smol-symphony 0.2.0 → 0.3.0

package/dist/src/core/runner/vm-plan.js

@@ -0,0 +1,390 @@
+// FCIS rewrite — pure assembly of the per-dispatch VmPlan.
+//
+// Functional core: every export here is a pure, synchronous (data) -> data
+// function. No IO, no async/await/Promise, no wall clock, no randomness, no
+// node: imports, no process/fetch. Imports ONLY from src/types.
+//
+// Ports the PLAN half of the original Gondolin dispatch path (read for
+// reference, never modified):
+//   • src/agent/runner.ts        — buildVmMounts, buildForwardedEnv,
+//                                   mcpDispatchTarget, computeAcpWsUrl,
+//                                   buildDispatchOptions (the data half).
+//   • src/agent/vm-acp-mapping.ts — buildMcpTcpHostEntry, acpWsUrlFromExplicit,
+//                                   the synthetic-host constants + guest URLs.
+//   • src/agent/gondolin-dispatch.ts — buildCreateVmOptions, buildTunnelMapping,
+//                                   buildLaunchEnv, the launch argv + the staged
+//                                   guest-file set (gitconfig + launcher + fake
+//                                   creds + effort settings), the fixed guest
+//                                   PATH/gitconfig constants, sessionLabel.
+//
+// All of that imperative-shell code was making PURE decisions inline (which
+// mounts, which env, which tunnel, which argv, which staged files). This module
+// hoists those decisions out as a single (data) -> VmPlan assembly so the shell
+// dispatcher only has to EXECUTE the plan (createVm + the base64-pipe writes +
+// the exec) — every routing/precedence decision is testable here without a VM.
+//
+// mustFix (unified in-VM control plane): Gondolin blocks guest→host loopback, so
+// ACP (the `/acp` WebSocket) and MCP (HTTP JSON-RPC) share ONE `tcp.hosts` entry
+// (`symphony-mcp:7001`) + synthetic per-host DNS. The guest dials
+// `ws://symphony-mcp:7001/acp` for ACP and `http://symphony-mcp:7001` for MCP
+// over the same mapping. When MCP is reached via an explicit host URL (direct
+// reachability, no tunnel) the entry is empty and the guest reaches the host
+// directly. buildMcpTcpHostEntry + acpWsUrlFromExplicit are the load-bearing
+// halves of that decision.
+import { buildEvalModeMounts } from './dispatch-config.js';
+import { buildMiseEnv, buildMiseMount, buildMisePrepCommand, buildMiseInstallCommand, miseSystemConfigFile, MISE_SHIMS_GUEST_DIR, } from './mise.js';
+import { sanitizeWorkspaceKey } from '../workspace-key.js';
+import { isCredentialEnvName, isCredentialTokenName, stripCredentialTokenVars, acpWsUrlFromExplicit, buildMcpTcpHostEntry, MCP_GUEST_BASE_URL, ACP_WS_GUEST_URL, } from '../vm-guards.js';
+// The control-plane URL/tunnel + credential-strip primitives live canonically in
+// core/vm-guards.ts; re-exported here so this file's importers (and its test) keep
+// the `vm-plan.js` specifier without duplicating the definitions.
+export { isCredentialTokenName, acpWsUrlFromExplicit, buildMcpTcpHostEntry, MCP_GUEST_BASE_URL, ACP_WS_GUEST_URL, } from '../vm-guards.js';
+// ─── Constants ported verbatim from the reference ────────────────────────────
+// The control-plane URL/host/port constants (MCP_GUEST_BASE_URL, ACP_WS_GUEST_URL,
+// and the synthetic host/port/path they derive from) live canonically in
+// core/vm-guards.ts; imported + re-exported above to avoid duplicating them.
+/** VM session-label / name prefix (reference `vm-port.ts:SYMPHONY_VM_PREFIX`). */
+export const SYMPHONY_VM_PREFIX = 'symphony-';
+/**
+ * Default guest path the in-VM ACP launcher (`scripts/vm-agent.mjs`) is staged +
+ * exec'd at (reference `gondolin-dispatch.ts:DEFAULT_VM_AGENT_GUEST_PATH`).
+ */
+export const DEFAULT_VM_AGENT_GUEST_PATH = '/opt/symphony/vm-agent.mjs';
+/** Non-secret mode for the staged launcher — it is code, not a credential. */
+export const VM_AGENT_LAUNCHER_MODE = 0o644;
+/**
+ * Fixed guest agent search PATH (reference `gondolin-dispatch.ts:GUEST_AGENT_PATH`).
+ * `vm.exec` runs without a login shell so the profile PATH does not apply. The mise
+ * shims dir leads (issue 209) so the agent's CHILD processes resolve the project's
+ * tools; the `mise` binary itself + any baked node sit under /usr/local/bin. A
+ * non-existent shims dir (not yet installed) is harmlessly skipped.
+ * Carries no secret.
+ */
+export const GUEST_AGENT_PATH = `${MISE_SHIMS_GUEST_DIR}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`;
+/**
+ * Map a non-zero BYO pre-launch probe exit code to a precise, operator-facing
+ * contract-violation message. The enumerated codes (11/12/21/13) map to a fixed
+ * diagnostic; the default branch echoes the guest's own stderr token (when any)
+ * so an unanticipated non-zero exit still carries what the guest emitted rather
+ * than a bare number. Ported verbatim from the shell `probeFailureMessage` (§4a).
+ *
+ * Pure: the shell runs the probe exec (IO) and hands the captured code/stderr to
+ * this decider for the message it throws as a ByoContractError.
+ */
+export function byoProbeFailureMessage(code, adapterBin, stderr, guestPath) {
+    const base = 'BYO image contract violation: ';
+    switch (code) {
+        case 11:
+            return `${base}the "node" binary is not on PATH (${guestPath}). The image must ship Node ≥ 21.`;
+        case 12:
+            return `${base}mise did not produce the "${adapterBin}" adapter shim on PATH (${guestPath}). The staged mise SYSTEM config must pin the chosen agent CLI and \`mise install\` must have succeeded.`;
+        case 21:
+            return `${base}node is present but lacks the global WebSocket (Node < 21). The in-VM launcher requires Node ≥ 21.`;
+        case 13:
+            return `${base}the in-VM launcher failed to materialize in the guest before launch.`;
+        default: {
+            const tail = stderr.trim();
+            const detail = tail ? ` Guest stderr: ${tail}` : '';
+            return `${base}the pre-launch probe failed (exit ${code}). Check that the image ships Node ≥ 21 + "${adapterBin}" + /bin/sh on PATH and a writable rootfs.${detail}`;
+        }
+    }
+}
+/**
+ * Guest path of the bind-mount-trust gitconfig (reference `GUEST_GITCONFIG_PATH`).
+ * Lives OUTSIDE the workspace mount so it never shows in the repo's git status.
+ */
+export const GUEST_GITCONFIG_PATH = '/opt/symphony/gitconfig';
+/** Disarms git's bind-mount ownership guard for every workspace path (issue 149). */
+export const GUEST_GITCONFIG_CONTENT = '[safe]\n\tdirectory = *\n';
+/** Non-secret mode for the staged gitconfig. */
+export const GUEST_GITCONFIG_MODE = 0o644;
+// ─── Control-plane tunnel (synthetic DNS / tcp.hosts) ────────────────────────
+// buildMcpTcpHostEntry + acpWsUrlFromExplicit are imported + re-exported from
+// core/vm-guards.ts (their canonical home) — see the top-of-file re-export.
+/**
+ * The host control-plane endpoint to tunnel into the guest, or null when no
+ * tunnel is needed/possible. Reference `runner.ts:mcpDispatchTarget`. Returns
+ * null when MCP is disabled, an `explicit_host_url` already points the guest at a
+ * directly-reachable URL, or the HTTP server has not bound a port
+ * (`boundMcpPort === null`). The bound port is INJECTED (it is a runtime fact the
+ * shell observes after the server binds) so this stays pure.
+ */
+export function mcpDispatchTarget(cfg, boundMcpPort) {
+    if (!cfg.mcp.enabled || cfg.mcp.explicit_host_url)
+        return null;
+    if (boundMcpPort === null)
+        return null;
+    return { host: cfg.mcp.host, port: boundMcpPort };
+}
+/**
+ * Assemble the unified control-plane tunnel decision. Mirrors the reference's
+ * three coupled decisions (`buildTunnelMapping`, `computeAcpWsUrl`, the MCP base
+ * URL) so the ACP URL and the `tcp.hosts` entry that backs it stay consistent:
+ *
+ *   • synthetic tunnel present (MCP enabled, port bound, no explicit URL):
+ *       tcpHostEntry = { 'symphony-mcp:7001': '<host>:<port>' }
+ *       mcpGuestBaseUrl = http://symphony-mcp:7001
+ *       acpWsGuestUrl   = ws://symphony-mcp:7001/acp
+ *   • explicit host URL (direct reachability, no tunnel):
+ *       tcpHostEntry = {}
+ *       mcpGuestBaseUrl = the explicit URL verbatim
+ *       acpWsGuestUrl   = ws(s)://<explicit-host>/acp (null if unparseable)
+ *   • neither (MCP disabled / no bound port and no explicit URL):
+ *       tcpHostEntry = {}, mcpGuestBaseUrl = the synthetic base (unreachable),
+ *       acpWsGuestUrl = null  — the runner's validateAcpTransport fails the
+ *       attempt fast in this case (no reachable dial-back URL).
+ */
+export function buildControlPlaneTunnel(cfg, boundMcpPort) {
+    const target = mcpDispatchTarget(cfg, boundMcpPort);
+    if (target) {
+        return {
+            mcpGuestBaseUrl: MCP_GUEST_BASE_URL,
+            acpWsGuestUrl: ACP_WS_GUEST_URL,
+            tcpHostEntry: buildMcpTcpHostEntry(target.host, target.port),
+        };
+    }
+    const explicit = cfg.mcp.explicit_host_url;
+    if (explicit) {
+        return {
+            mcpGuestBaseUrl: explicit,
+            acpWsGuestUrl: acpWsUrlFromExplicit(explicit),
+            tcpHostEntry: {},
+        };
+    }
+    // No synthetic tunnel and no explicit URL: the guest has no reachable control
+    // plane. Surfaced as a null ACP URL so the shell fails the attempt fast
+    // (reference validateAcpTransport: 'acp ws url unavailable').
+    return {
+        mcpGuestBaseUrl: MCP_GUEST_BASE_URL,
+        acpWsGuestUrl: null,
+        tcpHostEntry: {},
+    };
+}
+// ─── Mounts ──────────────────────────────────────────────────────────────────
+/**
+ * The host→guest mount set for a dispatch. Reference `runner.ts:buildVmMounts`:
+ * the workspace RW at its OWN host path (so `cwd` is identical inside/outside the
+ * VM), then the symphony-managed mise download-cache dir RW (issue 222; NOT the
+ * install dir — that lives on the ephemeral rootfs — and NOT a user `gondolin.volumes`
+ * entry; always present, mise provisioning is unconditional — issue 233),
+ * then every configured `gondolin.volumes` entry, then the eval-mode RO mounts
+ * (`tracker.root` → /symphony/issues, `logs.root` → /symphony/logs) when the
+ * resolved state opted in. Order is preserved exactly.
+ *
+ * SECURITY: the credential-mount denylist guard (`assertNoCredentialMounts`)
+ * lives in the shell (it needs `os.homedir()` + `fs.realpath`); this pure builder
+ * only assembles the list. The shell HARD-FAILs before createVm if any entry
+ * overlaps a credential directory.
+ */
+export function buildVmMounts(cfg, resolved, workspacePath) {
+    const mounts = [{ host: workspacePath, guest: workspacePath, readonly: false }];
+    // mise provisioning is unconditional (issue 233): the download-cache mount always rides.
+    mounts.push(buildMiseMount(cfg));
+    for (const v of cfg.gondolin.volumes) {
+        mounts.push({ host: v.host, guest: v.guest, readonly: v.readonly });
+    }
+    for (const m of buildEvalModeMounts(cfg, resolved)) {
+        mounts.push({ host: m.host, guest: m.guest, readonly: m.readonly });
+    }
+    return mounts;
+}
+// ─── Env ──────────────────────────────────────────────────────────────────────
+/**
+ * The stripped VM boot env. Reference `runner.ts:buildForwardedEnv`: forward the
+ * configured `gondolin.forward_env` vars, then STRIP every credential-bearing var
+ * (defense in depth). `readEnv` is INJECTED so this stays pure (no `process.env`
+ * in core). The credential strip is applied at compute time via the shared
+ * `isCredentialEnvName` policy (canonically core/vm-guards.ts) — equivalent to
+ * the reference's `stripCredentialEnv(computeForwardedEnv(...))` two-step, since
+ * folding the strip into the per-name filter already drops credential names. The
+ * guest holds only the placeholder bearer Gondolin substitutes at egress.
+ */
+export function buildForwardedEnv(cfg, readEnv) {
+    const env = {};
+    for (const k of cfg.gondolin.forward_env) {
+        if (isCredentialEnvName(k))
+            continue;
+        const v = readEnv(k);
+        if (v && v.length > 0)
+            env[k] = v;
+    }
+    return env;
+}
+// ─── Staged guest files ────────────────────────────────────────────────────────
+/** The bind-mount-trust gitconfig as a guest file (reference `guestGitconfigFile`). */
+export function guestGitconfigFile() {
+    return {
+        guestPath: GUEST_GITCONFIG_PATH,
+        content: GUEST_GITCONFIG_CONTENT,
+        mode: GUEST_GITCONFIG_MODE,
+    };
+}
+/** The injected in-VM launcher as a guest file (reference `launcherFile`). Carries no secret → 0644. */
+export function launcherFile(source, guestPath) {
+    return { guestPath, content: source, mode: VM_AGENT_LAUNCHER_MODE };
+}
+/**
+ * The full ordered guest-file set staged BEFORE the agent launches, mirroring the
+ * reference `bringUpOrTeardown` staging order:
+ *   1. the gitconfig (so in-guest git accepts the host-owned workspace from its
+ *      first command — issue 149),
+ *   2. the mise SYSTEM config (issue 209) — always staged (issue 233),
+ *   3. the fake native creds (placeholders only — the guest bearer + identity),
+ *   4. the model/effort runtime files (e.g. claude's settings.json effortLevel),
+ * then (separately, written first in the reference) the launcher itself. We keep
+ * the launcher at the FRONT here because the shell needs its landed path before
+ * the probe; the relative order of the remaining files matches the reference.
+ *
+ * NOTE: the reference staged the launcher with a `/tmp` fallback when the primary
+ * write fails (a readonly-rootfs BYO image). That fallback is a RUNTIME decision
+ * (it inspects the write's exit code), so it stays in the shell — this plan
+ * carries only the PRIMARY launcher path; the shell may re-stage under `/tmp` and
+ * exec THAT path. By design the fallback path is not part of VmPlan.
+ */
+export function buildGuestFiles(args) {
+    return [
+        launcherFile(args.launcherSource, args.guestAgentPath),
+        guestGitconfigFile(),
+        args.miseSystemConfig,
+        ...args.fakeCreds.files,
+        ...args.runtimeExtraFiles,
+    ];
+}
+// ─── Launch env + agent command ──────────────────────────────────────────────
+/**
+ * The launch env the in-VM `vm-agent.mjs` reads to dial back + spawn the adapter.
+ * Reference `gondolin-dispatch.ts:buildLaunchEnv`.
+ *
+ * ORDERING (load-bearing): the placeholder bearer (`fakeCreds.env`, a FAKE value
+ * keyed by the credential var name itself, e.g. `ANTHROPIC_AUTH_TOKEN`) is merged
+ * LAST — after `stripCredentialTokenVars(runtimeEnv)` — so the strip drops a real
+ * token smuggled via runtimeEnv but the placeholder survives. PATH/GIT_CONFIG_GLOBAL
+ * lead so a runtimeEnv-supplied PATH (rare) can still override via the spread.
+ *
+ * `agentCommand` carries the absolute node + adapter paths the pre-launch probe
+ * resolves; those are runtime facts (the probe is IO), so the shell fills them.
+ * This builder fixes only the PATH-independent, secret-free env shape.
+ */
+export function buildLaunchEnv(args) {
+    return {
+        PATH: GUEST_AGENT_PATH,
+        GIT_CONFIG_GLOBAL: GUEST_GITCONFIG_PATH,
+        ...(args.miseEnv ?? {}),
+        SYMPHONY_ACP_URL: args.acpWsGuestUrl,
+        SYMPHONY_ACP_TOKEN: args.acpToken,
+        SYMPHONY_ADAPTER_BIN: args.adapterBin,
+        SYMPHONY_ADAPTER_ARGS: JSON.stringify(args.adapterArgs),
+        ...(args.heartbeatIntervalMs !== undefined
+            ? { SYMPHONY_HEARTBEAT_INTERVAL_MS: String(args.heartbeatIntervalMs) }
+            : {}),
+        ...(args.heartbeatTimeoutMs !== undefined
+            ? { SYMPHONY_HEARTBEAT_TIMEOUT_MS: String(args.heartbeatTimeoutMs) }
+            : {}),
+        ...stripCredentialTokenVars(args.runtimeEnv),
+        // The placeholder (a fake) is ADDED after the strip — see the ordering note.
+        ...args.placeholderEnv,
+    };
+}
+// isCredentialTokenName + stripCredentialTokenVars (the runtime-env token strip)
+// are imported + re-exported from core/vm-guards.ts — see the top-of-file
+// re-export. They preserve non-secret vendor config (e.g. ANTHROPIC_MODEL) while
+// dropping the named credential vars + the *_API_KEY/*_TOKEN/*_SECRET suffixes.
+/**
+ * The agent argv exec'd inside the guest. Reference `launchAgent`:
+ * `[node, launcherGuestPath]`. The probe resolves the ABSOLUTE node path at
+ * runtime (PATH-independent), so the shell passes that as `resolvedNodeBin`; this
+ * builder only fixes the [node, launcher] shape.
+ */
+export function buildAgentCommand(resolvedNodeBin, guestAgentPath) {
+    return [resolvedNodeBin, guestAgentPath];
+}
+// ─── Session label ──────────────────────────────────────────────────────────
+/**
+ * The Gondolin session label / VM name. Reference `runner.ts:vmNameFor` +
+ * `gondolin-dispatch.ts:buildCreateVmOptions.sessionLabel`:
+ * `symphony-<sanitized-identifier>`, lowercased.
+ */
+export function buildSessionLabel(identifier) {
+    return `${SYMPHONY_VM_PREFIX}${sanitizeWorkspaceKey(identifier)}`.toLowerCase();
+}
+/**
+ * Resolve the boot `imagePath` selector (issue 206). The `gondolin.image` escape
+ * hatch (a pre-converted asset selector) ALWAYS wins when set; otherwise fall back
+ * to the asset the reconcile loop auto-converted from `gondolin.oci_image`
+ * (`convertedImageSelector`), and finally to the empty string (no image source —
+ * doctor/boot surfaces it). Keeps the convert→dispatch handoff a pure decision.
+ */
+export function resolveImagePath(image, convertedSelector) {
+    if (image && image.length > 0)
+        return image;
+    return convertedSelector ?? '';
+}
+// ─── Top-level assembly ────────────────────────────────────────────────────────
+/**
+ * Assemble the complete VmPlan for one dispatch — the single (data) -> VmPlan
+ * entry point. Composes every sub-decision (session label, mounts, stripped boot
+ * env, staged files, agent argv, control-plane tunnel) so the shell dispatcher
+ * only EXECUTES the plan. Pure: no IO, no clock, no randomness.
+ *
+ * The guest path the launcher is staged/exec'd at comes from
+ * `cfg.gondolin.guest_agent_path` (the SINGLE source of truth — same value drives
+ * the staged file AND the exec arg, so they can never drift); falls back to the
+ * default when unset. The launch env rides on VmPlan via the assembled launch env
+ * — but VmPlan's shape carries only `env` (boot env), `guestFiles`, and
+ * `agentCommand`, so the LAUNCH env (distinct from the boot env) is returned
+ * alongside the plan for the shell's `vm.exec` env. By design VmPlan has no
+ * `launchEnv` field; we surface it next to the plan rather than widening the type
+ * another slice owns.
+ */
+export function buildVmPlan(input) {
+    const { cfg, resolved } = input;
+    const guestAgentPath = cfg.gondolin.guest_agent_path && cfg.gondolin.guest_agent_path.length > 0
+        ? cfg.gondolin.guest_agent_path
+        : DEFAULT_VM_AGENT_GUEST_PATH;
+    const tunnel = buildControlPlaneTunnel(cfg, input.boundMcpPort);
+    // mise toolchain slice (issue 209): the env rides the boot env + the install/
+    // probe/launch execs; the system config is always staged (issue 233).
+    const miseEnv = buildMiseEnv();
+    const mise = {
+        env: miseEnv,
+        prepCommand: buildMisePrepCommand(),
+        installCommand: buildMiseInstallCommand(input.workspacePath),
+    };
+    const plan = {
+        sessionLabel: buildSessionLabel(input.identifier),
+        imagePath: resolveImagePath(cfg.gondolin.image, input.convertedImageSelector),
+        cpus: cfg.gondolin.cpus,
+        memMib: cfg.gondolin.mem_mib,
+        rootfsSize: cfg.gondolin.rootfs_size,
+        mounts: buildVmMounts(cfg, resolved, input.workspacePath),
+        env: { ...buildForwardedEnv(cfg, input.readEnv), ...miseEnv },
+        guestFiles: buildGuestFiles({
+            launcherSource: input.launcherSource,
+            guestAgentPath,
+            fakeCreds: input.fakeCreds,
+            runtimeExtraFiles: input.runtimeExtraFiles,
+            miseSystemConfig: miseSystemConfigFile(input.miseSystemConfigSource),
+        }),
+        agentCommand: buildAgentCommand(input.resolvedNodeBin, guestAgentPath),
+        tunnel,
+        allowWebSockets: input.allowWebSockets,
+        mise,
+    };
+    // The launch env needs the resolved ACP WS URL; when the tunnel produced none
+    // (no reachable control plane) the shell should already have failed the attempt
+    // (validateAcpTransport). We carry the empty string here so the type stays a
+    // plain string; the shell never reaches launch without a URL.
+    const launchEnv = buildLaunchEnv({
+        acpWsGuestUrl: tunnel.acpWsGuestUrl ?? '',
+        acpToken: input.acpToken,
+        adapterBin: input.adapterBin,
+        adapterArgs: input.adapterArgs,
+        runtimeEnv: input.runtimeEnv,
+        placeholderEnv: input.fakeCreds.env,
+        miseEnv,
+        heartbeatIntervalMs: cfg.acp.heartbeat_interval_ms,
+        heartbeatTimeoutMs: cfg.acp.heartbeat_timeout_ms,
+    });
+    return { plan, launchEnv };
+}
+//# sourceMappingURL=vm-plan.js.map

package/dist/src/core/runner/vm-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vm-plan.js","sourceRoot":"","sources":["../../../../src/core/runner/vm-plan.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,gEAAgE;AAChE,EAAE;AACF,uEAAuE;AACvE,8BAA8B;AAC9B,qEAAqE;AACrE,wEAAwE;AACxE,0EAA0E;AAC1E,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,kEAAkE;AAClE,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,2BAA2B;AAO3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EACL,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAMzB,iFAAiF;AACjF,mFAAmF;AACnF,kEAAkE;AAClE,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAEzB,gFAAgF;AAChF,mFAAmF;AACnF,yEAAyE;AACzE,6EAA6E;AAE7E,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAE9C;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AAExE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAE5C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,oBAAoB,+DAA+D,CAAC;AAEvH;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAmB,EACnB,UAAkB,EAClB,MAAc,EACd,SAAiB;IAEjB,MAAM,IAAI,GAAG,gCAAgC,CAAC;IAC9C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,EAAE;YACL,OAAO,GAAG,IAAI,qCAAqC,SAAS,mCAAmC,CAAC;QAClG,KAAK,EAAE;YACL,OAAO,GAAG,IAAI,6BAA6B,UAAU,2BAA2B,SAAS,0GAA0G,CAAC;QACtM,KAAK,EAAE;YACL,OAAO,GAAG,IAAI,oGAAoG,CAAC;QACrH,KAAK,EAAE;YACL,OAAO,GAAG,IAAI,sEAAsE,CAAC;QACvF,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,GAAG,IAAI,qCAAqC,IAAI,8CAA8C,UAAU,6CAA6C,MAAM,EAAE,CAAC;QACvK,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAE9D,qFAAqF;AACrF,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAEnE,gDAAgD;AAChD,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAE5E;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAkB,EAClB,YAA2B;IAE3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAkB,EAClB,YAA2B;IAE3B,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,eAAe,EAAE,kBAAkB;YACnC,aAAa,EAAE,gBAAgB;YAC/B,YAAY,EAAE,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;SAC7D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC3C,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,eAAe,EAAE,QAAQ;YACzB,aAAa,EAAE,oBAAoB,CAAC,QAAQ,CAAC;YAC7C,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,wEAAwE;IACxE,8DAA8D;IAC9D,OAAO;QACL,eAAe,EAAE,kBAAkB;QACnC,aAAa,EAAE,IAAI;QACnB,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAkB,EAClB,QAAgC,EAChC,aAAqB;IAErB,MAAM,MAAM,GAAc,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,yFAAyF;IACzF,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAkB,EAClB,OAA4C;IAE5C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,mBAAmB,CAAC,CAAC,CAAC;YAAE,SAAS;QACrC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kFAAkF;AAElF,uFAAuF;AACvF,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,SAAS,EAAE,oBAAoB;QAC/B,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,oBAAoB;KAC3B,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,SAAiB;IAC5D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAAC,IAO/B;IACC,OAAO;QACL,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC;QACtD,kBAAkB,EAAE;QACpB,IAAI,CAAC,gBAAgB;QACrB,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK;QACvB,GAAG,IAAI,CAAC,iBAAiB;KAC1B,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,IAW9B;IACC,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,iBAAiB,EAAE,oBAAoB;QACvC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACvB,gBAAgB,EAAE,IAAI,CAAC,aAAa;QACpC,kBAAkB,EAAE,IAAI,CAAC,QAAQ;QACjC,oBAAoB,EAAE,IAAI,CAAC,UAAU;QACrC,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC;QACvD,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE,8BAA8B,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE;YACtE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE,6BAA6B,EAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE;YACpE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC;QAC5C,6EAA6E;QAC7E,GAAG,IAAI,CAAC,cAAc;KACvB,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,0EAA0E;AAC1E,iFAAiF;AACjF,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,eAAuB,EAAE,cAAsB;IAC/E,OAAO,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;AAC3C,CAAC;AAED,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,OAAO,GAAG,kBAAkB,GAAG,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;AAClF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAoB,EAAE,iBAA4C;IACjG,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,iBAAiB,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,WAAW,CAAC,KAAkB;IAI5C,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAChC,MAAM,cAAc,GAClB,GAAG,CAAC,QAAQ,CAAC,gBAAgB,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;QACvE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB;QAC/B,CAAC,CAAC,2BAA2B,CAAC;IAElC,MAAM,MAAM,GAAG,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAEhE,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAe;QACvB,GAAG,EAAE,OAAO;QACZ,WAAW,EAAE,oBAAoB,EAAE;QACnC,cAAc,EAAE,uBAAuB,CAAC,KAAK,CAAC,aAAa,CAAC;KAC7D,CAAC;IAEF,MAAM,IAAI,GAAW;QACnB,YAAY,EAAE,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC;QACjD,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,sBAAsB,CAAC;QAC7E,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;QACvB,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;QAC5B,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW;QACpC,MAAM,EAAE,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC;QACzD,GAAG,EAAE,EAAE,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE;QAC7D,UAAU,EAAE,eAAe,CAAC;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc;YACd,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,gBAAgB,EAAE,oBAAoB,CAAC,KAAK,CAAC,sBAAsB,CAAC;SACrE,CAAC;QACF,YAAY,EAAE,iBAAiB,CAAC,KAAK,CAAC,eAAe,EAAE,cAAc,CAAC;QACtE,MAAM;QACN,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,IAAI;KACL,CAAC;IAEF,8EAA8E;IAC9E,gFAAgF;IAChF,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,SAAS,GAAG,cAAc,CAAC;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;QACzC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG;QACnC,OAAO;QACP,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,qBAAqB;QAClD,kBAAkB,EAAE,GAAG,CAAC,GAAG,CAAC,oBAAoB;KACjD,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC"}

package/dist/src/core/schedule/admission.js

@@ -0,0 +1,123 @@
+// FCIS rewrite — memory-aware admission decider (issue 27).
+//
+// Pure port of the original `computeMemoryAdmission` / `parseMemAvailableMib`
+// (REF: src/memory.ts) plus the clamp-transition log decision that lived inline
+// in the orchestrator's `availableGlobalSlots` (REF: src/orchestrator.ts).
+//
+// The /proc/meminfo READ is impure and stays in the shell (a MemProbe adapter);
+// the shell hands this decider a MemorySnapshot. This is the impureCoreRisk fix:
+// core never touches the wall clock, the filesystem, or /proc — it only folds the
+// supplied reading + running count + config into the effective cap and a clamp
+// log decision.
+//
+// Effective cap is `min(static_cap, running + admission_room)` where
+//   admission_room = max(0, floor((MemAvailable - reserve) / per_vm)).
+// We add `running` because MemAvailable already reflects the memory the live VMs
+// are using, so admission_room is the count of *additional* VMs that fit; adding
+// the current running count yields a total cap consistent with the static one.
+/**
+ * Parse a `/proc/meminfo` body and pull out `MemAvailable`. The kernel emits the
+ * value in KiB (`MemAvailable:    12345678 kB`); we return MiB for symmetry with
+ * `gondolin.mem_mib` and `agent.host_memory_reserve_mib`. Returns null when the
+ * line is missing or unparseable — the decider treats null the same as "probe
+ * unsupported" and skips the clamp.
+ *
+ * Pure: takes the already-read file body as data (the shell's MemProbe does the
+ * actual /proc read). No IO, no node builtins.
+ */
+export function parseMemAvailableMib(meminfo) {
+    const match = meminfo.match(/^MemAvailable:\s+(\d+)\s*kB\s*$/m);
+    if (!match)
+        return null;
+    const kb = parseInt(match[1], 10);
+    if (!Number.isFinite(kb))
+        return null;
+    return Math.floor(kb / 1024);
+}
+/**
+ * Fold the memory snapshot + running count + config into the admission summary.
+ *
+ * Skips the clamp (returns the static cap, `clampActive: false`,
+ * `admissionRoom: null`) when admission is disabled, the probe returned a null
+ * reading (unsupported host / unparseable line), or `perVmMib <= 0`. Otherwise
+ * computes the headroom-derived room and clamps the effective cap down to it.
+ */
+export function computeMemoryAdmission(input) {
+    const { enabled, staticCap, running, probe, reserveMib, perVmMib } = input;
+    if (!enabled || probe.memAvailableMib === null || perVmMib <= 0) {
+        return {
+            enabled,
+            staticCap,
+            effectiveCap: staticCap,
+            admissionRoom: null,
+            memAvailableMib: probe.memAvailableMib,
+            reserveMib,
+            perVmMib,
+            clampActive: false,
+        };
+    }
+    const headroom = probe.memAvailableMib - reserveMib;
+    const room = headroom <= 0 ? 0 : Math.floor(headroom / perVmMib);
+    const memoryCap = running + room;
+    const effectiveCap = Math.min(staticCap, memoryCap);
+    return {
+        enabled,
+        staticCap,
+        effectiveCap,
+        admissionRoom: room,
+        memAvailableMib: probe.memAvailableMib,
+        reserveMib,
+        perVmMib,
+        clampActive: memoryCap < staticCap,
+    };
+}
+/**
+ * Compute the number of free global dispatch slots, AND the clamp-transition log
+ * decision, from an admission summary.
+ *
+ * The shell owns the persisted "was the clamp active last tick?" flag and passes
+ * it in as `previousClampActive`; this decider returns the next flag plus a
+ * LogEffect[] (empty unless the clamp toggled). Only logging on the transition —
+ * rather than every tick — keeps the log quiet while memory stays low, matching
+ * the original orchestrator behavior.
+ *
+ * Pending continuations hold their slot (the post-transition resume of an issue
+ * that just normal-exited), so the shell subtracts them here too; failure-backoff
+ * retries do NOT hold a slot and are excluded by the caller.
+ */
+export function decideAvailableGlobalSlots(args) {
+    const { admission, running, pendingContinuations, previousClampActive } = args;
+    const logs = [];
+    if (admission.clampActive !== previousClampActive) {
+        if (admission.clampActive) {
+            logs.push({
+                family: 'log',
+                kind: 'emit',
+                level: 'info',
+                message: 'memory admission clamping concurrency',
+                fields: {
+                    static_cap: admission.staticCap,
+                    effective_cap: admission.effectiveCap,
+                    mem_available_mib: admission.memAvailableMib,
+                    reserve_mib: admission.reserveMib,
+                    per_vm_mib: admission.perVmMib,
+                },
+            });
+        }
+        else {
+            logs.push({
+                family: 'log',
+                kind: 'emit',
+                level: 'info',
+                message: 'memory admission cleared; full static cap available',
+                fields: {
+                    static_cap: admission.staticCap,
+                    mem_available_mib: admission.memAvailableMib,
+                },
+            });
+        }
+    }
+    const availableSlots = Math.max(0, admission.effectiveCap - running - pendingContinuations);
+    return { availableSlots, nextClampActive: admission.clampActive, logs };
+}
+//# sourceMappingURL=admission.js.map

package/dist/src/core/schedule/admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.js","sourceRoot":"","sources":["../../../../src/core/schedule/admission.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,2EAA2E;AAC3E,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,+EAA+E;AAC/E,gBAAgB;AAChB,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,iFAAiF;AACjF,iFAAiF;AACjF,+EAA+E;AAS/E;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;AAC/B,CAAC;AAkBD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAA2B;IAChE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAE3E,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAChE,OAAO;YACL,OAAO;YACP,SAAS;YACT,YAAY,EAAE,SAAS;YACvB,aAAa,EAAE,IAAI;YACnB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,UAAU;YACV,QAAQ;YACR,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,GAAG,UAAU,CAAC;IACpD,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAEpD,OAAO;QACL,OAAO;QACP,SAAS;QACT,YAAY;QACZ,aAAa,EAAE,IAAI;QACnB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU;QACV,QAAQ;QACR,WAAW,EAAE,SAAS,GAAG,SAAS;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAK1C;IAKC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC;IAE/E,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,IAAI,SAAS,CAAC,WAAW,KAAK,mBAAmB,EAAE,CAAC;QAClD,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC;gBACR,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,uCAAuC;gBAChD,MAAM,EAAE;oBACN,UAAU,EAAE,SAAS,CAAC,SAAS;oBAC/B,aAAa,EAAE,SAAS,CAAC,YAAY;oBACrC,iBAAiB,EAAE,SAAS,CAAC,eAAe;oBAC5C,WAAW,EAAE,SAAS,CAAC,UAAU;oBACjC,UAAU,EAAE,SAAS,CAAC,QAAQ;iBAC/B;aACF,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC;gBACR,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,qDAAqD;gBAC9D,MAAM,EAAE;oBACN,UAAU,EAAE,SAAS,CAAC,SAAS;oBAC/B,iBAAiB,EAAE,SAAS,CAAC,eAAe;iBAC7C;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAC7B,CAAC,EACD,SAAS,CAAC,YAAY,GAAG,OAAO,GAAG,oBAAoB,CACxD,CAAC;IAEF,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;AAC1E,CAAC"}

package/dist/src/core/schedule/circuit-breaker.js

@@ -0,0 +1,111 @@
+// FCIS rewrite — pure circuit-breaker core (issue 128; hardened in issue 135).
+//
+// Ported faithfully from the original `src/orchestrator-decisions.ts`
+// (`normalizeFailureReason`, `decideCircuitBreaker`) plus the holding-state
+// trip-notes text the original `Orchestrator.routeToHolding` rendered inline.
+//
+// The retry path retries an abnormally-exited dispatch with exponential backoff
+// and NO upper bound: a deterministically-failing dispatch loops indefinitely,
+// booting + reaping a VM every backoff interval. These pure helpers bound that
+// loop — count CONSECUTIVE failed dispatches and stop once an issue has made no
+// progress for `threshold` attempts in a row — without the streak bookkeeping
+// leaking into the shell.
+//
+// Issue 135 fix — count by STREAK LENGTH, NOT by same-reason. The original
+// breaker only incremented when the *normalized reason matched the prior one*,
+// so a dispatch that kept failing with FLAPPING reasons reset the counter every
+// time the reason changed and never tripped. Issue 135 looped 8× exactly this
+// way — four `ECONNRESET` turns (streak → 4), then a single `401` (different
+// reason → streak reset to 1), then `ECONNRESET` again (reset to 1) — the lone
+// interleaved 401 landed one short of the threshold and re-armed the breaker
+// from zero. The signal we actually want is "this issue has made no progress
+// for N attempts in a row", which is reason-independent: increment on every
+// consecutive abnormal exit; reset only when a dispatch exits cleanly (the
+// issue progressed). The normalized reason is still tracked, but only to label
+// the trip — it no longer gates counting.
+//
+// Every function here is pure and SYNCHRONOUS: (data) -> data. The single side
+// effect the original performed at the trip site — moving the issue into a
+// holding state with a diagnostic note — becomes a returned `tracker.move_state`
+// Effect (see `tripToHoldingEffect`), which the shell EXECUTES. No clock, no
+// randomness, no IO. Imports are restricted to src/types.
+/**
+ * Normalize a failure `reason` for the trip log / holding-state route note so
+ * the human-facing message is stable even when the underlying message embeds
+ * volatile tokens (request ids, status codes, timestamps, hashes, per-dispatch
+ * sentinels).
+ *
+ * Rule: lowercase, then collapse every whitespace-delimited token that contains
+ * a digit into `<id>` — volatile identifiers almost always carry a digit (a
+ * request id, an HTTP status, a timestamp fragment, a counter, a hex hash),
+ * whereas the human-readable words that carry a failure's *identity* (`agent
+ * turn refusal`, `agent turn transport_error`, `vm bring-up error`) do not.
+ * Used only for reporting now (counting no longer keys on it — see issue 135).
+ */
+export function normalizeFailureReason(reason) {
+    return reason
+        .toLowerCase()
+        .replace(/\S*\d\S*/g, '<id>')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+/**
+ * Fold one worker exit into the circuit-breaker streak. A clean exit (`normal`)
+ * resets it — the issue made progress. Any abnormal exit increments the streak
+ * by one REGARDLESS of reason (issue 135: keying on same-reason let flapping
+ * failures dodge the breaker forever). When `threshold > 0` and the streak
+ * reaches it, the breaker trips. `threshold <= 0` disables tripping entirely
+ * (the streak is still tracked but never trips), so an operator can turn the
+ * breaker off. `reason` is normalized only to label the eventual trip.
+ */
+export function decideCircuitBreaker(input) {
+    if (input.normal)
+        return { kind: 'reset' };
+    const normalizedReason = normalizeFailureReason(input.reason);
+    const count = input.prior ? input.prior.count + 1 : 1;
+    if (input.threshold > 0 && count >= input.threshold) {
+        return { kind: 'trip', normalizedReason, count };
+    }
+    return { kind: 'continue', normalizedReason, count };
+}
+/**
+ * Render the diagnostic note appended to the issue when the breaker trips and
+ * routes it to a holding state, so the operator sees why it stopped. Ported
+ * verbatim from the original `Orchestrator.routeToHolding`.
+ *
+ * `reason` is the human-facing failure reason (the original passed the RAW exit
+ * reason here, not the normalized one — the normalized form is for streak
+ * labeling/logging). `count` is the consecutive-failure streak length that
+ * tripped the breaker.
+ */
+export function tripHoldingNotes(holdingState, reason, count) {
+    return [
+        `**Circuit breaker tripped** — routed to \`${holdingState}\` for human inspection.`,
+        '',
+        `Symphony stopped retrying after **${count} consecutive attempts failed with the same error**, to avoid an unbounded dispatch loop (issue 128).`,
+        '',
+        `**Last failure reason:** ${reason}`,
+        '',
+        `Resolve the underlying cause, then move the issue back into an active state to resume dispatch.`,
+    ].join('\n');
+}
+/**
+ * Fold a tripped breaker into the `tracker.move_state` Effect the shell executes
+ * to move the issue into its holding state with the rendered diagnostic note.
+ * This is the single seam where the trip decision becomes a side effect: core
+ * returns the Effect, the shell performs the tracker move (the original did this
+ * inline in `routeToHolding`).
+ */
+export function tripToHoldingEffect(input) {
+    return {
+        family: 'tracker',
+        kind: 'move_state',
+        issueId: input.issueId,
+        toState: input.holdingState,
+        fromRoot: input.fromRoot,
+        fromState: input.fromState,
+        notes: tripHoldingNotes(input.holdingState, input.reason, input.count),
+        actor: input.actor,
+    };
+}
+//# sourceMappingURL=circuit-breaker.js.map

package/dist/src/core/schedule/circuit-breaker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"circuit-breaker.js","sourceRoot":"","sources":["../../../../src/core/schedule/circuit-breaker.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,sEAAsE;AACtE,4EAA4E;AAC5E,8EAA8E;AAC9E,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,0BAA0B;AAC1B,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAC/E,0CAA0C;AAC1C,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,iFAAiF;AACjF,6EAA6E;AAC7E,0DAA0D;AAU1D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO,MAAM;SACV,WAAW,EAAE;SACb,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;SAC5B,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;AACZ,CAAC;AAaD;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB,EAAE,MAAc,EAAE,KAAa;IAClF,OAAO;QACL,6CAA6C,YAAY,0BAA0B;QACnF,EAAE;QACF,qCAAqC,KAAK,sGAAsG;QAChJ,EAAE;QACF,4BAA4B,MAAM,EAAE;QACpC,EAAE;QACF,iGAAiG;KAClG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAmBD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,YAAY;QAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;QACtE,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC"}