pi-crew 0.11.55 → 0.11.57

package/src/runtime/task-runner/child-executor.ts

@@ -74,6 +74,7 @@ import { checkProcessLiveness } from "../process-status.ts";
 import { DEFAULT_RETRY_POLICY } from "../recovery/retry-executor.ts";
 import { runWorker } from "../run-worker.ts";
 import { parseSessionUsage, usageFromValue } from "../session-usage.ts";
+import { createSpawnPhaseTracer } from "../spawn-phase-trace.ts";
 import { recordSupervisorContact, supervisorContactFromEvent } from "../supervisor-contact.ts";
 import type { ResultSource, TaskExecutionResult } from "./post-execution.ts";
 import type { StreamBridgeHandle, TaskExecutionContext } from "./pre-execution.ts";
@@ -827,7 +828,14 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 			touch: () => persistHeartbeat(),
 		});
 		let childResult: ChildPiRunResult;
+		// spawn.trace (2026-11-01, run team_20261101074334 forensics): a
+		// 7-minute log-silent hang between task.started and worker.spawned
+		// left no bisectable trace. This tracer prints a phase breadcrumb every
+		// 30s ONLY while the pre-spawn/spawn window is stuck that long — healthy
+		// spawns stay silent.
+		const spawnTrace = createSpawnPhaseTracer(task.id, i);
 		try {
+			spawnTrace.phase("runWorker-await");
 			childResult = await runWorker({
 				cwd: task.cwd,
 				task: userPrompt,
@@ -878,6 +886,9 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 				attempt: i,
 				steeringFile: resolveRealContainedPath(`${manifest.artifactsRoot}/steering`, `${task.id}.jsonl`),
 				onSpawn: (pid) => {
+					// spawn.trace: the worker process exists — pre-spawn window closed.
+					spawnTrace.phase("worker-running");
+					spawnTrace.end();
 					// NEW-4/G25: pin this incarnation's pid FIRST so the liveness pulse
 					// corroborates against the real process from its first tick on.
 					attemptWorkerPid = pid;
@@ -1112,6 +1123,9 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 			// heartbeat anymore, including across the model-fallback respawn gap
 			// (where nothing is alive and the heartbeat must be allowed to age).
 			heartbeatPulse.stop();
+			// spawn.trace: attempt settled — always clear the tracer (onSpawn may
+			// never fire for a failed pre-spawn attempt).
+			spawnTrace.end();
 			if (timeoutHandle) clearTimeout(timeoutHandle);
 			// W2 fix — release the listener so it doesn't leak. {once:true}
 			// only auto-removes when the listener FIRES; if the timeout

package/src/runtime/task-runner/state-helpers.ts

@@ -91,6 +91,38 @@ function mergeTaskUpdateWithDisk(diskTasks: TeamTaskState[], incoming: TeamTaskS
 			},
 		};
 	}
+
+	// R6-5 WAITING-PRESERVE (FINDING D root fix, live probes 10/11/12,
+	// 2026-11-01): a runner-side snapshot (child-executor persistHeartbeat's
+	// ~1s whole-record persist is the caught clobberer — stack pinned via
+	// saveRunTasksCoalesced instrumentation, probe12 run
+	// team_20261101040510) carries a dispatch-time task object that NEVER
+	// learned the broker parked the task (the park is written disk-side by the
+	// broker's wait.request handler under the run lock; the runner's in-memory
+	// copy keeps status "running", no `waiting`). Without this guard the first
+	// post-park heartbeat persist ERASED the park (tasks.json → running,
+	// waiting:null), which broke respond.force's live-park gate ("no-park"
+	// while the worker was verifiably parked — probe10) — the FINDING A
+	// residual class, now closed at the merge chokepoint every
+	// persistSingleTaskUpdate caller funnels through.
+	//
+	// Rule (mirror of R6-1's "the verdict is not ours to overwrite"): when
+	// DISK holds a live park (`waiting` payload, non-terminal status) and the
+	// incoming snapshot does not itself carry park-awareness
+	// (waiting === undefined) and is NON-terminal, the disk park survives —
+	// the heartbeat was never authoritative over an ask park. Legitimate
+	// clears do NOT pass through here: respond.ts requeueWaitingTask and the
+	// broker's wait-resolve victim flip write FULL task arrays directly via
+	// saveRunTasks under the run lock (verified 2026-11-01), and terminal
+	// settles (post-execution) are let through by the non-terminal condition.
+	if (
+		diskTask.status === "waiting" &&
+		diskTask.waiting !== undefined &&
+		incoming.waiting === undefined &&
+		!isTerminalTaskStatus(effective.status)
+	) {
+		effective = { ...effective, status: "waiting" as const, waiting: diskTask.waiting };
+	}
 	return effective;
 }
 

package/src/state/contracts.ts

@@ -267,6 +267,21 @@ export const TEAM_EVENT_TYPES = [
 	"mailbox.send",
 	"mailbox.pickup",
 	"mailbox.pickup_deduped",
+	// HƯỚNG A (ADR Option 3, 2026-11-01): broker-side respond delivery audit —
+	// fired by crew-broker's respond.append (challenge-response) and
+	// respond.force (one-shot live-park) handlers when a leader response row
+	// is appended BY THE BROKER PROCESS (w1a: broker-signed rows verify in
+	// every worker). data: {taskId, questionId, auth, requestId, messageId,
+	// deduped} (+ tag/brokerSocket on the forced path). Diagnostic only —
+	// never transitions run/task state; the mailbox row is the source of truth.
+	"respond.broker_append",
+	// HƯỚNG A follow-up (probe19, 2026-11-01): broker-side forced-steer audit
+	// — fired by crew-broker's steer.force handler when a foreign/restarted
+	// session's steer is delivered BY THE BROKER PROCESS (mailbox row +
+	// broker-signed steering line; w1a: broker-signed rows verify in every
+	// worker). data: {taskId, auth:"forced"}. Diagnostic only — never
+	// transitions run/task state.
+	"steer.broker_force",
 	// Recovery
 	"recovery.rerun_task",
 	// Run-level budget/effectiveness/export/lifecycle bookkeeping

package/src/state/coordination/mailbox.ts

@@ -230,6 +230,21 @@ export function signMailboxMessage(message: MailboxMessage): MailboxMessage & {
 	return { ...message, sig: signPayloadHash(coordinationPayloadHash(canonicalMailboxPayload(row))) };
 }
 
+/** HƯỚNG A (ADR Option 3, 2026-11-01): challenge-response proof-signing seam
+ *  for broker `respond.append`. Signs ARBITRARY challenge bytes (nonce ∥
+ *  canonical payload — NO sha256 wrap, unlike the row signers above; the
+ *  broker verifies with node:crypto Ed25519 against its dispatch-time heap
+ *  binding of the dispatcher PUBLIC key) with THIS process's coordination
+ *  private key. Only the dispatcher process holds that key — the keypair
+ *  whose public half it stamped as manifest.dispatcherVerifyKey at dispatch
+ *  time — so only the dispatcher can produce a passing signature; workers
+ *  and other processes hold at most the public verify key. Private key
+ *  stays heap-only like every other signer here. */
+export function signCoordinationChallenge(payload: string): string {
+	const { privateKey } = getMailboxSigningKeypair();
+	return ed25519Sign(null, Buffer.from(payload, "utf8"), privateKey).toString("base64");
+}
+
 /** Steering-JSONL line shape shared by every writer (team-tool, broker
  *  steer.push, child-executor seed, wrap-up advisories). */
 export interface CoordinationSteerEntry {

package/src/state/types.ts

@@ -455,6 +455,17 @@ export interface TeamRunManifest {
 	 * models.json happens to list first.
 	 */
 	modelContext?: RunModelContext;
+	/** HƯỚNG A (2026-11-01, probe8): the ACTUAL broker socket path of the
+	 *  run's host process, stamped by the background runner at stdin-creds
+	 *  accept time (async topology: the runner's socket is NOT derivable from
+	 *  this manifest's sessionId — that hash belongs to the dispatcher-side
+	 *  synthetic session; live probe derived 7e4df036 while the run's broker
+	 *  listened on 9529a08a). Cross-process responders (respond-delivery.ts)
+	 *  prefer this field over derivation. Absent on pre-Á-wave manifests and
+	 *  on runs whose runner received no stdin creds — responders fall back to
+	 *  derivation, then to the local signed append (hướng C). Not a secret:
+	 *  same-uid readable either way; connecting still requires auth. */
+	brokerSocketPath?: string;
 	/** FINDING B (2026-10-31) — w1a coordination verify-key distribution: the
 	 *  base64 SPKI DER PUBLIC verify key of the DISPATCHING session process
 	 *  (the leader that created this run; stamped via