codna 0.2.7__tar.gz → 0.2.9__tar.gz

{codna-0.2.7 → codna-0.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.7
+Version: 0.2.9
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.7 → codna-0.2.9}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.7"
+__version__ = "0.2.9"

{codna-0.2.7 → codna-0.2.9}/codna/admission_control.py

@@ -122,10 +122,32 @@ def make_mojo_breach_fn(client: object | None = None, *, fallback: BreachFn = _n
     return _fn
 
 
+# The sidecar's own capacity gate: run-server.ts reads AGENT_CORE_MAX_CONCURRENCY (same 8 fallback)
+# and sheds anything beyond it with 429 `agent_core_saturated`. Read it from ONE place so the admitter
+# tracks the real limit instead of a constant that merely happens to match — nothing sets this variable
+# when the sidecar is spawned (runtime/local_stack.py), so the two 8s were previously equal only by
+# coincidence. Admitting above it cannot buy throughput; it just converts admissions into 429 retries.
+_SIDECAR_CEILING_FALLBACK = 8
+
+
+def sidecar_ceiling() -> int:
+    """Hard concurrency the agent-core sidecar will actually accept."""
+    import os
+
+    try:
+        return max(1, int(os.environ.get("AGENT_CORE_MAX_CONCURRENCY", _SIDECAR_CEILING_FALLBACK)))
+    except ValueError:
+        return _SIDECAR_CEILING_FALLBACK
+
+
 @dataclass
 class AdmissionConfig:
-    ceiling: int = 8                 # hard max concurrency (== sidecar AGENT_CORE_MAX_CONCURRENCY)
-    model_rate_budget: int = 8       # concurrent model calls the provider rate-limit comfortably allows
+    ceiling: int = _SIDECAR_CEILING_FALLBACK  # hard max; clamped to sidecar_ceiling() in get_admitter()
+    # Concurrent model calls the provider rate-limit comfortably allows. 4, NOT 8: this is the
+    # deterministic floor (det_cap = min(ceiling, model_rate_budget)), and get_admitter() has always
+    # constructed it with 4 while this default said 8 — so det_cap silently doubled depending on which
+    # entry point built the config. One value, one meaning.
+    model_rate_budget: int = 4
     sla_s: float = 900.0             # per-fix wall-clock budget (the timeout)
     breach_threshold: float = 0.10   # admit in the MC zone only while P(SLA breach) < this
     trials: int = 4000               # MC draws
@@ -264,10 +286,16 @@ def get_admitter() -> MCAdmissionDecider:
             if _ADMITTER is None:
                 mc = os.environ.get("CODNA_ADMISSION_MC", "mojo").strip().lower()
                 mc_fn = make_mojo_breach_fn() if mc == "mojo" else _numpy_breach_probability
+                # CLAMPED to what the sidecar will accept: admitting past its MAX_CONCURRENCY only
+                # turns admissions into 429 `agent_core_saturated` retries, so a larger
+                # CODNA_FIX_CEILING would buy queueing, not throughput.
+                hard = sidecar_ceiling()
                 _ADMITTER = MCAdmissionDecider(
                     AdmissionConfig(
-                        ceiling=int(os.environ.get("CODNA_FIX_CEILING", "8")),
-                        model_rate_budget=int(os.environ.get("CODNA_MODEL_RATE_BUDGET", "4")),
+                        ceiling=min(int(os.environ.get("CODNA_FIX_CEILING", str(hard))), hard),
+                        model_rate_budget=int(
+                            os.environ.get("CODNA_MODEL_RATE_BUDGET", str(AdmissionConfig.model_rate_budget))
+                        ),
                         sla_s=float(os.environ.get("CODNA_FIX_SLA_S", "900")),
                     ),
                     mc_fn=mc_fn,

{codna-0.2.7 → codna-0.2.9}/codna/agent-core/run-server.bundle.mjs

@@ -110643,7 +110643,7 @@ var init_bowser = __esm(() => {
 
 // agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.js
 var require_client2 = __commonJS((exports) => {
-  var __dirname = "/Users/angel/Developer/actions-runner/_work/codna/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
+  var __dirname = "/Users/angel/actions-runner-mac-2/_work/codna/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
   var retry2 = require_retry2();
   var protocols = require_protocols();
   var lambdaInvokeStore = require_invoke_store();

{codna-0.2.7 → codna-0.2.9}/codna/webhook_worker.py

@@ -31,6 +31,7 @@ from dataclasses import dataclass
 from typing import Any, Callable
 
 from . import webhook_github, webhook_metering
+from .admission_control import get_admitter
 from .agent_core_runtime import PROVIDER_RUNTIME_ENV_KEYS
 from .webhook import WebhookError, WebhookJob, codna_command, webhook_marker
 from .webhook_queue import _MAX_ATTEMPTS, QueuedJob, WebhookQueue
@@ -60,7 +61,11 @@ _SAFE_CONFIG = frozenset({
     "CODNA_SIDECAR_DIR", "CODNA_AGENT_CORE_DIR", "CODNA_RUNTIME_ROOT", "CODNA_PORT_BASE",
     "ALGENTA_ENGINE_DIR", "TELYS_HOME",
     "CODNA_AGENT_MODEL", "CODNA_FIX_MODEL", "ALGENTA_AGENT_MODEL", "ALGENTA_AGENT_PROVIDER",
-    "CODNA_FIX_SLA_S", "CODNA_FIX_CEILING", "CODNA_TIMEOUT_S",
+    # Admission tuning (admission_control.get_admitter). SLA and ceiling were already here;
+    # MODEL_RATE_BUDGET is the deterministic floor and was missing, so a hosted job could see two of
+    # the three knobs and silently fall back to the default floor for the third.
+    "CODNA_FIX_SLA_S", "CODNA_FIX_CEILING", "CODNA_MODEL_RATE_BUDGET", "CODNA_ADMISSION_MC",
+    "CODNA_TIMEOUT_S",
 })
 # ALLOWLIST (not denylist): the job runs untrusted repo code, so it inherits ONLY safe config
 # + Telys pointers/tuning. It does NOT inherit engine URL overrides, raw LLM provider keys, or
@@ -415,23 +420,56 @@ class WorkerPool:
         return process_job(qjob, app_id=self._app_id, private_key=self._private_key)
 
     def _loop(self) -> None:
+        # MC-predictive admission (admission_control): thread count is only the ceiling on CLAIMERS;
+        # how many fixes actually run at once is decided per-fix against the observed duration
+        # distribution, so a fix that would breach the SLA under current contention waits instead.
+        admitter = get_admitter()
         while not self._stop.is_set():
-            qjob = self._queue.claim()
-            if qjob is None:
+            # ADMIT BEFORE CLAIMING. A claimed row is status='running', which claim() excludes
+            # (webhook_queue.py:122, inside BEGIN IMMEDIATE) — so parking a claimed job while waiting
+            # for capacity cannot be double-processed. The real damage is subtler: claim() already
+            # incremented `attempts`, and recover_stale() requeues anything left 'running' at startup,
+            # so a restart during a wait burns a retry for work that never began — enough restarts and
+            # the job dies 'orphaned_after_max_attempts' having never run once. Holding capacity
+            # instead of a queue row also keeps counts()/recent() honest about what is really running.
+            verdict = admitter.try_admit()   # atomic check-and-reserve
+            if not verdict.admit:
                 self._stop.wait(self._poll)
                 continue
+            # From here the slot is RESERVED and must be released on every path (finally below).
+            # Deliberately try_admit() + poll rather than admitter.gate(): gate() blocks up to
+            # max_wait_s=1800 without observing self._stop, which would ignore shutdown and defeat
+            # CODNA_WEBHOOK_DRAIN_S draining. This loop re-checks _stop every poll interval.
+            slot_started = time.monotonic()
+            qjob: QueuedJob | None = None      # bound BEFORE the try: claim() itself can raise,
+            #                                    and the finally below must still release the slot
             try:
-                result = self._process(qjob)
-                if not result.ok:
-                    _log_worker_failure(qjob, code="job_failed", message=result.summary)
-                self._queue.complete(qjob.row_id, status="done" if result.ok else "failed",
-                                     result={"summary": result.summary, "attempt": qjob.attempts})
-            except WebhookError as exc:
-                _log_worker_failure(qjob, code=exc.code, message=str(exc))
-                self._queue.complete(qjob.row_id, status="failed", result={"error": exc.code, "message": str(exc)})
-            except Exception as exc:  # noqa: BLE001 — a worker must never die on one bad job
-                _log_worker_failure(qjob, code="job_crashed", message=str(exc))
-                self._queue.complete(qjob.row_id, status="failed", result={"error": "job_crashed", "message": str(exc)[:500]})
+                qjob = self._queue.claim()
+                if qjob is None:
+                    self._stop.wait(self._poll)
+                    continue
+                self._run_claimed(qjob)
+            finally:
+                # duration 0.0 when nothing was claimed: finish() only records positives
+                # (admission_control.finish), so an idle poll frees the slot without polluting the
+                # duration window the predictor learns from.
+                admitter.finish(time.monotonic() - slot_started if qjob is not None else 0.0)
+
+    def _run_claimed(self, qjob: QueuedJob) -> None:
+        """Process one claimed job and mark its queue row terminal. A worker must never die on one
+        bad job, so every outcome ends in complete()."""
+        try:
+            result = self._process(qjob)
+            if not result.ok:
+                _log_worker_failure(qjob, code="job_failed", message=result.summary)
+            self._queue.complete(qjob.row_id, status="done" if result.ok else "failed",
+                                 result={"summary": result.summary, "attempt": qjob.attempts})
+        except WebhookError as exc:
+            _log_worker_failure(qjob, code=exc.code, message=str(exc))
+            self._queue.complete(qjob.row_id, status="failed", result={"error": exc.code, "message": str(exc)})
+        except Exception as exc:  # noqa: BLE001 — a worker must never die on one bad job
+            _log_worker_failure(qjob, code="job_crashed", message=str(exc))
+            self._queue.complete(qjob.row_id, status="failed", result={"error": "job_crashed", "message": str(exc)[:500]})
 
     def start(self) -> None:
         self._queue.recover_stale()
@@ -440,14 +478,27 @@ class WorkerPool:
             t.start()
             self._threads.append(t)
 
-    def diagnostics(self) -> dict[str, int | bool]:
+    def diagnostics(self) -> dict[str, Any]:
         alive = sum(1 for thread in self._threads if thread.is_alive())
-        return {
+        diag: dict[str, Any] = {
             "configured_threads": self._concurrency,
             "started_threads": len(self._threads),
             "alive_threads": alive,
             "ready": alive >= self._concurrency,
         }
+        # Admission state: threads are only the claimer ceiling, so "alive_threads" alone no longer
+        # describes capacity. Surface what the admitter actually decided on (in-flight, how many
+        # duration samples it has learned from, p50) — best-effort, never break diagnostics.
+        try:
+            admitter = get_admitter()
+            diag["admission"] = {
+                **admitter.snapshot(),
+                "ceiling": admitter.cfg.ceiling,
+                "det_cap": admitter._det_cap(None),
+            }
+        except Exception:  # noqa: BLE001 — diagnostics must not fail on the admitter
+            diag["admission"] = None
+        return diag
 
     def stop(self, timeout: float | None = None) -> None:
         """Signal stop and DRAIN: wait (up to the drain grace) for the in-flight job to complete

{codna-0.2.7 → codna-0.2.9}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.7
+Version: 0.2.9
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.7 → codna-0.2.9}/codna.egg-info/SOURCES.txt

@@ -92,6 +92,7 @@ codna/runtime/processes.py
 memengine/__init__.py
 memengine/_validate.py
 memengine/native_runtime.py
+tests/test_admission_control.py
 tests/test_agent_core_runtime.py
 tests/test_benchmark_parity_imports.py
 tests/test_benchmark_suite.py

{codna-0.2.7 → codna-0.2.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.7"
+version = "0.2.9"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

codna-0.2.9/tests/test_admission_control.py

@@ -0,0 +1,202 @@
+"""MC-predictive admission control (`codna.admission_control`).
+
+This module shipped complete but wired to NOTHING — no callers, no tests — while a static
+`CODNA_WEBHOOK_CONCURRENCY=2` actually governed how many fixes ran at once. These tests pin the
+contract now that `WorkerPool` gates on it, and they cover two self-inconsistencies found while
+wiring it up (see `test_model_rate_budget_is_one_value` and `test_ceiling_is_clamped_to_the_sidecar`).
+
+The predictor is always INJECTED here (`mc_fn`) so no test depends on the daemon, the mojo kernel, or
+numpy's RNG. The kernel path is verified separately against a live runtime — a green run of this file
+proves the *policy*, never that the kernel decided anything.
+"""
+from __future__ import annotations
+
+import importlib
+import threading
+
+import pytest
+
+import codna.admission_control as ac
+
+
+def _cfg(**kw) -> ac.AdmissionConfig:
+    base = {"ceiling": 8, "model_rate_budget": 2, "sla_s": 900.0, "breach_threshold": 0.10}
+    base.update(kw)
+    return ac.AdmissionConfig(**base)
+
+
+def _decider(*, mc_fn=None, **kw) -> ac.MCAdmissionDecider:
+    return ac.MCAdmissionDecider(_cfg(**kw), mc_fn=mc_fn)
+
+
+# ── the deterministic floor: no prediction at all ──────────────────────────────────────────────
+def test_deterministic_floor_never_consults_the_predictor():
+    """Below det_cap the answer is "clearly safe" by construction, so the MC predictor must not run.
+    If it did, every trivially-safe fix would pay a simulation (and, on the mojo path, a round trip
+    to the engine) for a decision that cannot come out any other way."""
+    calls = []
+
+    def _spy(durations, contention, sla, n):
+        calls.append(contention)
+        return 0.0
+
+    d = _decider(mc_fn=_spy, model_rate_budget=2, ceiling=8)
+    # Seed history so the predictor COULD run — proving the floor, not an empty-window shortcut.
+    d.finish(10.0)
+    d.finish(12.0)
+
+    assert d.try_admit().admit is True     # prospective 1 <= det_cap 2
+    assert d.try_admit().admit is True     # prospective 2 <= det_cap 2
+    assert calls == [], f"predictor ran inside the deterministic floor: {calls}"
+
+
+def test_hard_ceiling_is_absolute_even_when_the_predictor_says_zero_risk():
+    """A predictor that always returns 0.0 must still not push past the ceiling: beyond it the
+    sidecar itself sheds load with 429 agent_core_saturated, so admitting is worse than waiting."""
+    d = _decider(mc_fn=lambda *a: 0.0, model_rate_budget=2, ceiling=3)
+    d.finish(10.0)
+    for _ in range(3):
+        assert d.try_admit().admit is True
+    verdict = d.try_admit()
+    assert verdict.admit is False
+    assert "ceiling" in verdict.reason
+    assert d.in_flight == 3
+
+
+# ── the MC zone ────────────────────────────────────────────────────────────────────────────────
+@pytest.mark.parametrize(
+    "p_breach, expect_admit",
+    [(0.0, True), (0.09, True), (0.10, False), (0.5, False)],
+    ids=["no-risk", "just-under", "at-threshold", "way-over"],
+)
+def test_mc_zone_admits_strictly_below_the_breach_threshold(p_breach, expect_admit):
+    """Between det_cap and ceiling the verdict is P(SLA breach) < breach_threshold. At-threshold must
+    THROTTLE (the comparison is strict `<`), which is the boundary a refactor is most likely to flip."""
+    d = _decider(mc_fn=lambda *a: p_breach, model_rate_budget=1, ceiling=4, breach_threshold=0.10)
+    d.finish(10.0)
+    assert d.try_admit().admit is True          # fills the deterministic floor
+    verdict = d.try_admit()                     # now in the MC zone
+    assert verdict.admit is expect_admit
+    assert verdict.p_breach == pytest.approx(p_breach)
+
+
+def test_mc_zone_with_no_history_holds_at_the_floor():
+    """With an empty duration window there is nothing to simulate. Holding at det_cap is the
+    conservative branch; guessing would mean admitting on a fabricated distribution."""
+    d = _decider(mc_fn=lambda *a: 0.0, model_rate_budget=1, ceiling=4)
+    assert d.try_admit().admit is True
+    verdict = d.try_admit()
+    assert verdict.admit is False
+    assert "no duration history" in verdict.reason
+
+
+def test_contention_grows_with_concurrency():
+    """The contention model is concurrency/det_cap — the reason a fix's wall-clock stretches as more
+    fixes share the provider's rate budget. Pin it: without it the MC zone would simulate the
+    UNCONTENDED distribution and cheerfully admit into a breach."""
+    seen = []
+    d = _decider(mc_fn=lambda dur, contention, sla, n: seen.append(contention) or 0.0,
+                 model_rate_budget=2, ceiling=6)
+    d.finish(10.0)
+    for _ in range(2):
+        d.try_admit()          # floor: no predictor call
+    d.try_admit()              # prospective 3, det_cap 2 -> 1.5
+    d.try_admit()              # prospective 4            -> 2.0
+    assert seen == [pytest.approx(1.5), pytest.approx(2.0)]
+
+
+# ── never stall ────────────────────────────────────────────────────────────────────────────────
+def test_a_raising_predictor_degrades_instead_of_blocking_admission():
+    """A predictor/engine outage must never wedge the gate. make_mojo_breach_fn wraps the kernel with
+    exactly this fallback, so verify the wrapper, not just the docstring."""
+    def _boom(*_a, **_k):
+        raise RuntimeError("engine down")
+
+    fn = ac.make_mojo_breach_fn(fallback=lambda *a: 0.0)
+    # mojo_breach_probability will fail (no client/daemon here) -> falls back to the given predictor.
+    assert fn([10.0, 11.0], 1.5, 900.0, 128) == 0.0
+
+    # And an explicitly exploding fallback surfaces rather than hanging.
+    fn_bad = ac.make_mojo_breach_fn(fallback=_boom)
+    with pytest.raises(RuntimeError):
+        fn_bad([10.0], 1.5, 900.0, 8)
+
+
+# ── atomicity ──────────────────────────────────────────────────────────────────────────────────
+def test_try_admit_is_atomic_under_concurrent_callers():
+    """check-and-reserve happens under ONE lock. With a separate can_admit()+start() every thread
+    could pass the check before any incremented, overshooting the ceiling."""
+    ceiling = 4
+    d = _decider(mc_fn=lambda *a: 0.0, model_rate_budget=ceiling, ceiling=ceiling)
+    admitted, peak, lock = [], [0], threading.Lock()
+    start = threading.Barrier(24)
+
+    def _worker():
+        start.wait()
+        if d.try_admit().admit:
+            with lock:
+                admitted.append(1)
+                peak[0] = max(peak[0], d.in_flight)
+
+    threads = [threading.Thread(target=_worker) for _ in range(24)]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join()
+
+    assert len(admitted) == ceiling, f"admitted {len(admitted)}, ceiling {ceiling}"
+    assert peak[0] <= ceiling
+    assert d.in_flight == ceiling
+
+
+def test_finish_releases_the_slot_and_only_records_positive_durations():
+    """WorkerPool calls finish(0.0) when a reserved slot found an empty queue: that must free capacity
+    WITHOUT polluting the window the predictor learns from (an idle poll is not a fix duration)."""
+    d = _decider(mc_fn=lambda *a: 0.0)
+    d.try_admit()
+    assert d.in_flight == 1
+    d.finish(0.0)
+    assert d.in_flight == 0
+    assert d.snapshot()["samples"] == 0
+
+    d.try_admit()
+    d.finish(12.5)
+    assert d.in_flight == 0
+    assert d.snapshot()["samples"] == 1
+    assert d.snapshot()["p50_s"] == pytest.approx(12.5)
+
+
+# ── the two self-inconsistencies found while wiring this up ────────────────────────────────────
+def test_model_rate_budget_is_one_conservative_value():
+    """REGRESSION: AdmissionConfig's dataclass default said 8 while get_admitter() constructed 4.
+    det_cap = min(ceiling, model_rate_budget), so the deterministic floor silently DOUBLED depending
+    on which entry point built the config — 8 admits four extra fixes with NO breach prediction.
+
+    Asserts the VALUE, not merely that the two agree: get_admitter() now derives its env default from
+    the dataclass, so an agreement-only check is a tautology that passes with the bug reinstated
+    (verified by mutation). 4 is the deliberate conservative floor; changing it should be a conscious
+    edit here too."""
+    assert ac.AdmissionConfig().model_rate_budget == 4
+    assert ac.get_admitter().cfg.model_rate_budget == 4
+
+
+def test_ceiling_is_clamped_to_the_sidecar(monkeypatch):
+    """REGRESSION: `ceiling`'s comment claimed it equalled the sidecar's AGENT_CORE_MAX_CONCURRENCY,
+    but nothing linked them — the two 8s matched by coincidence. Admitting past what run-server.ts
+    accepts only converts admissions into 429 agent_core_saturated retries."""
+    monkeypatch.setenv("AGENT_CORE_MAX_CONCURRENCY", "3")
+    monkeypatch.setenv("CODNA_FIX_CEILING", "99")
+    monkeypatch.setenv("CODNA_ADMISSION_MC", "numpy")
+    reloaded = importlib.reload(ac)
+    try:
+        assert reloaded.sidecar_ceiling() == 3
+        assert reloaded.get_admitter().cfg.ceiling == 3
+    finally:
+        # Restore a clean module + singleton for the rest of the session.
+        monkeypatch.undo()
+        importlib.reload(ac)
+
+
+def test_sidecar_ceiling_survives_a_garbage_env_value(monkeypatch):
+    monkeypatch.setenv("AGENT_CORE_MAX_CONCURRENCY", "not-a-number")
+    assert ac.sidecar_ceiling() == ac._SIDECAR_CEILING_FALLBACK

{codna-0.2.7 → codna-0.2.9}/tests/test_packaging.py

@@ -438,7 +438,31 @@ def test_cli_publish_workflow_uses_trusted_publishing_and_contract_verification(
     assert "env.PUBLISH_AUTH == 'oidc'" in workflow
     assert "env.PUBLISH_AUTH == 'token'" in workflow
     assert "TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}" in workflow
-    assert "python -m twine upload --non-interactive cli/dist/*" in workflow
+    # IDEMPOTENT upload on BOTH auth paths. PyPI versions are immutable, so re-uploading one it
+    # already has can never overwrite anything -- "already there" IS the desired end state. Without
+    # these flags a duplicate publish fails on "File already exists" and turns a correct, published
+    # release into a red deployment: it happened with an `on: release` trigger racing
+    # workflow_dispatch, and again on 0.2.7 when a CDN-stale PyPI read made a release run dispatch a
+    # second publish (deployment 5974216490 succeeded, duplicate 5974321714 failed, 0.2.7 live
+    # throughout). Asserted so the idempotency cannot be dropped again.
+    assert "python -m twine upload --non-interactive --skip-existing cli/dist/*" in workflow
+    # The OIDC path is asserted STRUCTURALLY, on the parsed step input -- a substring check for
+    # "skip-existing: true" is satisfied by the prose comment above those steps, so it could not
+    # fail (verified: deleting the real input left a text-only assert green).
+    import yaml as _yaml
+
+    _doc = _yaml.safe_load(workflow)
+    _oidc = [
+        st
+        for job in _doc["jobs"].values()
+        for st in job.get("steps", [])
+        if "gh-action-pypi-publish" in str(st.get("uses", ""))
+    ]
+    assert _oidc, "the OIDC publish step vanished"
+    for st in _oidc:
+        assert (st.get("with") or {}).get("skip-existing") is True, (
+            f"{st.get('name')!r} must pass skip-existing: true so a duplicate upload is a no-op"
+        )
     assert workflow.count("TWINE_PASSWORD:") == 1  # ONLY the gated token-fallback step, nowhere else
     assert "password:" not in workflow  # the token path must not use the pypa action's password input
     assert "api-token:" not in workflow

{codna-0.2.7 → codna-0.2.9}/tests/test_webhook_worker.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import json
+import threading
 import time
 
 import codna.webhook_worker as worker_module
@@ -677,3 +678,100 @@ def test_secure_label_success_never_claims_a_pull_request_was_opened():
     assert "pull request" not in body, f"secure pass must not claim a PR: {body!r}"
     assert "opened a fix" not in body
     assert "secure" in body and "✅" in body
+
+
+# --- admission gating: threads are the claimer ceiling, the admitter is the governor ------------
+class _ManyJobQueue:
+    """Hands out `n` jobs then None. Tracks how many are claimed but not yet completed."""
+
+    def __init__(self, n: int):
+        self._left = n
+        self.completed = []
+        self._lock = threading.Lock()
+        self.claimed = 0
+
+    def recover_stale(self):
+        return {"requeued": 0, "failed": 0}
+
+    def claim(self):
+        with self._lock:
+            if self._left <= 0:
+                return None
+            self._left -= 1
+            self.claimed += 1
+            row = self.claimed
+        return QueuedJob(row_id=row, delivery_id=f"d{row}", attempts=1,
+                         job=WebhookJob("fix", "acme/app", ref=f"sha{row}", installation_id=42, reason="test"))
+
+    def complete(self, row_id, *, status, result=None):
+        with self._lock:
+            self.completed.append((row_id, status))
+
+
+def test_worker_pool_never_exceeds_the_admitter_ceiling(monkeypatch):
+    """The pool may run MORE threads than the admitter's ceiling — threads are only the claimer
+    ceiling. What must hold is that concurrent FIXES never exceed what the admitter allows, since
+    beyond it the sidecar sheds load with 429 agent_core_saturated.
+
+    Before the gate existed, in-flight fixes == CODNA_WEBHOOK_CONCURRENCY exactly, with nothing
+    between claim and subprocess spawn.
+    """
+    import codna.admission_control as ac
+
+    ceiling = 2
+    admitter = ac.MCAdmissionDecider(
+        ac.AdmissionConfig(ceiling=ceiling, model_rate_budget=ceiling, sla_s=900.0),
+        mc_fn=lambda *a: 0.0,
+    )
+    monkeypatch.setattr(worker_module, "get_admitter", lambda: admitter)
+
+    peak, lock = [0], threading.Lock()
+    live = [0]
+
+    def _slow_fix(_qjob):
+        with lock:
+            live[0] += 1
+            peak[0] = max(peak[0], live[0])
+        time.sleep(0.05)
+        with lock:
+            live[0] -= 1
+        return JobResult(True, "ok")
+
+    queue = _ManyJobQueue(12)
+    pool = WorkerPool(queue, concurrency=8, poll_interval=0.01, process=_slow_fix)
+    pool.start()
+    deadline = time.monotonic() + 15
+    while len(queue.completed) < 12 and time.monotonic() < deadline:
+        time.sleep(0.02)
+    pool.stop(timeout=5)
+
+    assert len(queue.completed) == 12, f"only {len(queue.completed)} of 12 completed"
+    assert peak[0] <= ceiling, f"ran {peak[0]} concurrent fixes with an admitter ceiling of {ceiling}"
+    assert admitter.in_flight == 0, "a reserved slot leaked"
+
+
+def test_worker_releases_the_slot_when_the_queue_is_empty(monkeypatch):
+    """A reserved slot must be freed when the claim finds nothing, or idle polling would permanently
+    consume capacity and the pool would wedge after `ceiling` empty polls."""
+    import codna.admission_control as ac
+
+    admitter = ac.MCAdmissionDecider(ac.AdmissionConfig(ceiling=2, model_rate_budget=2), mc_fn=lambda *a: 0.0)
+    monkeypatch.setattr(worker_module, "get_admitter", lambda: admitter)
+
+    queue = _ManyJobQueue(0)          # always empty
+    pool = WorkerPool(queue, concurrency=2, poll_interval=0.01, process=lambda _q: JobResult(True, "ok"))
+    pool.start()
+    time.sleep(0.2)                   # several empty polls per thread
+    pool.stop(timeout=5)
+
+    assert admitter.in_flight == 0, "empty polls leaked reserved slots"
+    assert admitter.snapshot()["samples"] == 0, "an idle poll polluted the duration window"
+
+
+def test_diagnostics_reports_admission_state():
+    queue = _ManyJobQueue(0)
+    pool = WorkerPool(queue, concurrency=1, poll_interval=0.01, process=lambda _q: JobResult(True, "ok"))
+    diag = pool.diagnostics()
+    assert diag["configured_threads"] == 1
+    assert "admission" in diag
+    assert set(diag["admission"]) >= {"in_flight", "samples", "ceiling", "det_cap"}