code-coordinator 0.5.326__tar.gz → 0.5.328__tar.gz

{code_coordinator-0.5.326 → code_coordinator-0.5.328}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.326
+Version: 0.5.328
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.326 → code_coordinator-0.5.328}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.326
+Version: 0.5.328
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.326 → code_coordinator-0.5.328}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.326",
+  "tag": "0.5.328",
   "distance": 0,
-  "node": "g4f5acb0a5caf92650d4867c894085c97109eebc7",
+  "node": "g96977c771489f05d7c30eb4cc2696206c872072b",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-31"

{code_coordinator-0.5.326 → code_coordinator-0.5.328}/coord/agent.py

@@ -4027,14 +4027,36 @@ response (a session that silently chose to file instead of asking is \
 exactly the failure this design exists to prevent); the submission's \
 OUTCOME, AUDIENCE, DONE DEFINITION, and CONSTRAINTS; its mapped repo(s); \
 `coordinator.yml` topology context for those repo(s) (depends_on, which \
-machines claim each repo); and a RUNNING CONTEXT section rendering the \
-submission's full ledger so far — every question asked and (if answered) \
-its answer, every decision on record (current and archived, archived ones \
-carrying WHY they were ruled out), and the current narrative. Read \
-RUNNING CONTEXT before doing anything else: never re-ask a question already \
-answered there, and never re-propose a decision already archived there \
-without new information that changes the calculus — cite the existing \
-entry's seq/reason if the operator or a re-briefed fact brings it up again.
+machines claim each repo); a HOUSE STACK section (#2997) naming what the \
+REST of this org's registered repos already run and deploy on, which \
+managed services are already in use and already paid for, and any coord \
+gate that assumes a particular host; and a RUNNING CONTEXT section \
+rendering the submission's full ledger so far — every question asked and \
+(if answered) its answer, every decision on record (current and archived, \
+archived ones carrying WHY they were ruled out), and the current \
+narrative. Read RUNNING CONTEXT before doing anything else: never re-ask a \
+question already answered there, and never re-propose a decision already \
+archived there without new information that changes the calculus — cite \
+the existing entry's seq/reason if the operator or a re-briefed fact \
+brings it up again.
+
+**HOUSE STACK is context, not a mandate** — you may still propose \
+something outside it when it genuinely fits better (a greenfield repo is \
+not required to inherit the fleet's stack). But you may never propose a \
+stack/architecture/hosting/vendor decision in SILENCE about it: if HOUSE \
+STACK names a service that's a plausible fit and you're proposing \
+something else, you MUST record the house-stack option itself as a \
+considered-and-rejected alternative (`coord portal decision propose` \
+naming it, then `coord portal decision reject ... "<why it loses>"`) in \
+the SAME iteration you propose your own recommendation — the same \
+"record every alternative you seriously considered and ruled OUT" rule the \
+PROPOSE terminal move already requires below applies to the house stack \
+first, not last. The failure this closes (#2997, SUB-1EA1D3) was a session \
+proposing a brand-new vendor for a greenfield repo with FOUR rejected \
+alternatives on record and Cloudflare — the stack the rest of the org \
+already runs and pays for — never mentioned in any of them. Silence, not \
+disagreement, was the bug; a reasoned rejection is a completely fine \
+outcome.
 
 You can always re-fetch the live ledger mid-session with:
 

{code_coordinator-0.5.326 → code_coordinator-0.5.328}/coord/commands/portal.py

@@ -731,6 +731,7 @@ def _run_decompose_chat_interactive(
         build_decomposition_chat_briefing,
         describe_unapproved_submission,
         fetch_running_context,
+        house_stack_context,
         render_running_context_section,
         repo_topology_context,
         resolve_approved_submission,
@@ -794,6 +795,7 @@ def _run_decompose_chat_interactive(
     # that the Ask move would "refuse loudly" — no longer true.
 
     topology_context = repo_topology_context(cfg, repos)
+    house_stack = house_stack_context(cfg, exclude_repos=repos)
     discuss_mode, discuss_reason = select_discuss_mode(cfg, submission, discuss_override=discuss)
     running_context = render_running_context_section(fetch_running_context(submission_id))
     briefing = build_decomposition_chat_briefing(
@@ -802,6 +804,7 @@ def _run_decompose_chat_interactive(
         discuss=discuss_mode,
         discuss_reason=discuss_reason,
         running_context_section=running_context,
+        house_stack_context_section=house_stack,
     )
 
     repo_path = str(_Path(machine.repo_path(repos[0]) or str(_Path.cwd())).expanduser())
@@ -819,9 +822,9 @@ def _run_decompose_chat_interactive(
     seed_prompt = (
         f"Intake session for portal submission {submission_id} "
         f"(MODE: {mode_word} — {discuss_reason}): read the full context at "
-        f"{brief_path} (submission fields, repo topology, and the running-"
-        "context ledger so far) and let's work through it. This is an "
-        "ATTENDED session: state your read and your PROPOSED exit, then stop "
+        f"{brief_path} (submission fields, repo topology, the house stack, "
+        "and the running-context ledger so far) and let's work through it. "
+        "This is an ATTENDED session: state your read and your PROPOSED exit, then stop "
         "and wait for me — write nothing until I answer (#2867)."
     )
 

{code_coordinator-0.5.326 → code_coordinator-0.5.328}/coord/dao.py

@@ -393,6 +393,15 @@ class SqliteStore:
         forward-compatible stand-in the issue asks for (#1039 can replace the
         semantics without a wire-shape change — it's still one integer).
         Fail-open to 0 so a missing/pre-migration table never 503s the board.
+
+        #2983: that fail-open needs a rollback to actually be fail-open on
+        Postgres. This runs inside a caller's ``with closing(self._connect())``
+        block alongside many other reads (``_board_meta``, ``_round_number``,
+        every ``_table`` call in ``board_projection``), and Postgres aborts the
+        whole transaction on a failed statement — so a missing ``audit_log``
+        took out every *sibling* read on that connection too, producing
+        precisely the 503 this guard exists to prevent. Nothing uncommitted
+        can be lost: ``SqliteStore``'s connections are opened read-only.
         """
         try:
             cutoff = time.time() - _AUDIT_RECENT_WINDOW_SECONDS
@@ -400,7 +409,8 @@ class SqliteStore:
                 conn, "SELECT COUNT(*) AS n FROM audit_log WHERE ts >= ?", (cutoff,)
             ).fetchone()
             return int(row["n"]) if row else 0
-        except sql.driver_error(conn):
+        except sql.driver_error(conn) as exc:
+            db_mod.rollback_after_driver_error(conn, exc)  # #2983: caller reuses `conn`
             return 0
 
     # ── public reads ────────────────────────────────────────────────────────────

{code_coordinator-0.5.326 → code_coordinator-0.5.328}/coord/db.py

@@ -429,6 +429,79 @@ def close() -> None:
 
 _T = TypeVar("_T")
 
+
+# ── Recovering a connection after a swallowed driver error (#2983) ──────────
+
+
+def _board_connection_if_open() -> Any | None:
+    """This process's already-open board connection, or ``None`` (#2983).
+
+    Deliberately NOT :func:`get_connection`: this is called from inside a
+    driver-error handler, where *opening* a connection that wasn't open
+    before would be a surprising side effect (and, on the SQLite path,
+    would create the database file). It only ever hands back a connection
+    something else already opened — the ``override_connection()``/SQLite
+    singleton, else THIS thread's Postgres connection, mirroring
+    :func:`get_connection`'s own precedence order.
+    """
+    if _conn is not None:
+        return _conn
+    return getattr(_pg_thread_local, "conn", None)
+
+
+def rollback_after_driver_error(conn: Any | None, exc: BaseException) -> None:
+    """Clear the aborted transaction *exc* left behind on *conn*, so a
+    handler that swallowed *exc* and keeps using the same connection still
+    has a usable one (#2983).
+
+    **The rule this implements.** After catching a driver error through the
+    dialect seam (``except sql.driver_error(conn):`` /
+    ``except sql.driver_errors():``), a handler that intends to CONTINUE on
+    the same connection must roll back first. A handler that re-raises need
+    not. Postgres aborts the *whole* transaction on any failed statement,
+    so without this every statement issued afterwards on that connection —
+    for the rest of the process, since ``coord.db``'s connection is a
+    process-/thread-lived singleton — raises
+    ``psycopg.errors.InFailedSqlTransaction``. That is what made the whole
+    #2597/#2689/#2784 degrade-gracefully layer inert or actively harmful on
+    the second backend: guards written to *prevent* a crash caused one.
+    SQLite has no such concept — a failed statement there leaves the
+    connection perfectly usable — which is exactly why every one of these
+    21 handler sites read as correct for years.
+
+    **Gated on the exception, not on the connection's dialect.** *exc* is a
+    Postgres driver error iff it carries a SQLSTATE (``psycopg3``'s
+    ``.sqlstate``, ``psycopg2``'s ``.pgcode`` — the same pair
+    :func:`is_lock_contention_error` dispatches on, for the same #2719
+    reason: no config flag, no driver import). Keying off that rather than
+    ``sql.detect_dialect(conn)`` makes "SQLite behaviour is byte-identical
+    to before #2983" true *by construction* rather than by argument: a
+    ``sqlite3.Error`` has no SQLSTATE, so this returns without touching the
+    connection and no SQLite caller can lose uncommitted work it expected
+    to survive into the next statement (``retry_on_locked``'s multi-
+    statement writers being the case where that would actually be
+    observable). #2982's sibling fix in ``_migrate_add_columns`` predates
+    this helper and rolls back unconditionally; it is correct there (the
+    only uncommitted statement at that point is the one that just failed)
+    and is deliberately left as-is.
+
+    A ``None`` *conn* is a no-op — see :func:`_board_connection_if_open`,
+    which may legitimately have nothing to hand over. A failure of the
+    rollback itself is suppressed: this runs inside an ``except`` block
+    whose original exception is the interesting one, and masking it with a
+    secondary error from the recovery attempt would be strictly worse than
+    leaving the connection unrecovered.
+    """
+    if conn is None:
+        return
+    if getattr(exc, "sqlstate", None) is None and getattr(exc, "pgcode", None) is None:
+        return  # not a Postgres driver error — nothing was aborted
+    try:
+        conn.rollback()
+    except Exception:  # noqa: BLE001 — never mask the caught driver error
+        pass
+
+
 # #2538: a handful of consecutive short retries — long enough to ride out a
 # concurrent writer (the daemon's own passive tick, another `coord merge`/
 # `coord notify` invocation) that only holds the DB for a moment, short
@@ -517,6 +590,7 @@ def is_lock_contention_error(exc: BaseException) -> bool:
 def retry_on_locked(
     write: Callable[[], _T],
     *,
+    conn: Any | None = None,
     attempts: int = _LOCK_RETRY_ATTEMPTS,
     base_delay: float = _LOCK_RETRY_BASE_DELAY_S,
 ) -> _T:
@@ -547,12 +621,58 @@ def retry_on_locked(
     ``coord.state._record_dispatched_assignment_local``, whose caller —
     ``coord.auto_loop._dispatch_fix`` — treats it as a declined dispatch
     rather than letting it crash the whole run).
+
+    Transaction recovery, and whether "retry" means anything on Postgres
+    (#2983)
+    ------------------------------------------------------------------
+    SQLite's ``SQLITE_BUSY`` retry model is "the statement never ran; the
+    lock is held elsewhere; the transaction is untouched" — so re-running
+    *write* verbatim is exactly the right move, and has been since #2538.
+    Postgres's three contention SQLSTATEs
+    (:data:`_POSTGRES_LOCK_CONTENTION_SQLSTATES`) are contention-shaped in
+    the same way, but they ALSO abort the whole transaction. That makes the
+    retry loop *worse than useless* on Postgres without recovery: attempt 2
+    onwards raises ``InFailedSqlTransaction`` instead of re-attempting the
+    write, ``is_lock_contention_error`` reads False for it, and the loop
+    bails out on attempt 2 re-raising the wrong error — the #2597/#2689
+    retry budget silently reduced to a single attempt.
+
+    So the answer to "does SQLite's retry model have a Postgres analogue at
+    all, or should the retry just be a no-op there?" is: it has one, and it
+    is the standard Postgres idiom — **roll back, then re-run the whole
+    transaction.** Every *write* callable in this tree is already a
+    self-contained transaction (its own statements followed by its own
+    ``conn.commit()``), which is precisely what makes re-running it after a
+    rollback correct rather than a partial replay. Hence
+    :func:`rollback_after_driver_error` before both the retry and the final
+    re-raise: after the re-raise the connection must still be usable too,
+    because ~13 of this tree's callers catch that exception and *swallow*
+    it (a cache mirror whose upstream GitHub write already landed must not
+    turn into a 503), then keep using the same singleton connection.
+    Recovering here rather than in each of those handlers is what keeps the
+    guarantee in one place: **when this function returns OR raises, it has
+    not left an aborted transaction behind.**
+
+    *conn* is the connection *write* writes through, needed only for that
+    rollback. It defaults to :func:`_board_connection_if_open` because
+    every call site in this tree writes through ``get_connection()``
+    (``coord.state``, ``coord.merge_queue``, ``coord.audit``,
+    ``coord.commands.merge``), so the default is correct for all of them
+    and none had to be churned; pass it explicitly if you ever write
+    through a different connection. Rolling back an innocent already-
+    committed connection would be a no-op anyway — every writer here
+    commits immediately — and the rollback is skipped entirely unless the
+    caught exception carries a Postgres SQLSTATE, so the SQLite path is
+    byte-identical to before #2983.
     """
     delay = base_delay
     for attempt in range(1, attempts + 1):
         try:
             return write()
         except sql.driver_errors() as exc:
+            rollback_after_driver_error(
+                conn if conn is not None else _board_connection_if_open(), exc
+            )
             if not is_lock_contention_error(exc) or attempt >= attempts:
                 raise
             time.sleep(delay)
@@ -619,10 +739,21 @@ def _read_schema_version(conn: sqlite3.Connection) -> int:
     the current ``_DB_SCHEMA_VERSION`` and skips the write path entirely —
     until the next bump (#2675: that skip is exactly what silently dropped
     two `_migrate_add_columns` entries when they landed without one).
+
+    #2983: the "table doesn't exist yet" swallow below needs its own
+    rollback — #2982's fix is one layer downstream and does not cover this.
+    On a fresh Postgres database this is the FIRST statement `_open_postgres`
+    -> `_migrate_if_needed` runs, it errors (`UndefinedTable`), and that
+    aborts the transaction; the caller then continues on the same connection
+    straight into `_fix_schema_version_table`'s `CREATE TABLE IF NOT
+    EXISTS`, which raises `InFailedSqlTransaction`. So on Postgres the
+    brand-new-database path — the one case this guard exists for — could
+    never get past its own first statement.
     """
     try:
         row = sql.execute(conn, "SELECT MAX(version) FROM schema_version").fetchone()
-    except sql.driver_errors():  # #2784: was sqlite3.OperationalError only
+    except sql.driver_errors() as exc:  # #2784: was sqlite3.OperationalError only
+        rollback_after_driver_error(conn, exc)  # #2983: caller keeps using `conn`
         return 0  # table doesn't exist yet
     if row is None or row[0] is None:
         return 0

{code_coordinator-0.5.326 → code_coordinator-0.5.328}/coord/decomposition_chat.py

@@ -409,6 +409,209 @@ def pick_decomposition_chat_machine(cfg: "Config", repos: list[str]) -> "Machine
     return None
 
 
+# ── #2997: HOUSE STACK — the fleet's existing stack, not just this
+# submission's mapped repo(s). See the module briefing (SUB-1EA1D3, the
+# grocery-list submission) for why this section exists: a MODE: DISCUSS
+# iteration proposed Vite+React+Supabase for a greenfield repo without ever
+# weighing Cloudflare — the stack every other repo in this org already runs
+# and pays for — because nothing in the briefing carried it. This section is
+# CONTEXT, not a mandate (the design sketch's own framing): a session may
+# still propose something else, but the system prompt (coord/agent.py) is
+# what requires it to then record the house alternative as a
+# considered-and-rejected decision rather than staying silent about it.
+
+#: Root-level marker file -> the stack signal its mere presence implies.
+#: Deliberately mechanical and small, same posture as `_SEEDED_ROOT_FILES`
+#: above: cheap to check, cheap to extend, wrong at worst by omission (a
+#: repo using something unlisted here just contributes nothing) never by a
+#: false positive.
+_ROOT_STACK_MARKERS: dict[str, str] = {
+    "wrangler.toml": "Cloudflare Workers/Pages (wrangler.toml)",
+    "Cargo.toml": "Rust (Cargo.toml)",
+    "package.json": "Node/TypeScript (package.json)",
+    "pyproject.toml": "Python (pyproject.toml)",
+}
+
+#: Same idea, scoped to `.github/workflows/` — a deploy LANE is a workflow
+#: file, not a root marker.
+_WORKFLOW_STACK_MARKERS: dict[str, str] = {
+    "deploy-cloudflare.yml": "Cloudflare Pages deploy (.github/workflows/deploy-cloudflare.yml)",
+}
+
+#: `wrangler.toml` binding keys -> the managed Cloudflare service they name
+#: (Cloudflare's own `wrangler.toml` schema) — read only when the file is
+#: actually present, so this never guesses at a service that isn't wired up.
+_WRANGLER_BINDING_MARKERS: dict[str, str] = {
+    "d1_databases": "Cloudflare D1 (bound in wrangler.toml)",
+    "r2_buckets": "Cloudflare R2 (bound in wrangler.toml)",
+    "kv_namespaces": "Cloudflare KV (bound in wrangler.toml)",
+}
+
+#: Keywords worth a mention when they show up in a repo's own `CLAUDE.md` —
+#: the design sketch's "cheapest read from each repo's own CLAUDE.md" half,
+#: for a lane that leaves no marker file at all (e.g. Cloudflare Access,
+#: which is edge config, never a repo artifact — coord-portal's own
+#: `docs/CUSTOMER_PORTAL.md` names it in prose, not in a file this module
+#: could otherwise detect). Casefolded substring match: a false positive
+#: here only adds one extra weighed line, never a wrong guess about what
+#: exists, since the word is genuinely present in the repo's own docs.
+_CLAUDE_MD_KEYWORD_MARKERS: dict[str, str] = {
+    "cloudflare access": "Cloudflare Access (mentioned in CLAUDE.md)",
+    "cloudflare pages": "Cloudflare Pages (mentioned in CLAUDE.md)",
+    "cloudflare d1": "Cloudflare D1 (mentioned in CLAUDE.md)",
+    "cloudflare r2": "Cloudflare R2 (mentioned in CLAUDE.md)",
+}
+
+
+def _repo_stack_signals(repo_github: str, branch: str) -> list[str]:
+    """Mechanical, best-effort stack signals for *repo_github* on *branch* —
+    root-level marker files, known deploy-workflow files under
+    `.github/workflows/`, and (when `wrangler.toml` is present) the managed
+    Cloudflare services it binds.
+
+    **Degrades gracefully** (#2997 acceptance criterion): any lookup
+    failure, or a repo with nothing recognisable, returns `[]` rather than a
+    guess — this feeds an informational briefing section, not a gate, so
+    silence is always the safe failure mode.
+
+    "Any lookup failure" is meant literally, hence the deliberately broad
+    ``except Exception`` guards below rather than the narrow
+    ``RuntimeError``/``ValueError`` pair an earlier revision used. The
+    Contents-API seam this walks is not exception-typed end to end:
+    ``github_ops.list_repo_dir`` indexes ``entry["name"]`` on whatever JSON
+    came back (``KeyError``/``TypeError`` on a malformed or
+    unexpectedly-shaped payload), and ``_gh`` itself is a subprocess
+    boundary that a caller lower in the stack can surface as ``OSError``.
+    None of those are worth turning an *informational* paragraph into a
+    hard failure of ``coord portal decompose-chat`` for — a crash here
+    costs the operator the whole intake session, while a swallowed lookup
+    costs one unweighed line.
+    """
+    from coord import github_ops  # noqa: PLC0415
+
+    try:
+        root_files, root_dirs = _dir_entries(repo_github, "", branch)
+    except Exception:  # noqa: BLE001 - informational section, never a gate
+        return []
+
+    signals = [label for marker, label in _ROOT_STACK_MARKERS.items() if marker in root_files]
+
+    def _file_text(path: str) -> str:
+        """*path*'s contents on *branch*, or ``""`` on any lookup failure."""
+        try:
+            text = github_ops.get_repo_file(repo_github, path, branch)
+            # `isinstance` rather than a bare return: a Contents-API payload
+            # that decodes to something other than text must not turn a
+            # substring probe below into a `TypeError`.
+            return text if isinstance(text, str) else ""
+        except Exception:  # noqa: BLE001 - see the docstring
+            # Covers `binascii.Error` (a ValueError subclass) from
+            # `get_repo_file_with_sha`'s `base64.b64decode` on a malformed
+            # Contents-API response, `GhError` from the subprocess boundary,
+            # and anything else the seam can surface: this feeds an
+            # informational section, not a gate, so a failed read degrades
+            # to "no signal" rather than blowing up the briefing build.
+            return ""
+
+    def _entries(path: str) -> tuple[list[str], list[str]]:
+        """``(files, dirs)`` under *path*, or ``([], [])`` on any failure."""
+        try:
+            return _dir_entries(repo_github, path, branch)
+        except Exception:  # noqa: BLE001 - see the docstring
+            return [], []
+
+    if "wrangler.toml" in root_files:
+        wrangler_text = _file_text("wrangler.toml")
+        signals += [
+            label for key, label in _WRANGLER_BINDING_MARKERS.items() if key in wrangler_text
+        ]
+
+    if "CLAUDE.md" in root_files:
+        claude_md_text = _file_text("CLAUDE.md").casefold()
+        signals += [
+            label for key, label in _CLAUDE_MD_KEYWORD_MARKERS.items() if key in claude_md_text
+        ]
+
+    if ".github" in root_dirs:
+        _, gh_dirs = _entries(".github")
+        if "workflows" in gh_dirs:
+            wf_files, _ = _entries(".github/workflows")
+            signals += [
+                label for marker, label in _WORKFLOW_STACK_MARKERS.items() if marker in wf_files
+            ]
+
+    return signals
+
+
+def house_stack_context(cfg: "Config", exclude_repos: list[str] | None = None) -> str:
+    """Render the HOUSE STACK briefing section: what the *rest* of the
+    fleet's repos already run and deploy on, derived mechanically from each
+    registered repo's tracked files rather than hand-maintained (the design
+    sketch's own preference — a hand-maintained approved-stack list rots and
+    suppresses the reasoning the decision archive exists to capture).
+
+    *exclude_repos* is normally the submission's own mapped repo(s) — the
+    one(s) actually being decomposed, which say nothing about "the REST of
+    the fleet" even when they aren't greenfield.
+
+    A repo that contributes no recognisable signal (no CLAUDE.md, no known
+    marker file, no known workflow file) is omitted from the per-repo list
+    entirely — #2997's "degrades gracefully" criterion: nothing beats a
+    wrong guess. When *no* repo in the fleet contributes anything, the whole
+    section reads as empty rather than asserting a managed-services list or
+    a host-coupled gate that nothing here actually evidences.
+
+    One sick repo never costs the operator the whole intake session: each
+    repo's probe is isolated, so a lookup that blows up for `acme/api`
+    still leaves `acme/coord-portal`'s Cloudflare signal in the rendered
+    section. This section is built on the critical path of *every*
+    `coord portal decompose-chat` (headless and `--interactive` alike) —
+    an informational paragraph must never be able to abort a dispatch.
+    """
+    exclude = set(exclude_repos or [])
+    per_repo: list[str] = []
+    saw_cloudflare = False
+    for repo_cfg in cfg.repos:
+        if repo_cfg.name in exclude:
+            continue
+        branch = repo_cfg.default_branch or "main"
+        try:
+            signals = _repo_stack_signals(repo_cfg.github, branch)
+        except Exception:  # noqa: BLE001 - one repo must not sink the section
+            continue
+        if not signals:
+            continue
+        per_repo.append(f"- {repo_cfg.name} ({repo_cfg.github}): {'; '.join(signals)}")
+        if any("Cloudflare" in s for s in signals):
+            saw_cloudflare = True
+
+    if not per_repo:
+        return (
+            "HOUSE STACK (fleet-wide, #2997): no recognisable stack/deploy signal on any "
+            "other registered repo — nothing to weigh here."
+        )
+
+    lines = [
+        "HOUSE STACK (fleet-wide, not just this submission's mapped repo(s) — #2997):",
+        *per_repo,
+        "",
+        "This is CONTEXT, not a mandate: propose something else if it genuinely fits "
+        "better, but if you do, record the house-stack alternative as a "
+        "considered-and-rejected decision with a reason (`coord portal decision propose` "
+        "then `coord portal decision reject ... \"<why the house stack loses>\"`) instead "
+        "of leaving it unweighed.",
+    ]
+    if saw_cloudflare:
+        lines.append("")
+        lines.append(
+            "Gate that assumes a host: `coord portal enqueue-preview` reads a Cloudflare "
+            "Pages PREVIEW deployment URL created per-PR by `cloudflare/pages-action` "
+            "(docs/CUSTOMER_PORTAL.md) — choosing a different host means the #2359 "
+            "customer preview-approval gate does not apply without new coord work."
+        )
+    return "\n".join(lines)
+
+
 def repo_topology_context(cfg: "Config", repos: list[str]) -> str:
     """One paragraph of `coordinator.yml` topology per mapped repo — the
     "coordinator.yml topology context ... the same way docs/CUSTOMER_PORTAL.md's
@@ -442,6 +645,7 @@ def build_decomposition_chat_briefing(
     discuss: bool,
     discuss_reason: str,
     running_context_section: str = "",
+    house_stack_context_section: str = "",
 ) -> str:
     """Compose the seed briefing the worker sees as its first user message.
 
@@ -454,6 +658,15 @@ def build_decomposition_chat_briefing(
     pane already shows the operator (ms-67 contract §4b: "nothing hidden
     between 'looks right in the panel' and 'is what the session got'"),
     plus everything #2749's ledger has accumulated across prior iterations.
+
+    **#2997:** also carries a HOUSE STACK section (*house_stack_context_section*,
+    normally :func:`house_stack_context`'s output) — the fleet's existing
+    stack and infrastructure conventions, which used to be entirely absent
+    from this briefing. That gap is what let a MODE: DISCUSS iteration on a
+    greenfield repo propose a brand-new vendor (Supabase) without ever
+    weighing the Cloudflare stack the rest of this org already runs and
+    pays for (SUB-1EA1D3, this issue's own measured regression case). Empty
+    by default so every existing caller/test keeps working unchanged.
     """
     submission_id = submission.get("submission_id", "")
     repos = submission.get("repos") or []
@@ -484,6 +697,11 @@ def build_decomposition_chat_briefing(
     parts.append("COORDINATOR.YML TOPOLOGY CONTEXT:")
     parts.append(topology_context)
     parts.append("")
+    parts.append(
+        house_stack_context_section.strip()
+        or "HOUSE STACK (fleet-wide, #2997): (not computed for this briefing)"
+    )
+    parts.append("")
     parts.append(
         running_context_section.strip()
         or "RUNNING CONTEXT (from the portal ledger): (none yet — first iteration)"
@@ -677,6 +895,7 @@ def dispatch_decomposition_chat(
         machine = picked
 
     topology_context = repo_topology_context(config, repos)
+    house_stack = house_stack_context(config, exclude_repos=repos)
     discuss_mode, discuss_reason = select_discuss_mode(
         config, submission, discuss_override=discuss
     )
@@ -687,6 +906,7 @@ def dispatch_decomposition_chat(
         discuss=discuss_mode,
         discuss_reason=discuss_reason,
         running_context_section=running_context,
+        house_stack_context_section=house_stack,
     )
 
     resolved_model = config.models.default

{code_coordinator-0.5.326 → code_coordinator-0.5.328}/coord/merge_queue.py

@@ -42,7 +42,7 @@ from coord.ci_store import (
     summarize,
     summarize_counts,
 )
-from coord.db import get_connection, retry_on_locked
+from coord.db import get_connection, retry_on_locked, rollback_after_driver_error
 from coord.forge_availability import MERGE_GATE_REFUSAL_KINDS, record_merge_gate_refusal
 from coord.models import (
     CLOSES_ISSUE_TYPES,
@@ -3812,11 +3812,23 @@ def _archived_merged_issue_keys(conn: sqlite3.Connection) -> set[tuple[str, int]
             "SELECT repo_name, issue_number FROM merge_queue_archive WHERE state = ?",
             (MERGED,),
         ).fetchall()
-    except sql.driver_errors():  # #2784: not just sqlite3.OperationalError
+    except sql.driver_errors() as exc:  # #2784: not just sqlite3.OperationalError
         # "no such table" surfaces as a *different* driver-named exception
         # per backend (sqlite3.OperationalError vs psycopg.errors.
         # UndefinedTable), so this must go through the dialect seam or the
         # not-yet-archived case becomes an uncaught crash on Postgres.
+        #
+        # #2983: and catching it is only half the job. `conn` here is the
+        # process-lived `get_connection()` singleton, which the caller
+        # (`merged_issue_keys`, and in turn `enqueue_approved_work` /
+        # `staging_items`) keeps writing and reading through long after this
+        # returns — on Postgres the swallowed UndefinedTable aborts that
+        # connection's transaction, so the "archive doesn't exist yet"
+        # degrade turned every subsequent statement into
+        # InFailedSqlTransaction. Nothing uncommitted is at risk: this
+        # function only reads, and on Postgres the abort had already
+        # discarded anything pending regardless.
+        rollback_after_driver_error(conn, exc)
         return set()
     return {(r["repo_name"], r["issue_number"]) for r in rows}