dirigent-core 0.15.2__tar.gz → 0.16.0__tar.gz

{dirigent_core-0.15.2 → dirigent_core-0.16.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dirigent-core
-Version: 0.15.2
+Version: 0.16.0
 Summary: Dirigent engine core: schema, configuration, and plugin host.
 License-Expression: LicenseRef-Proprietary
 License-File: LICENSE

{dirigent_core-0.15.2 → dirigent_core-0.16.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "dirigent-core"
-version = "0.15.2"
+version = "0.16.0"
 description = "Dirigent engine core: schema, configuration, and plugin host."
 readme = "README.md"
 requires-python = ">=3.13"

{dirigent_core-0.15.2 → dirigent_core-0.16.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "dirigent-core"
-version = "0.15.2"
+version = "0.16.0"
 description = "Dirigent engine core: schema, configuration, and plugin host."
 readme = "README.md"
 requires-python = ">=3.13"

{dirigent_core-0.15.2 → dirigent_core-0.16.0}/src/dirigent_core/alembic/versions/0001_baseline_schema.py

@@ -607,6 +607,7 @@ def upgrade() -> None:
         sa.Column("attempt", sa.Integer(), server_default=sa.text("0"), nullable=False),
         sa.Column("available_at", dirigent_core.types.UtcDateTime(timezone=True), nullable=False),
         sa.Column("lease_owner", sa.String(length=200), nullable=True),
+        sa.Column("lease_token", sa.Uuid(), nullable=True),
         sa.Column("lease_expires_at", dirigent_core.types.UtcDateTime(timezone=True), nullable=True),
         sa.Column("sent_at", dirigent_core.types.UtcDateTime(timezone=True), nullable=True),
         sa.Column("error", sa.Text(), nullable=True),
@@ -799,6 +800,7 @@ def upgrade() -> None:
         sa.Column("next_poll_at", dirigent_core.types.UtcDateTime(timezone=True), nullable=True),
         sa.Column("deadline_at", dirigent_core.types.UtcDateTime(timezone=True), nullable=True),
         sa.Column("lease_owner", sa.String(length=200), nullable=True),
+        sa.Column("lease_token", sa.Uuid(), nullable=True),
         sa.Column("lease_expires_at", dirigent_core.types.UtcDateTime(timezone=True), nullable=True),
         sa.Column("heartbeat_at", dirigent_core.types.UtcDateTime(timezone=True), nullable=True),
         sa.Column(

{dirigent_core-0.15.2 → dirigent_core-0.16.0}/src/dirigent_core/alerting.py

@@ -30,6 +30,7 @@ from dirigent_common import (
 from dirigent_core.database import session_scope
 from dirigent_core.engine.definition import load_definition
 from dirigent_core.engine.services import EngineServices
+from dirigent_core.ids import uuid7
 from dirigent_core.logging import get_logger
 from dirigent_core.models import (
     AlertRule,
@@ -608,13 +609,23 @@ async def queue_test_message(
     return notification
 
 
+class ClaimedNotification(BaseModel):
+    """A notification one claim holds, and the generation that claim took."""
+
+    model_config = ConfigDict(arbitrary_types_allowed=True, frozen=True)
+
+    notification: Notification
+    lease_token: UUID
+    """The generation this claim took, which every later write of the row is fenced against."""
+
+
 async def claim_notification(
     session: AsyncSession,
     *,
     owner: str,
     now: datetime,
     lease_seconds: int,
-) -> Notification | None:
+) -> ClaimedNotification | None:
     """Claim the next due notification, the same way a worker claims an attempt."""
     statement = (
         sa.select(Notification)
@@ -628,12 +639,14 @@ async def claim_notification(
     notification = found.scalars().first()
     if notification is None:
         return None
+    token = uuid7()
     notification.status = NotificationStatus.SENDING
     notification.lease_owner = owner
+    notification.lease_token = token
     notification.lease_expires_at = now + timedelta(seconds=lease_seconds)
     notification.attempt += 1
     await session.flush()
-    return notification
+    return ClaimedNotification(notification=notification, lease_token=token)
 
 
 def notifier_config(services: EngineServices, notifier: Notifier, connection: Connection | None) -> BaseModel:
@@ -651,12 +664,13 @@ async def send_notification(
     notification: Notification,
     *,
     owner: str,
+    lease_token: UUID,
     now: datetime | None = None,
 ) -> bool:
     """Deliver one claimed notification, returning whether it was delivered.
 
-    The outcome is written only while this worker still holds the lease, so a delivery that
-    outlasted its lease cannot overwrite the outcome of the worker the row was handed to.
+    The outcome is written only while this claim still holds the lease, so a delivery that
+    outlasted its lease cannot overwrite the outcome of the claim the row was handed to.
 
     THE SESSION IS COMMITTED BEFORE THE SEND, so no transaction is open while an outbound
     call is in flight: on SQLite that transaction holds the one write lock, and everything
@@ -674,33 +688,42 @@ async def send_notification(
         await session.commit()
         await notifier.send(_message(notification), config)
     except Exception as error:
-        if not await _holds_lease(session, notification, owner):
+        if not await _holds_lease(session, notification, owner, lease_token):
             return False
         return await _record_failure(session, services, notification, error, moment)
-    if not await _holds_lease(session, notification, owner):
+    if not await _holds_lease(session, notification, owner, lease_token):
         return False
     notification.status = NotificationStatus.SENT
     notification.sent_at = moment
     notification.error = None
     notification.lease_owner = None
+    notification.lease_token = None
     notification.lease_expires_at = None
     _timeline(session, notification, LogLevel.INFO, f"alert delivered through {notification.notifier!r}", moment)
     _logger.info("notification delivered", notification_id=str(notification.id), notifier=notification.notifier)
     return True
 
 
-async def _holds_lease(session: AsyncSession, notification: Notification, owner: str) -> bool:
-    """Re-read the row and report whether this worker may still write this outcome.
+async def _holds_lease(session: AsyncSession, notification: Notification, owner: str, lease_token: UUID) -> bool:
+    """Re-read the row and report whether this claim may still write this outcome.
 
     The lease is a fence, not a hint: a row the sweeper returned to the queue belongs to
     whoever claimed it next, and writing into it would replace a live delivery's outcome
-    with the outcome of an abandoned one.
+    with the outcome of an abandoned one. The token is what makes that hold when the
+    somebody else is this worker again: a name matches its own next claim, a token never does.
     """
     found = await session.execute(
-        sa.select(Notification.status, Notification.lease_owner).where(Notification.id == notification.id)
+        sa.select(Notification.status, Notification.lease_owner, Notification.lease_token).where(
+            Notification.id == notification.id
+        )
     )
     row = found.one_or_none()
-    if row is not None and row.status is NotificationStatus.SENDING and row.lease_owner == owner:
+    if (
+        row is not None
+        and row.status is NotificationStatus.SENDING
+        and row.lease_owner == owner
+        and row.lease_token == lease_token
+    ):
         return True
     _logger.warning(
         "lease lost, notification outcome discarded",
@@ -717,10 +740,16 @@ async def renew_lease(
     notification_id: UUID,
     *,
     owner: str,
+    lease_token: UUID,
     lease_seconds: int,
     now: datetime | None = None,
 ) -> bool:
-    """Push a notification's lease out, reporting whether this worker still held it."""
+    """Push a notification's lease out, reporting whether this claim still held it.
+
+    A renewal names the claim's generation as well as its row, so one that outlived its lease
+    extends nothing: the row it names is either unclaimed or held by a later claim, this
+    worker's own next one included.
+    """
     moment = now or utcnow()
     renewed = await session.execute(
         sa.update(Notification)
@@ -728,6 +757,7 @@ async def renew_lease(
             Notification.id == notification_id,
             Notification.status == NotificationStatus.SENDING,
             Notification.lease_owner == owner,
+            Notification.lease_token == lease_token,
         )
         .values(lease_expires_at=moment + timedelta(seconds=lease_seconds))
         .returning(Notification.id)
@@ -762,6 +792,7 @@ async def _record_failure(
     message = f"{type(error).__name__}: {error}"
     notification.error = message
     notification.lease_owner = None
+    notification.lease_token = None
     notification.lease_expires_at = None
     budget = services.settings.notification_max_attempts
     if notification.attempt >= budget:
@@ -873,6 +904,7 @@ async def retry_notification(
     notification.error = None
     notification.sent_at = None
     notification.lease_owner = None
+    notification.lease_token = None
     notification.lease_expires_at = None
     await session.flush()
     _logger.info("notification queued again", notification_id=str(notification.id), notifier=notification.notifier)
@@ -898,6 +930,7 @@ async def recover_notifications(session: AsyncSession, *, now: datetime | None =
             status=NotificationStatus.PENDING,
             available_at=moment,
             lease_owner=None,
+            lease_token=None,
             lease_expires_at=None,
         )
         .returning(Notification.id)
@@ -926,37 +959,40 @@ class NotificationDispatcher(BaseModel):
         for _ in range(self.max_per_pass):
             async with session_scope(self.sessions) as session:
                 moment = now or utcnow()
-                notification = await claim_notification(
+                claim = await claim_notification(
                     session,
                     owner=self.owner,
                     now=moment,
                     lease_seconds=int(self.services.settings.notification_lease.total_seconds()),
                 )
-                if notification is None:
+                if claim is None:
                     return sent
+                notification_id, lease_token = claim.notification.id, claim.lease_token
             async with session_scope(self.sessions) as session:
-                claimed = await session.get(Notification, notification.id)
+                claimed = await session.get(Notification, notification_id)
                 if claimed is None:  # pragma: no cover - it was just claimed
                     continue
-                async with self._renewing(claimed.id):
-                    delivered = await send_notification(session, self.services, claimed, owner=self.owner, now=now)
+                async with self._renewing(notification_id, lease_token):
+                    delivered = await send_notification(
+                        session, self.services, claimed, owner=self.owner, lease_token=lease_token, now=now
+                    )
                 if delivered:
                     sent += 1
         return sent
 
     @asynccontextmanager
-    async def _renewing(self, notification_id: UUID) -> AsyncGenerator[None]:
+    async def _renewing(self, notification_id: UUID, lease_token: UUID) -> AsyncGenerator[None]:
         """Hold a notification's lease open for as long as its delivery is in flight."""
         halting = asyncio.Event()
-        renewing = asyncio.create_task(self._renew_until_halted(notification_id, halting))
+        renewing = asyncio.create_task(self._renew_until_halted(notification_id, lease_token, halting))
         try:
             yield
         finally:
             halting.set()
             await renewing
 
-    async def _renew_until_halted(self, notification_id: UUID, halting: asyncio.Event) -> None:
-        """Extend the lease on a cadence until halted, or until the row is no longer this worker's.
+    async def _renew_until_halted(self, notification_id: UUID, lease_token: UUID, halting: asyncio.Event) -> None:
+        """Extend the lease on a cadence until halted, or until the row is no longer this claim's.
 
         The halt is a flag rather than a cancel: a renewal already inside its transaction runs
         to its own end, where a cancel landing in a database await strands the session's
@@ -970,7 +1006,14 @@ class NotificationDispatcher(BaseModel):
                 return
             try:
                 async with session_scope(self.sessions) as session:
-                    if not await renew_lease(session, notification_id, owner=self.owner, lease_seconds=lease_seconds):
+                    renewed = await renew_lease(
+                        session,
+                        notification_id,
+                        owner=self.owner,
+                        lease_token=lease_token,
+                        lease_seconds=lease_seconds,
+                    )
+                    if not renewed:
                         return
             except Exception as error:  # the delivery runs on; the sweeper reclaims if it outlasts the lease
                 _logger.warning(

{dirigent_core-0.15.2 → dirigent_core-0.16.0}/src/dirigent_core/engine/claim.py

@@ -34,6 +34,9 @@ class ClaimedUnit(BaseModel):
     model_config = ConfigDict(frozen=True)
 
     attempt_id: UUID
+    lease_token: UUID
+    """The generation this claim took, which every later write of it is fenced against."""
+
     run_id: UUID
     run_item_id: UUID | None
     step_name: str

{dirigent_core-0.15.2 → dirigent_core-0.16.0}/src/dirigent_core/engine/context.py

@@ -24,8 +24,8 @@ from dirigent_common import JsonMap
 from dirigent_core.logging import debug_kept, get_logger
 from dirigent_core.models import Connection, Schema
 from dirigent_core.secrets import SecretBox
-from dirigent_core.storage import AttemptStorage, Storage, work_dir
-from dirigent_plugin import BlockFailure, ConnectionRef, ErrorClass, Logger, Runs, StorageBackend
+from dirigent_core.storage import AttemptStorage, Storage, connection_binder, work_dir
+from dirigent_plugin import BlockFailure, ConnectionRef, ErrorClass, Logger, Runs
 
 #: What an HTTP connection is assumed to call its fields, so core can build a client for
 #: any connection kind without importing the package that contributed it.
@@ -304,16 +304,11 @@ class EngineStepContext:
         where connection secrets are opened and nowhere else.
         """
         if self._bound_storage is None:
-            self._bound_storage = self._storage.bound_by(self._configure_backend)
+            self._bound_storage = self._storage.bound_by(
+                connection_binder(self._storage_connections, lambda _scheme, ref, model: self.connection(ref, model))
+            )
         return self._bound_storage
 
-    def _configure_backend(self, scheme: str, backend: StorageBackend) -> StorageBackend:
-        """Bind one scheme to the connection this instance configures it from, if it names one."""
-        ref = self._storage_connections.get(scheme)
-        if ref is None:
-            return backend
-        return backend.configured(self.connection(ref, backend.config_model))
-
     @property
     def scratch(self) -> str:
         """Return the run-scoped URI prefix for intermediate artifacts."""

{dirigent_core-0.15.2 → dirigent_core-0.16.0}/src/dirigent_core/engine/executor.py

@@ -55,6 +55,7 @@ from dirigent_core.engine.runs import (
 )
 from dirigent_core.engine.services import EngineServices
 from dirigent_core.engine.state import advance, lock_run
+from dirigent_core.ids import uuid7
 from dirigent_core.logging import get_logger, log_context
 from dirigent_core.models import LogEntry, PipelineVersion, Run, RunItem, StepAttempt, utcnow
 from dirigent_core.storage import AttemptStorage, scratch_prefix
@@ -262,7 +263,9 @@ class Engine:
         attempt.status = AttemptStatus.RUNNING
         started = attempt.started_at or now
         attempt.started_at = started
+        token = uuid7()
         attempt.lease_owner = self.owner
+        attempt.lease_token = token
         attempt.lease_expires_at = now + self.services.settings.lease
         attempt.heartbeat_at = now
         attempt.input = {**(attempt.input or {}), "config": config}
@@ -274,6 +277,7 @@ class Engine:
 
         return ClaimedUnit(
             attempt_id=attempt.id,
+            lease_token=token,
             run_id=run.id,
             run_item_id=attempt.run_item_id,
             step_name=attempt.step_name,
@@ -453,14 +457,20 @@ class Engine:
 
     # -- recording ---------------------------------------------------------------
 
-    def _holds_lease(self, attempt: StepAttempt) -> bool:
-        """Report whether this worker may still write the outcome of an attempt.
+    def _holds_lease(self, unit: ClaimedUnit, attempt: StepAttempt) -> bool:
+        """Report whether this claim may still write the outcome of an attempt.
 
         The lease is a fence, not a hint. If the sweeper decided this worker was dead and
-        handed the attempt to somebody else, the row belongs to that other worker, and
-        writing into it would clobber a live attempt with the result of an abandoned one.
+        handed the attempt to somebody else, the row belongs to that other claim, and writing
+        into it would clobber a live attempt with the result of an abandoned one. The token
+        is what makes that hold when the somebody else is this worker again: a name matches
+        its own next claim, a token never does.
         """
-        return attempt.status is AttemptStatus.RUNNING and attempt.lease_owner == self.owner
+        return (
+            attempt.status is AttemptStatus.RUNNING
+            and attempt.lease_owner == self.owner
+            and attempt.lease_token == unit.lease_token
+        )
 
     def _log_lost_lease(self, unit: ClaimedUnit, attempt: StepAttempt | None, what: str) -> None:
         """Log that an outcome was dropped, which means the work may have run twice."""
@@ -490,7 +500,7 @@ class Engine:
             if attempt is not None and attempt.status is AttemptStatus.CANCELLED:
                 await self._cancel_what_was_just_submitted(session, unit, attempt, handle)
                 return
-            if attempt is None or not self._holds_lease(attempt):
+            if attempt is None or not self._holds_lease(unit, attempt):
                 self._log_lost_lease(unit, attempt, "remote handle")
                 return
             attempt.remote_handle = handle.model_dump(mode="json")
@@ -593,7 +603,7 @@ class Engine:
             attempt = await session.get(StepAttempt, unit.attempt_id)
             if attempt is None:  # pragma: no cover - foreign keys prevent this
                 return
-            if not self._holds_lease(attempt):
+            if not self._holds_lease(unit, attempt):
                 self._log_lost_lease(unit, attempt, "attempt outcome")
                 return
             if entries:
@@ -879,21 +889,28 @@ class Engine:
 
     # -- leases ------------------------------------------------------------------
 
-    async def heartbeat(self, attempt_ids: Sequence[UUID], *, now: datetime | None = None) -> set[UUID]:
-        """Refresh the leases this worker holds, and say which ones it still holds.
+    async def heartbeat(self, units: Sequence[ClaimedUnit], *, now: datetime | None = None) -> set[UUID]:
+        """Refresh the leases these claims hold, and say which ones they still hold.
+
+        A claim is named by its attempt and its token, so a call that outlived its lease
+        refreshes nothing: the row it names is either unclaimed or held by a later claim,
+        this worker's own next one included.
 
         An attempt that does not come back was taken away by the sweeper, and the caller has
         to stop working on it: its outcome will be refused by :meth:`_holds_lease` anyway.
         """
-        if not attempt_ids:
+        if not units:
             return set()
         moment = now or utcnow()
         expires = moment + self.services.settings.lease
+        held_leases = sa.or_(
+            *(sa.and_(StepAttempt.id == unit.attempt_id, StepAttempt.lease_token == unit.lease_token) for unit in units)
+        )
         async with session_scope(self.sessions) as session:
             refreshed = await session.execute(
                 sa.update(StepAttempt)
                 .where(
-                    StepAttempt.id.in_(attempt_ids),
+                    held_leases,
                     StepAttempt.lease_owner == self.owner,
                     StepAttempt.status == AttemptStatus.RUNNING,
                 )
@@ -905,7 +922,7 @@ class Engine:
                 "leases refreshed",
                 worker=self.owner,
                 held=len(held),
-                lost=len(attempt_ids) - len(held),
+                lost=len(units) - len(held),
                 expires_at=expires.isoformat(),
             )
             return held
@@ -914,6 +931,7 @@ class Engine:
 def _release(attempt: StepAttempt) -> None:
     """Drop the lease from an attempt that is no longer being worked on."""
     attempt.lease_owner = None
+    attempt.lease_token = None
     attempt.lease_expires_at = None
 
 

{dirigent_core-0.15.2 → dirigent_core-0.16.0}/src/dirigent_core/engine/recovery.py

@@ -56,6 +56,7 @@ async def sweep_leases(session: AsyncSession, *, now: datetime | None = None) ->
             attempt.available_at = moment
             landing = "queued"
         attempt.lease_owner = None
+        attempt.lease_token = None
         attempt.lease_expires_at = None
         recovered.append(attempt.id)
         _logger.warning(

{dirigent_core-0.15.2 → dirigent_core-0.16.0}/src/dirigent_core/engine/runs.py

@@ -425,6 +425,7 @@ async def cancel_run(
         attempt.status = AttemptStatus.CANCELLED
         attempt.finished_at = moment
         attempt.lease_owner = None
+        attempt.lease_token = None
         attempt.lease_expires_at = None
     await _cancel_items(session, run, moment)
     run.status = RunStatus.CANCELLED

{dirigent_core-0.15.2 → dirigent_core-0.16.0}/src/dirigent_core/engine/services.py

@@ -4,14 +4,16 @@ from functools import cached_property
 
 from jsonschema import FormatChecker
 from pydantic import BaseModel, ConfigDict
+from sqlalchemy.ext.asyncio import AsyncSession
 
 from dirigent_client.schemas import BlockKind
 from dirigent_common import format_checker_with
 from dirigent_core.config import Settings
+from dirigent_core.engine.context import load_connections
 from dirigent_core.engine.failure import Failure
 from dirigent_core.plugins import PluginHost
 from dirigent_core.secrets import SecretBox
-from dirigent_core.storage import Storage, build_storage
+from dirigent_core.storage import AttemptStorage, Storage, UnknownStorageConnection, build_storage, connection_binder
 from dirigent_plugin import AnyOperator, AnySensor, ErrorClass
 
 
@@ -46,6 +48,26 @@ class EngineServices(BaseModel):
         """The one checker every instance validation asserts against: base plus contributed formats."""
         return format_checker_with(self.host.formats)
 
+    async def bound_storage(self, session: AsyncSession) -> AttemptStorage:
+        """Return storage with every scheme configured from the connection this instance names for it.
+
+        The configuration a step's context binds, for the paths that address artifacts outside
+        a step. ``self.storage`` configures nothing: a scheme reached through it is opened with
+        no endpoint and no credentials.
+
+        The facade caches the credentials its binder opened, so it belongs to the call that
+        asked for it, and a connection edited in the database is read by the next call.
+        """
+        records = await load_connections(session) if self.settings.storage_connections else {}
+
+        def open_connection(scheme: str, ref: str, model: type[BaseModel]) -> BaseModel:
+            record = records.get(ref)
+            if record is None:
+                raise UnknownStorageConnection(scheme, ref, records)
+            return self.secrets.decrypt_config(model, record.config, record.envelope, key_id=record.key_id)
+
+        return self.storage.bound_by(connection_binder(self.settings.storage_connections, open_connection))
+
     def block(self, block_id: str) -> AnyOperator | AnySensor:
         """Resolve a block id to the instance the engine calls."""
         return self.host.block(block_id)

{dirigent_core-0.15.2 → dirigent_core-0.16.0}/src/dirigent_core/models.py

@@ -275,6 +275,12 @@ class StepAttempt(Entity):
     deadline_at: Mapped[datetime | None] = mapped_column(Timestamp)
 
     lease_owner: Mapped[str | None] = mapped_column(sa.String(200))
+    lease_token: Mapped[UUID | None] = mapped_column(sa.Uuid)
+    """Minted afresh by every claim, so a write names the claim it came from.
+
+    A worker's name repeats: the same worker can reclaim an attempt the sweeper took from it,
+    and the abandoned call's outcome would pass a fence that only compares names."""
+
     lease_expires_at: Mapped[datetime | None] = mapped_column(Timestamp)
     heartbeat_at: Mapped[datetime | None] = mapped_column(Timestamp)
 
@@ -516,6 +522,12 @@ class Notification(Entity):
     attempt: Mapped[int] = mapped_column(sa.Integer, nullable=False, default=0, server_default=sa.text("0"))
     available_at: Mapped[datetime] = mapped_column(Timestamp, nullable=False, default=utcnow)
     lease_owner: Mapped[str | None] = mapped_column(sa.String(200))
+    lease_token: Mapped[UUID | None] = mapped_column(sa.Uuid)
+    """Minted afresh by every claim, so a write names the claim it came from.
+
+    A worker's name repeats: the same worker can reclaim a notification recovery took from it,
+    and the abandoned delivery's outcome would pass a fence that only compares names."""
+
     lease_expires_at: Mapped[datetime | None] = mapped_column(Timestamp)
     sent_at: Mapped[datetime | None] = mapped_column(Timestamp)
     error: Mapped[str | None] = mapped_column(sa.Text)

{dirigent_core-0.15.2 → dirigent_core-0.16.0}/src/dirigent_core/reporting.py

@@ -323,10 +323,11 @@ async def render_run_report(
             timeout=services.settings.report_render_timeout.total_seconds(),
         )
         existing = await _report_row(session, run.id)
+        storage = await services.bound_storage(session)
         async with session.begin_nested():
             reference = await persist_document(
                 session,
-                services.storage,
+                storage,
                 run.id,
                 name=REPORT_NAME,
                 text=markdown,

{dirigent_core-0.15.2 → dirigent_core-0.16.0}/src/dirigent_core/scheduler.py

@@ -298,7 +298,8 @@ async def prune(
     total = retention.Swept()
     for _ in range(max_batches):
         async with session_scope(sessions) as session:
-            swept = await retention.sweep(session, chosen, storage=services.storage, now=now, limit=limit)
+            storage = await services.bound_storage(session)
+            swept = await retention.sweep(session, chosen, storage=storage, now=now, limit=limit)
         for family, count in swept.counts.items():
             total.record(family, count)
         total.scratch_deleted += swept.scratch_deleted

{dirigent_core-0.15.2 → dirigent_core-0.16.0}/src/dirigent_core/storage.py

@@ -46,6 +46,25 @@ class OutsideRoot(StorageError):
         self.uri = uri
 
 
+class UnknownStorageConnection(StorageError):
+    """A scheme is configured from a connection code this instance does not hold."""
+
+    def __init__(self, scheme: str, ref: str, known: Iterable[str]) -> None:
+        """Name the scheme, the connection it is configured from, and the ones that exist."""
+        available = ", ".join(sorted(known)) or "none are configured"
+        super().__init__(f"no connection coded {ref!r} to configure the {scheme!r} scheme from ({available})")
+        self.scheme = scheme
+        self.ref = ref
+
+
+#: How one scheme is configured before it is addressed: what a bound facade calls once per scheme.
+type Binder = Callable[[str, StorageBackend], StorageBackend]
+
+#: How a binder reads the connection a scheme is configured from, opened and validated
+#: against the backend's own config model.
+type OpenConnection = Callable[[str, str, type[BaseModel]], BaseModel]
+
+
 def parse_uri(uri: str) -> tuple[str, str]:
     """Split a URI into its scheme and the backend-specific remainder."""
     split = urlsplit(uri)
@@ -241,7 +260,7 @@ class Storage:
         self,
         backends: Mapping[str, StorageBackend],
         artifact_root: str,
-        binder: "Callable[[str, StorageBackend], StorageBackend] | None" = None,
+        binder: Binder | None = None,
     ) -> None:
         """Bind the facade to the scheme index, the default scratch root, and how a scheme is configured."""
         self._backends = dict(backends)
@@ -267,11 +286,11 @@ class Storage:
             self._bound[scheme] = backend
         return backend
 
-    def bound_by(self, binder: "Callable[[str, StorageBackend], StorageBackend]") -> "AttemptStorage":
-        """Return the same namespace as an attempt-scoped facade, configured on first use.
+    def bound_by(self, binder: Binder) -> "AttemptStorage":
+        """Return the same namespace as a caller-scoped facade, configured on first use.
 
-        A new facade rather than a mutation: the process-wide one is shared by every attempt,
-        and one attempt must not reconfigure a scheme under another.
+        A new facade rather than a mutation: the process-wide one is shared by every caller,
+        and one must not reconfigure a scheme under another.
         """
         return AttemptStorage(self._backends, self.artifact_root, binder)
 
@@ -332,14 +351,28 @@ class Storage:
 
 
 class AttemptStorage(Storage):
-    """A storage facade belonging to exactly one attempt.
+    """A storage facade belonging to exactly one caller: one attempt, one request, one sweep.
 
     The binder opens connection secrets and the backend it returns is cached for the life of
-    the facade, so sharing one across attempts would hand one attempt's credentials to
-    another.
+    the facade, so sharing one would hand one caller's credentials to the next.
     """
 
 
+def connection_binder(storage_connections: Mapping[str, str], open_connection: OpenConnection) -> Binder:
+    """Build the binder that configures each scheme from the connection the instance names for it.
+
+    A scheme no connection is named for keeps the backend the plugin contributed.
+    """
+
+    def configure(scheme: str, backend: StorageBackend) -> StorageBackend:
+        ref = storage_connections.get(scheme)
+        if ref is None:
+            return backend
+        return backend.configured(open_connection(scheme, ref, backend.config_model))
+
+    return configure
+
+
 def build_storage(artifact_root: str, backends: Iterable[StorageBackend] = ()) -> Storage:
     """Assemble the facade: the plugin-contributed backends plus ``file://`` from core."""
     scheme, remainder = parse_uri(artifact_root)

{dirigent_core-0.15.2 → dirigent_core-0.16.0}/src/dirigent_core/worker.py

@@ -83,7 +83,7 @@ class Worker:
         self.alerts = NotificationDispatcher(sessions=sessions, services=services, owner=self.name)
         self.sweeper = sweeper
         self.chores = list(chores)
-        self.in_flight: set[UUID] = set()
+        self.in_flight: dict[UUID, ClaimedUnit] = {}
         self._stopping = asyncio.Event()
         self._halting = asyncio.Event()
         self._tasks: set[asyncio.Task[None]] = set()
@@ -141,7 +141,7 @@ class Worker:
                 semaphore.release()
                 await self._idle()
                 continue
-            self.in_flight.add(unit.attempt_id)
+            self.in_flight[unit.attempt_id] = unit
             telemetry.gauges.in_flight = len(self.in_flight)
             task = asyncio.create_task(self._execute(unit, semaphore))
             self._tasks.add(task)
@@ -164,7 +164,7 @@ class Worker:
         except Exception as error:  # the outcome transaction owns failures; this is a bug
             _logger.error("executing an attempt raised", attempt_id=str(unit.attempt_id), error=str(error))
         finally:
-            self.in_flight.discard(unit.attempt_id)
+            self.in_flight.pop(unit.attempt_id, None)
             self._running.pop(unit.attempt_id, None)
             telemetry.gauges.in_flight = len(self.in_flight)
             semaphore.release()
@@ -189,9 +189,9 @@ class Worker:
             if self._halting.is_set():
                 return
             try:
-                claimed = set(self.in_flight)
-                held = await self.engine.heartbeat(list(claimed))
-                self._abandon(claimed - held)
+                claimed = dict(self.in_flight)
+                held = await self.engine.heartbeat(list(claimed.values()))
+                self._abandon(set(claimed) - held)
                 await self._register(WorkerStatus.DRAINING if self.draining else WorkerStatus.RUNNING)
             except Exception as error:  # a missed heartbeat is recoverable; a dead task is not
                 _logger.warning("heartbeat failed", worker=self.name, error=str(error))