pi-crew 0.11.17 → 0.11.18

package/CHANGELOG.md

@@ -1,5 +1,67 @@
 # Changelog
 
+## [Unreleased]
+
+## [0.11.18] — U11 hybrid 2-tier worker + Δ-wave benches/gates + windows CI repair (2026-10-12)
+
+### Added
+
+- **bench(runtime): b15 — broker/scheduler task-array scan-cost microbench (Δ3)** — `bench/b15-broker-scan-cost.bench.ts` (b14 convention): measures the REAL scheduler paths (`taskGraphSnapshot`, `getReadyTasks`), a line-cited replica of the module-private `dagReadyTaskIds` call-site, the REAL crew-broker delegate/wait call-sites over a unix socket with an injected instant fake spawner, `loadRunManifestById` cold/warm floors, and the `scanZombieTempWorkspaces` walk at N=10/100/1000 in isolated mkdtemp homes. Scan-count instrumentation is bench-local (Array.prototype wrapped in-process only) — zero hot-file edits. **Δ3 verdict (bench-first rule): all 6 candidate index sites NOT-JUSTIFIED** — at realistic N≤11 tasks/run, scans cost 0.006-0.05 ms/call vs ms-scale I/O floors (loadCold 8.1 ms, DAG planner 28.8 ms @ n1000); even at 90× N, scans (0.86 ms) sit below the parse floor. **Held-lifetime audit closed no-op:** no structure is UNBOUNDED-RISK (details: `docs/perf/broker-scan-audit-2026-10-11.md`).
+- **feat(runtime): U11 — hybrid 2-tier worker model (embedded tier, DEFAULT-OFF)** — per-role opt-in to the EMBEDDED worker tier (in-process Pi session on the U4 live-session stack) with the subprocess tier kept as the default and automatic fallback:
+  - **Config** `runtime.embeddedWorkers {enabled, roles, maxConcurrent, faultThreshold}` (types + schema + lenient parse stay in sync, F19-1 discipline; all-invalid block collapses to undefined so a malformed config can never enable the tier). With the block absent/disabled, tier routing is a byte-identical no-op — no imports, no events, no budget reads (pinned by regression tests in both lanes).
+  - **Routing** (`resolveTaskRuntimeKind`, optional 5th input — every pre-U11 call site unchanged): an opted-in role upgrades a child-process resolution to live-session only. `isolationPolicy.isolatedRoles`, the scaffold kind, and the `PI_CREW_DEPTH > 0` nesting guard ALWAYS beat the opt-in (the depth rule is applied to the embedded upgrade itself — extended, never weakened). The legacy `runtime.mode: live-session` path is deliberately frozen (ADR 2026-08-15 (a)) — it gets no budget/ledger semantics.
+  - **Orchestration** (`task-runner/hybrid-tier.ts`, lazily imported only when the policy is enabled): fail-fast embedded ceiling (blast-radius bound, default `max(1, floor(worker-cap/2))`) → SHARED global worker slot (the exact `acquireWorkerSlot` semaphore the subprocess tier uses — no concurrency bypass; abort while queued takes no slot) → durable per-task fault ledger (`task.diagnostics.embeddedTier`, disk-merged freshest-count so retries/recovery see it) → automatic fallback to subprocess after `faultThreshold` counted faults (default 2; aborts and capacity rejections never count). `tier.decision` / `tier.fault` / `tier.fallback` events registered in `TEAM_EVENT_TYPES`. The subprocess fallback runs strictly sequentially after the live attempt resolved — the single-writer sink invariant is preserved.
+  - **Mitigations** (`live-session/embedded-tier.ts`, gated on `embeddedMitigations` passed only for embedded-routed tasks): (a) builtin-tools-only enforcement with verify-after-set and fail-closed degradation (no `mcp__*`, no extension drift); (b) provider `timeoutMs` clamp + restore on the session's ModelRuntime; (c) turn-count watchdog (bounded grace → dispose + escape); (d) session-side concurrency cap (fail-fast, never queue); ref-counted process `uncaughtException` guard (quarantine-all embedded sessions, host kept alive, 20-quarantine circuit breaker restores default crash behavior); ring-capped rate-limited memory metrics; factory-surface + global-state asserts (U4 pattern).
+  - **Fix round (2026-10-11, P1)**: provider-timeout registration is now ref-counted per (ModelRuntime, providerId) with wrapper-base chasing — concurrent embedded sessions share ONE ModelRuntime, and the original apply/restore could stack wrappers and permanently leak the embedded timeout clamp onto every later session on that runtime (silently — restore reported success). The registered wrapper now always delegates to the chased BASE provider at the min of the active clamps; the base is re-registered exactly when the last session leaves; any restore order is safe (pinned by two regression tests).
+- **docs(runtime): U11 DEFAULT-OFF policy guide** — `docs/usage.md` gains a "Hybrid 2-tier workers" section (config example, per-key semantics, the full safety model, fallback stickiness, `tier.*` / `live-session.embedded_*` observability) and the README config table documents `runtime.embeddedWorkers`.
+
+### Changed
+
+- **fix(utils): drop dead `hosted-git-info` branch in `parseGitUrl` — Δ2 gate allowlist back to strict** — the Δ2 finding's `require()` in `src/utils/git.ts` was verified to never resolve in ANY environment (undeclared, and in the repo checkout even the transitive path via peer `@earendil-works/pi-coding-agent` is unreachable from `src/`), so the hosted-parse candidate loops were dead code in every deployment and `parseGenericGitUrl` was the only path that ever executed. Removed the require, its types/loader, and both candidate loops (zero behavior change); `OPTIONAL_RUNTIME_REQUIRES` in `scripts/check-lazy-imports.mjs` is empty again — the gate is strict, resolving the "pending `optionalDependencies` decision" note in the Δ2 entry below.
+
+- **feat(scripts): Δ2 — declared-deps/lazy-import gate rewritten from regex to AST** (esbuild type-strip + acorn walk of `ImportDeclaration` / `export … from` / runtime `import()` / `require()`-`require.resolve()`, ports upstream check-runtime-deps semantics; per-entry budget `{maxFiles: 521, forbid: [test/, scripts/, docs/, dist/]}` for `index.bundle.ts`, ports upstream check-entry-graphs; `--root` fixture seam for tests) — closes every RR-021 residual regex blind spot; first run surfaced one real finding: `hosted-git-info` is an undeclared optional `require()` in `src/utils/git.ts` (resolves transitively via peer `@earendil-works/pi-coding-agent`; explicitly allowlisted in the gate pending an `optionalDependencies` decision).
+
+### Fixed
+
+- **fix(state): register 3 mailbox event types — CI `check:event-types --enforce` green** — `mailbox.send` (`crew-broker.ts:993`), `mailbox.pickup` and `mailbox.pickup_deduped` (`inbox-poll.ts`) were emitted but missing from `TEAM_EVENT_TYPES`, failing the CI registry-enforce gate (U5 exactly-once delivery audit trail; dedup key + receipt payload only — never message bodies). Bundle note: the registry const is tree-shaken from `dist/index.mjs` (fresh build byte-identical to the committed dist — `check-bundle-staleness --committed-hash` passes with no dist delta to commit).
+- **fix(test): fill 4 empty arrow-function bodies in `socket-path-fbat1.test.ts`** — comment-filled the `destroy: () => {}` / `net.createServer(() => {})` bodies that tripped biome `noEmptyBlockStatements` in CI; zero assertion changes.
+- **fix(test): `verify-gate-tool` Windows path assertion — exact string compare instead of `new RegExp(path)`** — building a RegExp from an absolute Windows path consumes the backslashes as regex escapes (`\t`→TAB, `\r`→CR, `\U`/`\p` identity-dropped), so the pattern could never match the literal path (windows-latest CI failure). Now `assert.equal` on the exact command string, plus a regression pin proving a raw-backslash RegExp does NOT match a Windows path.
+- **fix(test): U15 concurrent-dispose CI flake — fork-free busy loop closes the deferred-TERM-trap race** — with `while :; do sleep 1; done` there is a write→fork gap right after the readiness `echo`: dispose's group TERM lands inside that gap on loaded runners, dash defers the pending trap until the NEXT (post-signal) sleep dies (~1s) > `gracefulMs` 500, so SIGKILL beats the trap and the marker never appears (~30% flake; probe-pinned: failing runs always tReady<6ms, passing runs >20ms). `while :; do :; done` has no fork to straddle — dash runs the pending trap at the next simple-command boundary (ms), far inside the grace window. 11/11 pass locally.
+- **fix(state): stop unit-test runs leaking into the real user crew root** — the
+  test runner now isolates the crew home per suite (`scripts/test-runner.mjs`
+  sets BOTH `PI_CREW_HOME` and `PI_TEAMS_HOME` to a per-suite temp dir; PI_TEAMS_HOME
+  wins the mirror pair, so setting only one is silently defeatable; opt-out
+  `PI_CREW_TEST_NO_HOME_ISOLATION=1`; cleanup on all exit paths). Until now every
+  fixture that created a run from a bare `/tmp` cwd routed its state to
+  `~/.pi/agent/extensions/pi-crew/` via `scopeBaseRoot()`'s no-repo fallback — and
+  every live Pi session's async-notifier toasted those fixture failures as
+  `Error: pi-crew run failed: team_… (inline-seam-fixture/none)` (104 leaked run
+  dirs since June; quarantined + cleaned 2026-10-11).
+- **fix(run-index): hide terminal bare-temp-cwd runs from non-temp crew roots**
+  (defense-in-depth for the same leak) — `collectRuns()`'s 2.19 temp guard now
+  also covers the CWD dimension: in NON-temp roots (the real project/user roots)
+  a TERMINAL run whose cwd sits under a temp dir WITHOUT repo markers is a
+  test/isolated-workspace fixture parked by the no-repo fallback and is hidden.
+  Temp-root scans keep their original semantics (active runs liveness-gated,
+  terminal runs listed — prune/health consumers rely on it); temp cwds WITH repo
+  markers (deliberate /tmp projects, isolated worktrees) and active bare-temp-cwd
+  runs stay listed. By-ID resolution (`team status <runId>`) is unchanged.
+  Covered by `test/unit/extension/core/run-index-temp-cwd.test.ts`.
+
+### Docs
+
+- **docs(u12): upstream pi-durable tracking doc** — new
+  `docs/reviews/pi-upstream-tracking-u12.md` (living re-check log, rerun every pi npm
+  release). Records the U12 spec's 4 adoption triggers with verdicts pinned at upstream
+  `origin/main` = `cdaf6c227`: T1 banner/API-freeze NOT met (`README.md:3` banner stands,
+  `[Unreleased]` opens with 5 breaking bullets), T2 multi-process NOT met (everything still
+  under `packages/coding-agent/src/experimental/`, `PI_EXPERIMENTAL=1`-gated), T3 subagent
+  conversations via services NOT met (TODO open at `services/README.md:44`), T4 concurrency
+  cap MET via pi-crew's own `resolveBatchConcurrency` cap (upstream `cb4375493` changed the
+  pass algorithm, added no cap). Appends the 7-item blacklist of unreleased post-1.1.0 churn
+  from the 2026-10-11 delta §5, each with verbatim `[Unreleased]` changelog wording. Overall:
+  still track-only (1/4 vs ≥3/4 bar); exact-pin policy unchanged.
+
 ## [0.11.17] — upgrade wave A: pi-1.1.0 adoption, central env registry, OSC 7501 program-status (2026-10-11)
 
 Implements the 10-item Wave A from `pi-crew-upgrade-research-round2.md` +

package/README.md

@@ -124,6 +124,7 @@ Most-used keys (full set: [docs/usage.md](docs/usage.md) · [schema.json](schema
 | Key | What it does |
 |-----|--------------|
 | `runtime.mode` 🔒 | `auto \| scaffold \| child-process \| live-session` — how workers execute |
+| `runtime.embeddedWorkers` | U11 hybrid tier, **DEFAULT-OFF**: opt roles into in-process (embedded) workers with 2-fault fallback to subprocess — see [docs/usage.md](docs/usage.md#hybrid-2-tier-workers-embedded-tier-u11-default-off) |
 | `executeWorkers` 🔒 | `false` = dry-run planning only, no child processes |
 | `asyncByDefault` 🔒 | detach every run by default (survives session switches) |
 | `limits.maxConcurrentWorkers` | hard cap on parallel workers |