omp-conductor 0.15.12 → 0.16.0

package/src/reports.ts

@@ -37,7 +37,14 @@
  */
 
 import { availabilityDisposition, interruptDisposition } from "./availability.ts";
-import { readTelegramToken, resolveProjectTopicId, sendTelegram, TelegramSendError } from "./escalate.ts";
+import {
+  readTelegramToken,
+  resolveProjectTopicId,
+  sendTelegram,
+  telegramTextParts,
+  TelegramSendError,
+} from "./escalate.ts";
+import { createHash } from "node:crypto";
 import { localDayKey } from "./digest-schedule.ts";
 import {
   DIGEST_BACKLOG_LIMIT,
@@ -86,11 +93,68 @@ const NO_ISSUE = 0;
 const ERROR_SAMPLE = 90;
 
 /**
- * One delivery attempt's transport. Injected so the delivery contract — claim,
- * send, record, retry — is testable without a live bot, which is the same split
- * `confineToolCall` and `verifyPr` use: the decision is separable from the I/O.
- * Resolves with Telegram's own message id when it returns one, throws on any
- * known failure.
+ * The within-run harness reliability a settlement now names where a human
+ * reads it (#584). The row always carries the resolved model/provider and the
+ * counts (written at settlement straight off the worker result); this is only
+ * the *wording* — the sentence a settlement report and a tick digest tell an
+ * operator who would otherwise have to read a transcript to learn that the
+ * run finished on a fallback after a mid-run swap, or rode out a throttled
+ * provider on retries and compaction.
+ *
+ * Deliberately empty for a clean run: a run that never swapped, retried or
+ * compacted changes neither the settlement report nor the digest, so the
+ * "additive" claim is the observable one — byte-for-byte today's output on a
+ * quiet fleet. The resolved model is still recorded on the row every time (#584's
+ * second fake), but a clean run's narrative has nothing to add.
+ */
+export interface ReliabilitySettlement {
+  resolvedModel?: string;
+  resolvedProvider?: string;
+  retryFallbacks: { from: string; to: string }[];
+  retryFallbackSucceeded: number;
+  modelRecoveries: number;
+  autoRetryCount: number;
+  autoCompactionCount: number;
+}
+
+/**
+ * The human sentence for the above reliability surface, or undefined when there
+ * is nothing worth saying (a clean run). One line so it drops into both the
+ * settlement report and a material event's summary unchanged.
+ */
+export function reliabilitySettlementLine(
+  f: ReliabilitySettlement,
+): string | undefined {
+  const { resolvedModel, resolvedProvider } = f;
+  if (f.retryFallbacks.length === 0 && f.retryFallbackSucceeded === 0 && f.modelRecoveries === 0 && f.autoRetryCount === 0 && f.autoCompactionCount === 0) {
+    return undefined;
+  }
+  const activity = [
+    f.retryFallbacks.length > 0
+      ? `${f.retryFallbacks.length} within-run model swap${f.retryFallbacks.length === 1 ? "" : "s"}`
+      : undefined,
+    f.retryFallbackSucceeded > 0 ? `${f.retryFallbackSucceeded} recovered` : undefined,
+    f.modelRecoveries > 0 ? `${f.modelRecoveries} model recovery` : undefined,
+    f.autoRetryCount > 0 ? `${f.autoRetryCount} provider retry` : undefined,
+    f.autoCompactionCount > 0 ? `${f.autoCompactionCount} compaction` : undefined,
+  ].filter((part): part is string => part !== undefined);
+  const finished =
+    resolvedModel === undefined
+      ? "finished on the fallback"
+      : `finished on ${resolvedModel}${resolvedProvider === undefined ? "" : ` (${resolvedProvider})`}`;
+  return `Reliability: ${activity.join(", ")}; ${finished}.`;
+}
+
+/**
+ * One delivery attempt's transport for a *single message*. Injected so the
+ * delivery contract — claim, split, send, record progress, retry — is testable
+ * without a live bot, which is the same split `confineToolCall` and `verifyPr`
+ * use: the decision is separable from the I/O. The outbox splits a long report
+ * into labelled parts itself and drives one call per part (so partial progress
+ * can be persisted and resumed, #566); a text passed here is always under the
+ * wire limit. Resolves with Telegram's own message id when it returns one,
+ * throws on any known failure — {@link TelegramSendError} carries the
+ * definitive/unknown verdict the retry's honesty hangs on.
  */
 export type ReportSend = (text: string) => Promise<number | undefined>;
 
@@ -291,7 +355,14 @@ export function telegramReportSend(p: ProjectConfig): ReportSend {
         "definitive",
       );
     }
-    return await sendTelegram(token, chatId, text, { topicId: resolveProjectTopicId(p) });
+    // `sendTelegram` splits internally and resolves with every part's id. A
+    // caller on this seam always passes one message under the wire limit, so a
+    // single-element array comes back; `[0]` is that one id. A text over the
+    // limit would still be delivered whole (never truncated) — the seam would
+    // simply under-report the extra ids, which is why the split lives at the
+    // caller, not here.
+    const ids = await sendTelegram(token, chatId, text, { topicId: resolveProjectTopicId(p) });
+    return ids[0];
   };
 }
 
@@ -345,7 +416,13 @@ export async function deliverOperatorMessage(
     });
     return { kind: "held", category, noticeId: deps.noticeId, reason: disposition };
   }
-  await (deps.send ?? telegramReportSend(project))(text);
+  const send = deps.send ?? telegramReportSend(project);
+  // A long operator message is split and driven part-by-part through the same
+  // seam the outbox uses, so a custom transport sees the same per-part calls
+  // and the default one never truncates (#566).
+  for (const part of telegramTextParts(text)) {
+    await send(part);
+  }
   return { kind: "sent", category };
 }
 
@@ -596,9 +673,38 @@ export function createReportOutbox(deps: ReportOutboxDeps): ReportOutbox {
       return;
     }
 
-    let messageId: number | undefined;
+    const text = formatReportMessage(claimed, project.name);
+    const parts = telegramTextParts(text);
+    // Fingerprint of the exact text the split below is computed from. The
+    // per-part watermark on the row is only meaningful while this is unchanged:
+    // the resume point is a count into a specific split, so any drift in the
+    // text invalidates it (#566).
+    const messageHash = createHash("sha256").update(text).digest("hex");
+    // Resume at the first part this attempt has not yet confirmed. A count is
+    // only a valid resume point while the text — and therefore the split — is
+    // byte-identical to the attempt that wrote the watermark. Any change,
+    // notably the possible-repeat banner an unknown outcome adds to an
+    // ambiguous report, reshapes the parts, so the watermark is deliberately
+    // not carried across it and the whole report is re-sent amber-flagged —
+    // the same at-least-once semantics as the single-message path (#566).
+    const resumeAt = claimed.sentPartsHash === messageHash ? (claimed.sentParts ?? 0) : 0;
+    const start = Math.min(resumeAt, parts.length);
+
+    const messageIds: number[] = [];
     try {
-      messageId = await send(formatReportMessage(claimed, project.name));
+      // Strictly in order, one `sendMessage` at a time: parts never interleave
+      // with each other or with a message sent concurrently to the same chat.
+      for (let i = start; i < parts.length; i += 1) {
+        const id = await send(parts[i]!);
+        if (id !== undefined) messageIds.push(id);
+        // Persist progress before the next part ships. Only a multi-part send
+        // has a crossing point to protect: a crash or a definitive failure can
+        // then only ever re-send the part that was in flight, never the
+        // confirmed prefix. Guarded by attempt id like every other transition.
+        if (parts.length > 1) {
+          store.markReportPartsSent(claimed.id, attemptId, i + 1, messageHash, now());
+        }
+      }
     } catch (err) {
       const at = now();
       const error = err instanceof Error ? err.message : String(err);
@@ -641,15 +747,21 @@ export function createReportOutbox(deps: ReportOutboxDeps): ReportOutbox {
       pass.requeued.push(claimed.id);
       log(
         `report ${claimed.id} attempt ${claimed.attempts}/${REPORT_MAX_ATTEMPTS} was rejected, ` +
+          `${start + messageIds.length}/${parts.length} parts accepted, ` +
           `retrying in ${Math.round(delay / 1_000)}s: ${error}`,
       );
       return;
     }
 
-    store.markReportDelivered(claimed.id, attemptId, messageId, now());
+    store.markReportDelivered(claimed.id, attemptId, messageIds, now());
     pass.delivered.push(claimed.id);
     log(
-      `report ${claimed.id} delivered${messageId === undefined ? "" : ` as telegram message ${messageId}`}` +
+      `report ${claimed.id} delivered` +
+        (parts.length === 1
+          ? messageIds[0] === undefined
+            ? ""
+            : ` as telegram message ${messageIds[0]}`
+          : ` as ${parts.length} telegram messages (${messageIds.join(", ")})`) +
         `${claimed.ambiguous ? " (marked as a possible repeat)" : ""}`,
     );
   };

package/src/session-host.ts

@@ -50,6 +50,11 @@ export interface SessionHostSpec {
   verbSocketPath?: string;
   /** Deny every tool but reading and searching (#307) — the setup probes. */
   readOnly?: boolean;
+  /** The fleet-owned omp settings overlay (#537): absolute path to the YAML
+   *  overlay the daemon materialised from the project's `ompSettings` map.
+   *  Carried as a plain scalar like the other fields; absent, nothing is staged
+   *  on the far side either. */
+  ompSettingsFile?: string;
 }
 
 /** Parent → child. */
@@ -186,6 +191,7 @@ export async function runSessionHost(
       ...(spec.releaseGrants === undefined ? {} : { releaseGrants: spec.releaseGrants }),
       ...(spec.verbSocketPath === undefined ? {} : { verbSocketPath: spec.verbSocketPath }),
       ...(spec.readOnly === undefined ? {} : { readOnly: spec.readOnly }),
+      ...(spec.ompSettingsFile === undefined ? {} : { ompSettingsFile: spec.ompSettingsFile }),
       // The release audit lives in the daemon's state directory, which this
       // process may not be able to write and must not be trusted to. It
       // becomes a message; the parent performs the durable write.