alissa-tools-github-revloop 0.26.0__tar.gz → 0.27.0__tar.gz

{alissa_tools_github_revloop-0.26.0/src/main/alissa_tools_github_revloop.egg-info → alissa_tools_github_revloop-0.27.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.26.0
+Version: 0.27.0
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_revloop-0.26.0 → alissa_tools_github_revloop-0.27.0}/src/main/alissa/tools/github/revloop/loop.py

@@ -1523,10 +1523,11 @@ class StabilityNotice:
     The bookkeeping travels WITH the text rather than being written when the
     gate decides, because the two are not the same event: the gate runs above
     the CI gate and `_ensure_hub`, either of which can still refuse the round.
-    Writing `lifts` there would spend an operator's re-entry grant on a round
-    that was never queued -- and the grant is the only thing that can lift the
-    hold, so spending one silently is the one bookkeeping error this guard
-    cannot afford.
+    Writing `grants_seen` there would spend an operator's re-entry grant on a
+    round that was never queued -- and the grant is the only thing that can lift
+    the hold, so spending one silently is the one bookkeeping error this guard
+    cannot afford. The seed strengthens that: a gate-time write would also seed
+    a fresh episode's ledger off a round the reviewer never received.
     """
 
     text: str
@@ -2319,9 +2320,19 @@ class ReviewWatcher:
         # capped out at 10, was granted +5, and went tests-only at round 13
         # would get five "grace" rounds and no hold -- the guard disarmed on
         # exactly the shape issue #105 cites (PR #106 round 1, minor). After the
-        # seed the predicate means what it should: only an ack posted AFTER this
-        # guard last spoke can lift the hold. Either way the write happens only
-        # once `_spawn` has actually queued the round.
+        # seed the predicate means what it should: only an ack THE LEDGER DID
+        # NOT ALREADY KNOW ABOUT can lift the hold. Deliberately not "posted
+        # after this guard last spoke", which claims more than the code
+        # enforces -- the seed reads `granted_rounds`, i.e. acks already
+        # collected into state, and `_collect_acks` runs from exactly two places
+        # (the cap-out branch and the `graced` branch here). So an ack posted
+        # while the loop is below its cap with no episode open is not recorded
+        # when it is posted; it is first discovered by a later `graced` scan and
+        # lifts the hold despite predating the notice. That is the doctrine
+        # working -- nothing consumed that grant, so it is genuinely unspent,
+        # and it errs toward extra rounds rather than a false hold (PR #106
+        # round 2, nit). Either way the write happens only once `_spawn` has
+        # actually queued the round.
         notice = STABILITY_NOTICE.format(
             base=base[:8],
             head=pr.head_sha[:8],

alissa_tools_github_revloop-0.27.0/src/main/alissa/tools/github/revloop/version

@@ -0,0 +1 @@
+0.27.0

{alissa_tools_github_revloop-0.26.0 → alissa_tools_github_revloop-0.27.0}/src/main/alissa/tools/github/revloop/webui/__init__.py

@@ -5,10 +5,12 @@ budget of its own beyond two cached checks.
 Ported from the devloop's worker console (`alissa.tools.github.devloop.webui`,
 its PR #38) and adapted to reviewer semantics: the unit of work is a PR round,
 not an issue attempt, so the pipeline board is PR-centric (PR ref → round k of
-the cap → session → stage), the operator inbox pages cap-outs and stalled
-deferrals, and there is no worker-tasks panel (reviewers create no tasks) and
-no maintenance edge. Module shapes are copied deliberately -- family precedent
-is copy-adapt per repo; a shared-webui package is a separate, deferred lane.
+the cap → session → stage), the operator inbox pages cap-outs, stalled
+deferrals and stability holds, split live from settled so a page whose PR has
+left the newest poll's candidate set files itself away, and there is no
+worker-tasks panel (reviewers create no tasks) and no maintenance edge. Module
+shapes are copied deliberately -- family precedent is copy-adapt per repo; a
+shared-webui package is a separate, deferred lane.
 
 The daemon (loop.py) already persists everything the console needs: every poll
 pass writes one `poll_snapshots` row (UI-1, PR #35) carrying the pass timing,

{alissa_tools_github_revloop-0.26.0 → alissa_tools_github_revloop-0.27.0}/src/main/alissa/tools/github/revloop/webui/page.py

@@ -244,6 +244,13 @@ td.num, th.num { text-align: right; font-variant-numeric: tabular-nums; }
 .inbox-kind { font-family: var(--mono); font-size: 0.75rem; color: var(--status-blocked); }
 .inbox-kind.cap-out { color: var(--status-cancelled); }
 .inbox-kind.stability-held { color: var(--status-cancelled); }
+.inbox-settled > summary { cursor: pointer; list-style: none; padding: 0.55rem 0;
+  border-top: 1px solid var(--surface-border); color: var(--text-muted);
+  font-family: var(--mono); font-size: 0.75rem; }
+.inbox-settled > summary::-webkit-details-marker { display: none; }
+.inbox-settled .inbox-item { opacity: 0.55; }
+.inbox-note { color: var(--text-muted); font-size: 0.75rem; font-family: var(--mono);
+  padding: 0.55rem 0; border-top: 1px solid var(--surface-border); }
 .log {
   font-family: var(--mono); font-size: 0.75rem; line-height: 1.55;
   color: var(--text-tertiary); background: var(--bg-primary);
@@ -504,16 +511,60 @@ _JS = r"""
     });
   }
 
-  function renderInbox(items) {
-    if (!items.length) { el('inbox').innerHTML = '<div class="empty">Inbox clear.</div>'; return; }
-    el('inbox').innerHTML = items.map(function (it) {
-      return '<div class="inbox-item"><span>' +
-        '<span class="inbox-kind ' + esc(it.kind) + '">' + esc(it.kind) + '</span> ' +
-        '<a href="' + esc(it.url) + '" target="_blank" rel="noopener">' +
-        esc(it.repo_slug) + '#' + esc(it.number) + '</a>' +
-        (it.detail ? ' <span class="muted mono">' + esc(it.detail) + '</span>' : '') +
-        '</span><span class="muted num">' + dur(it.age_seconds) + '</span></div>';
-    }).join('');
+  function inboxRow(it) {
+    return '<div class="inbox-item"><span>' +
+      '<span class="inbox-kind ' + esc(it.kind) + '">' + esc(it.kind) + '</span> ' +
+      '<a href="' + esc(it.url) + '" target="_blank" rel="noopener">' +
+      esc(it.repo_slug) + '#' + esc(it.number) + '</a>' +
+      (it.detail ? ' <span class="muted mono">' + esc(it.detail) + '</span>' : '') +
+      '</span><span class="muted num">' + dur(it.age_seconds) + '</span></div>';
+  }
+
+  // Two lists, one panel. `items` is what the operator still owes; `settled`
+  // is pages whose PR has left the poll's candidate set (merged, closed, or
+  // the review request withdrawn) -- exhaust, so it rides behind a collapsed
+  // <details> and never displaces the empty state. An inbox whose live half
+  // is empty says "Inbox clear." even with a hundred settled rows behind it:
+  // that is the whole point of the split.
+  function renderInbox(items, settled, truncated, dropped) {
+    settled = settled || [];
+    dropped = dropped || 0;
+    // The panel re-renders every poll and the innerHTML assignment below
+    // destroys this subtree, taking the <details> node with it -- and its
+    // `open` is the OPERATOR's state, not the payload's. So read it off the
+    // live node first and fold it back into the string being built, rather
+    // than re-applying it after the write (which would flash the footer shut
+    // for a frame on every poll). No prior node -- the first render, or an
+    // inbox that had nothing settled last time -- reads false, which is how
+    // collapsed-by-default survives this: the `open` here is never
+    // unconditional. Fifty rows are not readable in ten seconds.
+    var prior = el('inbox').querySelector('details.inbox-settled');
+    var open = !!(prior && prior.open);
+    // `Inbox clear.` is a positive claim that nothing is owed, so it may only
+    // be made off a COMPLETE read. When a ledger read came back at its bound
+    // there are older rows nobody looked at, and the panel says that instead.
+    var empty = truncated
+      ? 'No live pages in the ledger window read — it was truncated, so an older page may still be outstanding.'
+      : 'Inbox clear.';
+    var body = items.length ? items.map(inboxRow).join('')
+      : '<div class="empty">' + empty + '</div>';
+    // A truncated read qualifies the LIST as much as its absence: a partial
+    // list of live pages reads as complete unless the panel says otherwise,
+    // so the qualifier rides with the rows and not only with the empty state.
+    if (items.length && truncated) {
+      body += '<div class="inbox-note">ledger window truncated — older pages were not read</div>';
+    }
+    if (settled.length) {
+      // Two true numbers, not one: `settled.length` is what expanding the
+      // footer actually reveals, and `dropped` is what the per-half cap left
+      // out of the payload -- a drop that happens well inside a read that
+      // never hit its bound, so `truncated` does not cover it.
+      body += '<details class="inbox-settled"' + (open ? ' open' : '') + '><summary>' +
+        settled.length + ' settled' +
+        (dropped ? ' (+' + dropped + ' not shown)' : '') + ' — show</summary>' +
+        settled.map(inboxRow).join('') + '</details>';
+    }
+    el('inbox').innerHTML = body;
   }
 
   function act(url, body, btn) {
@@ -614,7 +665,8 @@ _JS = r"""
     sparkline(el('spark-duration'), d.sparklines.poll_duration_ms);
     sparkline(el('spark-active'), d.sparklines.active_sessions);
     renderPipeline(d.pipeline);
-    renderInbox(d.inbox);
+    renderInbox(d.inbox, d.inbox_settled, d.inbox_truncated,
+                d.inbox_settled_dropped);
     renderSessions(d.sessions);
     renderTopProcs(d.top_procs);
     renderLog(d.log);

{alissa_tools_github_revloop-0.26.0 → alissa_tools_github_revloop-0.27.0}/src/main/alissa/tools/github/revloop/webui/sources.py

@@ -103,6 +103,28 @@ INBOX_STABILITY = "stability-held"
 # clears stops being an inbox. The ping read applies the kind filter in SQL, so
 # this counts pages and not the telemetry rows interleaved with them.
 INBOX_LIMIT = 50
+# How many rows each ledger read materialises for the live/settled split to
+# choose from. It has to be WIDER than what is rendered. The split picks from
+# whatever the read returned, so reading exactly INBOX_LIMIT rows would make
+# the live half not "every live page, capped at INBOX_LIMIT" but "the live
+# pages that happen to be among the newest INBOX_LIMIT rows of a never-pruned
+# store" -- and a full window of settled rows would empty it while a page is
+# outstanding, which is the failure this whole split exists to prevent, reached
+# from the other side. Four windows deep gives the live half room to fill past
+# a long run of settled rows (`escalations` is keyed per head, so one PR that
+# caps out across five pushes spends five slots). The read is still bounded, so
+# the never-pruned tables still cannot grow an unbounded payload, and what
+# reaches the page is capped at INBOX_LIMIT per half exactly as before. A wider
+# window is still a window, so `inbox_truncated` covers the residual case.
+INBOX_READ_LIMIT = INBOX_LIMIT * 4
+# How many poll intervals a freshly raised page is live for regardless of the
+# snapshot. The liveness test reads the LATEST snapshot, so a page raised
+# between two passes has no snapshot to appear in yet and would flicker into
+# `settled` for one refresh; two intervals covers the raise-to-next-pass gap
+# with a pass to spare. Erring long is the safe direction -- the failure this
+# split exists to prevent is an operator skipping the inbox, and a settled row
+# shown one refresh too long costs nothing.
+INBOX_LIVE_GRACE_INTERVALS = 2
 # The kind prefix that makes a ping row an operator page. `read_pings` matches
 # it in SQL; `_inbox` re-checks it to split the session out of the kind.
 PING_STALLED_PREFIX = f"{ESCALATION_STALLED}:"
@@ -116,6 +138,23 @@ RETRY_NO_ROW = "no ledger row"
 RETRY_UNAVAILABLE = "state unavailable"
 
 
+def _pr_key(repo: object, number: object) -> "tuple[str, int] | None":
+    """The identity the inbox and the pipeline board compare PRs by.
+
+    The two sides reach this from different stores -- an inbox row's `number`
+    comes out of sqlite, a board row's out of a snapshot's JSON -- so the key
+    is normalised rather than compared as-is, and a row too malformed to key
+    (a null number) returns None instead of raising: every read path here
+    degrades, it never blanks the dashboard.
+    """
+    if not isinstance(number, (int, str)):
+        return None
+    try:
+        return (str(repo), int(number))
+    except ValueError:
+        return None
+
+
 def is_managed(name: "str | None") -> bool:
     """Whether a tmux session belongs to this daemon's reviewer namespace.
 
@@ -257,24 +296,27 @@ class Sources:
         return self._read_state([], lambda st: st.read_snapshots(limit))
 
     def ledgers(self) -> dict:
-        """The two INBOX tables, each bounded to INBOX_LIMIT rows of the kind
-        the console pages on. The spawn ledger is deliberately not here: it is
-        a lookup table read by key, not a display list bounded by recency --
-        `sessions` reads it for exactly the session names it renders."""
+        """The two INBOX tables, each bounded to INBOX_READ_LIMIT rows of the
+        kind the console pages on -- deliberately wider than the INBOX_LIMIT
+        the payload renders, because `_inbox` splits live from settled inside
+        whatever this returns and a window of settled rows must not be able to
+        squeeze the live half out. The spawn ledger is deliberately not here:
+        it is a lookup table read by key, not a display list bounded by recency
+        -- `sessions` reads it for exactly the session names it renders."""
         empty: "dict[str, list]" = {
             "escalations": [], "pings": [], "stability_pings": []
         }
         return self._read_state(empty, lambda st: {
-            "escalations": st.read_escalations(INBOX_LIMIT),
+            "escalations": st.read_escalations(INBOX_READ_LIMIT),
             "pings": st.read_pings(
-                INBOX_LIMIT, kind_prefix=PING_STALLED_PREFIX
+                INBOX_READ_LIMIT, kind_prefix=PING_STALLED_PREFIX
             ),
             # A SECOND bounded read rather than one unfiltered one: `read_pings`
             # narrows to a single prefix in SQL so its limit bounds the rows the
             # console actually renders, and the telemetry kinds interleaved with
             # both pages would otherwise evict them.
             "stability_pings": st.read_pings(
-                INBOX_LIMIT, kind_prefix=PING_STABILITY_PREFIX
+                INBOX_READ_LIMIT, kind_prefix=PING_STABILITY_PREFIX
             ),
         })
 
@@ -542,6 +584,16 @@ class Sources:
         # and still working (in_flight) and one whose respawn is deferred
         # behind a session that still shows life (deferred).
         chrono = list(reversed(snaps))
+        # The board rows and the inbox liveness test read the SAME item set --
+        # built once, so the two panels can never disagree about which PRs the
+        # newest pass still had in hand.
+        items = self._pipeline(latest)
+        inbox = self._inbox(
+            ledgers["escalations"],
+            ledgers["pings"],
+            ledgers.get("stability_pings", []),
+            live_prs=self._live_prs(latest, items),
+        )
         sparklines = {
             "poll_duration_ms": [s["duration_ms"] for s in chrono],
             "active_sessions": [s["in_flight"] + s["deferred"] for s in chrono],
@@ -588,13 +640,23 @@ class Sources:
                 "snapshot_ts": latest["ts"] if latest else None,
                 "duration_ms": latest["duration_ms"] if latest else None,
                 "round_cap": self.config.round_cap,
-                "items": self._pipeline(latest),
+                "items": items,
             },
-            "inbox": self._inbox(
-                ledgers["escalations"],
-                ledgers["pings"],
-                ledgers.get("stability_pings", []),
-            ),
+            "inbox": inbox["live"],
+            # Exhaust, not backlog: pages whose PR has left the poll's
+            # candidate set. Kept in the payload (the operator can still audit
+            # what was raised) but out of the list that means "you owe this".
+            "inbox_settled": inbox["settled"],
+            # Post-cap on purpose: the counter has to match the rows expanding
+            # the footer actually reveals. What the cap dropped rides beside
+            # it rather than inside it, so both numbers are true of the thing
+            # they label.
+            "inbox_settled_count": len(inbox["settled"]),
+            "inbox_settled_dropped": inbox["settled_dropped"],
+            # At least one ledger read came back at its bound, so there are
+            # older rows this payload never looked at. The panel refuses to
+            # claim `Inbox clear.` on a window it knows was truncated.
+            "inbox_truncated": inbox["truncated"],
             "sessions": sessions,
             # Host-wide, not per session: when the memory tile says the charge
             # IS resident, this is what names the holder.
@@ -631,12 +693,51 @@ class Sources:
             items.append(item)
         return items
 
+    def _live_prs(
+        self, latest: "dict | None", items: "list[dict]"
+    ) -> "set[tuple[str, int]] | None":
+        """The `(repo, number)` set an inbox page must still be in to be worth
+        an operator's attention, or None when there is no evidence either way.
+
+        The daemon's newest poll pass is the oracle: every PR with a review
+        pending from the reviewer identity is a candidate, so a page whose PR
+        is absent from the latest snapshot is one that pass did not list.
+        Ordinarily that means the trigger cleared -- the PR merged, closed, or
+        the review request was withdrawn -- and nothing the console offers can
+        act on it any more. Those three are the ordinary causes, NOT the only
+        ones: `review_requests` issues a single unpaginated `search/issues`
+        call, so past its page size a pass sees an arbitrary subset, and one
+        ranked by relevance rather than age, so the subset is not even stable
+        between calls (TASK-1796886433 covers closing that ceiling), and a
+        repo dropped from `config.watches` stops being walked at all, which
+        settles its outstanding pages by operator action rather than by
+        anything the PR did. A capped
+        (or stability-held) PR that is still open keeps its review request and
+        so stays in the set: its page is exactly the one that needs a re-entry
+        ack, and it must not be filed away.
+
+        Derived from the rendered board rows rather than the raw stages, so
+        the inbox and the pipeline panel cannot disagree about what the pass
+        had in hand. None (no snapshot at all -- a fresh boot, an unreadable
+        state.db) means "no evidence", and the caller treats every row as
+        live: the same rule the daemon's liveness oracle uses for a failed
+        listing, because hiding a page on missing evidence is the one
+        unrecoverable direction.
+        """
+        if not latest:
+            return None
+        keys = (
+            _pr_key(item.get("repo_slug"), item.get("number")) for item in items
+        )
+        return {key for key in keys if key is not None}
+
     def _inbox(
         self,
         escalations: "list[dict]",
         pings: "list[dict]",
         stability_pings: "list[dict] | None" = None,
-    ) -> "list[dict]":
+        live_prs: "set[tuple[str, int]] | None" = None,
+    ) -> dict:
         """The operator inbox: everything the daemon paged a human about, in
         one list, newest first.
 
@@ -653,11 +754,44 @@ class Sources:
         process -- a caller that passed unfiltered rows still gets an inbox of
         pages only, just a shorter one.
 
-        Bounded twice over: each reader is already capped at INBOX_LIMIT rows
-        (newest first), and the merged list is capped again, so the payload
-        cannot grow without bound as the two never-pruned tables accumulate.
+        Bounded twice over: each reader is already capped at INBOX_READ_LIMIT
+        rows (newest first), and each returned list is capped again at
+        INBOX_LIMIT, so the payload cannot grow without bound as the
+        never-pruned tables accumulate.
+
+        Returns the rows split two ways -- `live` (what the operator still
+        owes) and `settled` (the PR has left the poll's candidate set, so the
+        page is exhaust). `escalations` and `pings` are dedupe key stores and
+        must never be pruned, so this read-time split is the only place the
+        distinction can be made, and it is made from the local snapshot alone:
+        a page load still costs the GitHub API nothing. A row raised less than
+        INBOX_LIVE_GRACE_INTERVALS poll intervals ago is live whatever the
+        snapshot says, and `live_prs` of None (no snapshot) means every row is
+        live -- see `_live_prs`.
+
+        `truncated` reports that at least one of the reads came back AT its
+        bound, so there are older rows the split never saw. The reason it
+        exists is the empty case: an empty `live` half off a truncated window
+        means "no live pages among the rows I read", which is not what `Inbox
+        clear.` claims. It qualifies the non-empty case too, though -- a
+        partial list of live pages reads as complete unless the panel says
+        otherwise -- so the page renders it both ways. Widening the read (see
+        INBOX_READ_LIMIT) makes truncation rare; it cannot make it impossible,
+        and a panel that positively asserts nothing is owed had better be
+        right.
+
+        `settled_dropped` is the settled rows the INBOX_LIMIT cap left out of
+        the payload. It is a second, quieter truncation than `truncated`: it
+        happens inside a read that may never have reached its bound, so the
+        flag says nothing about it, and `len(settled)` alone would understate
+        a real backlog with no signal anywhere.
         """
         now = int(self._wall())
+        grace = INBOX_LIVE_GRACE_INTERVALS * self.config.poll_interval
+        truncated = any(
+            len(rows) >= INBOX_READ_LIMIT
+            for rows in (escalations, pings, stability_pings or [])
+        )
         out: list[dict] = []
         for row in escalations:
             out.append(
@@ -707,4 +841,33 @@ class Sources:
                 }
             )
         out.sort(key=lambda item: item["age_seconds"])
-        return out[:INBOX_LIMIT]
+        live: list[dict] = []
+        settled: list[dict] = []
+        for item in out:
+            key = _pr_key(item["repo_slug"], item["number"])
+            if (
+                live_prs is None
+                or item["age_seconds"] < grace
+                # A row this cannot key is missing evidence ABOUT THE ROW, and
+                # missing evidence never hides a page -- the same rule the
+                # None snapshot gets one clause up. Filing an unkeyable row
+                # away would be the console asserting something it does not
+                # know. Low reachability (both `number` columns are INTEGER
+                # NOT NULL), so this rests on caller discipline rather than on
+                # the schema, which is exactly why it is written down here.
+                or key is None
+                or key in live_prs
+            ):
+                live.append(item)
+            else:
+                settled.append(item)
+        return {
+            "live": live[:INBOX_LIMIT],
+            "settled": settled[:INBOX_LIMIT],
+            # The settled rows the per-half cap left out. A SECOND truncation,
+            # and a quieter one: it happens inside a read that may never have
+            # hit its bound, so `truncated` says nothing about it and the
+            # count alone would silently understate.
+            "settled_dropped": max(0, len(settled) - INBOX_LIMIT),
+            "truncated": truncated,
+        }

{alissa_tools_github_revloop-0.26.0 → alissa_tools_github_revloop-0.27.0/src/main/alissa_tools_github_revloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.26.0
+Version: 0.27.0
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_revloop-0.26.0/src/main/alissa/tools/github/revloop/version

@@ -1 +0,0 @@
-0.26.0