tumwater 0.2.0 → 0.4.0

package/dist/src/doctor/doctor-holds.js

@@ -1,4 +1,3 @@
-// vocabulary: plain
 import { roleLabel } from "../roles/role-labels.js";
 import { pausedRoles, pausedRolesUntil, standingTeamPause } from "../team/team-state.js";
 import { MODEL_TIERS } from "../config/config-schema.js";
@@ -9,34 +8,36 @@ import { roleCapVerdicts } from "../gates/role-cap-gates.js";
 import { readMergeQueue } from "../merge/merge-queue.js";
 import { MAINTENANCE_DAILY_FLOOR } from "../gates/maintenance-quota.js";
 import { heldByMainRed, mainCheckForPoll, maintenanceQuotaForPoll } from "../status/status-polls.js";
-import { loadLoopState } from "../loop/loop-state.js";
-import { baseRoleOf, loopIds, loopPaused } from "../roles/loop-ids.js";
-import { ERROR_STREAK_BREAKER, ERROR_STREAK_WARN } from "../tick/tick-apply.js";
+import { loadRunnerState } from "../runner/runner-state-load.js";
+import { baseRoleOf, runnerIds, runnerPaused } from "../roles/runner-ids.js";
+import { ERROR_STREAK_BREAKER, ERROR_STREAK_WARN } from "../run/run-apply.js";
 import { squash } from "../text/text.js";
 import { usd } from "../text/format.js";
 import { parseQuietHours, quietHoursStatus, quietWindowEnd, roleQuietHold } from "../scheduling/quiet-hours.js";
-import { humanUntil } from "../text/datetime.js";
+import { DAY_MS, HOUR_MS, humanUntil } from "../text/datetime.js";
 import { budgetPhrase, pauseReasonSuffix, plural } from "../text/phrases.js";
-import { claudeUtilizationPct, claudeWindowEntries, claudeWindowLabel, readClaudeAccount } from "../agent/claude/claude-account.js";
-import { claudeWindowObservation } from "../team/team-polls.js";
+import { readAccount, utilizationPct, windowEntries, windowLabel } from "../agent/subscription-account.js";
+import { backendDisplayName } from "../agent/backend-traits.js";
+import { windowObservation } from "../team/team-polls.js";
 import { readEventsSince } from "../events/event-window.js";
 import { errorMessage } from "../text/text.js";
 import { okOutcome, warnOutcome } from "./outcome.js";
+import { redMainWarning } from "../baseline/main-guardrails.js";
 /** The standing-hold checks: `pause` (checkPause), `quiet hours` (checkQuietHours), and `budget`
- * (checkBudget), `claude window` (checkClaudeWindow), `maintenance quota`
- * (checkMaintenanceQuota), and `error streaks` (checkErrorStreaks), all read-only reports of
- * holds on ticking. */
-export function loadLoopStates(root, config) {
-    return loopIds(config)
-        .map((id) => loadLoopState(root, id))
+ * (checkBudget), the `claude window`/`codex window` rows (checkSubscriptionWindow),
+ * `maintenance quota` (checkMaintenanceQuota), and `error streaks` (checkErrorStreaks), all
+ * read-only reports of holds on running. */
+export function loadRunnerStates(root, config) {
+    return runnerIds(config)
+        .map((id) => loadRunnerState(root, id))
         .sort((a, b) => a.role.localeCompare(b.role));
 }
 /** The `pause` check: names a standing operator pause so doctor does not print "ready to run"
- * over a team that starts no tick. Read-only: it reads the same team and per-role pause
+ * over a team that starts no run. Read-only: it reads the same team and per-role pause
  * markers the scheduler reads (standingTeamPause, pausedRoles, pausedRolesUntil — all treat
  * an expired marker as absent), so its verdict cannot disagree with what the team does. A
- * team pause is a warn because it stops every loop; paused roles are ok because the operator
- * chose them by name and every other loop keeps ticking. `now` only drives the countdowns. */
+ * team pause is a warn because it stops every role; paused roles are ok because the operator
+ * chose them by name and every other role keeps running. `now` only drives the countdowns. */
 export function checkPause(root, now = Date.now()) {
     const team = standingTeamPause(root);
     const roles = pausedRoles(root);
@@ -53,10 +54,10 @@ export function checkPause(root, now = Date.now()) {
     return warnOutcome(`${head}${pauseReasonSuffix(team.reason)}${rolesPhrase ? `; ${rolesPhrase}` : ""}`);
 }
 /** The `quiet hours` check: names the team quiet window and any per-role windows holding now,
- * so doctor does not print "ready to run" over a team that starts no tick until the window
+ * so doctor does not print "ready to run" over a team that starts no run until the window
  * ends. Read-only: membership comes from the scheduler's own parser and predicate
  * (quietHoursStatus, roleQuietHold), so the verdict cannot disagree with the gate. A team
- * window holding is a warn because it stops every loop (the director is exempt); held per-role
+ * window holding is a warn because it stops every role (the director is exempt); held per-role
  * windows are ok because the operator chose those roles by name. A malformed value reads as
  * unset here — checkInit owns that error. `now` is injected so tests never read the clock. */
 export function checkQuietHours(config, now = new Date()) {
@@ -89,13 +90,13 @@ export function checkQuietHours(config, now = new Date()) {
  * own `maxDailyCostUsdPerRole` cap. Read-only and built on the scheduler's own definitions
  * (teamDailyCost, budgetReached, roleCapVerdicts), so the verdict cannot disagree with the gate.
  * `published` is the running scheduler's figure (it includes runs charged since the last save)
- * and wins over the persisted sum, as in status. A reached team cap is a warn because role loops
+ * and wins over the persisted sum, as in status. A reached team cap is a warn because roles
  * run on their tier fallback or hold until local midnight (the `fallback` row says which);
  * per-role caps reached alone are ok because the operator chose them by name. */
 export function checkBudget(root, config, published, now = Date.now()) {
     if (config === undefined)
         return okOutcome("not checked — tumwater.json unreadable");
-    const states = loadLoopStates(root, config);
+    const states = loadRunnerStates(root, config);
     const spent = published?.spentUsd ?? teamDailyCost(states, now);
     const caps = config.maxDailyCostUsdPerRole;
     const capped = [...roleCapVerdicts(states.map((s) => ({ role: s.role, state: s })), caps, now)]
@@ -116,63 +117,65 @@ export function checkBudget(root, config, published, now = Date.now()) {
     return okOutcome(`${phrase} today${cappedPhrase}`);
 }
 /** The `maintenance quota` check: rolling-24 h maintenance merges against the allowance
- * (`maintenancePerWorkMerge` per work merge + the daily floor), naming the maintenance loops held
+ * (`maintenancePerWorkMerge` per work merge + the daily floor), naming the maintenance roles held
  * when it is full. Read-only and built on the same verdict the scheduler and status use
- * (maintenanceQuotaForPoll). Only a live team's running loops and merge queue count as in flight,
+ * (maintenanceQuotaForPoll). Only a live team's running roles and merge queue count as in flight,
  * since a dead team's leftover `running` flag and queue drain nothing. A held allowance is a warn
  * because it stops a whole tier. */
 export function checkMaintenanceQuota(root, config, aliveTeam, now = Date.now()) {
     if (config === undefined)
         return okOutcome("not checked — tumwater.json unreadable");
-    const loops = loadLoopStates(root, config).map((s) => ({ role: s.role, running: aliveTeam && s.running === true }));
+    const runners = loadRunnerStates(root, config).map((s) => ({ role: s.role, running: aliveTeam && s.running === true }));
     const queued = aliveTeam ? new Set(readMergeQueue(root).entries.map((e) => e.role)) : new Set();
-    const { allowance, used, held } = maintenanceQuotaForPoll(root, config.maintenancePerWorkMerge, loops, queued, now);
+    const { allowance, used, held } = maintenanceQuotaForPoll(root, config.maintenancePerWorkMerge, runners, queued, now);
     if (held.length > 0) {
         return warnOutcome(`allowance reached — ${used}/${allowance} maintenance merges in the last 24h; held until the window rolls under: ${[...held].sort().join(", ")}`);
     }
     const base = `${used}/${allowance} maintenance merges in the last 24h (${config.maintenancePerWorkMerge} per work merge + ${MAINTENANCE_DAILY_FLOOR} floor)`;
-    const anyMaintenance = loops.some((l) => commitTier(l.role) === "maintenance");
+    const anyMaintenance = runners.some((l) => commitTier(l.role) === "maintenance");
     return okOutcome(anyMaintenance ? base : `${base}; no maintenance role enabled`);
 }
-/** The `claude window` check: whether a rejected subscription window holds the subscription claude
- * seams. Read-only and built on claudeWindowObservation, the verdict the scheduler's team hold
- * uses, so it cannot disagree with the hold. A hold is a warn because it stops every subscription
- * claude seam until the window resets; otherwise the most constrained window's state is reported
- * as ok (a rejected window spending overage reads `rejected` here: overage spends, it does not
- * hold). API-billed claude never holds. */
-export function checkClaudeWindow(root, now = Date.now(), chain, config) {
-    const account = readClaudeAccount(root, now);
+/** The `<backend> window` check, one row per subscription backend in use (claude and codex):
+ * whether a rejected subscription window holds the subscription `<backend>` seams. Read-only and
+ * built on windowObservation (the backend's own), the verdict the scheduler's team hold uses, so
+ * it cannot disagree with the hold. A hold is a warn because it stops every subscription seam on
+ * that backend until the window resets; otherwise the most constrained window's state is
+ * reported as ok (a rejected window spending overage reads `rejected` here: overage spends, it
+ * does not hold). Returns null (omitting the row from doctor) when the backend has no
+ * subscription account — the same omit-a-row pattern as `pi extensions` — because an absent or
+ * API-billed account never holds. */
+export function checkSubscriptionWindow(backend, root, now = Date.now(), chain, config) {
+    const account = readAccount(root, backend, now);
     if (account?.billing !== "subscription")
-        return okOutcome("no subscription window reported");
-    const held = claudeWindowObservation(account, now);
+        return null;
+    const held = windowObservation(backend, account, now);
     if (held?.kind === "subscription-window" && held.windowType !== undefined && held.resetsAt !== undefined) {
-        const label = claudeWindowLabel(held.windowType);
+        const label = windowLabel(held.windowType);
         const resets = humanUntil(held.resetsAt, now);
-        const moved = MODEL_TIERS.filter((t) => {
-            const reason = chain?.[t]?.reason;
-            return reason === "window" || reason === "reserve";
-        });
+        const moved = MODEL_TIERS.filter((t) => (chain?.[t]?.reason === "window" || chain?.[t]?.reason === "reserve") &&
+            config !== undefined &&
+            withModelOverrides(config, t, {}).agent === backend);
         if (moved.length > 0) {
-            const waiting = MODEL_TIERS.filter((t) => !chain?.[t] && config !== undefined && withModelOverrides(config, t, {}).agent === "claude");
+            const waiting = MODEL_TIERS.filter((t) => !chain?.[t] && config !== undefined && withModelOverrides(config, t, {}).agent === backend);
             return warnOutcome(`${label} window rejected — ${moved.join(", ")} moved to fallbacks until it resets in ${resets}${waiting.length > 0 ? `; ${waiting.join(", ")} wait` : ""}`);
         }
-        return warnOutcome(`${label} window rejected — subscription claude model jobs wait until it resets in ${resets}`);
+        return warnOutcome(`${label} window rejected — subscription ${backendDisplayName(backend)} model jobs wait until it resets in ${resets}`);
     }
-    const top = claudeWindowEntries(account)[0];
+    const top = windowEntries(account)[0];
     if (top === undefined)
         return okOutcome("subscription; no window reported yet");
-    const pct = typeof top.utilization === "number" ? ` (${claudeUtilizationPct(top.utilization)}% used)` : "";
-    const label = claudeWindowLabel(top.type);
+    const pct = typeof top.utilization === "number" ? ` (${utilizationPct(top.utilization)}% used)` : "";
+    const label = windowLabel(top.type);
     return okOutcome(top.status === "allowed_warning" ? `${label} window nearing its limit${pct}` : `${label} window ${top.status}${pct}`);
 }
 /** How far back the `provider hold` check reads for hold/resume crossings. The longest a
  * hold can stay is HOLD_CAP_MS (team-hold's 15-minute cap that escalation doubles against),
  * so a window a comfortable multiple of that covers any standing hold's crossing event plus
  * its resume — an older resumed event must not be missed or a re-opened provider reads held. */
-const HOLD_CHECK_WINDOW_MS = 2 * 3600_000;
+const HOLD_CHECK_WINDOW_MS = 2 * HOUR_MS;
 /** The `provider hold` check: names each provider whose team-wide failure hold
  * (src/team/team-hold.ts, polled by pollTeamHold) stands now — a 429/backend-failure storm
- * that stops the roles on that provider from starting new ticks until it re-opens. Read-only:
+ * that stops the roles on that provider from starting new runs until it re-opens. Read-only:
  * it infers the standing set from the event log's own `rate_limit_hold`/`rate_limit_resumed`
  * crossings, the events pollTeamHold writes, so it cannot disagree with the hold. A standing
  * hold is a warn (as with the `claude window` row) because it stops every role on that
@@ -210,16 +213,16 @@ export function checkProviderHolds(root, now = Date.now()) {
     });
     return warnOutcome(lines.join("; "));
 }
-/** The `error streaks` check: names each enabled loop whose `consecutiveErrors` is at or past
+/** The `error streaks` check: names each enabled role whose `consecutiveErrors` is at or past
  * ERROR_STREAK_WARN, with its streak and last error, and whether it is paused. Read-only; it reads
  * the same `consecutiveErrors` the error-streak breaker and `teamAlerts` read, and the same
  * `pausedRoles` marker the scheduler reads. The marker does not record who wrote it, so a paused
- * loop at ERROR_STREAK_BREAKER's bar is described, not attributed to the breaker. A warn, not a
- * fail: a failing loop does not stop the team from running. */
+ * role at ERROR_STREAK_BREAKER's bar is described, not attributed to the breaker. A warn, not a
+ * fail: a failing role does not stop the team from running. */
 export function checkErrorStreaks(root, config) {
     if (config === undefined)
         return okOutcome("not checked — tumwater.json unreadable");
-    const failing = loadLoopStates(root, config)
+    const failing = loadRunnerStates(root, config)
         .filter((s) => (s.consecutiveErrors ?? 0) >= ERROR_STREAK_WARN);
     if (failing.length === 0)
         return okOutcome("no role failing repeatedly");
@@ -227,7 +230,7 @@ export function checkErrorStreaks(root, config) {
     const phrases = failing.map((s) => {
         const n = s.consecutiveErrors ?? 0;
         let phrase = `${roleLabel(s.role)}: ${n} failed runs`;
-        if (loopPaused(paused, s.role)) {
+        if (runnerPaused(paused, s.role)) {
             const key = paused.has(s.role) ? s.role : paused.has(baseRoleOf(s.role)) ? baseRoleOf(s.role) : `${s.role}-1`;
             phrase +=
                 n >= ERROR_STREAK_BREAKER
@@ -240,23 +243,34 @@ export function checkErrorStreaks(root, config) {
     });
     return warnOutcome(`failing run after run: ${phrases.join("; ")}`);
 }
-/** The `main red` check: names the code loops the red-main gate (mainRedGate) holds, ending
- * each blocked tick `main_red` while main's suite is red. Read-only: it asks heldByMainRed,
- * the predicate the status phase's `main red` label reads, so the two cannot disagree. A warn,
- * not a fail: a red main does not stop the team from running. */
-export function checkMainRed(root, config) {
+/** The `main red` check: names the code roles the red-main gate (mainRedGate) holds, ending
+ * each blocked run `main_red` while main's suite is red, and warns when main has been red over
+ * RED_MAIN_WARN_MS even with no role held (the red-main gate's guardrail, G1). Read-only: it
+ * asks heldByMainRed, the predicate the status phase's `main red` label reads, so the two
+ * cannot disagree on the held roles, and redMainWarning over the event trail, so both phrases
+ * can appear in one row. A warn, not a fail: a red main does not stop the team from running.
+ * `now` is injected so a test can pin a red's age. */
+export function checkMainRed(root, config, now = Date.now()) {
     if (config === undefined)
         return okOutcome("not checked — tumwater.json unreadable");
     const mainCheck = mainCheckForPoll(root, config);
-    const ids = loopIds(config);
-    const held = loadLoopStates(root, config)
+    const ids = runnerIds(config);
+    const held = loadRunnerStates(root, config)
         .filter((s) => heldByMainRed(s, mainCheck));
-    if (held.length === 0)
+    const phrases = [];
+    if (held.length > 0) {
+        const err = held.find((s) => s.lastError)?.lastError;
+        const cause = err ? ` — ${squash(err, 160)}` : "";
+        const healer = ids.some((id) => baseRoleOf(id) === "ci")
+            ? "; the ci role is exempt and repairs it"
+            : "; no ci role is enabled to repair it — fix main by hand or enable ci";
+        phrases.push(`main's check is failing; ${plural(held.length, "code role")} waiting: ${held.map((s) => roleLabel(s.role)).join(", ")}${cause}${healer}`);
+    }
+    const events = readEventsSince(root, DAY_MS).events;
+    const red = redMainWarning(events, now);
+    if (red !== null)
+        phrases.push(red);
+    if (phrases.length === 0)
         return okOutcome("no role waiting on main's check");
-    const err = held.find((s) => s.lastError)?.lastError;
-    const cause = err ? ` — ${squash(err, 160)}` : "";
-    const healer = ids.some((id) => baseRoleOf(id) === "bugfix")
-        ? "; the bugfix role is exempt and repairs it"
-        : "; no bugfix role is enabled to repair it — fix main by hand or enable bugfix";
-    return warnOutcome(`main's check is failing; ${plural(held.length, "code role")} waiting: ${held.map((s) => roleLabel(s.role)).join(", ")}${cause}${healer}`);
+    return warnOutcome(phrases.join("; "));
 }

package/dist/src/doctor/doctor-install.js

@@ -5,11 +5,12 @@ import fs from "node:fs";
 import path from "node:path";
 import { installDrift } from "../build/dep-install.js";
 import { readEventsSince } from "../events/event-window.js";
+import { DAY_MS } from "../text/datetime.js";
 import { plural, shortSpanPhrase } from "../text/phrases.js";
 import { errorMessage, textOr } from "../text/text.js";
 import { okOutcome, warnOutcome } from "./outcome.js";
 /** How far back a failed `dep_install` event may sit and still explain the drift. */
-const DEP_INSTALL_CHECK_WINDOW_MS = 24 * 3600_000;
+const DEP_INSTALL_CHECK_WINDOW_MS = DAY_MS;
 export function checkRootInstall(root, now = Date.now()) {
     if (!fs.existsSync(path.join(root, "package-lock.json")))
         return okOutcome("no package-lock.json — nothing pinned");