alissa-tools-github-devloop 0.6.2__tar.gz → 0.6.3__tar.gz

{alissa_tools_github_devloop-0.6.2/src/main/alissa_tools_github_devloop.egg-info → alissa_tools_github_devloop-0.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.6.2
+Version: 0.6.3
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_devloop-0.6.2 → alissa_tools_github_devloop-0.6.3}/src/main/alissa/tools/github/devloop/alissa.py

@@ -70,23 +70,45 @@ class Alissa:
 
     def list_sessions(self) -> "list[dict]":
         """Managed tmux sessions as `alissa tmux ls --json` reports them
-        (dicts carrying at least `name` and `status`). Raises CommandError
-        when the CLI cannot answer at all (the caller skips that sweep);
-        unparseable or non-list JSON degrades to an empty list -- a broken
-        listing must read as "nothing to reap", never crash the poll."""
-        out = run(["alissa", "tmux", "ls", "--json"], timeout=60)
+        (dicts carrying at least `name` and `status`).
+
+        Raises CommandError whenever the CLI does not answer USABLY: a
+        non-zero exit, or a zero exit whose stdout is empty, unparseable, or
+        not a JSON list. `--json` serialises its array and returns BEFORE the
+        human-readable empty case, so a working CLI with nothing to report
+        prints `[]`, never nothing -- which makes empty/garbled output a CLI
+        that failed to answer, not an answer of "no sessions". A PARSED empty
+        list is the genuine zero-session listing and is returned as such.
+
+        That distinction is load-bearing, not pedantry: callers feed this to
+        SessionLiveness, where a successful listing missing a name means the
+        session is DEAD. Degrading unusable output to `[]` would hand every
+        caller a confident, empty, WRONG roster -- respawning over sessions
+        that are merely unlistable, which is the double-spawn this daemon's
+        staleness matrix exists to prevent.
+
+        Raising cannot crash a poll: every caller already treats CommandError
+        as skip-this-pass (the reaper skips its sweep, the max_sessions budget
+        fails open, and the roster reads INDETERMINATE, so neither a respawn
+        nor a resume can fire on a listing that did not happen)."""
+        argv = ["alissa", "tmux", "ls", "--json"]
+        out = run(argv, timeout=60)
         if not out.strip():
-            return []
+            raise CommandError(
+                argv, 0, "`alissa tmux ls --json` printed nothing (a working "
+                "CLI prints `[]` when there are no sessions)",
+            )
         try:
             data = json.loads(out)
         except json.JSONDecodeError:
-            log.warning(
-                "`alissa tmux ls --json` returned unparseable output -- "
-                "treating as no sessions this sweep"
+            raise CommandError(
+                argv, 0, "`alissa tmux ls --json` returned unparseable output",
             )
-            return []
         if not isinstance(data, list):
-            return []
+            raise CommandError(
+                argv, 0, "`alissa tmux ls --json` returned "
+                f"{type(data).__name__}, not a JSON list",
+            )
         return [entry for entry in data if isinstance(entry, dict)]
 
     def kill_session(self, name: str) -> None:

{alissa_tools_github_devloop-0.6.2 → alissa_tools_github_devloop-0.6.3}/src/main/alissa/tools/github/devloop/loop.py

@@ -55,6 +55,23 @@ wholesale and restores the legacy two-signal matrix. The local ledger only
 counts attempts, ages the newest spawn so a dead session can be retried, and
 remembers which escalation kinds were already raised.
 
+The third signal is load-bearing in the OTHER direction too, on the branch
+where no PR is linked at all -- the implement phase, before the session has
+anything to show for itself. There the second signal is STRUCTURALLY absent
+(not "no evidence of life" but "no place life could have left evidence
+yet"), so elapsed time alone used to decide, and any honest implementation
+longer than stale_minutes was read as a death: studio.alissa.app#231 spawned
+a duplicate attempt over a session that opened its PR four minutes later,
+and both PRs ran a full review. The roster answers what the missing PR
+cannot -- a name present in a listing is a session that is RUNNING, whatever
+it has published -- so only DEAD (absent from a SUCCESSFUL listing) respawns,
+exactly as this edge always did, while ALIVE and INDETERMINATE take the same
+floored defer, with its own "live stalled" episode ping naming the session
+and the `alissa tmux kill` that would release the lane. This guard is NOT
+behind `resume_enabled`: that switch gates an ACTION the daemon gained, and
+turning it off restores a conservative legacy; this is a guard against a
+DOUBLE SPAWN, and no version of "off" for it is safe.
+
 The same pass then runs the REVIEW-RESPONSE edge (fix_rounds_enabled): open
 PRs authored by the token identity whose newest substantive review verdict is
 request_changes, with no pending re-request and no push since that review --
@@ -485,6 +502,18 @@ STALLED_COMMENT = (
     "attempt while the PR is open."
 )
 
+LIVE_STALLED_COMMENT = (
+    "**Dev loop stalled?** — attempt {attempts} has been in flight "
+    "{minutes} min and has opened no pull request, but its session "
+    "`{session}` {status}. The daemon never respawns an attempt it cannot "
+    "prove is gone (a second session would land on the same branch in the "
+    "same worktree and open a duplicate PR), so it keeps deferring the "
+    "retry — is that session still making progress? Operator options: check "
+    "it, and if it is wedged `alissa tmux kill {session}` to let the retry "
+    "proceed, or finish the work by hand. Unassigning the issue alone is "
+    "not enough — the daemon's ledger keeps aging this attempt regardless."
+)
+
 FIX_CAP_COMMENT = (
     "**Fix loop cap-out** — {attempts} fix attempt(s) were spawned on review "
     "round {round} of this PR without any of them completing the round "
@@ -595,6 +624,15 @@ ESCALATION_STALLED = "stalled"
 ESCALATION_FIX_CAP = "fix-cap"
 ESCALATION_FIX_STALLED = "fix-stalled"
 
+# The pre-PR liveness deferral's own kind (see live_stalled_kind). Distinct
+# from ESCALATION_STALLED because the two stories are different and so are
+# their remedies: `stalled` says "a PR is open and holding the retry -- close
+# it", `live-stalled` says "no PR exists and the session itself is still
+# listed -- kill it if it is wedged". A lane can hit both (a session that
+# stalls before its PR and a later attempt that stalls behind one), and
+# neither ping may silence the other.
+ESCALATION_LIVE_STALLED = "live-stalled"
+
 # The maintenance edge's cap-out kind prefix. The `maintain-` prefix keeps
 # rows from ever colliding with the issue edge's `cap` when an issue and a
 # PR share a number; the epoch suffix is maintain_cap_kind's job below.
@@ -676,6 +714,25 @@ def stalled_kind(attempt: int) -> str:
     return f"{ESCALATION_STALLED}:a{attempt}"
 
 
+def live_stalled_kind(attempt: int) -> str:
+    """The ledger kind for the stalled ping of ONE pre-PR liveness-deferral
+    episode.
+
+    stalled_kind's episode reasoning, transposed to the deferral that holds
+    when the timer is stale, no PR exists yet, and the attempt's session is
+    still listed (or unresolvable). It recurs for the same reason: every
+    attempt can wedge before opening its PR, and attempt k's ping must not
+    silence attempt k+1's -- keyed on the bare kind, the TERMINAL attempt
+    wedging would defer silently forever, with the cap-out (below the
+    deferral) unreachable. The `live-` prefix keeps it independent of the
+    linked-PR stall: one lane can raise both, and each names a remedy the
+    other does not. Delivery contract as stalled_kind's -- the row lands only
+    AFTER the comment posts, so a transient failure retries next poll and the
+    ping lands exactly once per episode.
+    """
+    return f"{ESCALATION_LIVE_STALLED}:a{attempt}"
+
+
 def deferral_activity_kind(session: str) -> str:
     """The activity-log kind that dedupes ONE capacity-deferral episode's line.
 
@@ -796,6 +853,29 @@ class Liveness(str, Enum):
     INDETERMINATE = "indeterminate"
 
 
+# The two readings that hold the pre-PR deferral, spelled for the operator who
+# reads LIVE_STALLED_COMMENT. ALIVE is evidence, INDETERMINATE is the absence
+# of it, and the remedy differs (kill a wedged session vs repair the session
+# listing), so the ping must not blur them into one sentence. DEAD is absent
+# on purpose: it never defers.
+#
+# The call site reads this with a fallback, and the dead branch is deliberate.
+# What keeps DEAD out is not the enum -- it is the CALL-SITE INVARIANT (`if
+# liveness is not Liveness.DEAD:`), which lives ~500 lines away in the branch
+# most likely to be edited when the matrix grows again. A total lookup would
+# be correct today and raise KeyError the moment a fourth Liveness member or
+# a new caller reaches this, crashing the poll on the one path whose whole
+# job is to page a human about a lane nothing else can reach. Clumsy wording
+# still reaches the operator; a KeyError does not.
+LIVE_STALLED_STATUS = {
+    Liveness.ALIVE: "is still present in the machine's session listing",
+    Liveness.INDETERMINATE: (
+        "cannot be resolved — the session listing is unavailable, so the "
+        "daemon has no evidence either way"
+    ),
+}
+
+
 class SessionLiveness:
     """The pass's tmux roster -- the oracle behind `session_liveness`.
 
@@ -807,6 +887,14 @@ class SessionLiveness:
     listing SUCCEEDED and the row's name is absent from it. A tmux hiccup can
     never manufacture a respawn.
 
+    That argument is only as good as the caller's ability to tell a listing
+    that SUCCEEDED from one that merely exited 0, so `Alissa.list_sessions`
+    raises CommandError on empty, unparseable, or non-list output rather than
+    degrading it to `[]`: an empty ROSTER (`listed`, nothing live) must mean
+    the machine really is idle, because every lookup against it answers DEAD.
+    A garbled listing read as an empty one would be an oracle that is
+    confident, wrong, and wrong in the respawning direction.
+
     `reaped` is the set of names the sweep just killed: they were live in the
     listing but are not any more, so they resolve DEAD (the same discounting
     `_count_active_sessions` does for the budget). A `live: False` row (a
@@ -1125,7 +1213,12 @@ class DevWatcher:
         edit) must resolve to whatever it actually says. `roster` None -- no
         listing was taken for this call at all, which is how every direct
         `evaluate()` caller that does not run a sweep behaves -- reads
-        INDETERMINATE, i.e. today's legacy matrix."""
+        INDETERMINATE, exactly like a listing that failed: on the resume
+        branches that is the legacy matrix (no resume can fire), and on the
+        pre-PR branch it is the deferral, because "the caller gave me no way
+        to check" is the same ambiguity as "the check did not answer", and
+        neither may license a respawn onto a possibly-live worktree. The
+        polling path always supplies a roster (see `_sweep_and_budget`)."""
         if roster is None:
             return Liveness.INDETERMINATE
         return roster.of(session)
@@ -1283,6 +1376,72 @@ class DevWatcher:
                         attempts,
                         session=session_name(issue, attempts),
                     )
+            else:
+                # No linked open PR: the IMPLEMENT phase, before the session
+                # has anything to show for itself. The second signal is
+                # STRUCTURALLY absent here -- not "no evidence of life" but
+                # "no place life could have left evidence yet" -- so without
+                # the third signal elapsed time alone decided, and any honest
+                # implementation longer than stale_minutes was read as a
+                # death (fahera-mx/studio.alissa.app#231: attempt 1 opened its
+                # PR four minutes after attempt 2 was spawned on top of it,
+                # and both PRs ran a full review). The roster answers the
+                # question the missing PR cannot: a name present in the
+                # listing is a session that is RUNNING, whatever it has
+                # published. Only DEAD -- a name absent from a SUCCESSFUL
+                # listing -- respawns, exactly as this edge always did;
+                # ALIVE and INDETERMINATE take the same floored defer the
+                # linked-PR branch takes, and for the same fail-safe reason
+                # (a respawn lands on the SAME branch in the SAME worktree as
+                # the session it doubles, so ambiguity must never respawn).
+                #
+                # Unlike the resume branch above, this guard is NOT behind
+                # `resume_enabled`: that switch gates an ACTION the daemon
+                # gained (spawning onto a dead session's PR), and turning it
+                # off restores a legacy behavior that was merely conservative.
+                # This is the opposite -- a guard against a double spawn --
+                # and there is no version of "off" for it that is safe.
+                #
+                # The session name comes from the ledger row (the identity the
+                # reaper and the console key on), falling back to the
+                # deterministic name for a row that carries none: `unnamed`
+                # rows resolve INDETERMINATE otherwise, and since they respawn
+                # unconditionally TODAY, deferring them forever would be a
+                # regression dressed as caution.
+                live_session = self.state.newest_spawn_session(
+                    issue.full_name, number
+                ) or session_name(issue, attempts)
+                liveness = self.session_liveness(live_session, roster)
+                # Falling through means DEAD, and DEAD here is CONFIRMED (a
+                # successful listing without this name) -- so the retry below
+                # can name the session it proved gone instead of presuming.
+                dead_session = live_session
+                if liveness is not Liveness.DEAD:
+                    # Floored exactly like the linked-PR deferral, and needing
+                    # it for the same reason: this sits ABOVE the cap check,
+                    # so while it holds no other escalation can reach the
+                    # issue. A wedged-but-listed session would otherwise be
+                    # deferred in silence forever.
+                    stalled_after = (
+                        STALLED_DEFER_MULTIPLE * self.config.stale_minutes * 60
+                    )
+                    if age >= stalled_after and not self.state.escalated(
+                        issue.full_name, number, live_stalled_kind(attempts)
+                    ):
+                        self._escalate_live_stalled(
+                            issue, attempts, age, live_session, liveness
+                        )
+                    return Decision(
+                        Action.IN_FLIGHT,
+                        f"attempt {attempts} is stale ({int(age / 60)} min) "
+                        f"with no linked open PR, but its session "
+                        f"{live_session} reads {liveness.value} — the "
+                        f"implement phase publishes nothing until the PR "
+                        f"exists; not respawning over a session that may "
+                        f"still be running",
+                        attempts,
+                        session=live_session,
+                    )
 
         # Never spawn attempt cap+1. Escalate ONCE; `escalated()` dedupes, and
         # raising attempt_cap re-enters the loop without clearing the ledger.
@@ -1312,11 +1471,13 @@ class DevWatcher:
         elif age is not None:
             log.warning(
                 "%s attempt %d has been in flight %.0f min with no completion "
-                "and no linked open PR — re-enqueuing as attempt %d (developer "
-                "session presumed dead)",
+                "and no linked open PR, and its session %s is absent from the "
+                "tmux listing (CONFIRMED dead, not presumed) — re-enqueuing as "
+                "attempt %d",
                 issue.issue_slug,
                 attempts,
                 age / 60,
+                dead_session,
                 attempts + 1,
             )
         attempt = attempts + 1
@@ -1488,10 +1649,14 @@ class DevWatcher:
         # still best-effort -- `_append_activity` swallows its failures and a
         # failed line never gates the spawn -- and still fully dry-run gated.
         #
-        # A resume names the confirmation that unblocked it (an operator
-        # reading the issue must be able to tell a proven-dead resume from a
-        # timer-only retry); a plain retry says presumed; attempt 1 is a plain
-        # spawn.
+        # Both spawn-over-a-predecessor contexts name the CONFIRMATION that
+        # unblocked them. Neither is a presumption any more: this edge reaches
+        # a retry only past the liveness guard, so the prior session was
+        # absent from a successful listing either way. What still separates
+        # them is what the dead session left behind -- a draft PR to finish,
+        # or nothing at all (it died in the implement phase) -- which is
+        # exactly what tells the operator whether work was lost. Attempt 1 is
+        # a plain spawn.
         if resume_pr is not None:
             context = (
                 f"resumed — previous session confirmed dead (absent from the "
@@ -1499,7 +1664,10 @@ class DevWatcher:
                 f"PR {resume_pr.url}"
             )
         elif reenqueued:
-            context = "re-enqueued — previous session presumed dead"
+            context = (
+                "re-enqueued — previous session confirmed dead (absent from "
+                "the tmux listing) with no PR opened"
+            )
         else:
             context = "spawned"
         self._append_activity(
@@ -1792,6 +1960,68 @@ class DevWatcher:
             issue.full_name, issue.number, stalled_kind(attempts)
         )
 
+    def _escalate_live_stalled(
+        self,
+        issue: Issue,
+        attempts: int,
+        age: float,
+        session: str,
+        liveness: Liveness,
+    ) -> None:
+        """Operator ping for the OTHER long deferral: no PR was ever opened,
+        and what holds the retry back is the session itself still reading
+        ALIVE (or unresolvable) in the tmux listing.
+
+        Same contract as `_escalate_stalled` in every respect that matters --
+        one comment per deferral EPISODE (keyed live_stalled_kind(attempts),
+        so a later attempt wedging pings again), the row recorded only AFTER
+        the comment posts so a transient failure retries next poll, and the
+        decision stays IN_FLIGHT regardless. What differs is the STORY, and
+        with it the remedy the operator is handed: `stalled` says a PR is
+        holding the lane and closing it frees the retry; this says there is
+        no PR at all and the session is the thing to look at -- so the ping
+        names it and the `alissa tmux kill` that would release the lane.
+        `status` spells ALIVE and INDETERMINATE apart (evidence vs the
+        absence of it: kill a wedged session vs repair the listing), with a
+        fallback because a daemon must never crash a poll over wording."""
+        status = LIVE_STALLED_STATUS.get(
+            liveness, "reads " + liveness.value + " in the machine's session listing"
+        )
+        body = LIVE_STALLED_COMMENT.format(
+            attempts=attempts,
+            minutes=int(age / 60),
+            session=session,
+            status=status,
+        )
+        log.warning(
+            "STALLED %s attempt %d has been deferred %.0f min with no linked "
+            "open PR while its session %s reads %s — escalating to operator "
+            "(once per attempt)",
+            issue.issue_slug,
+            attempts,
+            age / 60,
+            session,
+            liveness.value,
+        )
+
+        if self.config.dry_run:
+            log.info("[dry-run] would comment on %s:\n%s", issue.issue_slug, body)
+            return
+
+        try:
+            self.github.comment(issue.owner, issue.repo, issue.number, body)
+        except CommandError as exc:
+            log.error(
+                "could not post the live-stalled comment on %s: %s — not "
+                "recording the episode; the ping retries next poll",
+                issue.issue_slug,
+                exc,
+            )
+            return
+        self.state.record_escalation(
+            issue.full_name, issue.number, live_stalled_kind(attempts)
+        )
+
     def _escalate(self, issue: Issue, attempts: int) -> None:
         body = ESCALATION_COMMENT.format(
             attempts=attempts, cap=self.config.attempt_cap, label=self.config.label

alissa_tools_github_devloop-0.6.3/src/main/alissa/tools/github/devloop/version

@@ -0,0 +1 @@
+0.6.3

{alissa_tools_github_devloop-0.6.2 → alissa_tools_github_devloop-0.6.3/src/main/alissa_tools_github_devloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.6.2
+Version: 0.6.3
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_devloop-0.6.2/src/main/alissa/tools/github/devloop/version

@@ -1 +0,0 @@
-0.6.2