code-coordinator 0.5.315__tar.gz → 0.5.316__tar.gz

{code_coordinator-0.5.315 → code_coordinator-0.5.316}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.315
+Version: 0.5.316
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.315 → code_coordinator-0.5.316}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.315
+Version: 0.5.316
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.315 → code_coordinator-0.5.316}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.315",
+  "tag": "0.5.316",
   "distance": 0,
-  "node": "g12da3c4a4320f19ffd6f46fd6eb6b882a5ba5026",
+  "node": "g84875a2c21cee2157331b4a2f1e92ca1c9b812fe",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-31"

{code_coordinator-0.5.315 → code_coordinator-0.5.316}/coord/github_ops.py

@@ -1892,7 +1892,9 @@ def list_remote_branch_names(repo: str) -> set[str]:
     }
 
 
-def branch_exists_on_remote(repo: str, branch: str) -> bool:
+def branch_exists_on_remote(
+    repo: str, branch: str, *, cache: dict | None = None
+) -> bool:
     """Return True if `branch` currently exists on `repo` (owner/name) at GitHub.
 
     Uses a targeted ``gh api`` call rather than listing all branches.  Fails
@@ -1903,7 +1905,27 @@ def branch_exists_on_remote(repo: str, branch: str) -> bool:
 
     Called by ``dispatch_review`` and ``_dispatch_fix`` (#586) to avoid
     routing a follow-on assignment to a machine that can't fetch the branch.
-    """
+
+    *cache* (#2989) is an optional caller-owned ``dict`` used to memoise the
+    lookup for the duration of ONE sweep, mirroring
+    :func:`work_is_terminal`'s ``cache=``.  A single ``reconcile_board_merges``
+    pass measured 1,304 ref lookups for only 851 distinct refs (1.53x
+    redundancy) because sibling assignment rows — a work row and its
+    conflict-fix, or a re-dispatch — legitimately share one branch.  The
+    cache is deliberately **per-pass and caller-scoped**, never module-level:
+    branch existence is exactly the kind of fact that must be re-read on the
+    next pass.
+    """
+    key = (repo, branch)
+    if cache is not None and key in cache:
+        return cache[key]
+    result = _branch_exists_on_remote_uncached(repo, branch)
+    if cache is not None:
+        cache[key] = result
+    return result
+
+
+def _branch_exists_on_remote_uncached(repo: str, branch: str) -> bool:
     try:
         _gh("api", f"repos/{repo}/git/refs/heads/{branch}",
             caller="github_ops.branch_exists_on_remote")

{code_coordinator-0.5.315 → code_coordinator-0.5.316}/coord/reconcile.py

@@ -31,6 +31,23 @@ if TYPE_CHECKING:
 # and treating a huge, all-matching-so-far diff as inconclusive (fail open).
 _FALSE_MERGE_AUDIT_MAX_FILES = 20
 
+# #2989: bounds the OUTER candidate set of that same sweep — the loop #2639
+# left unbounded. Without it the set is proportional to project history
+# (1,302 rows on the drive host, +1 per merge, never shrinking), re-probed
+# every 30s. This is a per-pass ceiling applied newest-first as a backstop
+# behind the persistent terminal marker (`state.mark_false_merge_audit_
+# clean`); the older tail drains over subsequent passes as newer rows are
+# confirmed and drop out permanently. Not applied to a targeted
+# `--issue N` audit.
+_FALSE_MERGE_AUDIT_MAX_ROWS = 50
+
+# #2989: how often the sweep may run when the caller opts into throttling
+# (the daemon's reconcile tick does; a manual `coord reconcile-merges` does
+# not). It detects a rare, non-urgent condition — a merged-marked row whose
+# branch still differs from base — which is an hourly sweep, not a
+# twice-a-minute one.
+_FALSE_MERGE_AUDIT_MIN_INTERVAL_SECONDS = 3600.0
+
 
 def _query_agent(host: str, port: int = AGENT_PORT, timeout: float = 5.0) -> dict | None:
     try:
@@ -2908,6 +2925,7 @@ def reconcile_board_merges(
     repo: str | None = None,
     issue: int | None = None,
     dry_run: bool = False,
+    throttle_false_merge_audit: bool = False,
 ) -> list[str]:
     """Reconcile done work assignments against git/GitHub reality.
 
@@ -2970,7 +2988,14 @@ def reconcile_board_merges(
     catching a historical false ``status='merged'`` flip that predates this
     fix (or any future bug shaped like it) rather than leaving it invisible
     to every other diagnostic forever. See its own inline comment for the
-    full methodology and false-positive guards.)
+    full methodology and false-positive guards.
+
+    #2989 bounds sweep (h)'s candidate set — it used to select every
+    ``merged`` work-like row in project history and re-probe all of them on
+    the daemon's 30s tick (97% of a pass's ``gh`` calls). Set
+    *throttle_false_merge_audit* to run that sweep at most hourly; the
+    daemon tick does, a manual ``coord reconcile-merges`` deliberately does
+    not. See the inline block above ``_false_merge_candidates``.)
     """
     from coord import github_ops, state  # noqa: PLC0415
 
@@ -3456,28 +3481,121 @@ def reconcile_board_merges(
     # this is a FLAG for a human to check, exactly like the manual sweep this
     # automates, not a verdict. Fail-open at every layer: any fetch failure
     # skips that row/file rather than either flagging or clearing it.
-    _false_merge_candidates = [
-        a
-        for a in board.active + board.completed
-        if a.status == "merged"
-        and a.branch
-        and (a.type in WORK_LIKE_TYPES or is_interactive_merge_session(a))
-        and (repo is None or a.repo_name == repo)
-        and (issue is None or a.issue_number == issue)
-    ]
+    #
+    # BOUNDING (#2989) — three mechanisms, applied in this order.  Before
+    # them this sweep selected EVERY `merged` work-like row in the board:
+    # 1,302 rows on the drive host, proportional to project history rather
+    # than to work in flight, re-probed on the daemon's 30s tick.  Measured,
+    # that was 1,304 of one pass's 1,346 `gh` invocations (97%), and the
+    # generator behind the fleet-wide secondary rate limiting #2809/#2858/
+    # #2934/#2977 all treated symptomatically.  (#2639 had already capped
+    # the inner per-file loop — the wrong loop; the outer candidate set was
+    # left unbounded.)
+    #
+    #   (1) CADENCE.  This detects a rare, non-urgent condition — a
+    #       merged-marked row whose branch still differs from base, which is
+    #       recovered by a human days later regardless.  Twice a minute is
+    #       absurd for that.  The daemon tick passes
+    #       `throttle_false_merge_audit=True` and the sweep then runs at most
+    #       once an hour (~120x fewer passes on its own).  A manual `coord
+    #       reconcile-merges` / `coord diagnose` never throttles: an operator
+    #       who asked for a sweep gets one, deterministically.
+    #   (2) TERMINAL MARKER.  A clean verdict is clean forever (branch
+    #       deleted, merged PR at the tip, already an ancestor of base, or
+    #       content byte-identical on base — none of those un-happen for a
+    #       terminal row).  Persisting it (`state.mark_false_merge_audit_
+    #       clean`) drops the row from the candidate list permanently, which
+    #       makes the set proportional to *unaudited* merges — bounded by
+    #       recent throughput, not project age.  This is the real fix, and
+    #       the same discipline `coord.gate_snapshot`'s refresh already
+    #       states ("merged history is never refreshed").
+    #   (3) RECENCY CAP.  A backstop for the first pass after this ships (and
+    #       for any board whose marker was lost): audit at most
+    #       `_FALSE_MERGE_AUDIT_MAX_ROWS` rows per pass, newest first.  A
+    #       false merge that has gone unnoticed for two months is not being
+    #       caught by a 30-second sweep anyway; the older tail is simply
+    #       drained over the following passes as newer rows get marked.
+    #
+    # An explicit `--issue N` bypasses (2) and (3) entirely: a targeted
+    # re-audit must always re-probe, so a previously-cleared row stays
+    # re-checkable by hand.  Nothing here changes what the sweep CONCLUDES,
+    # only how many probes it takes to conclude it.
+    _false_merge_targeted = issue is not None
+    _run_false_merge_audit = True
+    if throttle_false_merge_audit and not _false_merge_targeted:
+        _last_run = state.get_false_merge_audit_last_run()
+        if (time.time() - _last_run) < _FALSE_MERGE_AUDIT_MIN_INTERVAL_SECONDS:
+            _run_false_merge_audit = False
+
+    _false_merge_candidates: list[Assignment] = []
+    if _run_false_merge_audit:
+        _false_merge_candidates = [
+            a
+            for a in board.active + board.completed
+            if a.status == "merged"
+            and a.branch
+            and (a.type in WORK_LIKE_TYPES or is_interactive_merge_session(a))
+            and (repo is None or a.repo_name == repo)
+            and (issue is None or a.issue_number == issue)
+            # #2989: a row whose repo has no GitHub mapping is unprobeable —
+            # drop it HERE rather than after the recency cap, so a pile of
+            # orphaned rows (a repo since removed from coordinator.yml) can't
+            # eat the cap's slots and starve the rows we can actually audit.
+            and getattr(config.repo(a.repo_name), "github", None)
+        ]
+        if not _false_merge_targeted:
+            _already_clean = state.load_false_merge_audit_clean()
+            if _already_clean:
+                _false_merge_candidates = [
+                    a
+                    for a in _false_merge_candidates
+                    if a.assignment_id not in _already_clean
+                ]
+            if len(_false_merge_candidates) > _FALSE_MERGE_AUDIT_MAX_ROWS:
+                _false_merge_candidates.sort(
+                    key=lambda a: (a.finished_at or a.dispatched_at or 0.0),
+                    reverse=True,
+                )
+                _false_merge_candidates = _false_merge_candidates[
+                    :_FALSE_MERGE_AUDIT_MAX_ROWS
+                ]
+
+    if (
+        _run_false_merge_audit
+        and throttle_false_merge_audit
+        and not _false_merge_targeted
+        and not dry_run  # a dry-run must not consume the real run's turn
+    ):
+        # Stamp even when there was nothing to do — the point of the stamp is
+        # "this sweep had its turn this hour", not "this sweep found work".
+        state.set_false_merge_audit_last_run(time.time())
+
     if _false_merge_candidates:
         from coord.branch_model import resolve_base_branch_for_issue_number  # noqa: PLC0415
 
         _false_merge_milestone_cache: dict = {}
+        # #2989 mechanism (3'): one ref lookup per DISTINCT (repo, branch)
+        # per pass, not one per row.  Sibling rows legitimately share a
+        # branch (a work row and its conflict-fix, a re-dispatch), which
+        # measured 1.53x redundancy — ~453 wasted calls in a single pass.
+        _false_merge_branch_cache: dict = {}
+        _false_merge_confirmed_clean: list[str] = []
         for a in _false_merge_candidates:
             repo_cfg = config.repo(a.repo_name)
             if repo_cfg is None or not repo_cfg.github:
                 continue
             try:
-                if not github_ops.branch_exists_on_remote(repo_cfg.github, a.branch):
-                    continue  # branch gone — presumed genuinely merged + cleaned up
+                if not github_ops.branch_exists_on_remote(
+                    repo_cfg.github, a.branch, cache=_false_merge_branch_cache
+                ):
+                    # branch gone — presumed genuinely merged + cleaned up,
+                    # and permanently so (#2989).
+                    _false_merge_confirmed_clean.append(a.assignment_id)
+                    continue
                 if github_ops.pr_is_merged(repo_cfg.github, a.branch):
-                    continue  # correctly tracked: a merged PR sits at this exact tip
+                    # correctly tracked: a merged PR sits at this exact tip
+                    _false_merge_confirmed_clean.append(a.assignment_id)
+                    continue
                 base_branch = resolve_base_branch_for_issue_number(
                     repo_cfg,
                     repo_cfg.github,
@@ -3487,13 +3605,20 @@ def reconcile_board_merges(
                 ahead = github_ops.branch_commits_ahead(
                     repo_cfg.github, base_branch, a.branch
                 )
-                if not ahead:  # None (fail-open) or 0 (already an ancestor)
+                if ahead is None:
+                    # fail-open: the probe itself failed, so this row is NOT
+                    # confirmed clean — re-probe it next pass (#2989).
+                    continue
+                if ahead == 0:
+                    # already an ancestor of base: its content landed, and
+                    # that is permanent (#2989).
+                    _false_merge_confirmed_clean.append(a.assignment_id)
                     continue
                 changed_files = github_ops.get_compare_files(
                     repo_cfg.github, base_branch, a.branch
                 )
                 if not changed_files:
-                    continue  # can't confirm anything — fail open
+                    continue  # can't confirm anything — fail open, re-probe
                 content_differs = False
                 differing_path = None
                 for _path in changed_files[:_FALSE_MERGE_AUDIT_MAX_FILES]:
@@ -3514,7 +3639,10 @@ def reconcile_board_merges(
                         differing_path = _path
                         break
                 if not content_differs:
-                    continue  # verbatim on base already — rebase/squash, not lost
+                    # verbatim on base already — rebase/squash, not lost, and
+                    # a terminal row's content cannot un-land (#2989).
+                    _false_merge_confirmed_clean.append(a.assignment_id)
+                    continue
                 actions.append(
                     f"POSSIBLY LOST (#2639): {a.assignment_id} "
                     f"({a.repo_name} #{a.issue_number}, branch={a.branch}) is "
@@ -3535,4 +3663,10 @@ def reconcile_board_merges(
                     f"({a.repo_name} #{a.issue_number}): {exc}"
                 )
 
+        # #2989: persist the terminal marker once, at the end of the sweep —
+        # one board_meta write per pass, not one per row.  Never on a
+        # dry-run: `--dry-run` must not change what the next real pass does.
+        if _false_merge_confirmed_clean and not dry_run:
+            state.mark_false_merge_audit_clean(_false_merge_confirmed_clean)
+
     return actions

{code_coordinator-0.5.315 → code_coordinator-0.5.316}/coord/serve_app.py

@@ -986,7 +986,12 @@ def _reconcile_merges_tick(config: Config) -> list[str]:
     from coord.state import build_board, save_board  # noqa: PLC0415
 
     board = build_board()
-    actions = reconcile_board_merges(board, config)
+    # #2989: the daemon is the ONLY caller that opts into throttling the
+    # false-merge audit (sweep h). It ran on this same 30s tick against a
+    # candidate set proportional to project history — 97% of a reconcile
+    # pass's `gh` calls, and the demand behind the fleet-wide secondary rate
+    # limiting. A manual `coord reconcile-merges` still sweeps every time.
+    actions = reconcile_board_merges(board, config, throttle_false_merge_audit=True)
     save_board(board)
     if actions:
         # #1038: one coarse operational row per tick that did something —

{code_coordinator-0.5.315 → code_coordinator-0.5.316}/coord/state.py

@@ -18,6 +18,7 @@ import sqlite3
 import sys
 import time
 import warnings
+from collections.abc import Iterable
 from dataclasses import asdict, replace
 from datetime import datetime, timezone
 from pathlib import Path
@@ -4363,6 +4364,140 @@ def delete_milestone_gate(*, repo_name: str, tracking_issue: int) -> None:
         )
 
 
+# ── #2989: the false-merge audit's terminal marker ──────────────────────────
+#
+# Sweep (h) of :func:`coord.reconcile.reconcile_board_merges` re-derives
+# "did this branch really land" for `status='merged'` rows.  Its candidate
+# set was proportional to PROJECT HISTORY (1,302 rows on the drive host,
+# growing by one per merge, never shrinking) and it re-probed every one of
+# them against GitHub on the daemon's 30s tick — 97% of a reconcile pass's
+# `gh` calls, and the generator behind the fleet-wide secondary rate
+# limiting #2809/#2858/#2934/#2977 all treated symptomatically.
+#
+# A row whose audit came back CLEAN is clean forever: the branch was
+# deleted after a real merge, or a merged PR sits at its exact tip, or its
+# commits are already an ancestor of base, or its changed files are
+# byte-identical on base.  None of those can un-happen for a row that is
+# already terminal.  Recording the verdict makes the candidate set
+# proportional to *unaudited* merges — bounded by recent throughput — which
+# is the same discipline `coord.gate_snapshot`'s refresh already states
+# ("merged history is never refreshed").
+#
+# Stored as a JSON list of assignment_ids under one board_meta key, in the
+# same seam as `milestone_drains`/`milestone_gates` above.  Local-DB only:
+# the only callers are the daemon's own reconcile tick and a `coord
+# reconcile-merges` CLI run, both of which execute against the canonical DB
+# (a thin client's `coord reconcile-merges` reroutes to the daemon before
+# reaching this code).  Fail-open at both ends — a read or write problem
+# degrades to "re-probe next pass", never to a wrong verdict.
+
+_FALSE_MERGE_AUDIT_CLEAN_KEY = "false_merge_audit_clean"
+
+# Cap on the persisted clean-verdict list.  It is append-only and bounded
+# only by total merge history, so trim it the way a ring buffer would: the
+# most recently confirmed rows are the ones a repeat pass would otherwise
+# re-probe first.  Dropping the tail is safe — a forgotten row just gets
+# re-audited once and re-marked.
+_FALSE_MERGE_AUDIT_CLEAN_MAX = 5000
+
+
+def load_false_merge_audit_clean() -> set[str]:
+    """Return assignment_ids whose false-merge audit already came back clean.
+
+    Fails open to an empty set on any read problem — the caller then simply
+    re-probes, which is correct-but-slower, never wrong.
+    """
+    try:
+        conn = get_connection()
+        row = sql.execute(
+            conn,
+            "SELECT value FROM board_meta WHERE key = ?",
+            (_FALSE_MERGE_AUDIT_CLEAN_KEY,),
+        ).fetchone()
+    except Exception:  # noqa: BLE001 — advisory cache, never load-bearing
+        return set()
+    if row is None:
+        return set()
+    try:
+        data = json.loads(row["value"])
+    except (TypeError, ValueError):
+        return set()
+    if not isinstance(data, list):
+        return set()
+    return {str(x) for x in data if isinstance(x, (str, int))}
+
+
+def mark_false_merge_audit_clean(assignment_ids: Iterable[str]) -> None:
+    """Record *assignment_ids* as permanently audited-clean (idempotent).
+
+    Never raises — this is an optimisation marker, and a board that cannot
+    persist it must still reconcile correctly (just without the speedup).
+    """
+    new = {str(a) for a in assignment_ids if a}
+    if not new:
+        return
+    try:
+        conn = get_connection()
+        with conn:
+            existing = load_false_merge_audit_clean()
+            merged = existing | new
+            if merged == existing:
+                return
+            # Keep insertion order stable-ish (old first, newly-confirmed
+            # last) so the trim below drops the oldest confirmations.
+            ordered = [a for a in existing if a in merged]
+            ordered += [a for a in new if a not in existing]
+            if len(ordered) > _FALSE_MERGE_AUDIT_CLEAN_MAX:
+                ordered = ordered[-_FALSE_MERGE_AUDIT_CLEAN_MAX:]
+            sql.upsert(
+                conn,
+                "board_meta",
+                ["key", "value"],
+                (_FALSE_MERGE_AUDIT_CLEAN_KEY, json.dumps(ordered)),
+                conflict_columns=["key"],
+            )
+    except Exception:  # noqa: BLE001 — advisory cache, never load-bearing
+        return
+
+
+_FALSE_MERGE_AUDIT_LAST_RUN_KEY = "false_merge_audit_last_run"
+
+
+def get_false_merge_audit_last_run() -> float:
+    """Epoch seconds of the last throttled false-merge audit, 0.0 if never."""
+    try:
+        conn = get_connection()
+        row = sql.execute(
+            conn,
+            "SELECT value FROM board_meta WHERE key = ?",
+            (_FALSE_MERGE_AUDIT_LAST_RUN_KEY,),
+        ).fetchone()
+    except Exception:  # noqa: BLE001
+        return 0.0
+    if row is None:
+        return 0.0
+    try:
+        return float(row["value"])
+    except (TypeError, ValueError):
+        return 0.0
+
+
+def set_false_merge_audit_last_run(when: float) -> None:
+    """Stamp the last throttled false-merge audit run. Never raises."""
+    try:
+        conn = get_connection()
+        with conn:
+            sql.upsert(
+                conn,
+                "board_meta",
+                ["key", "value"],
+                (_FALSE_MERGE_AUDIT_LAST_RUN_KEY, repr(float(when))),
+                conflict_columns=["key"],
+            )
+    except Exception:  # noqa: BLE001
+        return
+
+
 # ── #1630: fleet-health aggregation ─────────────────────────────────────────
 # Local-DB only, like list_milestone_drains above — the only writer is the
 # daemon's own health-poll tick (coord.serve_app), which always runs