orbi-cli 0.7.7__tar.gz → 0.7.9__tar.gz

{orbi_cli-0.7.7/src/orbi_cli.egg-info → orbi_cli-0.7.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: orbi-cli
-Version: 0.7.7
+Version: 0.7.9
 Summary: Orbi — local AI development worker: claims GitHub Issues, runs Pi in isolated worktrees, and delivers PRs (GitHub Issues + labels are the only state store).
 Author: xqliu
 License-Expression: AGPL-3.0-only OR LicenseRef-Sustainable-Use-1.0

{orbi_cli-0.7.7 → orbi_cli-0.7.9}/pyproject.toml

@@ -44,7 +44,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "orbi-cli"
-version = "0.7.7"
+version = "0.7.9"
 description = "Orbi — local AI development worker: claims GitHub Issues, runs Pi in isolated worktrees, and delivers PRs (GitHub Issues + labels are the only state store)."
 readme = "README.md"
 requires-python = ">=3.14"

{orbi_cli-0.7.7 → orbi_cli-0.7.9}/src/orbi/__init__.py

@@ -18,4 +18,4 @@ the package would shadow the installed package for every process with
 the checkout root on sys.path. The direct-execution compatibility entry
 is `python3 -m orbi.cli` (development path only).
 """
-__version__ = "0.7.7"
+__version__ = "0.7.9"

{orbi_cli-0.7.7 → orbi_cli-0.7.9}/src/orbi/blocked_comment.py

@@ -12,12 +12,13 @@ receipt) never goes through this exit and never gets the line.
 from __future__ import annotations
 
 from orbi import language
-from orbi.delivery_labels import EVENT_BLOCKED
+from orbi.delivery_labels import EVENT_BLOCKED, READY_LABEL
 from orbi.github import apply_label_patch, comment_issue
 
 
 def post_blocked_comment(number: int, *, repo: str, body: str,
-                         current_labels, language_code: str) -> None:
+                         current_labels, language_code: str,
+                         ready_label: str = READY_LABEL) -> None:
     """Block `number`: apply the `ai-blocked` label patch, then comment.
 
     The order is part of the contract: the label transition lands first, the
@@ -27,7 +28,7 @@ def post_blocked_comment(number: int, *, repo: str, body: str,
     """
     apply_label_patch(
         number, repo=repo, event=EVENT_BLOCKED,
-        current_labels=current_labels,
+        current_labels=current_labels, ready_label=ready_label,
     )
     comment_issue(
         number, repo=repo,

{orbi_cli-0.7.7 → orbi_cli-0.7.9}/src/orbi/branch_reclaim.py

@@ -23,6 +23,7 @@ from pathlib import Path
 from typing import TYPE_CHECKING
 from urllib.parse import quote
 
+from orbi import gitops
 from orbi.journal import GIT_NETWORK_TIMEOUT_SECONDS, event, run_command
 
 if TYPE_CHECKING:
@@ -93,14 +94,16 @@ def delete_merged_delivery_branch(
 ) -> None:
     """Delete a MERGED delivery PR's remote head branch (Issue #1478).
 
-    Called right after `gh pr merge` lands. Only an `orbi/`-prefixed
-    head (a branch Orbi itself created) is deleted; an external takeover
-    PR's head is left to its owner. A 404/422 (the reference is already
-    gone) counts as success. Any other failure emits a warning event and
-    returns — the merge has already landed, so this cleanup never fails
-    the delivery.
+    Called right after `gh pr merge` lands. Only this source repo's own
+    delivery branch (`gitops.is_delivery_branch`, the one ownership
+    check, Issue #1788) is deleted; a head a user named
+    (`orbi/manual`), another repository's delivery name or an external
+    takeover PR's head is left to its owner. A 404/422 (the reference is
+    already gone) counts as success. Any other failure emits a warning
+    event and returns — the merge has already landed, so this cleanup
+    never fails the delivery.
     """
-    if not branch.startswith("orbi/"):
+    if not gitops.is_delivery_branch(source_repo, branch):
         return
     try:
         delete_remote_branch(source_repo, branch)
@@ -174,7 +177,7 @@ def read_merged_pull_requests(source_repo: str) -> list[dict]:
 
 
 def reclaim_merged_delivery_branches(config: config_domain.RunnerConfig) -> None:
-    """Delete remote `orbi/*` branches whose delivery PR has MERGED.
+    """Delete this repo's remote delivery branches whose PR has MERGED.
 
     A merged delivery leaves its `orbi/<slug>-issue-<n>` branch on the
     remote forever; #1478 stops NEW ones, this pass drains the BACKLOG.
@@ -182,7 +185,9 @@ def reclaim_merged_delivery_branches(config: config_domain.RunnerConfig) -> None
     idempotent, bounded (at most `BRANCH_RECLAIM_MAX_PER_TICK` deletes)
     and never fatal.
 
-    Only a branch whose CURRENT remote oid equals the `headRefOid` a
+    Only a branch this source repo OWNS (`gitops.is_delivery_branch`,
+    Issue #1788: `orbi/<owner>-<repo>-issue-<n>`, never an `orbi/`
+    prefix alone) whose CURRENT remote oid equals the `headRefOid` a
     MERGED PR reports is deleted. The delivery branch name is fixed per
     Issue, so a reopened Issue's new attempt pushes to the same name
     while the old merged PR still reports it: without the oid match the
@@ -201,7 +206,7 @@ def reclaim_merged_delivery_branches(config: config_domain.RunnerConfig) -> None
         heads = {
             branch: oid
             for branch, oid in _parse_remote_heads(raw).items()
-            if branch.startswith("orbi/")
+            if gitops.is_delivery_branch(source_repo, branch)
         }
         if not heads:
             return

{orbi_cli-0.7.7 → orbi_cli-0.7.9}/src/orbi/claim.py

@@ -12,10 +12,10 @@ from __future__ import annotations
 import json
 import logging
 import os
-import re
 from collections.abc import Sequence
 from pathlib import Path
 
+from orbi import gitops
 from orbi import milestone as milestone_bookkeeping
 from orbi.config import RunnerConfig
 from orbi.delivery_labels import (
@@ -214,20 +214,21 @@ def reconcile_open_epics(repo: str, run_id: str, language_code: str) -> list[str
 # idempotency key (one report per PR, never one per tick).
 ORPHAN_PR_MARK = "<!-- orbi:orphan-pr -->"
 
-_ORPHAN_PR_BRANCH_RE = re.compile(r"orbi/.+-issue-(\d+)\Z")
 
+def orphan_pr_branch_issue(repo: str, head_ref: object) -> int | None:
+    """The source Issue number of THIS repo's delivery branch, or None.
 
-def orphan_pr_branch_issue(head_ref: object) -> int | None:
-    """The source Issue number of a stable delivery branch, or None.
-
-    `task_branch` names every Runner delivery branch
-    `orbi/<source_repo slug>-issue-<N>`; any other head (a human's or an
-    external contributor's branch) is never the Runner's business.
+    The ownership decision is `gitops.is_delivery_branch` and the number
+    comes from the same naming source (`gitops.delivery_branch_prefix`,
+    Issue #1788): only `orbi/<this source repo>-issue-<N>` names an Issue
+    here, so another repository's `orbi/x-y-issue-3` — or a human's own
+    `orbi/manual` — is never the Runner's business.
     """
-    if not isinstance(head_ref, str):
+    if not isinstance(head_ref, str) or not gitops.is_delivery_branch(
+        repo, head_ref,
+    ):
         return None
-    match = _ORPHAN_PR_BRANCH_RE.fullmatch(head_ref)
-    return int(match.group(1)) if match else None
+    return int(head_ref.removeprefix(gitops.delivery_branch_prefix(repo)))
 
 
 def reconcile_orphan_prs(
@@ -256,7 +257,9 @@ def reconcile_orphan_prs(
         if not isinstance(pr, dict):
             continue
         pr_number = pr.get("number")
-        issue_number = orphan_pr_branch_issue(pr.get("headRefName"))
+        issue_number = orphan_pr_branch_issue(
+            repo, pr.get("headRefName"),
+        )
         if not isinstance(pr_number, int) or issue_number is None:
             continue
         details = issue_view(issue_number, "state", repo=repo, timeout=30)
@@ -315,6 +318,7 @@ def _pick_from_scan(
     active_milestone: str | None = None,
     ready_label: str = READY_LABEL,
     external_only: bool = False, held: frozenset = frozenset(),
+    raise_on_read_failure: bool = False,
 ) -> dict | None:
     """Return the first claimable Issue of one scan result, else None.
 
@@ -361,6 +365,13 @@ def _pick_from_scan(
     `held` names the deliveries a live co-runner works on: such an Issue
     is skipped (`claim_yield reason=held_by_live_runner`) and never
     claimed twice — the skip is the FIRST guard of this loop.
+
+    `raise_on_read_failure` decides what a failed Milestone read of the
+    release gate MEANS to the caller — the same meaning every other read
+    of the decision carries (`_read_failed`): the claim fails safe
+    and skips the release this tick, an OBSERVER of the decision
+    (`orbi status`) re-raises so the failed read is named instead of
+    rendering as an empty queue (Issue #1782).
     """
     for issue in issues:
         if (repo, int(issue["number"])) in held:
@@ -386,10 +397,12 @@ def _pick_from_scan(
                         repo, target_milestone,
                     )
                 except Exception as exc:
-                    event(
-                        "release_milestone_check_failed", level=logging.ERROR,
+                    _read_failed(
+                        "release_milestone_check_failed", exc,
+                        raise_on_read_failure,
                         issue=issue.get("number"), repo=repo,
-                        milestone=target_milestone, error=exc)
+                        milestone=target_milestone,
+                    )
                     return None
                 if open_issues > 1:
                     event("release_milestone_incomplete", issue=issue.get("number"),
@@ -420,9 +433,31 @@ def _pick_from_scan(
     return None
 
 
+def _read_failed(
+    read: str, exc: Exception, raise_on_read_failure: bool, **fields: object,
+) -> None:
+    """Journal one failed read, then fail open OR re-raise.
+
+    THE one place `raise_on_read_failure` is decided (Issue #1794):
+    every failing read in this module calls it with its OWN journal event
+    name and fields (`release_milestone_check_failed`,
+    `blocked_by_check_failed`), so each site keeps its line while the
+    meaning of a failed read cannot drift between sites.
+    The claim fails open: a broken query must never deadlock the queue,
+    so this tick claims nothing and the next one retries. An OBSERVER of
+    the same decision (`orbi status`) must not read a failed read as an
+    empty queue — it asks for the failure instead (#1668, #1782).
+    """
+    event(read, level=logging.ERROR, **fields, error=exc)
+    if raise_on_read_failure:
+        raise
+
+
 def pick_issue(repo: str, active_milestone: str | None = None,
                dispatch_label: str = READY_LABEL,
-               held: frozenset = frozenset()) -> dict | None:
+               held: frozenset = frozenset(),
+               timeout: int | None = None,
+               raise_on_read_failure: bool = False) -> dict | None:
     # A merged delivery keeps `ai-ready` + `ai-merged` on the (still
     # open) Issue; `ai-merged` is the success terminal state, so it is
     # excluded from the ready scan like every other delivery state.
@@ -456,24 +491,34 @@ def pick_issue(repo: str, active_milestone: str | None = None,
     # code-layer marker guard to the triage tickets an external
     # contribution routes to — an external review is supplementary
     # capacity, never a competitor of this version's deliveries.
+    # `timeout` is the CALLER's read bound (the status view's #1668
+    # bound); the claim itself reads unbounded. The ready decision is
+    # one function for both readers (Issue #1773), so the bound travels
+    # with the call instead of a second query being built.
+    # `raise_on_read_failure` says what a failed scan read MEANS to the
+    # caller: the claim fails open (default), the status observation
+    # re-raises so the failure is named instead of reading as an empty
+    # queue (`_read_failed`).
     for search in ready_searches(active_milestone, dispatch_label):
         try:
             issues = list_issues(
                 repo, state="open", search=search,
                 json_fields="number,title,body,labels,blockedBy,author", limit=200,
+                timeout=timeout,
             )
         except Exception as exc:
             # Fail open: a failed blockedBy query must
             # never deadlock the queue. This tick claims nothing from
             # this repo and the next tick retries the query; the error
             # is logged, never raised, and no label is touched.
-            event(
-                "blocked_by_check_failed", level=logging.ERROR,
-                repo=repo, error=exc,
+            _read_failed(
+                "blocked_by_check_failed", exc, raise_on_read_failure,
+                repo=repo,
             )
             return None
         picked = _pick_from_scan(
             issues, repo, ready_label=dispatch_label, held=held,
+            raise_on_read_failure=raise_on_read_failure,
         )
         if picked is not None:
             return picked
@@ -489,18 +534,18 @@ def pick_issue(repo: str, active_milestone: str | None = None,
             repo, state="open",
             search=release_fallback_search(active_milestone, dispatch_label),
             json_fields="number,title,body,labels,blockedBy,milestone",
-            limit=200,
+            limit=200, timeout=timeout,
         )
     except Exception as exc:
-        event(
-            "blocked_by_check_failed", level=logging.ERROR,
-            repo=repo, error=exc,
+        _read_failed(
+            "blocked_by_check_failed", exc, raise_on_read_failure, repo=repo,
         )
         return None
     picked = _pick_from_scan(
         issues, repo, allow_release=True, held=held,
         active_milestone=active_milestone,
         ready_label=dispatch_label,
+        raise_on_read_failure=raise_on_read_failure,
     )
     if picked is not None:
         return picked
@@ -518,17 +563,17 @@ def pick_issue(repo: str, active_milestone: str | None = None,
             repo, state="open",
             search=external_takeover_search(dispatch_label),
             json_fields="number,title,body,labels,blockedBy",
-            limit=200,
+            limit=200, timeout=timeout,
         )
     except Exception as exc:
-        event(
-            "blocked_by_check_failed", level=logging.ERROR,
-            repo=repo, error=exc,
+        _read_failed(
+            "blocked_by_check_failed", exc, raise_on_read_failure, repo=repo,
         )
         return None
     return _pick_from_scan(
         issues, repo, external_only=True, held=held,
         ready_label=dispatch_label,
+        raise_on_read_failure=raise_on_read_failure,
     )
 
 
@@ -669,6 +714,7 @@ def pick_next_delivery(
     for repo in repos:
         repo_language = (language.DEFAULT_LANGUAGE if config is None
                          else merged_repo_language(config, repo))
+        _, dispatch_label = _repo_scan_keys(config, repo, active_milestone)
         # Epic reconciliation is a per-tick bypass: a broken GitHub query or
         # mutation must never prevent the ordinary delivery scans.
         try:
@@ -709,6 +755,7 @@ def pick_next_delivery(
             repo, slot_dir, max_concurrency,
             repo_dir=config.repo_dir if config is not None else None,
             hooks=hooks, language_code=repo_language,
+            ready_label=dispatch_label,
         )
         if selected is not None:
             issue, scene = selected
@@ -723,7 +770,7 @@ def pick_next_delivery(
             return repo, issue, None
     for repo in repos:
         held = slot_held_deliveries(slot_dir, max_concurrency)
-        issue = _pick_issue_with_repo_policy(repo, active_milestone, config, held)
+        issue = pick_ready_issue(repo, active_milestone, config, held)
         if issue is not None:
             return repo, issue, None
     # Issue #1745: a delivery waiting for a maintainer is re-checked LAST —
@@ -734,10 +781,12 @@ def pick_next_delivery(
     for repo in repos:
         repo_language = (language.DEFAULT_LANGUAGE if config is None
                          else merged_repo_language(config, repo))
+        _, dispatch_label = _repo_scan_keys(config, repo, active_milestone)
         selected = pick_awaiting_merge_delivery(
             repo, slot_dir, max_concurrency,
             repo_dir=config.repo_dir if config is not None else None,
             hooks=hooks, language_code=repo_language,
+            ready_label=dispatch_label,
         )
         if selected is not None:
             issue, scene = selected
@@ -791,19 +840,66 @@ def _repo_scan_context(
     )
 
 
-def _pick_issue_with_repo_policy(
-    repo: str, active_milestone: str | None, config: RunnerConfig | None,
-    held: frozenset = frozenset(),
+def _live_held_deliveries(
+    config: RunnerConfig | None,
+) -> frozenset[tuple[str, int]]:
+    """The deliveries live co-runners hold RIGHT NOW, from the host config.
+
+    The claim path reads its slots through `slot_held_deliveries`
+    (`pick_next_delivery`); this is the same read for a reader that has
+    only the configuration — a host without a readable `slot_dir`
+    contributes nothing (fail open: skip only what is provably held).
+    """
+    if config is None or config.slot_dir is None:
+        return frozenset()
+    return frozenset(
+        slot_held_deliveries(config.slot_dir, config.max_concurrency)
+    )
+
+
+def pick_ready_issue(
+    repo: str, active_milestone: str | None = None,
+    config: RunnerConfig | None = None,
+    held: frozenset | None = None,
+    *, timeout: int | None = None, raise_on_read_failure: bool = False,
 ) -> dict | None:
-    """Fresh ready scan with the repo's scan keys.
+    """The Issue the next fresh claim would pick: THE ready decision.
+
+    Every reader of "which Issue is ready" asks THIS function, so the
+    answer cannot drift into a second query (Issue #1773): the claim
+    loop (`pick_next_delivery`) and `orbi status` (`cli.ready_issue`, with
+    its own read bound) both arrive here. It carries the claim's own
+    searches and delivery-state exclusions (see `ready_searches`), the
+    repository policy's scan keys, the Epic/blockedBy/scene guards and
+    the release + external-takeover fallbacks.
 
     `dispatch_label` and `active_milestone` are resolved from the
-    repository policy before the scan (see `_repo_scan_keys`), and
-    `held` (the deliveries live co-runners work on) is passed through.
+    repository policy before the scan (see `_repo_scan_keys`), `held`
+    (the deliveries live co-runners work on) is passed through, and
+    `timeout` bounds every scan's read and `raise_on_read_failure`
+    decides what a failed read means to the caller: the claim fails open,
+    while `orbi status` re-raises so a broken read is named as a failure
+    and never rendered as an empty queue (`_read_failed`).
+
+    An unset `held` reads the SAME live slots the claim reads, from the
+    configuration's own `slot_dir`/`max_concurrency`
+    (`_live_held_deliveries`): the status reader must not name a delivery
+    a live co-runner already holds during the seconds between that
+    runner's slot-identity write and its `ai-in-progress` label (Issue
+    #1782). Both readers decide on the same held set, and no held logic
+    lives in `cli.py`.
     """
+    if held is None:
+        held = _live_held_deliveries(config)
     milestone, dispatch_label = _repo_scan_keys(
         config, repo, active_milestone,
     )
     if dispatch_label == READY_LABEL:
-        return pick_issue(repo, milestone, held=held)
-    return pick_issue(repo, milestone, dispatch_label=dispatch_label, held=held)
+        return pick_issue(
+            repo, milestone, held=held, timeout=timeout,
+            raise_on_read_failure=raise_on_read_failure,
+        )
+    return pick_issue(
+        repo, milestone, dispatch_label=dispatch_label, held=held,
+        timeout=timeout, raise_on_read_failure=raise_on_read_failure,
+    )

{orbi_cli-0.7.7 → orbi_cli-0.7.9}/src/orbi/cli.py

@@ -32,10 +32,12 @@ from pathlib import Path
 
 from orbi import (
     __version__,
+    claim,
     cli_source,
     config as config_domain,
     engine_source,
     git_transport,
+    journal as journal_domain,
     notify,
     runner,
     scheduler,
@@ -156,12 +158,15 @@ def dispatch_issue(repo: str, title: str, body: str, *,
     return url
 
 
-def list_labeled_issues(repo: str, label: str, state: str = "open",
-                        search: str | None = None, *,
+def list_labeled_issues(repo: str, label: str, state: str = "open", *,
                         timeout: int | None = None) -> list[dict]:
-    """Return the newest Issues matching a label search (gh lists newest first)."""
+    """Return the newest Issue carrying one label (gh lists newest first).
+
+    The label IS the query: the status view never assembles a search of
+    its own. "Which Issue is ready" is the claim's decision (#1773).
+    """
     return list_issues(
-        repo, state=state, search=search or f"label:{label}",
+        repo, state=state, search=f"label:{label}",
         json_fields="number,title,url,state", limit=1, timeout=timeout,
     )
 
@@ -171,17 +176,27 @@ def current_issue(repo: str) -> dict | None:
     return issues[0] if issues else None
 
 
-def ready_issue(repo: str) -> dict | None:
-    """The ready queue, read under the status cycle's bound.
+def ready_issue(repo: str,
+                config: config_domain.RunnerConfig) -> dict | None:
+    """The Issue the claim would pick, read under the status bound (#1668).
 
-    The status view owns this read, so a stalled `gh issue list` fails
-    the observation within the bound instead of hanging it (Issue #1668).
+    The ready decision lives on the claim side (Issue #1773): an Issue in
+    a delivery state (ai-pr-opened/ai-fix-needed/ai-merged/ai-blocked) is
+    never ready, and the claim's pick/skip lines stay out of the view; an
+    unreadable scan fails the observation (#1668), not an empty queue.
+    The held set and the Milestone read arrive from the claim (#1782).
     """
-    issues = list_labeled_issues(
-        repo, READY_LABEL, search=f"label:{READY_LABEL} -label:{IN_PROGRESS_LABEL}",
-        timeout=status_observe.STATUS_READ_TIMEOUT_SECONDS,
-    )
-    return issues[0] if issues else None
+    journal = journal_domain.LOGGER
+    level = journal.level
+    journal.setLevel(max(level, logging.WARNING))
+    try:
+        return claim.pick_ready_issue(
+            repo, config.active_milestone, config,
+            timeout=status_observe.STATUS_READ_TIMEOUT_SECONDS,
+            raise_on_read_failure=True,
+        )
+    finally:
+        journal.setLevel(level)
 
 
 def recent_result(repo: str) -> dict | None:
@@ -204,7 +219,9 @@ def recent_result(repo: str) -> dict | None:
 
 
 def format_issue(issue: dict) -> str:
-    return f"#{issue['number']} {issue['title']} {issue['url']}"
+    """Render `#N title url`; a claim-scan record carries no url (#1773)."""
+    url = issue.get("url")
+    return f"#{issue['number']} {issue['title']}" + (f" {url}" if url else "")
 
 
 def slot_lines(state_dir: Path, capacity: int) -> list[str]:
@@ -943,7 +960,8 @@ def main(argv: list[str] | None = None) -> int:
             return 1
         observer = status_observe.StatusObserver(
             config, scope,
-            read_ready=ready_issue, read_result=recent_result,
+            read_ready=lambda repo: ready_issue(repo, config),
+            read_result=recent_result,
             read_base=freeze_base,
         )