alissa-tools-github-orcloop 0.18.2__tar.gz → 0.18.4__tar.gz

{alissa_tools_github_orcloop-0.18.2/src/main/alissa_tools_github_orcloop.egg-info → alissa_tools_github_orcloop-0.18.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-orcloop
-Version: 0.18.2
+Version: 0.18.4
 Summary: ALISSA-TOOLS-GITHUB-ORCLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_orcloop-0.18.2 → alissa_tools_github_orcloop-0.18.4}/src/main/alissa/tools/github/orcloop/__main__.py

@@ -135,6 +135,16 @@ def build_parser() -> argparse.ArgumentParser:
     over.add_argument("--release-blocked-floor-days", type=int, metavar="DAYS")
     over.add_argument("--marker-key", metavar="KEY", help="Autonomous-Dev trailer key")
     over.add_argument("--scope-key", metavar="KEY", help="Autonomous-Scope trailer key")
+    over.add_argument(
+        "--scope-lock-exempt",
+        dest="scope_lock_exempt",
+        action="append",
+        metavar="[OWNER/REPO:]GLOB",
+        help="a regenerable path the lane gate does not lock on: a literal path or a "
+        "`<dir>/**` subtree; two scopes overlapping only on entries inside it no "
+        "longer conflict (e.g. convex/_generated/**). Prefix `owner/repo:` to exempt "
+        "it in that repo only. Repeatable; default none",
+    )
     over.add_argument("--alissa-endpoint", metavar="URL")
     over.add_argument("--ledger-path", type=Path, metavar="PATH")
     over.add_argument(
@@ -603,6 +613,7 @@ def overrides_from(args: argparse.Namespace) -> dict:
         "release_blocked_floor_days": args.release_blocked_floor_days,
         "marker_key": args.marker_key,
         "scope_key": args.scope_key,
+        "scope_lock_exempt": tuple(args.scope_lock_exempt) if args.scope_lock_exempt else None,
         "alissa_endpoint": args.alissa_endpoint,
         "ledger_path": args.ledger_path,
         "close_loop_enabled": args.close_loop_enabled,
@@ -858,6 +869,13 @@ def log_effective_config(config: Config) -> None:
         log.debug("fleet vitals: disabled")
     log.debug("marker_key: %s", config.marker_key)
     log.debug("scope_key: %s", config.scope_key)
+    if config.scope_lock_exempt:
+        log.info(
+            "scope lock: exempt paths %s — two scopes overlapping only on entries "
+            "inside them no longer conflict (entries prefixed owner/repo: apply to "
+            "that repo only)",
+            ", ".join(config.scope_lock_exempt),
+        )
     log.debug("release_blocked_floor_days: %s", config.release_blocked_floor_days)
     log.debug("alissa_endpoint: %s", config.alissa_endpoint)
     log.debug("ledger_db: %s", config.ledger_db)

{alissa_tools_github_orcloop-0.18.2 → alissa_tools_github_orcloop-0.18.4}/src/main/alissa/tools/github/orcloop/alissa_client.py

@@ -1413,13 +1413,23 @@ class AlissaClient:
         and return the new task's opaque id -- all the create answers
         (`{"taskId": …}`; the number is a `get_task` away). The merge policy's
         validation floor (issue #116) is the one caller: the "Validate after
-        merge" task on the origin task, assigned to the origin's reporter.
+        merge" task on the origin task, OWNED BY THE CALLER -- the fleet
+        actor, the API's own default when `assign_to_actor_id` is left empty.
+
+        `assign_to_actor_id` seats another actor as owner and is subject to
+        the API's owner-assign gate: a caller that is not an admin of a team
+        the target belongs to (and does not pass `teamSlug`) is refused with
+        `HTTP 403 FORBIDDEN: {'error': 'FORBIDDEN', 'message': 'Only a team
+        admin can seat another member as owner; pass teamSlug'}`. The fleet
+        actor is a member, not an admin, so the floor never passes it (issue
+        #120); the parameter stays for a caller that can.
 
         `criteria` is the API's shape verbatim (`{id, type, description}`
         objects -- plain strings are refused with a 400). Permission is the
         parent's OWNER, which the daemon's token is on the tasks it released;
-        a refusal comes back as the base `AlissaError` and the caller decides
-        (the floor skips the merge)."""
+        a refusal comes back as an `AlissaError` subclass and the caller
+        decides (the floor skips the merge -- and escalates once when the
+        refusal is permanent)."""
         body: dict = {
             "title": title,
             "definitionOfDone": definition_of_done,

{alissa_tools_github_orcloop-0.18.2 → alissa_tools_github_orcloop-0.18.4}/src/main/alissa/tools/github/orcloop/config.py

@@ -148,6 +148,7 @@ CONFIG_KEYS = (
     "release_blocked_floor_days",
     "marker_key",
     "scope_key",
+    "scope_lock_exempt",
     "alissa_endpoint",
     "dry_run",
     "ledger_path",
@@ -220,7 +221,7 @@ _BOOL_KEYS = frozenset({
 # it arrives as a single string, with the SAME separators (see LIST_SEPARATORS
 # and `split_entries`) — a per-key syntax is exactly the drift O11 removed.
 _LIST_KEYS = frozenset({
-    "repos", "bow_owners",
+    "repos", "bow_owners", "scope_lock_exempt",
     "merge_author_logins", "merge_reviewer_logins", "merge_hold_paths",
     "merge_yolo_merge_classes", "merge_yolo_hold_classes", "merge_allow_no_checks_repos",
 })
@@ -667,6 +668,84 @@ def normalize_bow_owners(values: tuple[str, ...] | list[str]) -> tuple[str, ...]
     return tuple(out)
 
 
+# One `scope_lock_exempt` entry, split (issue #123): an optional `owner/repo:`
+# prefix, then the exempt glob. Both halves are kept as written so the lane
+# gate can match the repo case-insensitively and name the glob verbatim.
+SCOPE_EXEMPT_SUBTREE = "/**"
+
+
+def split_scope_lock_exempt_entry(entry: str) -> tuple[str | None, str]:
+    """`(owner/repo or None, glob)` for one exempt entry, unvalidated.
+
+    The prefix is the text before the FIRST `:` -- a repo name never carries
+    one and a repo-relative glob has no reason to, so the first colon is the
+    separator whenever there is one. Validation is `_validate_scope_lock_exempt_entry`'s
+    job; this only splits."""
+    repo, sep, glob = entry.partition(":")
+    if not sep:
+        return None, entry
+    return repo, glob
+
+
+def _validate_scope_lock_exempt_entry(entry: str) -> None:
+    """Refuse a `scope_lock_exempt` entry the lane gate could not read
+    EXACTLY, naming the entry (issue #123).
+
+    An exemption WEAKENS the scope lock, so unlike a scope glob (where a
+    conservative reading only serializes) a misread exemption lets two
+    sessions onto the same files. The accepted shapes are therefore the two
+    the coverage test (`loop.scope_lock_exempt_covers`) can decide without
+    guessing: a literal repo-relative path (`convex/_generated/api.d.ts`) and
+    a whole subtree (`convex/_generated/**`). Every other wildcard shape --
+    `convex/*.ts`, `**/generated/**`, a bare `**` that would exempt EVERY
+    path and silently switch the lock off -- is refused here rather than
+    read approximately at the gate.
+    """
+    repo, glob = split_scope_lock_exempt_entry(entry)
+    where = f"scope_lock_exempt entry {entry!r}"
+    if repo is not None and not is_repo_name(repo):
+        raise ValueError(
+            f"{where}: the text before the `:` ({repo!r}) is not an owner/repo "
+            f"name. An entry is `<glob>` (every repo) or `<owner>/<repo>:<glob>` "
+            f"(that repo only), e.g. \"ali-fhr/studio.alissa.app:convex/_generated/**\"."
+        )
+    if not glob:
+        raise ValueError(f"{where}: no glob after the `:`")
+    if glob == "**":
+        literal, shape = "", "a subtree (`<dir>/**`)"
+    elif glob.endswith(SCOPE_EXEMPT_SUBTREE):
+        literal = glob[: -len(SCOPE_EXEMPT_SUBTREE)]
+        shape = "a subtree (`<dir>/**`)"
+    else:
+        literal = glob
+        shape = "a literal path"
+    if not literal:
+        raise ValueError(
+            f"{where}: {glob!r} would exempt every path, which is the scope lock "
+            f"switched off; name the regenerable directory (`<dir>/**`) or file."
+        )
+    if any(char in "*?[" for char in literal):
+        raise ValueError(
+            f"{where}: {glob!r} is neither a literal path nor a `<dir>/**` "
+            f"subtree. An exemption must say exactly what it covers -- a "
+            f"wildcard anywhere but a trailing `/**` cannot be decided from the "
+            f"literal prefix, and an exemption read approximately would let two "
+            f"sessions onto the same files."
+        )
+    if literal.startswith("/") or literal.endswith("/"):
+        raise ValueError(
+            f"{where}: {glob!r} must be repo-relative with no leading or "
+            f"trailing `/` (read as {shape})."
+        )
+    if any(part in ("", ".", "..") for part in literal.split("/")):
+        raise ValueError(
+            f"{where}: {glob!r} has an empty, `.` or `..` path segment (read as "
+            f"{shape}); write the path as the repository sees it."
+        )
+    if any(char.isspace() for char in glob):
+        raise ValueError(f"{where}: {glob!r} contains whitespace")
+
+
 def normalize_entries(values: "tuple[str, ...] | list[str]") -> tuple[str, ...]:
     """A plain list key (the merge edge's logins and hold paths): every
     element split on the family separators, stripped, empties dropped,
@@ -867,6 +946,14 @@ class Config:
     marker_key: str = "Autonomous-Dev"
     scope_key: str = "Autonomous-Scope"
 
+    # Regenerable paths the lane gate does not lock on (issue #123): an
+    # overlap between two `Autonomous-Scope` entries that both lie inside one
+    # of these globs is set aside before two lanes are compared; each glob is
+    # optionally prefixed `owner/repo:` to apply to that repo only.
+    # Empty (the default) leaves every decision exactly as before. Read
+    # through `scope_lock_exemptions`, never directly.
+    scope_lock_exempt: tuple[str, ...] = ()
+
     alissa_endpoint: str = DEFAULT_ALISSA_ENDPOINT
 
     # None means "derive from the workspace" — read `ledger_db` for the
@@ -1231,6 +1318,20 @@ class Config:
         wanted = full_name.casefold()
         return any(entry.casefold() == wanted for entry in self.merge_allow_no_checks_repos)
 
+    def scope_lock_exemptions(self, full_name: str) -> tuple[str, ...]:
+        """The exempt globs that apply to owner/repo (issue #123): every
+        unprefixed `scope_lock_exempt` entry plus the ones prefixed with THIS
+        repo's name. Case-insensitive on the repo, like GitHub owner/repo
+        names; the globs themselves are returned as written, in config order,
+        so a log line can name them verbatim."""
+        wanted = full_name.casefold()
+        out: list[str] = []
+        for entry in self.scope_lock_exempt:
+            repo, glob = split_scope_lock_exempt_entry(entry)
+            if (repo is None or repo.casefold() == wanted) and glob not in out:
+                out.append(glob)
+        return tuple(out)
+
     def watches_static(self, full_name: str) -> bool:
         """Whether owner/repo is on the STATIC allowlist. Case-insensitive,
         like GitHub owner/repo names.
@@ -1421,6 +1522,14 @@ class Config:
             if not value.strip():
                 raise ValueError(f"{name} must be a non-empty string")
 
+        # Issue #123: validated entry by entry at load, because an exemption
+        # the gate could not read exactly is a lock silently weakened.
+        scope_lock_exempt = normalize_entries(
+            _string_list(raw.get("scope_lock_exempt", cls.scope_lock_exempt), "scope_lock_exempt")
+        )
+        for entry in scope_lock_exempt:
+            _validate_scope_lock_exempt_entry(entry)
+
         # NOT stripped: the convention's trailing space (`autodev: `) is load-
         # bearing, so only an all-whitespace prefix is rejected. An empty prefix
         # would make EVERY Body of Work a release feed.
@@ -1730,6 +1839,7 @@ class Config:
             release_blocked_floor_days=floor_days,
             marker_key=marker_key,
             scope_key=scope_key,
+            scope_lock_exempt=scope_lock_exempt,
             alissa_endpoint=raw.get("alissa_endpoint", cls.alissa_endpoint),
             ledger_path=Path(ledger_path).expanduser() if ledger_path else None,
             close_loop_enabled=close_loop_enabled,

{alissa_tools_github_orcloop-0.18.2 → alissa_tools_github_orcloop-0.18.4}/src/main/alissa/tools/github/orcloop/loop.py

@@ -510,7 +510,7 @@ from .alissa_client import (
     TaskRow,
     row_for_task,
 )
-from .config import FEED_BOW, Config, is_repo_name
+from .config import FEED_BOW, SCOPE_EXEMPT_SUBTREE, Config, is_repo_name
 from .ghclient import (
     CloseWalk,
     GitHub,
@@ -1869,14 +1869,88 @@ def _newest_at(reviews: Sequence[Review]) -> float:
     return max((r.submitted_epoch or 0.0 for r in reviews), default=0.0)
 
 
-def scopes_disjoint(first: list[str], second: list[str]) -> bool:
+def scope_lock_exempt_covers(entry: str, exempt: str) -> bool:
+    """Whether the exempt glob covers a scope entry ENTIRELY (issue #123).
+
+    The direction matters: exemption WEAKENS the lock, so where `globs_overlap`
+    says "overlap" when unsure, this says "not covered" when unsure. It reads
+    the two shapes `config._validate_scope_lock_exempt_entry` admits and
+    nothing else:
+
+    * a subtree `<dir>/**` covers `<dir>` itself and every entry whose text
+      lies under `<dir>/` -- `convex/_generated/api.d.ts`,
+      `convex/_generated/**`, `convex/_generated/sub/*.ts`;
+    * a literal path covers that path and anything under it.
+
+    `convex/**` is NOT covered by `convex/_generated/**`: it claims far more
+    than the exempt part, and dropping it would unlock `convex/schema.ts`.
+    Neither is `convex/_gen*/**` -- its literal prefix stops short of the
+    exempt root, so what it matches cannot be known from the text."""
+    if exempt.endswith(SCOPE_EXEMPT_SUBTREE):
+        root = exempt[: -len(SCOPE_EXEMPT_SUBTREE)]
+    else:
+        root = exempt
+    return entry == root or entry.startswith(root + "/")
+
+
+def _exempt_entry(entry: str, exempt: Sequence[str]) -> bool:
+    """Whether some exempt glob covers this scope entry entirely."""
+    return any(scope_lock_exempt_covers(entry, glob) for glob in exempt)
+
+
+def scopes_disjoint(
+    first: list[str], second: list[str], exempt: Sequence[str] = (),
+) -> bool:
     """Whether two `Autonomous-Scope` glob lists are safe to run in parallel.
 
     A scopeless (empty) side occupies the whole lane, so it is disjoint from
-    nothing. Otherwise disjoint iff no glob pair overlaps."""
+    nothing. Otherwise disjoint iff no glob pair overlaps -- except a pair
+    whose entries BOTH lie inside an `exempt` glob (issue #123: a regenerable
+    path is a pure function of the code, so two lanes that both declare it
+    never truly conflict on it). Every exempt entry is set aside from both
+    sides that way, and only that way: a non-exempt entry keeps its WHOLE
+    claim, the exempt region included, so `convex/**` still conflicts with
+    `convex/_generated/**` -- the wider lane declared it may touch the
+    generated tree by a glob the exemption does not cover, and partial
+    coverage is not exemption. A scope whose every entry is exempt is
+    therefore disjoint from every scope that does not claim the exempt region
+    non-exemptly: it declared paths, and each is one the lock does not
+    protect. That is the opposite of scopeless, which is decided first, on
+    the scopes as declared, so exemption can never turn a narrowly scoped
+    lane into a whole-lane lock. With no exemptions no entry is exempt and
+    this is bit for bit the pre-#123 predicate."""
     if not first or not second:
         return False
-    return not any(globs_overlap(one, two) for one in first for two in second)
+    return not any(
+        globs_overlap(one, two)
+        and not (_exempt_entry(one, exempt) and _exempt_entry(two, exempt))
+        for one in first for two in second
+    )
+
+
+def scope_lock_exemptions_used(
+    first: list[str], second: list[str], exempt: Sequence[str],
+) -> tuple[str, ...]:
+    """The exempt globs that set an overlap aside between two scopes -- the
+    ones a decision line names (issue #123). An exempt glob is "used" when a
+    pair of exempt entries overlaps and it covers one of them; an exemption
+    that covered nothing in conflict changed nothing and is not named. Config
+    order, no duplicates. A scopeless side uses none: it is never compared."""
+    if not first or not second or not exempt:
+        return ()
+    used: list[str] = []
+    for one in first:
+        for two in second:
+            if not globs_overlap(one, two):
+                continue
+            if not (_exempt_entry(one, exempt) and _exempt_entry(two, exempt)):
+                continue
+            for glob in exempt:
+                if glob not in used and (
+                    scope_lock_exempt_covers(one, glob) or scope_lock_exempt_covers(two, glob)
+                ):
+                    used.append(glob)
+    return tuple(used)
 
 
 def queue_by_target(
@@ -2688,10 +2762,14 @@ class Orchestrator:
             claims.setdefault((issue.repo, issue.claim), set()).add(issue.slug)
         for (repo, claim), slugs in claims.items():
             occupant = [] if claim == SCOPELESS_CLAIM else claim.split(" ")
+            # Under the same exemptions the gate applied (issue #123): an
+            # overlap on regenerable paths alone held nobody, so it is not
+            # pressure on the claim and the conflict view must not show it.
+            exempt = self.config.scope_lock_exemptions(repo)
             queued = sum(
                 1 for member in held
                 if member.bow_key == repo
-                and not scopes_disjoint(list(member.scope), occupant)
+                and not scopes_disjoint(list(member.scope), occupant, exempt)
             )
             self.workplan.record_lane(repo, claim, sorted(slugs), queued=queued)
 
@@ -4890,6 +4968,10 @@ class Orchestrator:
                 f"lane {target} occupied: {lane_reason}{note}",
                 task.task_number,
             ))
+        # Issue #123: a release the exemption admitted says so, because the
+        # overlap it set aside is exactly what an operator reading the log
+        # beside the in-flight scopes would otherwise expect to have held.
+        note += self._lane_exemption_note(target, scope, occupancy)
 
         # Issue #78: what a scopeless release is about to cost. Computed here
         # because this is the one point where the RESOLVED target and the pass's
@@ -4973,7 +5055,10 @@ class Orchestrator:
     ) -> str | None:
         """Why the target repo's lane cannot take this release now, or None to
         admit it. Checks the parallelism cap, the scopeless-occupies-the-lane
-        rule, and pairwise scope disjointness against the in-flight occupants."""
+        rule, and pairwise scope disjointness against the in-flight occupants
+        -- under the repo's scope-lock exemptions (issue #123), which the
+        reason names when an exempt overlap was set aside beside the real one
+        (`_lane_exemption_note` is the release-side counterpart)."""
         occupants = occupancy.get(target, [])
         if len(occupants) >= self.config.repo_parallelism:
             return (
@@ -4987,14 +5072,41 @@ class Orchestrator:
                     f"issue(s) are in-flight"
                 )
             return None
+        exempt = self.config.scope_lock_exemptions(target)
         for occupant in occupants:
-            if not scopes_disjoint(scope, occupant):
+            if not scopes_disjoint(scope, occupant, exempt):
+                used = scope_lock_exemptions_used(scope, occupant, exempt)
+                ignored = (
+                    f" (overlap on exempt paths set aside: {', '.join(used)}; "
+                    f"the conflict is on the rest)" if used else ""
+                )
                 return (
                     f"scope {scope} conflicts with in-flight scope "
-                    f"{occupant or '(scopeless — whole lane)'}"
+                    f"{occupant or '(scopeless — whole lane)'}{ignored}"
                 )
         return None
 
+    def _lane_exemption_note(
+        self, target: str, scope: list[str], occupancy: dict[str, list[list[str]]]
+    ) -> str:
+        """The narration for a release the scope-lock exemption ADMITTED
+        (issue #123): ` (overlap only on exempt paths: <globs>)` when some
+        occupant overlapped this scope on exempt paths alone, else ``. Called
+        only after `_lane_blocked` admitted the release, so every overlap left
+        is an exempt one; with no exemptions configured it is always empty,
+        which keeps the unset log bit for bit."""
+        exempt = self.config.scope_lock_exemptions(target)
+        if not exempt or not scope:
+            return ""
+        used: list[str] = []
+        for occupant in occupancy.get(target, []):
+            for glob in scope_lock_exemptions_used(scope, occupant, exempt):
+                if glob not in used:
+                    used.append(glob)
+        if not used:
+            return ""
+        return f" (overlap only on exempt paths: {', '.join(used)})"
+
     def _trailer_dedupe(
         self,
         task: Task,
@@ -5165,7 +5277,9 @@ class Orchestrator:
         labeled = self.config.label in issue.labels
         if not labeled:
             lane_reason = self._lane_blocked(target, issue_scope, occupancy)
-            if lane_reason is not None:
+            if lane_reason is None:
+                issue_note += self._lane_exemption_note(target, issue_scope, occupancy)
+            else:
                 if not issue_scope:
                     # A scopeless issue needs an EMPTY lane, so this hold does
                     # not clear when one occupant closes -- it clears when the

{alissa_tools_github_orcloop-0.18.2 → alissa_tools_github_orcloop-0.18.4}/src/main/alissa/tools/github/orcloop/merge.py

@@ -84,14 +84,24 @@ messages). The gate, in order:
 10. `dry_run` -> SKIPPED "would merge …", no writes -- the floor included.
 9b. The FLOOR (issue #116, L3), only for a merge the policy downgraded from
     an operator hold: BEFORE the merge call, once per (pr, head) (ledger
-    `merge:floor:<pr>:<head7>`), a comment on the origin Alissa task naming
-    the class and the reason, and a committed `Validate after merge`
-    downstream task owned by the origin's reporter. Either write failing ->
-    SKIPPED "floor not posted", retried next poll. Never a merge without
-    the page. Three rows keep the retry from repeating a write that landed:
-    the comment's, the task's (`merge:floor-task:<pr>:<head7>:<taskId>`,
-    written the moment the create returns, so a failed read-back or status
-    set never creates a second task), and the floor's.
+    `merge:floor:<pr>:<head7>`), a comment on the origin Alissa task saying
+    the policy IS MERGING past the gate (class and reason), and a committed
+    `Validate after merge` downstream task OWNED BY THE CALLING ACTOR -- the
+    fleet actor, the identity that owns every fed task (issue #120: the API's
+    owner-assign gate refuses the fleet actor seating the origin's reporter
+    as owner, so the reporter is reached through the origin task, which is
+    the parent of the floor task and carries the floor comment). A write
+    failing TRANSIENTLY (5xx, 429, transport) -> SKIPPED "floor not posted",
+    retried next poll. A write failing PERMANENTLY (a 4xx that is not
+    transient: 403, 404, 422) -> one escalation comment on the origin task
+    (`merge:floor-failed:<pr>:<head7>`) saying the PR needs a human merge
+    until the floor can be written, one WARNING (L4), and every later poll
+    on this head is a quiet SKIP that writes nothing; a new head is a new
+    episode. Never a merge without the page. Three rows keep the retry from
+    repeating a write that landed: the comment's, the task's
+    (`merge:floor-task:<pr>:<head7>:<taskId>`, written the moment the create
+    returns, so a failed read-back or status set never creates a second
+    task), and the floor's.
 11. Merge: `PUT /pulls/{n}/merge` with the configured method and
     `sha=head_sha` -- the guard that makes GitHub refuse (405/409) when the
     head moved between our reads and the merge; a refusal is SKIPPED and
@@ -133,7 +143,7 @@ from functools import lru_cache
 from typing import Callable, Sequence
 
 from . import loop_events
-from .alissa_client import AlissaClient, AlissaError
+from .alissa_client import AlissaClient, AlissaError, AlissaTransient
 from .config import MERGE_POLICY_YOLO, MERGE_READINESS_CLASSES, Config
 from .ghclient import (
     CheckSummary,
@@ -249,6 +259,18 @@ def policy_verdict(config: Config, klass: str | None) -> tuple[bool, str]:
     return (False, f"policy yolo holds class {klass} (in neither class list)")
 
 
+def floor_failure_is_permanent(exc: AlissaError) -> bool:
+    """Is this floor write refused for GOOD (issue #120) -- a 4xx that is not a
+    retry-later signal? 403 (the owner-assign gate, a missing role), 404 (the
+    origin task is gone or invisible), 422 (a payload the API refuses) do not
+    heal between polls; retrying them costs a WARNING and a refused write per
+    poll for as long as the head is approved. `AlissaTransient` (408/429/5xx
+    and transport failures, status 0) is excluded by CLASS, so the client's
+    taxonomy and this predicate cannot drift; a status-0 base error (the
+    create answered no `taskId`) is a malformed answer, retried too."""
+    return not isinstance(exc, AlissaTransient) and 400 <= exc.status < 500
+
+
 # --- hard-stop path globs ----------------------------------------------------
 #
 # `fnmatch` has no `**`: `*` there crosses `/`, so `**/migrations/**` and
@@ -358,11 +380,16 @@ HELD_KIND_PREFIX = MERGE_KIND_PREFIX + "held:"            # merge:held:<why>:<pr
 # a failed read-back or status set finishes THAT task instead of creating a
 # second (PR #117 round 1); the floor row is the one the merge reads. A
 # fourth, `floor-unmerged`, is the once-per-head correction the origin task
-# gets when the merge call it was paged about is then refused.
+# gets when the merge call it was paged about is then refused. A fifth,
+# `floor-failed` (issue #120), is the once-per-head escalation a floor write
+# that failed PERMANENTLY (a non-transient 4xx) leaves: its row is what keeps
+# every later poll on that head a quiet SKIP instead of a WARNING and a
+# refused write per poll.
 FLOOR_KIND_PREFIX = MERGE_KIND_PREFIX + "floor:"          # merge:floor:<pr>:<head7>
 FLOOR_COMMENT_KIND_PREFIX = MERGE_KIND_PREFIX + "floor-comment:"  # merge:floor-comment:<pr>:<head7>
 FLOOR_TASK_KIND_PREFIX = MERGE_KIND_PREFIX + "floor-task:"  # merge:floor-task:<pr>:<head7>:<taskId>
 FLOOR_UNMERGED_KIND_PREFIX = MERGE_KIND_PREFIX + "floor-unmerged:"  # merge:floor-unmerged:<pr>:<head7>
+FLOOR_FAILED_KIND_PREFIX = MERGE_KIND_PREFIX + "floor-failed:"  # merge:floor-failed:<pr>:<head7>
 
 # The hold reasons, as the short slugs the ledger kind and the event key carry.
 HOLD_OPERATOR = "operator"
@@ -422,10 +449,14 @@ MERGED_BY_POLICY_COMMENT = (
     "on {task_ref} as a comment and a `Validate after merge` task before the merge."
 )
 # The floor (issue #116, L3): what the origin task reads BEFORE the merge call
-# when the policy downgrades an operator hold. The wording is the issue's.
+# when the policy downgrades an operator hold. The wording is issue #120's: it
+# is posted before the merge call, so it says the merge IS HAPPENING -- the
+# earlier "merged" read false at posting time and stayed false whenever the
+# floor's second write then failed.
 FLOOR_TASK_COMMENT = (
-    "**Merge policy {policy} merged PR #{pr} with an open operator gate** — "
-    "{klass}: {reason}. Validate this before validating the task. ({url})"
+    "**Merge policy `{policy}` is merging PR #{pr} with an open operator gate** — "
+    "{klass}: {reason}. A `Validate after merge` task follows this comment; "
+    "validate that before validating this task. ({url})"
 )
 FLOOR_TASK_TITLE = "Validate after merge: {reason}"
 FLOOR_TASK_DOD = (
@@ -433,14 +464,31 @@ FLOOR_TASK_DOD = (
     "has been validated by a human after the merge, and the outcome is recorded "
     "on this task."
 )
+# Owner: the calling actor (issue #120). The API defaults the owner of a
+# downstream task to the caller, and the caller is the fleet actor -- the one
+# identity that owns every task the loop feeds. The origin's reporter is not
+# seated (the owner-assign gate refuses it) and does not need to be: the human
+# validates the ORIGIN task, which is this task's parent and carries the floor
+# comment; this row exists so the item cannot vanish.
 FLOOR_TASK_DESCRIPTION = (
-    "The orchestrator's merge edge merged {pr_url} under merge policy `{policy}` "
+    "The orchestrator's merge edge is merging {pr_url} under merge policy `{policy}` "
     "although the reviewer's approve read `Merge-Readiness: operator — {klass}: "
-    "{reason}`. The class is in `merge_yolo_merge_classes`, so the merge did not "
+    "{reason}`. The class is in `merge_yolo_merge_classes`, so the merge does not "
     "wait -- but the gate is still open: validate it before validating the origin "
-    "task.\n\nAlissa-Task: {task_ref}"
+    "task. Owner: the fleet actor; the human validates the ORIGIN task — this row "
+    "exists so the item cannot vanish.\n\nAlissa-Task: {task_ref}"
 )
 FLOOR_TASK_CRITERION = "The open operator gate ({klass}) has been validated by a human after the merge."
+# The escalation (issue #120): a floor write refused for good -- a 4xx that is
+# not transient, the owner-assign gate's 403 being the one that was seen in
+# production -- is not a next-poll retry. Once per (pr, head), on the origin
+# task, naming the HTTP error; the merge edge then leaves this head alone.
+FLOOR_FAILED_TASK_COMMENT = (
+    "**Merge policy `{policy}` cannot write the validation floor for PR #{pr} on "
+    "`{head7}`** — {detail}. This PR needs a human merge until the floor can be "
+    "written; the merge edge skips this head without retrying (a new head is a "
+    "new attempt). ({url})"
+)
 # The correction (PR #117 round 1): the floor is worded as the issue words it
 # and posted BEFORE the merge call, so a refused merge leaves the origin task
 # paged about a merge that did not happen. Once per (pr, head), best-effort.
@@ -941,10 +989,21 @@ class MergeEdge:
     ) -> "MergeDecision | None":
         """Page the origin task about the gate the policy is about to merge
         past: one comment, then one committed `Validate after merge`
-        downstream task owned by the origin's reporter -- BEFORE the merge
-        call, once per (pr, head). None when the floor stands (posted now or
-        on an earlier poll for this head); a SKIPPED decision when any write
-        failed, so this poll merges nothing and the next retries the floor.
+        downstream task owned by the calling actor (issue #120) -- BEFORE the
+        merge call, once per (pr, head). None when the floor stands (posted
+        now or on an earlier poll for this head); a SKIPPED decision when any
+        write failed: a TRANSIENT failure (5xx, 429, transport) is retried
+        next poll; a PERMANENT one (a 4xx that is not transient -- 403, 404,
+        422) is escalated once on the origin task and every later poll on
+        this head is a quiet SKIP (`_floor_failed`).
+
+        The task's owner is whoever the API defaults to -- the caller, i.e.
+        the fleet actor. `assign_to_actor_id` is deliberately NOT passed: the
+        owner-assign gate refuses the fleet actor seating another actor as
+        owner ("Only a team admin can seat another member as owner; pass
+        teamSlug"), which is what kept every yolo merge skipped forever
+        (issue #120). The reporter still sees the floor through the origin
+        task, this task's parent, which carries the floor comment.
 
         Three ledger rows: the comment's lands after the comment so a failed
         task create does not re-post it; the task's -- carrying the created
@@ -957,6 +1016,14 @@ class MergeEdge:
         floor_kind = f"{FLOOR_KIND_PREFIX}{pr.number}:{pr.head7}"
         if self.state.escalated(candidate.task_number, floor_kind):
             return None
+        failed_kind = f"{FLOOR_FAILED_KIND_PREFIX}{pr.number}:{pr.head7}"
+        if self.state.escalated(candidate.task_number, failed_kind):
+            # Escalated on an earlier poll: quiet, no write, no WARNING (L4).
+            return self._skipped(
+                candidate,
+                f"{pr.pr_slug}: floor failed for good on {pr.head7} (escalated on {ref}) — "
+                f"needs a human merge; a new head retries",
+            )
         if self.alissa is None:
             return self._skipped(
                 candidate,
@@ -973,15 +1040,7 @@ class MergeEdge:
                 self.state.record_escalation(candidate.task_number, comment_kind, at=now)
             task_id = self._floor_task_id(candidate, task_prefix)
             if task_id is None:
-                # The reporter owns the validation: read it off the origin
-                # task. A payload without one falls back to the calling actor
-                # (the API's own default) and says so in the log.
-                origin = self.alissa.get_task(ref)
-                if not origin.reporter_id:
-                    log.warning(
-                        "merge: %s carries no reporterId — the validation task defaults to the "
-                        "daemon's own actor", ref,
-                    )
+                # No owner override (issue #120): the API seats the caller.
                 task_id = self.alissa.create_downstream_task(
                     ref,
                     title=FLOOR_TASK_TITLE.format(reason=reason or klass)[:200],
@@ -995,7 +1054,6 @@ class MergeEdge:
                         "id": "vc-1", "type": "manual",
                         "description": FLOOR_TASK_CRITERION.format(klass=klass),
                     }],
-                    assign_to_actor_id=origin.reporter_id,
                 )
                 # The task exists from here on: its row lands BEFORE the
                 # read-back and the status set, so a failure in either
@@ -1010,6 +1068,8 @@ class MergeEdge:
             if created.status != "committed":
                 self.alissa.set_status(task_id, "committed")
         except AlissaError as exc:
+            if floor_failure_is_permanent(exc):
+                return self._floor_failed(candidate, now, exc=exc, kind=failed_kind)
             log.warning(
                 "merge: floor on %s for %s not posted (%s) — merge skipped this poll",
                 ref, pr.pr_slug, exc,
@@ -1037,6 +1097,38 @@ class MergeEdge:
         task_id = str(rows[0]["kind"])[len(task_prefix):]
         return task_id or None
 
+    def _floor_failed(
+        self, candidate: MergeCandidate, now: int, *, exc: AlissaError, kind: str,
+    ) -> MergeDecision:
+        """A floor write refused for good (issue #120): one escalation comment
+        on the origin task naming the HTTP error, one WARNING, the
+        `merge:floor-failed:<pr>:<head7>` row -- and SKIPPED. The row is what
+        makes every later poll on this head a quiet SKIP before any write
+        (`_floor`'s second check). The comment is best-effort in the same
+        sense as the correction: one that did not post leaves no row, so the
+        next poll escalates again (and re-tries the floor, which fails the
+        same way) until the page lands -- an escalation that never posted is
+        not an escalation."""
+        pr = candidate.pr
+        ref = candidate.ref
+        log.warning(
+            "merge: floor on %s for %s failed for good (%s) — escalated once, this head "
+            "needs a human merge; skipped quietly from here on",
+            ref, pr.pr_slug, exc,
+        )
+        posted = self._task_comment(candidate, FLOOR_FAILED_TASK_COMMENT.format(
+            policy=self.config.merge_policy, pr=pr.number, head7=pr.head7, detail=exc,
+            url=pr.url or pr.pr_slug,
+        ))
+        if posted:
+            self.state.record_escalation(candidate.task_number, kind, at=now)
+        return self._skipped(
+            candidate,
+            f"{pr.pr_slug}: floor failed for good on {ref} ({exc}) — escalated"
+            + ("" if posted else " (escalation comment pending — retries next poll)")
+            + ", needs a human merge; a new head retries",
+        )
+
     def _floor_unmerged(self, candidate: MergeCandidate, now: int, *, detail: str) -> None:
         """The correction the origin task gets when the merge call fails on a
         head it was paged about: once per (pr, head), best-effort (a comment

alissa_tools_github_orcloop-0.18.4/src/main/alissa/tools/github/orcloop/version

@@ -0,0 +1 @@
+0.18.4

{alissa_tools_github_orcloop-0.18.2 → alissa_tools_github_orcloop-0.18.4}/src/main/alissa/tools/github/orcloop/workplan.py

@@ -2122,8 +2122,10 @@ def _queued_behind(card: Card, lanes: Sequence[LaneRow], today: str) -> int:
     """How many members are queued behind THIS card's lane claim today.
 
     Read straight off the lane map rather than recounted: `record_lane` computes
-    the pressure with `scopes_disjoint`, the same predicate the lane gate
-    refuses on, so a leverage figure and the holds behind it cannot disagree
+    the pressure with `scopes_disjoint` under the repo's scope-lock exemptions
+    (issue #123: an overlap on exempt, regenerable paths alone is not a
+    conflict here either), the same predicate the lane gate refuses on, so a
+    leverage figure and the holds behind it cannot disagree
     (the rule [[o21-workplan-console]] learned the hard way -- two definitions of
     one word is a bug even when both are right).
 

{alissa_tools_github_orcloop-0.18.2 → alissa_tools_github_orcloop-0.18.4}/src/main/alissa/tools/github/orcloop/workplan_html.py

@@ -103,8 +103,10 @@ QUEUE_GUIDE = (
 LANE_GUIDE = (
     "Rows are SCOPE CLAIMS, not directories: each is an `Autonomous-Scope` "
     "value some released issue declared. Two rows that overlap are a conflict "
-    "— that is what the lane gate refuses. ▲ N is queue pressure: committed "
-    "feed members held behind that claim on that day."
+    "— that is what the lane gate refuses — unless the overlap is only on a "
+    "regenerable path the operator exempted from the lock "
+    "(`scope_lock_exempt`; an overlap between two exempt entries is set aside). ▲ N is "
+    "queue pressure: committed feed members held behind that claim on that day."
 )
 
 _STAGE_HINTS: dict[Stage, str] = {

{alissa_tools_github_orcloop-0.18.2 → alissa_tools_github_orcloop-0.18.4/src/main/alissa_tools_github_orcloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-orcloop
-Version: 0.18.2
+Version: 0.18.4
 Summary: ALISSA-TOOLS-GITHUB-ORCLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_orcloop-0.18.2/src/main/alissa/tools/github/orcloop/version

@@ -1 +0,0 @@
-0.18.2