code-coordinator 0.5.115__tar.gz → 0.5.116__tar.gz

{code_coordinator-0.5.115 → code_coordinator-0.5.116}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.115
+Version: 0.5.116
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.115 → code_coordinator-0.5.116}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.115
+Version: 0.5.116
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.115 → code_coordinator-0.5.116}/code_coordinator.egg-info/SOURCES.txt

@@ -673,6 +673,7 @@ tests/test_quiet_hours.py
 tests/test_quiet_hours_store_2146.py
 tests/test_reap_merged_sessions.py
 tests/test_reap_stale_interactive_tick.py
+tests/test_reconcile.py
 tests/test_reconcile_branch.py
 tests/test_reconcile_completions.py
 tests/test_reconcile_merges.py

{code_coordinator-0.5.115 → code_coordinator-0.5.116}/code_coordinator.egg-info/scm_file_list.json

@@ -704,6 +704,7 @@
     "tests/test_quiet_hours_store_2146.py",
     "tests/test_reap_merged_sessions.py",
     "tests/test_reap_stale_interactive_tick.py",
+    "tests/test_reconcile.py",
     "tests/test_reconcile_branch.py",
     "tests/test_reconcile_completions.py",
     "tests/test_reconcile_merges.py",

{code_coordinator-0.5.115 → code_coordinator-0.5.116}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.115",
+  "tag": "0.5.116",
   "distance": 0,
-  "node": "g28e36b1a94feb56072af2832c5a0025e5b6ffa90",
+  "node": "gf24de3d23e8fe5dd6998c12ce6e8fee637f65f25",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-16"

{code_coordinator-0.5.115 → code_coordinator-0.5.116}/coord/commands/dispatch.py

@@ -1797,9 +1797,12 @@ def retry(assignment_id: str, config_path: Path, acknowledge_cost: bool = False)
     from coord.board_service import read_board, write_board
     from coord.models import WORK_LIKE_TYPES
     from coord.reconcile import (
+        RetryProviderMismatch,
         UnsupportedRetryType,
         _reassign,
+        _resolve_retry_provider,
         describe_no_candidate_machines,
+        describe_retry_provider_mismatch,
         describe_unsupported_retry_type,
     )
 
@@ -1920,14 +1923,59 @@ def retry(assignment_id: str, config_path: Path, acknowledge_cost: bool = False)
         click.echo(f"error: {describe_unsupported_retry_type(exc)}", err=True)
         sys.exit(1)
 
-    # Determine escalated model for the retry.
+    # #2323: resolve (and #437 TOS-guard) the provider this retry would
+    # dispatch through BEFORE deciding anything about the model — printed
+    # up front so it's never left for the drive's own header to contradict
+    # four seconds later, and checked before the escalation message so a
+    # refusal is never preceded by a reassuring "escalating model" line for
+    # a retry that's about to be refused. `providers.labels` is consulted
+    # the same way a first work dispatch consults it (gated to
+    # `type="work"`, coord/dispatch.py:548); a genuine `harness:opencode`
+    # label match here means retry lands back on `opencode`, not the
+    # claude default that a label-blind resolution used to fall through to.
+    from coord.state import get_cached_issue_labels  # noqa: PLC0415
+
+    issue_labels = get_cached_issue_labels(
+        assignment.repo_name, assignment.issue_number,
+    )
+    try:
+        resolved_provider_name = _resolve_retry_provider(assignment, cfg, issue_labels)
+    except RetryProviderMismatch as exc:
+        click.echo(f"error: {describe_retry_provider_mismatch(exc)}", err=True)
+        sys.exit(1)
+    except ValueError as exc:
+        click.echo(f"error: {exc}", err=True)
+        sys.exit(1)
+    click.echo(f"  provider: {resolved_provider_name}")
+
+    # Determine escalated model for the retry. #2323: `cfg.models.
+    # next_model` walks the claude tier ladder — only meaningful when this
+    # retry actually resolves to a claude-family provider. The precheck
+    # above already guarantees `resolved_provider_name` matches the failed
+    # run's own provider (else it would have refused), so gating on the
+    # resolved provider's TYPE here is equivalent to gating on the failed
+    # run's, without a second lookup.
+    from coord.config import IMPLICIT_PROVIDER_TYPES  # noqa: PLC0415
+    from coord.providers import provider_type_for  # noqa: PLC0415
+
     original_model = assignment.model or cfg.models.default
-    escalated = cfg.models.next_model(original_model)
-    if escalated != original_model:
-        click.echo(f"  escalating model: {original_model} → {escalated}")
+    if provider_type_for(resolved_provider_name, cfg.providers) in IMPLICIT_PROVIDER_TYPES:
+        escalated = cfg.models.next_model(original_model)
+        if escalated != original_model:
+            click.echo(f"  escalating model: {original_model} → {escalated}")
+        retry_model = escalated
+    else:
+        # Not a claude-family provider — the escalation ladder doesn't
+        # apply; reuse the failed run's own model field exactly (`None`
+        # tells `_reassign` to reuse `assignment.model` verbatim, rather
+        # than stamping `original_model`'s `cfg.models.default` fallback
+        # onto a provider that fallback means nothing to).
+        retry_model = None
 
     try:
-        result = _reassign(assignment, board, cfg, model=escalated)
+        result = _reassign(
+            assignment, board, cfg, model=retry_model, issue_labels=issue_labels,
+        )
     except UnsupportedRetryType as exc:
         # Defense in depth — the precheck above already covers this, but
         # `_reassign` is shared with `auto_reassign` and must never silently
@@ -1935,12 +1983,19 @@ def retry(assignment_id: str, config_path: Path, acknowledge_cost: bool = False)
         # precheck.
         click.echo(f"error: {describe_unsupported_retry_type(exc)}", err=True)
         sys.exit(1)
+    except RetryProviderMismatch as exc:
+        # Defense in depth — the precheck above already covers this, but
+        # `_reassign` is shared with `auto_reassign` and must never
+        # silently substitute the provider even if a future caller skips
+        # the precheck.
+        click.echo(f"error: {describe_retry_provider_mismatch(exc)}", err=True)
+        sys.exit(1)
     if result is None:
         # #1396: name the blocking machines and their apparent load instead
         # of a bare "no available machine" — the usual cause is a phantom
         # `running` row from a dead interactive session nothing reaped.
         click.echo(
-            f"error: {describe_no_candidate_machines(assignment, board, cfg)}",
+            f"error: {describe_no_candidate_machines(assignment, board, cfg, issue_labels)}",
             err=True,
         )
         sys.exit(1)
@@ -1960,7 +2015,7 @@ def retry(assignment_id: str, config_path: Path, acknowledge_cost: bool = False)
     click.echo(
         f"Retried: {result.machine_name} → {result.repo_name} "
         f"#{result.issue_number} (assignment {result.assignment_id}, "
-        f"type={result.type})"
+        f"type={result.type}, provider={resolved_provider_name})"
     )
     # #1101: surface the continued branch so it's obvious the retry picked
     # up existing work instead of forking a fresh branch off the default.

{code_coordinator-0.5.115 → code_coordinator-0.5.116}/coord/reconcile.py

@@ -1028,21 +1028,140 @@ def describe_unsupported_retry_type(exc: UnsupportedRetryType) -> str:
     )
 
 
+class RetryProviderMismatch(ValueError):
+    """Raised by :func:`_reassign` when a retry would resolve to a
+    different provider than the failed run it is replacing (#2323).
+
+    A retry that consults ``providers.labels`` can legitimately land on a
+    different provider than *this exact assignment row* if the issue's
+    labels or ``coordinator.yml`` changed between the original dispatch and
+    the retry — but silently substituting the provider is exactly the #1796
+    failure mode one level up: an operator (or an unattended `coord drive`)
+    asking to retry a `harness:opencode` leg is not asking to move it to
+    `claude`, even if that is where today's precedence chain would land.
+    Refuse instead, the same way the #437 TOS gate refuses rather than
+    substitutes a human-attended provider.
+    """
+
+    def __init__(self, failed_provider: str, resolved_provider: str):
+        self.failed_provider = failed_provider
+        self.resolved_provider = resolved_provider
+        super().__init__(
+            f"retry would move this assignment from provider "
+            f"{failed_provider!r} to {resolved_provider!r}"
+        )
+
+
+def describe_retry_provider_mismatch(exc: RetryProviderMismatch) -> str:
+    """Human-readable refusal message for :class:`RetryProviderMismatch`
+    (#2323).
+
+    Mirrors :func:`describe_unsupported_retry_type`'s shape — names both
+    providers and points at the deliberate override an operator who
+    actually wants the move can use.
+    """
+    return (
+        f"refusing retry: the failed run dispatched through provider "
+        f"{exc.failed_provider!r}, but this retry resolves to "
+        f"{exc.resolved_provider!r} — retrying would silently move the "
+        "work onto a different provider (and, for a claude provider, walk "
+        "a model-escalation ladder that has no meaning for the other one). "
+        "If the issue's labels or `providers.labels` changed since the "
+        "original dispatch and the move is intentional, dispatch by hand "
+        "instead: `coord assign --interactive`."
+    )
+
+
+def _resolve_retry_provider(
+    failed: Assignment, config: Config, issue_labels: list[str] | None,
+) -> str:
+    """Resolve (and #437 TOS-guard) the provider a retry of *failed* would
+    dispatch through, refusing if it differs from the provider the failed
+    run itself used (#2323).
+
+    Mirrors a first work dispatch's resolution precedence exactly
+    (``coord.dispatch.dispatch``, ``coord/dispatch.py:548``): spec (always
+    ``None`` here — a retry never carries a fresh per-spec override) ->
+    ``providers.labels`` (gated to ``failed.type == "work"``, the same
+    restriction the first dispatch applies) -> repo default ->
+    ``providers.default``.
+
+    Args:
+        failed: The failed/advisory assignment being retried.
+        config: The coordinator config.
+        issue_labels: The target issue's current GitHub label names, or
+            ``None``/empty when unavailable — falls back to no label match,
+            reproducing pre-#2323 (label-blind) resolution for that one
+            issue rather than raising.
+
+    Returns:
+        The resolved (and TOS-cleared) provider name.
+
+    Raises:
+        ValueError: the #437 TOS gate refuses (the resolved provider is
+            ``human_attended_only``) — same contract
+            :func:`coord.providers.guard_unattended_dispatch` uses.
+        RetryProviderMismatch: the resolved provider differs from
+            ``failed.provider_name`` (falling back to ``"claude"`` for a
+            row dispatched before #324 started recording it).
+    """
+    from coord.providers import guard_unattended_dispatch  # noqa: PLC0415
+
+    repo_for_provider = config.repo(failed.repo_name)
+    # #1889/#2323: providers.labels routes work dispatches by the issue's
+    # harness-eval label — gated to type="work" exactly as the first
+    # dispatch gates it (coord/dispatch.py:548) so a label meant for the
+    # eventual work dispatch never leaks into mock-author/test-author
+    # retries that never saw it on their original dispatch either.
+    provider_issue_labels = issue_labels if failed.type == "work" else None
+    resolved = guard_unattended_dispatch(
+        spec_provider=None,
+        repo_provider=(
+            repo_for_provider.provider if repo_for_provider is not None else None
+        ),
+        providers_cfg=config.providers,
+        models_cfg=config.models,
+        where="auto-reassign (reconcile)",
+        issue_labels=provider_issue_labels,
+    )
+    # #324: None means "dispatched before #324 landed or via a path that
+    # doesn't set this field" — the documented implicit default is "claude".
+    failed_provider = failed.provider_name or "claude"
+    if resolved != failed_provider:
+        raise RetryProviderMismatch(failed_provider, resolved)
+    return resolved
+
+
 def _reassign(
     failed: Assignment, board: Board, config: Config,
     *,
     model: str | None = None,
+    issue_labels: list[str] | None = None,
 ) -> Assignment | None:
     """Re-dispatch a failed assignment to a machine with spare capacity.
 
     *model* overrides the model tier on the retry. When None, the
     original assignment's model is reused (escalation happens at the call
-    site).
+    site — and must only be requested when the retry resolves to the same
+    claude-family provider the failed run used, #2323: the claude
+    escalation ladder means nothing to another provider).
+
+    *issue_labels* (#2323) is the target issue's current GitHub label
+    names, threaded into provider resolution via
+    :func:`_resolve_retry_provider` so ``providers.labels`` is honoured on
+    a retry the same way it is on a first dispatch — without this, every
+    retry fell through to the repo/global default regardless of which
+    label originally routed the issue.
 
     Raises :class:`UnsupportedRetryType` when ``failed.type`` is not in
     :data:`coord.models.WORK_LIKE_TYPES` — a ``smoke``/``review``/other
     non-work row must not be silently re-dispatched as a fresh
     ``type="work"`` worker (#1636).
+
+    Raises :class:`RetryProviderMismatch` (#2323) when the resolved
+    provider differs from the one the failed run actually used — refuses
+    rather than silently moving the work onto a different provider, the
+    #1796 rule applied at dispatch.
     """
     if failed.type not in WORK_LIKE_TYPES:
         raise UnsupportedRetryType(failed.type, failed.review_of_assignment_id)
@@ -1061,22 +1180,59 @@ def _reassign(
     def has_room(m: Machine) -> bool:
         return len(running.get(m.name, [])) < _machine_capacity(m, config)
 
+    # #437: STRUCTURAL TOS-COMPLIANCE GATE — auto-reassign is an
+    # unattended dispatch path; refuse to retry through a provider that
+    # opts out of unattended use.  #2323: also resolves through
+    # `providers.labels` (gated to type="work", exactly as a first
+    # dispatch gates it) instead of skipping straight to the repo/global
+    # default, and refuses outright — RetryProviderMismatch, NOT a silent
+    # `return None` — when the resolution disagrees with the provider the
+    # failed run actually used.  A plain TOS ValueError still resolves to
+    # `return None`: skip the reassignment, leaving the failed assignment
+    # for human attention rather than getting silently re-tried on the
+    # wrong provider.  Resolved BEFORE machine selection so the #1711
+    # capability filter below can key off it.
+    try:
+        resolved_provider_name = _resolve_retry_provider(failed, config, issue_labels)
+    except RetryProviderMismatch:
+        raise
+    except ValueError:
+        return None
+
+    # #1711: STRUCTURAL PROVIDER-AVAILABILITY GATE, applied as a candidate
+    # filter — a retry must never route to a machine that hasn't declared
+    # it can run the resolved provider (e.g. an `opencode` retry landing on
+    # a machine with no `provider:opencode` capability), exactly as a first
+    # dispatch refuses that combination (`coord.dispatch.dispatch` →
+    # `guard_provider_machine_capability`). Filtering (rather than raising
+    # on `candidates[0]`) means a fleet where SOME machine declares the
+    # capability still retries there; a fleet where none does falls through
+    # to the "no candidates" `return None`, leaving the row for human
+    # attention — `describe_no_candidate_machines` names the reason.
+    from coord.providers import machine_supports_provider  # noqa: PLC0415
+
+    def can_run_provider(m: Machine) -> bool:
+        return machine_supports_provider(m, resolved_provider_name, config.providers)
+
     candidates = [
         m for m in config.machines
         if m.can_work_on(failed.repo_name)
         and m.repo_path(failed.repo_name) is not None
         and has_room(m)
+        and can_run_provider(m)
         and m.name != failed.machine_name
         and m.name not in paused
     ]
     if not candidates:
         # Fall back to including the same machine that failed last time —
-        # paused machines stay excluded even from the fallback.
+        # paused machines (and #1711 capability-lacking machines) stay
+        # excluded even from the fallback.
         candidates = [
             m for m in config.machines
             if m.can_work_on(failed.repo_name)
             and m.repo_path(failed.repo_name) is not None
             and has_room(m)
+            and can_run_provider(m)
             and m.name not in paused
         ]
     if not candidates:
@@ -1085,31 +1241,6 @@ def _reassign(
     machine = candidates[0]
     repo_path = machine.repo_path(failed.repo_name)
 
-    # #437: STRUCTURAL TOS-COMPLIANCE GATE — auto-reassign is an
-    # unattended dispatch path; refuse to retry through a provider that
-    # opts out of unattended use.  Resolve precedence with per-repo
-    # override and the global default (the failed assignment doesn't
-    # carry a spec-level provider into this path).  On refusal: skip the
-    # reassignment — the failed assignment stays failed for human
-    # attention rather than getting silently re-tried on the wrong
-    # provider.
-    from coord.providers import guard_unattended_dispatch  # noqa: PLC0415
-    repo_for_provider = config.repo(failed.repo_name)
-    try:
-        guard_unattended_dispatch(
-            spec_provider=None,
-            repo_provider=(
-                repo_for_provider.provider
-                if repo_for_provider is not None
-                else None
-            ),
-            providers_cfg=config.providers,
-            models_cfg=config.models,
-            where="auto-reassign (reconcile)",
-        )
-    except ValueError:
-        return None
-
     retry_model = model if model is not None else failed.model
     # The Assignment keeps the alias for legibility; the wire payload is
     # resolved through models.versions when an exact id is pinned.
@@ -1156,6 +1287,18 @@ def _reassign(
         # worker's integration base (the start point / rebase target).
         "branch": retry_default_branch,
     }
+    # #2323: name the resolved provider on the wire the same way a first
+    # dispatch does (`coord.dispatch._wire_payload_needs_provider_field`) —
+    # omitted only for the vanilla, uncustomized "claude" definition so
+    # byte-identical payloads survive for every deployment that never
+    # touches `providers:`. Without this, `resolved_provider_name` above
+    # was resolved (and TOS-guarded, and matched against the failed run)
+    # purely for bookkeeping, and the wire payload silently fell back to
+    # the agent's hardcoded legacy claude spawn path regardless — the exact
+    # bug #2323 reported.
+    from coord.dispatch import _wire_payload_needs_provider_field  # noqa: PLC0415
+    if _wire_payload_needs_provider_field(resolved_provider_name, config):
+        payload["provider"] = resolved_provider_name
     # #1101: continue the failed assignment's actual branch instead of
     # silently forking a fresh one off the repo default — any real work it
     # already committed and pushed must not be orphaned by a retry. Mirrors
@@ -1187,6 +1330,12 @@ def _reassign(
         dispatched_at=time.time(),
         type=failed.type,
         model=retry_model,
+        # #2323: record the resolved provider the same way a first dispatch
+        # does (`response.get("_provider_name")` in coord/commands/
+        # dispatch.py) — so the board/TUI and the next retry's own
+        # `_resolve_retry_provider` mismatch check see the provider this
+        # retry actually ran under, not the one the failed row ran under.
+        provider_name=resolved_provider_name,
         # #1101: record the continued branch on the board immediately
         # instead of waiting for a later reconcile backfill from agent
         # /status — the retry payload above already told the agent to
@@ -1222,6 +1371,7 @@ def _reassign(
 
 def describe_no_candidate_machines(
     failed: Assignment, board: Board, config: Config,
+    issue_labels: list[str] | None = None,
 ) -> str:
     """Explain why :func:`_reassign` found no candidate machine (#1396).
 
@@ -1235,15 +1385,39 @@ def describe_no_candidate_machines(
     reaped, still counted against the machine's capacity.
 
     Mirrors ``_reassign``'s exact candidate filter (repo capability, repo
-    path, pause set, capacity check, same-machine exclusion — #1417 replaced
-    the old binary "any running assignment = busy" rule with a per-machine
-    capacity count against ``machines[].max_workers``/``concurrency.
-    max_workers``) but keeps a reason per excluded machine instead of
-    discarding it, so the message names the blocking machines and what
-    they're apparently running — including the age, which makes a
-    400-hour-old phantom obvious at a glance.
+    path, pause set, capacity check, #1711 provider-capability check,
+    same-machine exclusion — #1417 replaced the old binary "any running
+    assignment = busy" rule with a per-machine capacity count against
+    ``machines[].max_workers``/``concurrency.max_workers``) but keeps a
+    reason per excluded machine instead of discarding it, so the message
+    names the blocking machines and what they're apparently running —
+    including the age, which makes a 400-hour-old phantom obvious at a
+    glance.
+
+    *issue_labels* (#2323) threads the same label list the caller handed
+    ``_reassign``, so the provider this diagnostic resolves (for the #1711
+    capability lines) matches the one the retry actually resolved.
     """
     from coord.machine_pause import paused_set  # noqa: PLC0415
+    from coord.providers import (  # noqa: PLC0415
+        machine_supports_provider,
+        resolve_provider_name,
+    )
+
+    # #1711: resolve the provider the retry would use, so machines that
+    # can't run it are named as such instead of reading as "free". A
+    # resolution failure (unknown provider name in config) degrades to
+    # skipping the capability lines — this is a diagnostic, not a gate.
+    repo_for_capability = config.repo(failed.repo_name)
+    try:
+        provider_for_capability: str | None = resolve_provider_name(
+            None,
+            repo_for_capability.provider if repo_for_capability is not None else None,
+            config.providers,
+            issue_labels=issue_labels if failed.type == "work" else None,
+        )
+    except ValueError:
+        provider_for_capability = None
 
     paused = paused_set(config.machines)
     now = time.time()
@@ -1271,6 +1445,18 @@ def describe_no_candidate_machines(
         if m.name in paused:
             lines.append(f"  {m.name}: paused")
             continue
+        if provider_for_capability is not None and not machine_supports_provider(
+            m, provider_for_capability, config.providers,
+        ):
+            # #1711: mirrors `_reassign`'s capability filter — this machine
+            # never declared it can run the resolved provider, so it was
+            # excluded regardless of load.
+            lines.append(
+                f"  {m.name}: cannot run provider {provider_for_capability!r} "
+                "(no matching capability in coordinator.yml "
+                "machines[].capabilities)"
+            )
+            continue
         running = running_by_machine.get(m.name, [])
         cap = _machine_capacity(m, config)
         own_full = len(running) >= cap
@@ -1787,7 +1973,26 @@ def reconcile(board: Board, config: Config) -> list[str]:
                 getattr(failed_a, "failure_reason", None)
             ):
                 continue
-            reassigned = _reassign(failed_a, board, config)
+            # #2323: thread the issue's cached labels through so
+            # auto-reassign resolves `providers.labels` the same way a
+            # first dispatch (and `coord retry`) does — best-effort local
+            # cache read (never a GitHub call from this passive tick); an
+            # uncached issue falls back to label-blind resolution, same as
+            # passing `None`.
+            from coord.state import get_cached_issue_labels  # noqa: PLC0415
+
+            cached_labels = get_cached_issue_labels(
+                failed_a.repo_name, failed_a.issue_number,
+            )
+            try:
+                reassigned = _reassign(
+                    failed_a, board, config, issue_labels=cached_labels,
+                )
+            except RetryProviderMismatch:
+                # Refuse rather than substitute (#2323) — leave the failed
+                # assignment for human attention (`coord retry`) instead of
+                # silently auto-moving it to a different provider.
+                continue
             if reassigned is not None and reassigned.assignment_id is not None:
                 changed.append(reassigned.assignment_id)