      if (settlement.state === "failed") {
+        patch.lastError = settlement.reason;
+        patch.failureClass = "returned-for-revision";
+        patch.recoveryAction = "none";
+      }
       store.updateRun(run.id, patch);
       log(`#${run.issue} settled: ${settlement.reason}`);
       continue;
@@ -2823,8 +2954,26 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     }
     d.project = fresh;
     d.caps = freshCaps;
+    d.deliveryPolicyValid = true;
   } catch (err) {
-    log(`config reload failed (${errText(err)}) — continuing with the values loaded at boot`);
+    log(`config reload failed (${errText(err)}) — retaining boot values but blocking autonomous delivery`);
+    d.deliveryPolicyValid = false;
+  }
+
+  // Availability-held notices are already durable. Once the freshly reloaded
+  // policy opens (or newly allows their category), atomically hand a bounded
+  // batch to the report outbox. Pauses do not suppress delivery.
+  if (d.deliveryPolicyValid !== false) {
+    try {
+      const catchUp = enqueueAvailableHeldNotices(d.project, d.store, Date.now());
+      if (catchUp !== undefined && !catchUp.deduped) {
+        log(`availability catch-up ${catchUp.report.id} queued for ${d.project.name}`);
+      }
+    } catch (err) {
+      // The daily digest may have claimed the same rows from another process
+      // between selection and association. Either way the ledger still owns them.
+      log(`availability catch-up handoff deferred (${errText(err)}) — retrying next tick`);
+    }
   }
 
   // Before the pause check, deliberately. This one is not about dispatch: the
@@ -2844,6 +2993,11 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   } catch (err) {
     log(`base-branch check sweep failed: ${errText(err)}`);
   }
+  try {
+    await watchBaseHealth(d);
+  } catch (err) {
+    log(`current base-health sweep failed: ${errText(err)}`);
+  }
   try {
     await adoptSalvagedPrs(d);
   } catch (err) {
@@ -3367,6 +3521,10 @@ export interface StatusSnapshot {
    * reading like a mistake (#220).
    */
   pauseReason?: string;
+  /** Mechanical operator availability at the moment this snapshot was read. */
+  availability?: AvailabilityState;
+  /** Next digest opportunity under the same predicate that gates submission. */
+  digestSchedule?: DigestScheduleState;
   caps: Caps;
   /**
    * The effective per-shape release grants. On the snapshot rather than re-read
@@ -3386,6 +3544,9 @@ export interface StatusSnapshot {
    *  unknown outcome, or written off. An empty list is the only honest way to
    *  say "everything authored this cycle actually went out" (#123). */
   openReports: ReportRecord[];
+  /** Ordinary outcomes and deferred escalations not yet associated with an
+   * accepted digest report. */
+  digestBacklog: DigestBacklog;
   /**
    * The most recent conductor-verb calls and how the daemon decided them
    * (#126). On `status` rather than only behind `omp-conductor ledger` because
@@ -3393,8 +3554,8 @@ export interface StatusSnapshot {
    * config does not let it, and an operator who has to know to go looking is an
    * operator who finds out from the tracker instead.
    */
-  /** Newest post-merge base verdict per routed repository within seven days. */
-  baseChecks: RunRecord[];
+  /** Current live-head push-workflow verdict per recently merged repository. */
+  baseHealth: BaseHealth[];
   verbLedger: VerbLedgerEntry[];
   /** Runs backed by a worker process — the number capacity compares against. */
   liveWorkers: number;
@@ -3441,6 +3602,10 @@ export function statusSnapshotFromStore(
   store: Store,
   planUsage?: PlanUsageStatus,
 ): StatusSnapshot {
+  const now = Date.now();
+  const lastDigestKey = store.lastDigestDedupeKey(p.name);
+  const lastDigestDay =
+    lastDigestKey === undefined ? undefined : lastDigestKey.slice("digest:".length);
   const since = startOfToday();
   const dispatch = store.latestDispatch(p.name);
   const labelOpsPending = store.countPendingLabelOps(p.name);
@@ -3454,12 +3619,15 @@ export function statusSnapshotFromStore(
     stateDir: stateDir(),
     paused: isPaused(),
     ...(reason === undefined ? {} : { pauseReason: reason }),
+    availability: availabilityState(p.reporting, now),
+    digestSchedule: digestScheduleState(p.reporting ?? DEFAULT_REPORT_POLICY, lastDigestDay, now),
     caps,
     releaseGrants: resolveReleaseGrants(p),
     activeRuns: store.activeRuns(p.name),
     salvagedRuns: store.salvagedRuns(p.name),
     turnOverrides: store.listTurnOverrides(p.name),
     openReports: store.openReports(p.name),
+    digestBacklog: store.digestBacklog(p.name),
     verbLedger: store.verbLedger(p.name, { limit: STATUS_LEDGER_SCAN }),
     liveWorkers: store.liveRuns(p.name).length,
     runsToday: store.runsStartedSince(p.name, since),
@@ -3468,12 +3636,12 @@ export function statusSnapshotFromStore(
     ...(planUsage === undefined ? {} : { planUsage }),
     // Written by the tracker's hooks rather than polled, so the renderer does
     // not re-read GitHub to know it is being refused (#198).
-    ghRefusals: store.ghRefusalsSince?.(Date.now() - 5 * 60_000),
+    ghRefusals: store.ghRefusalsSince?.(now - 5 * 60_000),
     ghCallsToday: store.ghCallsToday?.(utcDay()),
     ...(labelOpsPending === 0 || oldestLabelOpAt === undefined
       ? {}
-      : { labelOps: { pending: labelOpsPending, oldestAgeMs: Date.now() - oldestLabelOpAt } }),
-    baseChecks: store.latestBaseChecks(p.name, Date.now() - BASE_STATUS_WINDOW_MS),
+      : { labelOps: { pending: labelOpsPending, oldestAgeMs: now - oldestLabelOpAt } }),
+    baseHealth: store.baseHealth(p.name),
   };
 }
 
@@ -3556,18 +3724,22 @@ export function formatReleaseGrants(grants: ResolvedGrants): string[] {
     ...RELEASE_SHAPES.map((shape) => `  ${shape.padEnd(19)}${grants[shape]}`),
   ];
 }
-export function formatBaseChecks(runs: readonly RunRecord[]): string[] {
-  return runs.flatMap((run) => {
-    if (run.baseCheck === undefined) return [];
-    const branch = run.baseRef ?? "?";
-    const flag = run.settlementFlags?.find((candidate) => candidate.kind === "base-branch-red");
-    const verdict =
-      run.baseCheck === "red"
-        ? `RED — ${flag?.detail ?? "workflow failed after merge"}`
-        : run.baseCheck === "red-preexisting"
-          ? `red before merge${flag === undefined ? "" : ` — ${flag.detail}`}`
-          : run.baseCheck;
-    return [`base ${run.repo}/${branch}  ${verdict}`];
+export function formatBaseHealth(rows: readonly BaseHealth[]): string[] {
+  return rows.map((row) => {
+    const head = row.headSha.slice(0, 8);
+    if (row.verdict === "green") {
+      return `base ${row.repo}/${row.branch}  green (${row.runsCount} run(s)) at ${head}`;
+    }
+    if (row.verdict === "red") {
+      return `base ${row.repo}/${row.branch}  RED — ${row.detail ?? `workflow failed at ${head}`}`;
+    }
+    if (row.verdict === "pending") {
+      return `base ${row.repo}/${row.branch}  pending (${row.runsCount} run(s)) at ${head}`;
+    }
+    return (
+      `base ${row.repo}/${row.branch}  unknown — ` +
+      (row.detail ?? `no push-triggered workflow run for ${head}`)
+    );
   });
 }
 
@@ -3618,7 +3790,7 @@ export function formatStatus(s: StatusSnapshot): string {
       if (flagged !== undefined) lines.push(`      ${flagged}`);
     }
   }
-  lines.push(...formatBaseChecks(s.baseChecks));
+  lines.push(...formatBaseHealth(s.baseHealth));
   lines.push(...formatSalvagedRuns(s.salvagedRuns));
   lines.push(...formatOpenReports(s.openReports));
   lines.push(...formatVerbLedger(s.verbLedger));
@@ -4380,7 +4552,17 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     }
   }
 
-  const escalator = createEscalator(project, tracker, store, orchestrator);
+  let runtimeDeps: Deps | undefined;
+  const currentProject = (): ProjectConfig => runtimeDeps?.project ?? project;
+  const deliveryPolicyValid = (): boolean => runtimeDeps?.deliveryPolicyValid === true;
+  const escalator = createEscalator(
+    currentProject,
+    tracker,
+    store,
+    orchestrator,
+    Date.now,
+    deliveryPolicyValid,
+  );
 
   // Report delivery is the daemon's, not the model's (#123). Built beside the
   // escalator because a report nobody can deliver pages through it, and driven
@@ -4388,10 +4570,11 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   // but still owes its operator the report it was handed, and five minutes is a
   // long time to sit on a page.
   const outbox = createReportOutbox({
-    project,
+    project: currentProject,
     store,
     escalate: (e) => escalator.escalate(e),
     log,
+    deliveryAllowed: deliveryPolicyValid,
   });
 
   // Every row still `sending` when a daemon boots belonged to a process that is
@@ -4417,6 +4600,8 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     caps,
     tracker,
     store,
+    // Fail closed until the first tick re-reads and validates the live config.
+    deliveryPolicyValid: false,
     // Process-wide, so a `status` served off this daemon's own HTTP surface
     // reuses the tick's reading instead of shelling out again.
     usage: sharedUsageSource(),
@@ -4431,6 +4616,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     ...(verbPeerReader === undefined ? {} : { verbPeerReader }),
     verbActions,
   };
+  runtimeDeps = d;
 
   if (o.once) {
     try {

package/src/diff-flags.ts

@@ -290,9 +290,19 @@ function expandBraces(token: string): string[] {
   return alternatives.map((alt) => prefix + alt + suffix);
 }
 
+/** A trailing slash-separated extension list:
+ *  `scripts/a.sh/.py` → [`scripts/a.sh`, `scripts/a.py`]. */
+function expandExtensionAlternation(token: string): string[] {
+  const match = /^(.+?)\.([A-Za-z][A-Za-z0-9]{1,7})((?:\/\.[A-Za-z][A-Za-z0-9]{1,7})+)$/.exec(token);
+  if (match === null) return [token];
+  const [, base, first, rest] = match;
+  if (base === undefined || first === undefined || rest === undefined) return [token];
+  return [first, ...rest.split("/.").filter(Boolean)].map((extension) => `${base}.${extension}`);
+}
+
 /** Every path-shaped token on the report's `changed:` line. An absent line and
  *  a line naming nothing are the same answer: nothing was disclosed. */
-export function claimedPaths(report: string): string[] {
+function parseClaimedPaths(report: string, extensionAlternatives?: Set<string>): string[] {
   const line = CHANGED_LINE.exec(report)?.[1] ?? "";
   const seen = new Set<string>();
   // Split on whitespace and semicolons, and on commas *outside* a brace group:
@@ -306,13 +316,21 @@ export function claimedPaths(report: string): string[] {
     // directions — sees plain paths: a brace token dies earlier at the
     // CLAIMED_PATH filter if it is never opened up (#224).
     for (const expanded of expandBraces(normalised)) {
-      if (!CLAIMED_PATH.test(expanded) && !DOTTED_MODULE.test(expanded)) continue;
-      seen.add(expanded);
+      const alternatives = expandExtensionAlternation(expanded);
+      for (const path of alternatives) {
+        if (!CLAIMED_PATH.test(path) && !DOTTED_MODULE.test(path)) continue;
+        seen.add(path);
+        if (alternatives.length > 1) extensionAlternatives?.add(path);
+      }
     }
   }
   return [...seen];
 }
 
+export function claimedPaths(report: string): string[] {
+  return parseClaimedPaths(report);
+}
+
 /**
  * Whether one claim covers one path. Every rule here is deliberately generous,
  * because each one that fails produces an omission flag on an honest report:
@@ -505,7 +523,8 @@ export function analyseSettlement(audit: SettlementAudit): SettlementFlag[] {
 
 function reconcileChanged(audit: SettlementAudit, flags: SettlementFlag[]): void {
   const touched = audit.diff.files.filter((f) => DERIVED_FILE[basename(f.path)] !== true);
-  const claims = claimedPaths(audit.report);
+  const extensionAlternatives = new Set<string>();
+  const claims = parseClaimedPaths(audit.report, extensionAlternatives);
   const priorClaims = claimedPaths((audit.priorReports ?? []).join("\n"));
   // Coverage pools the current report with every prior attempt's disclosures:
   // a file the final report no longer names was disclosed while the work was
@@ -553,12 +572,62 @@ function reconcileChanged(audit: SettlementAudit, flags: SettlementFlag[]): void
     if (audit.diff.files.some((f) => covers(claim, f.path) || covers(claim, f.previousPath ?? ""))) {
       continue;
     }
+    if (extensionAlternatives.has(claim)) {
+      const stem = claim.slice(0, claim.lastIndexOf("."));
+      const matchedAlternative = claims.some(
+        (other) =>
+          other !== claim &&
+          extensionAlternatives.has(other) &&
+          other.slice(0, other.lastIndexOf(".")) === stem &&
+          audit.diff.files.some((f) => covers(other, f.path) || covers(other, f.previousPath ?? "")),
+      );
+      if (matchedAlternative) continue;
+    }
     flags.push({
       kind: "unmatched-claim",
       file: claim,
       detail: "named by the report's `changed:` line but not touched by the PR",
     });
   }
+
+  // A parser failure can otherwise accuse the report in both directions for
+  // the same file. Collapse only that self-refuting pair; unrelated findings
+  // remain intact.
+  const unmatched = flags.filter((flag) => flag.kind === "unmatched-claim");
+  const removed = new Set<SettlementFlag>();
+  let exampleClaim = "";
+  let examplePath = "";
+  for (const undisclosed of flags.filter((flag) => flag.kind === "undisclosed-file")) {
+    const name = basename(undisclosed.file);
+    const extension = name.lastIndexOf(".");
+    const stem = extension > 0 ? name.slice(0, extension) : name;
+    if (stem.length < 3) continue;
+    for (const claim of unmatched) {
+      if (!claim.file.includes(stem)) continue;
+      removed.add(undisclosed);
+      removed.add(claim);
+      if (exampleClaim === "") {
+        exampleClaim = claim.file;
+        examplePath = undisclosed.file;
+      }
+    }
+  }
+  if (removed.size === 0) return;
+
+  const kept = flags.filter((flag) => !removed.has(flag));
+  const removedClaims = unmatched.filter((flag) => removed.has(flag)).length;
+  flags.splice(
+    0,
+    flags.length,
+    ...kept,
+    {
+      kind: "report-format-unparsed",
+      file: "(report)",
+      detail:
+        `${removedClaims} claim(s) on the \`changed:\` line could not be parsed as paths yet name the same ` +
+        `file(s) the PR touched (e.g. ${exampleClaim} vs ${examplePath}) — read the diff directly`,
+    },
+  );
 }
 
 function detectWeakening(audit: SettlementAudit, flags: SettlementFlag[]): void {