The TUI's referenced-prompt snapshot now rides the prompt's own
admission transaction instead of a pre-admission inject: while idle, a
one-shot prepended agent/prompt-submit wrapper appends the snapshot to
the allow decision's additionalContexts, so a blocking hook discards
the prompt and its attached context together instead of stranding the
snapshot in history for the next unrelated prompt. A prompt discarded
before admission releases the wrapper; steering keeps the inject path
since it bypasses admission and drains at the same boundary. The
session-reference snapshot adapter pinned the old context-before-prompt
order; the branch-wide order (prompt first, its contexts after) is now
asserted and the fixture re-recorded.
tool-tasks drops the last consumer of the removed thrown-disposed
contract: completion notices now inject unconditionally, which is
well-defined during owner teardown — the loop treats disposal like any
cancel, so the notice appends as durable idle context (persisted for
resume while the session is attached, dropped with the detached log
after). README pair and the owner-disposal tests state the new
delivery contract.
The staged-promotion machinery (concludingParents keyed by parent token
plus a pendingParentConclusions staging map) spread one fact — this call
concluded the turn — across three registry-side collections with manual
cleanup. Align it with how additionalContexts already crosses the same
boundary: concludeTurn() marks only its own execution, the marker rides
that execution's successful result (ToolExecutionFailure types
concludesTurn as never, so a policy-converted failure sheds it with the
type), and the composite that owns the nested dispatch forwards it —
Code Mode's binding does so beside its existing context forwarding.
The registry loses both parent-keyed collections and the promotion
block; the propagation decision moves to the owning boundary; the
structured-output consumer's own two-phase commit is untouched.
master's bilingual README pairing (new since this branch forked) covers
packages/core/tools and packages/client/runtime, whose EN sides this PR
edits. Translate the scheduling-contract sentences (bridge pool, SDK
overlap line, loop cross-reference, codeDispatches lifecycle) into the zh
sides — including the verbatim shared model-facing block — and re-record
both pairing records.
agent-loop lifecycle: dispose drains machine.done to true quiescence.
cancel()'s own running-to-idle transition can legitimately re-enter
through an automation listener (goal-session's idle drive runs
synchronously to its first await) and replace done with a fresh
admission after the single capture; teardown now re-cancels and
re-awaits until the slot stabilizes, so the scope never unwinds under a
live run.
tools: a nested concludeTurn() stages on its own execution and promotes
to the enclosing composite only on the call's authoritative successful
verdict. A post-execute policy that converts the nested success into an
error no longer lets a recovering composite stop the turn on a failed
terminal operation (the Code Mode structured-output shape).
goal-session: the driver owns its round durability barrier again. The
loop's persistence is eager write-behind with no turn-end flush, so the
old post-turn agent/error signal for flush failures never fires; a
settled round now sets needsCheckpoint and re-enters drive, flushing
before the next reservation and disarming on failure instead of queueing
an autonomous round on state that was never persisted.
The public classifier existed to defend an exported reader against
arbitrary signals, but its only production caller is the loop reading
its own machine-private turn signal, where cancel() is the sole aborter
and always writes one frozen canonical cause. Delete the export and its
15-line structural validation: settle() states the slot invariant with
one cast, the boolean call sites ask signal.aborted directly, and the
retry veto drops entirely because a requested window already implies a
live signal (cancel() retires the window before aborting).
The abort(reason) channel and first-wins semantics are unchanged; only
the reader's publicness is gone, and with it the paranoia it required.
The drive-pass guard for an unsettled attempt was wrongly annotated
unreachable after admission joined the running interval. It is reachable:
a contained turn-close failure (pre-commit turn/end rejection) reaches
idle with the attempt's turn open and no terminal reason, and the idle
drive pass must yield to that attempt instead of misreading the absent
reason as settled. Replace the ignore with a test driving exactly that
path; the guard's comment now names the real producer.
The admission-ordering fix changed the event taxonomy's observable order,
so the generated event/producer catalogs and the cordis API catalog are
regenerated. goal-session's mid-drive yield (an unsettled attempt seen by
an idle-triggered drive pass) became unreachable now that claimed prompt
admission joins the loop's running interval — a drive pass requires idle,
so it can no longer observe an unsettled reservation; the guard stays as
an annotated backstop.
Three ordering fixes on the admission and settlement boundaries.
kick() installs the abort owner, marks the interval busy (running is
emitted before any listener can observe the claim), and installs the
pending done BEFORE publishing agent/inbox/dequeue: a dequeue listener
that cancels or disposes now finds live cancellation and quiescence
ownership instead of the previous activity's settled state, and claimed
prompt admission — including asynchronous prompt-submit hooks — sits
inside the running interval where cancel routing can reach it. The
admission-rejected path yields one microtask before continueOrIdle so
the idle transition cannot fire inside send()'s synchronous extent.
agent/idle now names only committed turns: a run that aborts or fails
before its turn/start commits exits without the notification, since
there is no durable turn/end for settlement consumers to act against.
The event's JSDoc states the narrowed contract.
The coverage pass left agent.ts with eight v8 ignore annotations — well
above this repo's density elsewhere. Six guarded conditions the
surrounding invariants already exclude; expressing the invariant directly
deletes the dead arm instead of excusing it: admission/run teardown
releases the abort slot unconditionally (no writer can replace the owner
mid-flight), the request-failed branch closes its always-open step
unconditionally, the recovery finally retires the window it installed,
and the driver finally drops its dead last-resort step close (every path
already closes the step). kick()'s dequeue states the non-empty-queue
invariant as a non-null assertion. The two remaining ignores are the
assertNever exhaustiveness guard and the retry()/run() slot-race guard,
both repo-wide conventions.
Conflict resolution: session.ts keeps this branch's paired-start callTime
(the start event exists here; a settle-only window stays null — the PR2
fix's semantics compose). The README's codeDispatches section is restored
to the running→settled lifecycle this branch implements, keeping PR2's
null-callTime nuance for starts outside the window.
Responding to ds-review-bot round 2 on #658 (three critical findings, one
warning — all rooted in the pump/commit split racing ordered stages):
- ONE driver lane now owns every ordered stage: the start append, prepare
(pre-execute/guards), and the head-of-line commit (post-execute, context
deferral, settle append). start() is awaited before the next entry can
start, so concurrent submissions can no longer run pre-execute pipelines
concurrently; only the around-dispatch/body stage overlaps, matching the
native loop's fillPool sequencing.
- An exclusive call's barrier now holds through its COMMIT: later starts
wait for the exclusive pipeline (post-execute included) to finish, the
native exclusive-group semantics.
- drainDispatches() awaits the driver run itself, so a commit already
mid-flight when the program returns is drained before run_code closes
the turn — the settle event and deferred contexts land inside it.
- maxParallelSubCalls is resolved and validated at construction (positive
integer), so direct construction can no longer wedge the pool with 0.
New tests: overlapping-submission ordered-prepare, barrier-through-commit,
drain-mid-commit, cap rejection. 96 keyless snapshots replay unchanged;
Agent Note updated (both languages).
agent-loop: behavior tests for retry-while-busy, cancelled recovery
windows, no-facts stream failures, idle-listener preemption, rejected
driver promises under whenIdle, finish-chunk failures after step close,
presentationMeta persistence, pre-aborted and torn-down create/resume
signals, and configured-start failures over existing artifacts or after
teardown. The remaining guards that no public path can reach carry
justified v8 ignore annotations naming the invariant that starves them.
acp bridge: cover the retry-adoption path (a retry turn resolves the
prompt the failed turn deferred), the no-retry quiescence rejection, and
the admission-blocked cancelled settlement; the synchronous send-throw
catch is annotated as a future-proofing guard since the machine's send()
contains listener failures.
Responding to ds-review-bot round 2 on #653: the tool/code-dispatch event
is appended at settlement, so using its time as callTime fabricated a
zero-duration call for duration-aware consumers — it is now null (start
unknown) per the ToolResultNode contract, pinned in the session spec. The
README's codeDispatches section described the PR3 running→settled
lifecycle a stack ahead of this tree; it now documents the settled-only
index this PR ships (the running shape lands with the start event in
#658, which already merges cleanly over this).
Responding to ds-review-bot round 2 on #648: the env seam's accepted
values, native default, process-wide scope, loud-failure behavior, and
temporary status now live in apps/cli/README.md next to the Web/headless
surface it configures, not only in the cordis.yml comment.
The automation bridge inherited two master-era assumptions the message
machine no longer honors. A prompt blocked at pre-turn admission opens no
turn, so no turn/end could ever settle it — the bridge now watches
whenIdle() and reports a turnless slot as cancelled (the disposed-agent
guard moved to a registry identity check before send). A failed turn no
longer rejects at its turn/end either: agent.retry() closes the failed
turn and opens a successor on the same history, so the bridge holds the
terminal error and lets a retry-triggered turn/start adopt the prompt,
rejecting only at quiescence with no successor.
Also: refresh the empty-response-retry fixture for retry-as-turn logging,
adapt master-side tests to the unified send()/UserMessageData API and
registry-fact disposal, resync the doc pairs both sides touched, trim
architecture.md back under its word ceiling, and regenerate the event and
persistence catalogs.
Responding to ds-review-bot on #664 (root cause lives here): when a history
window carries a tool/code-dispatch settle without its paired start, the
runtime fabricated callTime = settle time, so downstream duration views
presented a measured 0 ms. Match the native tool-result contract instead —
callTime: null = unknown — and pin it; the trajectory cell already renders
null as the em dash, and the waterfall gains explicit unknown handling in
its own PR.
The coverage gate flagged three untaken paths in the bridge scheduler:
- the exclusive-head inFlight re-check was dead (the shared guard above
already returns for an exclusive head with any in-flight sibling) — removed;
- the commit-cursor undefined-dispatched break was structurally unreachable
once entries join commitQueue only after start() ran synchronously —
reordered the pump so the invariant holds by construction, annotated;
- the finish (final-result) commit arm and the pump re-entry guard gain a
covering test (throwing tools/pre-execute listener) and a defensive
annotation respectively; mid-run unregistration test renamed to match its
actual post-result settlement path.
Also covers the direct-construction maxParallelSubCalls default (index.ts)
and commits the regenerated persistence catalog for the new dispatch pair.
ui-sidebar shell landed on master (#643: geometry-only shell, the
browsing region moved to the sidebar.workspaces slot); this branch's
sidebar.settings foot seat re-applies on top — the hardcoded foot row
becomes the seat, the seat rides the railIn crossfade, and the shell
spec's renderSlot stub key-splits region vs settings.
