code-coordinator 0.5.211__tar.gz → 0.5.213__tar.gz

{code_coordinator-0.5.211 → code_coordinator-0.5.213}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.211
+Version: 0.5.213
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.211 → code_coordinator-0.5.213}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.211
+Version: 0.5.213
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.211 → code_coordinator-0.5.213}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.211",
+  "tag": "0.5.213",
   "distance": 0,
-  "node": "g69492bc482e0d53d98048d02518e14923db70112",
+  "node": "ga9e3937295f13339509408e4a07ca7e7028b9987",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-21"

{code_coordinator-0.5.211 → code_coordinator-0.5.213}/coord/commands/drive_queue.py

@@ -2350,6 +2350,162 @@ def _run_merge_only_candidates(plan: TickPlan, config_path: Path | None) -> None
         click.echo(f"merge-only: {reason}")
 
 
+def _run_auto_revalidate_checks_stale(config_path: Path | None) -> None:
+    """#2535: best-effort auto-fire of the CI-staleness rerun for merge-queue
+    entries blocked SOLELY on stale CI checks against an already-approved
+    review — closing the gap where nothing periodic ever calls a live
+    ``coord merge`` or ``coord merge --revalidate`` on such an entry's
+    behalf, so it just sits until an operator notices ``--dry-run``'s
+    ``checks_stale`` line and reruns by hand (the trigger: #2530's Gate-A
+    PR #2534 sat blocked 2026-08-21 on nothing but 210 unrelated merges
+    having landed since its CI last ran).
+
+    Deliberately narrow — this is NOT ``merge.auto_drain`` reopened (that
+    flag stays ``False`` by design; see ``docs/DRIVE_QUEUE.md`` and the
+    2026-06-07 incident it guards against). This step never merges anything
+    and never touches an entry blocked on review, a real CI failure, or a
+    conflict — it only triggers a ``gh run rerun`` for the exact shape
+    :func:`coord.merge_queue.ci_revalidation_candidates` already scopes
+    ``--revalidate``'s CI arm to (#1851/#1925): ``PENDING``, review
+    approved, smoke fresh, CI checks green but predating the current base.
+
+    BOUNDED, shared with the live path. Draws from the SAME
+    ``ci_stale_reruns``/``MAX_CI_STALE_RERUNS`` budget
+    :func:`coord.merge_queue.process`'s own #2197 auto-rerun already spends
+    from — a live ``coord merge`` attempt and this tick share one ceiling,
+    never two independent ones that could double the effective retry count.
+    An entry that has already exhausted the budget (on a prior live attempt
+    or a prior tick) is left for a human exactly as #2197 already leaves it;
+    this function never fires a further rerun past the cap, though it does
+    keep recording the escalation (below) for as long as the entry stays
+    stuck, so a human watching the audit trail sees it, not just the first
+    tick that hit the ceiling.
+
+    Cost-visible (#1632's posture): every triggered rerun is a real CI run
+    on GitHub's own runners, recorded via :func:`coord.audit.record_audit`
+    (operational tier) so an operator can see the auto-fired count — same
+    spirit as the notifier being advisory rather than silent, never a
+    silent background spend.
+
+    Deliberately NOT behind a new config flag — this reuses exactly the
+    bound and the counter #2197 already established for "an automatic CI
+    rerun triggered by staleness"; the only thing new here is a periodic
+    caller for the case nothing was already about to call ``process()``
+    live. If that judgment turns out to be wrong in practice, the fix is a
+    ``merge.auto_revalidate_stale_ci`` off-switch, not removing the
+    dedicated budget this already shares.
+
+    Best-effort like every other optional step in this tick (conflict
+    reconciliation in ``_auto_drain_tick``, the merge-only fast path above):
+    a failure here must never abort the rest of the tick. Skipped entirely
+    on a thin client — this daemon-host tick is the only place it ever
+    runs, same guard :func:`_fetch_live_ci_gate`/
+    :func:`_run_merge_only_candidates` use.
+    """
+    from coord.board_service import resolve as resolve_board_service  # noqa: PLC0415
+
+    if resolve_board_service() is not None:
+        return
+
+    try:
+        from coord import github_ops as _gh_ops  # noqa: PLC0415
+        from coord import merge_queue as _mq  # noqa: PLC0415
+        from coord.audit import record_audit  # noqa: PLC0415
+        from coord.ci_store import build_ci_store  # noqa: PLC0415
+        from coord.commands._common import _load_config  # noqa: PLC0415
+        from coord.state import load_board as _load_board  # noqa: PLC0415
+
+        cfg = _load_config(config_path)
+        board = _load_board()
+        ci_store = build_ci_store(
+            cfg.ci_store.type, host=cfg.ci_store.host, token_env=cfg.ci_store.token_env,
+        )
+        if ci_store is None or not ci_store.is_available:
+            return
+        items = _mq.load_queue()
+        candidates = _mq.ci_revalidation_candidates(items, board, cfg, ci_store, _gh_ops)
+    except Exception:  # noqa: BLE001 — best-effort, see docstring
+        return
+
+    if not candidates:
+        return
+
+    touched: list = []
+    for entry in candidates:
+        label = f"{entry.repo_name} #{entry.issue_number} ({entry.branch})"
+        if entry.ci_stale_reruns >= _mq.MAX_CI_STALE_RERUNS:
+            # Budget already spent (on a previous tick, or a previous live
+            # `coord merge` attempt) — #2197's own terminal wording is
+            # already on the entry from whichever call last evaluated it.
+            # Nothing new to trigger; still worth one audit row per tick so
+            # an operator watching the trail sees this has been sitting
+            # exhausted, not silently forgotten.
+            record_audit(
+                tier="operational", category="merge",
+                event_type="merge_checks_stale_auto_revalidate_exhausted",
+                actor="drive-queue-tick",
+                summary=(
+                    f"auto-revalidate: {label} still checks_stale after "
+                    f"{entry.ci_stale_reruns}/{_mq.MAX_CI_STALE_RERUNS} "
+                    "auto-reruns — needs a human (`coord merge --revalidate` "
+                    "or `coord merge --only`)"
+                ),
+                repo=entry.repo_name, issue=entry.issue_number,
+                assignment_id=entry.assignment_id,
+                details={
+                    "pr_number": entry.pr_number,
+                    "ci_stale_reruns": entry.ci_stale_reruns,
+                },
+            )
+            continue
+        try:
+            reran = ci_store.rerun_for_pr(entry.repo_github, entry.pr_number)
+        except Exception as exc:  # noqa: BLE001 — one entry's failure must not sink the rest
+            click.echo(
+                f"auto-revalidate: could not re-run CI for {label}: {exc}", err=True
+            )
+            continue
+        entry.ci_stale_reruns += 1
+        entry.error = (
+            f"{_mq.CI_PENDING_PREFIX} re-run triggered for CI checks that "
+            "predate the current base (#2535 auto-revalidate "
+            f"{entry.ci_stale_reruns}/{_mq.MAX_CI_STALE_RERUNS} "
+            f"{'triggered' if reran else 'failed to trigger'})"
+        )
+        touched.append(entry)
+        click.echo(
+            f"auto-revalidate: {'triggered' if reran else 'FAILED to trigger'} "
+            f"a CI re-run for {label} (checks_stale, review already approved) "
+            f"— {entry.ci_stale_reruns}/{_mq.MAX_CI_STALE_RERUNS}"
+        )
+        record_audit(
+            tier="operational", category="merge",
+            event_type="merge_checks_stale_auto_revalidate",
+            actor="drive-queue-tick",
+            summary=(
+                f"auto-revalidate: {'triggered' if reran else 'FAILED to trigger'} "
+                f"a CI re-run for {label} — {entry.ci_stale_reruns}/"
+                f"{_mq.MAX_CI_STALE_RERUNS}"
+            ),
+            repo=entry.repo_name, issue=entry.issue_number,
+            assignment_id=entry.assignment_id,
+            details={"pr_number": entry.pr_number, "reran": reran},
+        )
+
+    if not touched:
+        return
+
+    try:
+        from coord import merge_queue as _mq  # noqa: PLC0415
+
+        fresh = _mq.load_queue()
+        by_id = {e.assignment_id: e for e in touched}
+        merged = [by_id.get(item.assignment_id, item) for item in fresh]
+        _mq.save_queue(merged)
+    except Exception:  # noqa: BLE001 — best-effort persistence; next tick recomputes
+        pass
+
+
 def _run_resume_probe(entry: QueueEntry) -> ProbeResult:
     """Run one entry's ``--resume-when`` probe with a hard timeout.
 
@@ -2730,6 +2886,15 @@ def drive_queue_tick(
         if not reconcile_only:
             _run_merge_only_candidates(plan, config_path)
 
+        # #2535: independent of the drive-queue plan above (this scans the
+        # MERGE queue directly, not drive-queue rows) — a bounded, best-effort
+        # CI re-run for any entry blocked solely on stale-but-green checks
+        # with an already-approved review. Same `not reconcile_only` posture
+        # as the merge-only fast path just above: a `gh run rerun` is a real
+        # external action that mode promises not to take.
+        if not reconcile_only:
+            _run_auto_revalidate_checks_stale(config_path)
+
         # #2235 Phase 0: record every entry this tick moved INTO or OUT OF
         # `blocked`/`parked`, with the reason the queue stated and — for a
         # release — what the release itself reveals about the true cause.

{code_coordinator-0.5.211 → code_coordinator-0.5.213}/docs/ORACLE_LOOP.md

@@ -393,8 +393,16 @@ Phase 0 steps 1–2 and Phase 1 step 6 above are also reachable by right-clickin
   not a live session). The CLI's own claim-detection refuses a duplicate dispatch while one is
   already in flight. This *is* Phase 0 step 1.
 - **"View Gate A mock (PR)"** 👁 → opens that worker's PR in the browser so a human can read
-  `contract.md` + the rendered mock(s). Disabled until a PR exists. **Merging that PR does not
-  satisfy Gate A** (#2063) — it is only how you *see* what you are signing off on.
+  `contract.md` and review/merge the branch. Disabled until a PR exists. **This does not show the
+  rendered mock(s)** (#2501) — GitHub's "Files changed" view renders `.html` as a source diff,
+  never a live page; use "View Gate A mock (local)" below for that. **Merging that PR does not
+  satisfy Gate A** (#2063) — it is only how you review/merge what you are signing off on.
+- **"View Gate A mock (local)"** 👁 → the actual mock viewer (#2501). Fast-forward-pulls the local
+  checkout's default branch (never forcing, never touching a dirty or diverged tree — aborts with
+  a toast instead, same as everywhere else this repo touches git destructively) and then opens
+  `tests/acceptance/ms-NN/mocks/` from disk in the OS's default browser, where `.html` actually
+  renders. Disabled until that mocks directory exists locally. Opens `mocks/index.html` once #2512
+  ships it; falls back to opening the mocks directory itself until then.
 - **"Approve Gate A"** ✓ → `coord gate-a --approved <repo> <tracking_issue>` — records the verdict
   that actually satisfies Gate A. Sits directly beside the 👁 on purpose: reviewing and recording
   are one gesture.

{code_coordinator-0.5.211 → code_coordinator-0.5.213}/tests/test_cli_drive_queue.py

@@ -2166,6 +2166,149 @@ def test_a_parked_merge_only_race_falls_back_to_an_ordinary_relaunch(
     assert len(merge_only_runs.merge) == 1, merge_only_runs.merge
 
 
+# ── #2535: auto-fire a CI re-run for a merge-queue entry blocked SOLELY on
+# stale-but-green checks with an already-approved review — no drive-queue row
+# needed at all, since this scans the merge queue directly. Fixtures below are
+# deliberately self-contained (not `live_ci_backend`, which fixes the base
+# timestamp to always read FRESH — the opposite of what a staleness scenario
+# needs, and whose fake CI stand-in has no `rerun_for_pr` to assert calls on).
+
+
+def _seed_pending_merge_row(
+    coord_db, issue: int, *, pr_number: int, ci_stale_reruns: int = 0
+) -> None:
+    """A bare `merge_queue` row — no drive-queue counterpart — PENDING, with
+    a PR number (required for `ci_revalidation_candidates` to consider it at
+    all) and an optional pre-spent `ci_stale_reruns` budget."""
+    coord_db.execute(
+        "INSERT INTO merge_queue "
+        "(assignment_id, repo_name, repo_github, branch, target_branch, "
+        " issue_number, issue_title, state, pr_number, enqueued_at, "
+        " ci_stale_reruns) "
+        "VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?)",
+        (
+            f"w{issue}", REPO, "john/claude-coordinator", f"work-{issue}", "main",
+            issue, f"issue {issue}", pr_number, time.time(), ci_stale_reruns,
+        ),
+    )
+    coord_db.commit()
+
+
+class _FakeStaleCi:
+    """Stands in for the live backend, like `live_ci_backend`'s `_FakeLiveCi`
+    — but with a `rerun_for_pr` that records its calls (#2182's fake has
+    none, since nothing before #2535 ever needed the tick to trigger one)."""
+
+    is_available = True
+
+    def __init__(self, rerun_calls: list) -> None:
+        self._rerun_calls = rerun_calls
+
+    def list_checks_for_pr(self, repo: str, number: int) -> list:
+        from coord.ci_store import CheckRun
+
+        return [CheckRun(
+            name="build", status="completed", conclusion="success",
+            url="", run_id="1", started_at=100.0, completed_at=160.0,
+        )]
+
+    def expects_checks(self, repo: str, number: int) -> bool:
+        return True
+
+    def rerun_for_pr(self, repo: str, number: int) -> bool:
+        self._rerun_calls.append((repo, number))
+        return True
+
+
+@pytest.fixture
+def stale_ci_backend(monkeypatch):
+    """Fakes the #1851 staleness shape directly: a green check that
+    `started_at` well BEFORE the base's own commit timestamp — the base
+    moved out from under an already-green PR. Returns the list of
+    `(repo, pr_number)` pairs `rerun_for_pr` was called with.
+    """
+    import coord.ci_store as ci_store_module
+    import coord.github_ops as github_ops
+
+    rerun_calls: list[tuple[str, int]] = []
+    monkeypatch.setattr(
+        ci_store_module, "build_ci_store", lambda t, **_kw: _FakeStaleCi(rerun_calls)
+    )
+    # The check above started at 100.0; the base's own commit landed at
+    # 1000.0 — well AFTER, so `_ci_checks_are_stale` reads True.
+    monkeypatch.setattr(
+        github_ops, "get_branch_commit_timestamp", lambda repo, branch: 1000.0
+    )
+    monkeypatch.setattr(github_ops, "get_pr_commit_messages", lambda repo, n: [])
+    monkeypatch.setattr(github_ops, "check_pr_mergeable", lambda repo, n: None)
+    return rerun_calls
+
+
+def test_auto_revalidate_fires_a_ci_rerun_for_an_entry_blocked_solely_on_stale_checks(
+    cli_no_gates, coord_db, stale_ci_backend,
+):
+    """The #2530/#2534 shape, unattended: a PENDING entry with a PR, review
+    already satisfied (`cli_no_gates` disables the review requirement —
+    the same minimal "sole blocker is CI" shape
+    `TestCiRevalidationCandidates` uses in tests/test_merge_queue.py), and
+    CI checks that are green but predate the current base. The tick fires
+    the re-run itself — no drive-queue row, no operator running
+    `coord merge --revalidate` by hand.
+    """
+    _seed_pending_merge_row(coord_db, 2534, pr_number=42)
+
+    result = cli_no_gates("tick")
+    assert result.exit_code == 0, result.output
+
+    assert stale_ci_backend == [("john/claude-coordinator", 42)]
+    row = coord_db.execute(
+        "SELECT ci_stale_reruns, error FROM merge_queue WHERE issue_number = ?",
+        (2534,),
+    ).fetchone()
+    assert row["ci_stale_reruns"] == 1
+    assert row["error"].startswith("CI running:")
+    assert "#2535" in row["error"]
+
+    from coord.audit import query_audit_log
+
+    entries = query_audit_log(event_type="merge_checks_stale_auto_revalidate")["entries"]
+    assert len(entries) == 1
+    assert entries[0]["issue"] == 2534
+    assert entries[0]["repo"] == REPO
+
+
+def test_auto_revalidate_never_exceeds_the_shared_budget(
+    cli_no_gates, coord_db, stale_ci_backend,
+):
+    """Budget already spent (whether by a prior tick or a prior live
+    `coord merge` attempt makes no difference — it's the same counter): no
+    NEW rerun fires, but the exhaustion is still recorded so a human
+    watching the audit trail sees it."""
+    from coord.merge_queue import MAX_CI_STALE_RERUNS
+
+    _seed_pending_merge_row(
+        coord_db, 2534, pr_number=42, ci_stale_reruns=MAX_CI_STALE_RERUNS
+    )
+
+    result = cli_no_gates("tick")
+    assert result.exit_code == 0, result.output
+
+    assert stale_ci_backend == []  # no new rerun triggered
+    row = coord_db.execute(
+        "SELECT ci_stale_reruns FROM merge_queue WHERE issue_number = ?",
+        (2534,),
+    ).fetchone()
+    assert row["ci_stale_reruns"] == MAX_CI_STALE_RERUNS  # unchanged
+
+    from coord.audit import query_audit_log
+
+    entries = query_audit_log(
+        event_type="merge_checks_stale_auto_revalidate_exhausted"
+    )["entries"]
+    assert len(entries) == 1
+    assert entries[0]["issue"] == 2534
+
+
 def test_a_repeatedly_dead_drive_still_reaches_blocked_and_escalates(
     cli, seed, launches, coord_db
 ):

{code_coordinator-0.5.211 → code_coordinator-0.5.213}/tests/test_thin_client_board_audit.py

@@ -233,10 +233,26 @@ COMMANDS_ALLOWLIST: dict[str, set[tuple[str, str]]] = {
     # (#1870), reaches it. Read-only: load_board only, no save_board, and the
     # whole block is wrapped in a fail-soft `except Exception: return {}` whose
     # empty result degrades to exactly the pre-#2350 `resumed` relaunch path.
+    # #2535-guarded: `_run_auto_revalidate_checks_stale` is the same shape and
+    # the same guard once more — it hands a board to
+    # `merge_queue.ci_revalidation_candidates` so the tick can fire the bounded
+    # CI re-run for a merge-queue entry blocked solely on stale-but-green
+    # checks against an already-approved review (PR #2534 sat there on nothing
+    # but 210 unrelated merges having landed since its CI last ran). The
+    # `if resolve_board_service() is not None: return` early return sits ABOVE
+    # the `from coord.state import load_board` import, so a thin client returns
+    # before the local read is even imported, let alone called; only the daemon
+    # host, where `coord drive-queue tick` runs and nowhere else (#1870),
+    # reaches it. Read-only with respect to the board: load_board only, no
+    # save_board (its one write is to the separate merge-queue table via
+    # `merge_queue.save_queue`, which the extended scan below already covers),
+    # and the whole block is wrapped in a fail-soft `except Exception: return`
+    # that degrades to exactly the pre-#2535 "wait for an operator" behaviour.
     "drive_queue.py": {
         ("_fetch_live_ci_gate", "load_board"),
         ("_fetch_live_blocked_gate", "load_board"),
         ("_fetch_merge_only_ready", "load_board"),
+        ("_run_auto_revalidate_checks_stale", "load_board"),
         ("drive_queue_diagnose", "build_board"),
     },
     # #1337: `coord test` no longer calls save_board at all — the verdict is

{code_coordinator-0.5.211 → code_coordinator-0.5.213}/tui/src/app/dialogs.rs

@@ -896,13 +896,32 @@ impl CoordApp {
                 // headlessly (an independent mock-author agent renders the
                 // viewable mock + writes tests/acceptance/ms-NN/contract.md —
                 // the CLI's own claim-detection refuses a duplicate dispatch).
-                // "View Gate A mock" opens that worker's PR in the browser
-                // (same mechanism as the Done-lifecycle "Open PR" below) so a
-                // human can read contract.md + the rendered mock(s) and
-                // review/merge the branch — the Test → Review → Merge round
-                // trip that constitutes sign-off — before `coord acceptance
-                // author` (out of scope here) is run against the merged
-                // contract.
+                // "View Gate A mock (PR)" opens that worker's PR in the
+                // browser (same mechanism as the Done-lifecycle "Open PR"
+                // below) so a human can read contract.md and review/merge
+                // the branch — the Test → Review → Merge round trip that
+                // constitutes sign-off — before `coord acceptance author`
+                // (out of scope here) is run against the merged contract.
+                // #2501: the PR route was NEVER a way to see the rendered
+                // mock(s) themselves — GitHub's "Files changed" view renders
+                // `.html` as a source diff, not a live page. "View Gate A
+                // mock (local)" sits beside it for that: it fast-forward-
+                // pulls the local checkout's default branch (never forcing,
+                // never touching a dirty tree — see
+                // `pull_default_branch_ff_only`) and then opens
+                // tests/acceptance/ms-NN/mocks/index.html from disk via a
+                // `file://` URL — a `.html` file IS MIME-associated with the
+                // OS's default browser, so this reliably renders there.
+                // #2512 amendment: until `mocks/index.html` exists (older
+                // checkouts, or a mock-author run predating #2512), this
+                // falls back to opening the raw `mocks/` DIRECTORY instead —
+                // a directory has no such MIME association, so on most
+                // desktops that `file://` URL opens in the OS's file
+                // manager, not the browser; the operator is one extra click
+                // (pick an `.html` file) from the rendered mock, not looking
+                // at it directly. Interim and acceptable per that amendment,
+                // but worth being precise about here rather than implying
+                // both paths land in the browser equally.
                 items.push(ContextMenuItem::action(
                     "dispatch-gate-a-mock",
                     "Dispatch Gate A mock",
@@ -912,6 +931,14 @@ impl CoordApp {
                 view_gate_a_item.disabled =
                     epic_issue.and_then(|iss| self.pipeline_pr_number(iss)).is_none();
                 items.push(view_gate_a_item);
+                let mut view_gate_a_local_item = ContextMenuItem::action(
+                    "view-gate-a-mock-local",
+                    "View Gate A mock (local)",
+                );
+                view_gate_a_local_item.disabled = !epic_issue
+                    .map(|iss| self.gate_a_mocks_dir_exists_for(iss))
+                    .unwrap_or(false);
+                items.push(view_gate_a_local_item);
                 // #2063: the sign-off itself, right beside the 👁 that opens
                 // the thing being signed off on — reviewing and recording are
                 // one gesture. Until now "merging that PR is what satisfies
@@ -6982,6 +7009,16 @@ impl CoordApp {
                 }
                 true
             }
+            // #2501: local counterpart to "view-gate-a-mock" — pulls the
+            // local checkout's default branch (fast-forward only) and opens
+            // the rendered mock(s) from disk, since the PR route can never
+            // actually show them (GitHub renders `.html` as source, not a
+            // live page). All toasting on abort/failure happens inside
+            // `dispatch_view_gate_a_mock_local_for_selected_pipeline_row`.
+            "view-gate-a-mock-local" => {
+                self.dispatch_view_gate_a_mock_local_for_selected_pipeline_row();
+                true
+            }
             // #2063: record the human Gate-A verdict. `--approved` is what
             // unblocks the milestone's issues; `--changes` records a
             // rejection so the refusal downstream can say what to fix