From ad1e58d9664ed0427e8f2d5d1d357c5cfaadeeca Mon Sep 17 00:00:00 2001 From: Jinjing <6427696+AmethystLiang@users.noreply.github.com> Date: Sat, 1 Aug 2026 00:25:35 -0700 Subject: [PATCH] chore: declutter top-level repo layout (#11890) Remove one-off incident docs and committed test-results noise, move dev/repro/bench tools under tests/tools, and relocate i18next config into config/ so the GitHub root scrolls to the description faster. --- .github/CODEOWNERS | 2 +- .github/workflows/daemon-relocation-spike.yml | 4 +- .github/workflows/win-crash-survival-e2e.yml | 2 +- .github/workflows/win-update-e2e.yml | 4 +- .github/workflows/win-update-survival-e2e.yml | 4 +- .gitignore | 4 +- ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md | 1787 ----------------- i18next.config.ts => config/i18next.config.ts | 0 config/reliability-gates.jsonc | 16 +- .../scripts/pr-workflow-parallelism.test.mjs | 2 +- .../run-multi-workspace-typing-bench.mjs | 2 +- .../verify-localization-extraction.mjs | 16 +- .../scripts/win-crash-survival-e2e.test.mjs | 20 +- config/vitest.config.ts | 2 +- package.json | 16 +- ...rer-worktree-freeze-incident-2026-07-29.md | 1268 ------------ .../session-ingest-throughput.bench.test.ts | 2 +- test-results/pr-11293-11177-integration-r1.md | 123 -- test-results/pr-11293-11177-integration-r2.md | 130 -- test-results/pr-11293-11177-integration-r3.md | 168 -- ...nal-multi-workspace-typing-latency.spec.ts | 2 +- .../tools}/benchmarks/cpu-pressure-worker.mjs | 0 .../benchmarks/daemon-coldstart-bench.mjs | 4 +- .../benchmarks/main-thread-jank-bench.mjs | 4 +- ...rtup-acl-fix-2026-06-10T19-37-58-671Z.json | 0 ...l-fix-steady-2026-06-10T19-41-40-683Z.json | 0 ...tup-baseline-2026-06-10T19-36-01-305Z.json | 0 ...erf-baseline-2026-07-02T07-23-46-933Z.json | 0 ...perf-fix-a-b-2026-07-02T07-46-58-178Z.json | 0 ...perf-fix-abd-2026-07-02T07-51-00-936Z.json | 0 ...erf-fix-abdf-2026-07-02T07-59-11-820Z.json | 0 .../tools}/benchmarks/startup-time-bench.mjs | 4 +- .../terminal-cold-park-resource-bench.mjs | 4 +- .../terminal-cold-park-reveal-bench.mjs | 4 +- .../terminal-headless-parse-bench.mjs | 2 +- .../tools}/benchmarks/terminal-perf-bench.mjs | 6 +- .../benchmarks/terminal-pipeline-bench.mjs | 8 +- .../workspace-switch-paint-latency.mjs | 2 +- .../worktree-deletion-dev-bench.mjs | 0 .../tools}/daemon-relocation-spike/README.md | 4 +- .../daemon-relocation-spike/app-inventory.mjs | 0 .../tools}/daemon-relocation-spike/cli.mjs | 4 +- .../daemon-relocation-spike/daemon-launch.mjs | 0 .../daemon-relocation-spike/host-copy.mjs | 0 .../loaded-module-probe.mjs | 0 .../loaded-modules.ps1 | 0 .../daemon-relocation-spike/ndjson-client.mjs | 0 .../daemon-relocation-spike/selftest.mjs | 0 .../tools}/daemon-relocation-spike/spike.mjs | 0 .../daemon-relocation-spike/tier-file-set.mjs | 0 .../repro-macos-renderer-close-teardown.cjs | 0 .../repro-orchestration-long-prompt.mjs | 2 +- .../repro-watcher-crash-7547/.gitignore | 0 .../tools}/repro-watcher-crash-7547/README.md | 4 +- .../tools}/repro-watcher-crash-7547/child.cjs | 0 .../repro-watcher-crash-7547/fixed-child.cjs | 0 .../tools}/repro-watcher-crash-7547/run.cjs | 0 {tools => tests/tools}/spikes/.gitignore | 0 .../tools}/terminal-garble-frame-analysis.mjs | 0 .../terminal-garble-production-repro.mjs | 2 +- ...erminal-garble-react-terminal-recovery.mjs | 0 .../tools}/terminal-garble-session-replay.mjs | 0 .../tools}/win-crash-survival-e2e/README.md | 4 +- .../win-crash-survival-e2e/cli-args.mjs | 2 +- .../crash-assertions.mjs | 0 .../win-crash-survival-e2e/crash-step.mjs | 0 .../daemon-identity.mjs | 0 .../win-crash-survival-e2e/reattach-proof.mjs | 0 .../tools}/win-crash-survival-e2e/run.mjs | 0 .../tools}/win-update-e2e/README.md | 12 +- .../tools}/win-update-e2e/app-driver.mjs | 0 .../tools}/win-update-e2e/app-driver.test.mjs | 0 .../tools}/win-update-e2e/assertions.mjs | 0 .../tools}/win-update-e2e/cli-args.mjs | 4 +- .../win-update-e2e/daemon-processes.mjs | 0 .../tools}/win-update-e2e/installer-steps.mjs | 0 .../win-update-e2e/interactivity-probes.mjs | 0 .../win-update-e2e/onboarding-profile.mjs | 0 .../tools}/win-update-e2e/platform-guard.mjs | 0 .../win-update-e2e/powershell-runner.mjs | 0 .../tools}/win-update-e2e/preflight.mjs | 0 .../registry-shortcut-backup.mjs | 0 {tools => tests/tools}/win-update-e2e/run.mjs | 0 .../tools}/win-update-e2e/window-enum.ps1 | 0 .../tools}/win-update-e2e/window-watch.mjs | 0 .../tools}/win-update-e2e/window-watch.ps1 | 0 86 files changed, 89 insertions(+), 3561 deletions(-) delete mode 100644 ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md rename i18next.config.ts => config/i18next.config.ts (100%) delete mode 100644 renderer-worktree-freeze-incident-2026-07-29.md delete mode 100644 test-results/pr-11293-11177-integration-r1.md delete mode 100644 test-results/pr-11293-11177-integration-r2.md delete mode 100644 test-results/pr-11293-11177-integration-r3.md rename {tools => tests/tools}/benchmarks/cpu-pressure-worker.mjs (100%) rename {tools => tests/tools}/benchmarks/daemon-coldstart-bench.mjs (98%) rename {tools => tests/tools}/benchmarks/main-thread-jank-bench.mjs (98%) rename {tools => tests/tools}/benchmarks/results/startup-acl-fix-2026-06-10T19-37-58-671Z.json (100%) rename {tools => tests/tools}/benchmarks/results/startup-acl-fix-steady-2026-06-10T19-41-40-683Z.json (100%) rename {tools => tests/tools}/benchmarks/results/startup-baseline-2026-06-10T19-36-01-305Z.json (100%) rename {tools => tests/tools}/benchmarks/results/terminal-perf-baseline-2026-07-02T07-23-46-933Z.json (100%) rename {tools => tests/tools}/benchmarks/results/terminal-perf-fix-a-b-2026-07-02T07-46-58-178Z.json (100%) rename {tools => tests/tools}/benchmarks/results/terminal-perf-fix-abd-2026-07-02T07-51-00-936Z.json (100%) rename {tools => tests/tools}/benchmarks/results/terminal-perf-fix-abdf-2026-07-02T07-59-11-820Z.json (100%) rename {tools => tests/tools}/benchmarks/startup-time-bench.mjs (99%) rename {tools => tests/tools}/benchmarks/terminal-cold-park-resource-bench.mjs (99%) rename {tools => tests/tools}/benchmarks/terminal-cold-park-reveal-bench.mjs (99%) rename {tools => tests/tools}/benchmarks/terminal-headless-parse-bench.mjs (97%) rename {tools => tests/tools}/benchmarks/terminal-perf-bench.mjs (99%) rename {tools => tests/tools}/benchmarks/terminal-pipeline-bench.mjs (98%) rename {tools => tests/tools}/benchmarks/workspace-switch-paint-latency.mjs (99%) rename {tools => tests/tools}/benchmarks/worktree-deletion-dev-bench.mjs (100%) rename {tools => tests/tools}/daemon-relocation-spike/README.md (98%) rename {tools => tests/tools}/daemon-relocation-spike/app-inventory.mjs (100%) rename {tools => tests/tools}/daemon-relocation-spike/cli.mjs (94%) rename {tools => tests/tools}/daemon-relocation-spike/daemon-launch.mjs (100%) rename {tools => tests/tools}/daemon-relocation-spike/host-copy.mjs (100%) rename {tools => tests/tools}/daemon-relocation-spike/loaded-module-probe.mjs (100%) rename {tools => tests/tools}/daemon-relocation-spike/loaded-modules.ps1 (100%) rename {tools => tests/tools}/daemon-relocation-spike/ndjson-client.mjs (100%) rename {tools => tests/tools}/daemon-relocation-spike/selftest.mjs (100%) rename {tools => tests/tools}/daemon-relocation-spike/spike.mjs (100%) rename {tools => tests/tools}/daemon-relocation-spike/tier-file-set.mjs (100%) rename {tools => tests/tools}/repro-macos-renderer-close-teardown.cjs (100%) rename {tools => tests/tools}/repro-orchestration-long-prompt.mjs (99%) rename {tools => tests/tools}/repro-watcher-crash-7547/.gitignore (100%) rename {tools => tests/tools}/repro-watcher-crash-7547/README.md (94%) rename {tools => tests/tools}/repro-watcher-crash-7547/child.cjs (100%) rename {tools => tests/tools}/repro-watcher-crash-7547/fixed-child.cjs (100%) rename {tools => tests/tools}/repro-watcher-crash-7547/run.cjs (100%) rename {tools => tests/tools}/spikes/.gitignore (100%) rename {tools => tests/tools}/terminal-garble-frame-analysis.mjs (100%) rename {tools => tests/tools}/terminal-garble-production-repro.mjs (99%) rename {tools => tests/tools}/terminal-garble-react-terminal-recovery.mjs (100%) rename {tools => tests/tools}/terminal-garble-session-replay.mjs (100%) rename {tools => tests/tools}/win-crash-survival-e2e/README.md (96%) rename {tools => tests/tools}/win-crash-survival-e2e/cli-args.mjs (97%) rename {tools => tests/tools}/win-crash-survival-e2e/crash-assertions.mjs (100%) rename {tools => tests/tools}/win-crash-survival-e2e/crash-step.mjs (100%) rename {tools => tests/tools}/win-crash-survival-e2e/daemon-identity.mjs (100%) rename {tools => tests/tools}/win-crash-survival-e2e/reattach-proof.mjs (100%) rename {tools => tests/tools}/win-crash-survival-e2e/run.mjs (100%) rename {tools => tests/tools}/win-update-e2e/README.md (96%) rename {tools => tests/tools}/win-update-e2e/app-driver.mjs (100%) rename {tools => tests/tools}/win-update-e2e/app-driver.test.mjs (100%) rename {tools => tests/tools}/win-update-e2e/assertions.mjs (100%) rename {tools => tests/tools}/win-update-e2e/cli-args.mjs (97%) rename {tools => tests/tools}/win-update-e2e/daemon-processes.mjs (100%) rename {tools => tests/tools}/win-update-e2e/installer-steps.mjs (100%) rename {tools => tests/tools}/win-update-e2e/interactivity-probes.mjs (100%) rename {tools => tests/tools}/win-update-e2e/onboarding-profile.mjs (100%) rename {tools => tests/tools}/win-update-e2e/platform-guard.mjs (100%) rename {tools => tests/tools}/win-update-e2e/powershell-runner.mjs (100%) rename {tools => tests/tools}/win-update-e2e/preflight.mjs (100%) rename {tools => tests/tools}/win-update-e2e/registry-shortcut-backup.mjs (100%) rename {tools => tests/tools}/win-update-e2e/run.mjs (100%) rename {tools => tests/tools}/win-update-e2e/window-enum.ps1 (100%) rename {tools => tests/tools}/win-update-e2e/window-watch.mjs (100%) rename {tools => tests/tools}/win-update-e2e/window-watch.ps1 (100%) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 6c76a2fe4..b44287a9e 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -2,4 +2,4 @@ /src/renderer/src/i18n/locales/ @brennanb2025 /config/scripts/*localization*.mjs @brennanb2025 /config/scripts/*locale*.mjs @brennanb2025 -/i18next.config.ts @brennanb2025 +/config/i18next.config.ts @brennanb2025 diff --git a/.github/workflows/daemon-relocation-spike.yml b/.github/workflows/daemon-relocation-spike.yml index 319580dc2..799c06031 100644 --- a/.github/workflows/daemon-relocation-spike.yml +++ b/.github/workflows/daemon-relocation-spike.yml @@ -13,7 +13,7 @@ on: branches: - Jinwoo-H/windows-update-survival paths: - - 'tools/daemon-relocation-spike/**' + - 'tests/tools/daemon-relocation-spike/**' - '.github/workflows/daemon-relocation-spike.yml' workflow_dispatch: {} @@ -76,7 +76,7 @@ jobs: # --keep-work-dir so the per-tier daemon stdout/stderr logs survive # for the artifact upload (the spike otherwise removes work-dir), # which is what diagnoses a tier that fails to reach ready. - node tools/daemon-relocation-spike/spike.mjs ` + node tests/tools/daemon-relocation-spike/spike.mjs ` --app-dir dist/win-unpacked ` --work-dir "$work" ` --tier $tier ` diff --git a/.github/workflows/win-crash-survival-e2e.yml b/.github/workflows/win-crash-survival-e2e.yml index cd7e02451..0098932a1 100644 --- a/.github/workflows/win-crash-survival-e2e.yml +++ b/.github/workflows/win-crash-survival-e2e.yml @@ -135,7 +135,7 @@ jobs: run: | New-Item -ItemType Directory -Force artifacts | Out-Null $log = "artifacts/crash-survival-output.log" - node tools/win-crash-survival-e2e/run.mjs ` + node tests/tools/win-crash-survival-e2e/run.mjs ` --expect "$env:EXPECT" ` --exe-path "$env:ORCA_EXE" ` --soak-seconds 8 2>&1 | Tee-Object -FilePath $log diff --git a/.github/workflows/win-update-e2e.yml b/.github/workflows/win-update-e2e.yml index 21c788256..1e572b2a0 100644 --- a/.github/workflows/win-update-e2e.yml +++ b/.github/workflows/win-update-e2e.yml @@ -20,7 +20,7 @@ on: branches: - Jinwoo-H/windows-update-survival paths: - - 'tools/win-update-e2e/**' + - 'tests/tools/win-update-e2e/**' - '.github/workflows/win-update-e2e.yml' workflow_dispatch: inputs: @@ -125,7 +125,7 @@ jobs: ORCA_E2E_DIAG_DIR: artifacts/diag run: | $log = "artifacts/harness-output.log" - node tools/win-update-e2e/run.mjs ` + node tests/tools/win-update-e2e/run.mjs ` --from "$env:FROM_EXE" ` --to "$env:TO_EXE" ` --expect "$env:EXPECT" ` diff --git a/.github/workflows/win-update-survival-e2e.yml b/.github/workflows/win-update-survival-e2e.yml index 4f19e2529..3b34ed3a9 100644 --- a/.github/workflows/win-update-survival-e2e.yml +++ b/.github/workflows/win-update-survival-e2e.yml @@ -16,7 +16,7 @@ on: paths: - 'src/main/daemon/**' - 'src/main/pty/**' - - 'tools/win-update-e2e/**' + - 'tests/tools/win-update-e2e/**' - 'config/electron-builder.config.cjs' - '.github/workflows/win-update-survival-e2e.yml' workflow_dispatch: @@ -97,7 +97,7 @@ jobs: $exe = "dist/orca-windows-setup.exe" if (-not (Test-Path $exe)) { throw "Installer not found at $exe" } $log = "artifacts/survival-output.log" - node tools/win-update-e2e/run.mjs ` + node tests/tools/win-update-e2e/run.mjs ` --from "$exe" ` --to "$exe" ` --expect "$env:EXPECT" ` diff --git a/.gitignore b/.gitignore index 7f954a8df..51306ff20 100644 --- a/.gitignore +++ b/.gitignore @@ -70,7 +70,7 @@ coverage/ prod-release-scan-*.md # Benchmark run output -/tools/benchmarks/results/*.json +/tests/tools/benchmarks/results/*.json /.bench-fixtures/ # Temp @@ -132,4 +132,4 @@ src/renderer/src/i18n/locales/.ja-catalog-cache.json src/renderer/src/i18n/locales/.es-catalog-cache.json # Bench result JSONs are working artifacts -tools/benchmarks/results/terminal-pipeline-*.json +tests/tools/benchmarks/results/terminal-pipeline-*.json diff --git a/ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md b/ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md deleted file mode 100644 index 57c00ba3a..000000000 --- a/ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md +++ /dev/null @@ -1,1787 +0,0 @@ -# Orca Orchestration Implementation Checklist - -This is the durable implementation ledger for the orchestration primitives proposal. Update it in -the same change that implements, removes, or materially revises an item. The design source is -`docs/orchestration-primitives.html`; keep it synchronized with this checklist. - -## How to use this file - -- Check an item only after its implementation and proportionate tests are complete. -- If an item changes meaning, edit the checklist and add a dated decision-log entry explaining why. -- After every implementation session, append a progress-log entry with files, tests, findings, and - the next concrete step. -- Do not mark a phase complete while any acceptance test in that phase remains open. -- Preserve the non-goals. A new subsystem requires separate evidence and a separate proposal. - -Status meanings: - -- `[ ]` not started or not proven -- `[x]` implemented and verified -- `DEFERRED` deliberately outside the current implementation sequence - -## Current summary - -- [x] Fresh primitive-oriented design written and repeatedly reviewed. -- [x] Product UI changes explicitly excluded. -- [x] Current orchestration skill now teaches setup-run for new worktrees, batch processing, - `agentTerminalHandle` preference, and the custom-argv setup-policy limitation. -- [x] Phase 0 command/skill compatibility work complete. -- [x] Phase 1 local Run, mailbox, lifecycle, and idempotency primitives complete. -- [x] Phase 2 same-server composed worker lifecycle complete. -- [x] Phase 3 connected-server federation complete. -- [x] Revalidate Phase 3 after the 2026-07-24 post-rebase dogfood exposed a renderer-adoption - process-identity regression. -- [x] Phase 4 structured worker output is implemented with passing automated coverage and physical - local, mixed-version, restart, disconnect, and Windows-home to Mac-worker evidence; optional - symmetric acceptance checks remain tracked below. -- [x] Hard-cutover migration fence implemented and locally verified; branch-head CI remains the - final remote check. - -## Scope invariants - -- [x] Agents choose decomposition, topology, placement, parallelism, and recovery strategy. -- [x] Low-level worktree, terminal, setup, and handoff commands remain independently usable. -- [x] Every composed mutation with external effects returns explicit effects and an honest outcome; - control-plane-only mutations return their exact resource receipt. -- [x] Worker assertions remain labeled as worker reports, not Orca-verified correctness. -- [x] Silence alone never proves worker death or triggers replacement. -- [x] Multi-server Runs use one authoritative Run home and connected worker servers. -- [x] Runtime/server/host identity mechanics remain hidden from ordinary agent commands. - -Explicit non-goals: - -- [x] No product dashboard, Run UI, badges, or coordinator chat UI. -- [x] No scheduler, automatic placement, capacity allocator, fairness, or priority aging. -- [x] No automatic retry or replacement based on silence. -- [x] No commit, branch, merge, integration, or target-ref tracking. -- [x] No filesystem read-only/writer enforcement. -- [x] No generalized ACL, organization, role, or worker-profile system. -- [x] No replicated Run database, leader election, or automatic Run-home failover. -- [x] No dead-letter/poison-message workflow. -- [x] No universal provider-session or transcript framework. - -## Phase 0 — Vocabulary and current-agent ergonomics - -### Command compatibility - -- [x] Remove or rename the existing scheduler-like `orca orchestration run --spec` before shipping - lightweight `run-*` commands. -- [x] Publish the canonical command map in CLI help. -- [x] Define aliases or explicit deprecations for any renamed current command. -- [x] Keep current flat task commands unless a separately justified CLI migration changes them. -- [x] Require explicit destructive reset scope; bare reset must not imply reset-all. - -### Skill and recipes - -- [x] Teach that `check --wait` returns a message batch, not one message. -- [x] Teach processing every returned message and waiting until expected Dispatches settle. -- [x] Document crash-safe explicit acknowledgment and redelivery of an unacknowledged batch. -- [x] Prefer `agentTerminalHandle`, then legacy `startupTerminal.handle`, then exact terminal-list - resolution. -- [x] Pass `--setup run` for new worktrees by default. -- [x] State a concrete reason before using `--setup skip` or `--setup inherit`. -- [x] Preserve `start-immediately` as the normal setup/agent startup policy. -- [x] Warn that the two-step custom-argv launch cannot preserve explicit `wait-for-setup`. -- [x] Add executable current-version recipes for local fan-out, new worktrees, completion/failure, - questions, timeout recovery, and restart limitations. -- [x] Ensure installed, bundled, repository, and generated orchestration skill copies stay in sync. - -### Phase 0 acceptance - -- [x] An agent reading only CLI help and the skill can select current versus new worktree correctly. -- [x] The agent starts all independent workers before blocking. -- [x] The agent cannot mistake the old scheduler Run for a lightweight namespace Run. -- [x] Recipes contain only commands supported by the matching shipped CLI version. - -## Phase 1 — Run, mailbox, lifecycle, and durable mutation receipts - -### Lightweight Run - -- [x] Add a Run table with stable Run ID, objective, created/updated timestamps, and home database. -- [x] Add mandatory Run association to new Tasks, Dispatches, Messages, deliveries, and questions. -- [x] Migrate pre-Run orchestration rows into one unbound, inspect-only legacy Run. -- [x] Keep old scheduler-run storage distinct from lightweight Runs. -- [x] Implement `run-create`, `run-use`, `run-current`, `run-list`, and `run-show`. -- [x] Bind a coordinator pane explicitly; never infer a Run from a worktree or sole candidate. -- [x] Store one active mailbox consumer generation per Run. -- [x] Rebinding fences the old consumer and cancels its active waiter. -- [x] Do not implement Run archive/delete in V1. - -### Logical routing and prompt safety - -- [x] Add stable `run:` and exact `dispatch:` message recipients. -- [x] Do not add a task-recipient retargeting rule in V1. -- [x] Make send, ask, reply, completion, heartbeat, and runtime notices inbox-only. -- [x] Ensure only explicit dispatch injection and terminal-send operations can modify terminal input. -- [x] Define send success as durable acceptance, not observation or action. -- [x] Rename or remove `check --inject` if its name implies remote delivery. -- [x] Reject explicit Run/recipient targets from federated workers when the only valid destination is - their authenticated Run home. - -### Crash-safe inbox consumption - -- [x] Add one FIFO mailbox sequence. -- [x] Bound each actionable delivery to 50 messages. -- [x] Allow one outstanding Delivery and one active actionable waiter per Run mailbox. -- [x] Return the identical Delivery ID and batch until acknowledgment. -- [x] Implement whole-batch idempotent acknowledgment. -- [x] Bind Delivery acknowledgment to the current consumer generation. -- [x] Implement atomic `ack -> check -> register waiter`. -- [x] Keep peek/all/history modes read-only. -- [x] Treat type filters as wake predicates only; return the oldest full actionable batch. -- [x] Return typed timeout, cancelled, connection-lost, waiter-exists, stale-delivery, and - consumer-fenced outcomes. -- [x] Preserve unacknowledged mail across client and Orca process restart. - -### Truthful lifecycle - -- [x] Require `outcome=succeeded|failed` on terminal worker reports. -- [x] Map authenticated succeeded reports to Dispatch succeeded and Task completed. -- [x] Map authenticated failed reports to Dispatch failed and Task failed. -- [x] Persist stale/foreign reports as history without lifecycle mutation. -- [x] Reject malformed lifecycle transitions with typed missing/invalid fields. -- [x] Label result provenance as `worker_report`. -- [x] Apply every terminal transition as one transactional compare-and-set. -- [x] First committed completion, stop fence, or abandon wins. -- [x] Make duplicate identical completion idempotent. - -### Questions - -- [x] Model a question as durable message/thread state, not a task gate. -- [x] Default ask from an active Dispatch to its owning Run mailbox. -- [x] Record one idempotent first answer from the current Run consumer generation. -- [x] Reject conflicting later answers. -- [x] Resume by original message ID after timeout or disconnect. -- [x] Recover a lost ask-acceptance response through the same mutation retry receipt. -- [x] Close pending questions when their Dispatch stops or is abandoned. -- [x] Wake closed question waits with `dispatch_inactive`. - -### Narrow pane authority - -- [x] Mint an unforgeable per-Dispatch capability at lifecycle injection. -- [x] Carry the capability outside user-controlled request parameters on native, WSL, and SSH CLI - bridges. -- [x] Persist only its verifier or secure-store reference. -- [x] Verify capability, exact managed pane, Dispatch ID, and process incarnation for lifecycle calls. -- [x] Revoke/fence the capability on stop, abandon, or replacement. -- [x] Do not generalize this into user/role access control. - -### Durable mutation ledger - -- [x] Let clients retain/reuse one opaque retry request ID after unknown acceptance. -- [x] Before effects, persist authenticated caller/peer, request ID, canonical payload hash, - operation state, and receipt. -- [x] Join concurrent identical mutations or return the recorded result. -- [x] Return `request_mismatch` for the same request ID with a changed payload. -- [x] Cover Run/Task creation, send, ask, reply, acknowledgment, start, stop, and abandon. -- [x] Persist dedupe receipts across Orca restart. - -### Phase 1 acceptance - -- [x] Two Runs on the same runtime never mix tasks or mail. -- [x] An old coordinator cannot acknowledge or reply after `run-use` fences it. -- [x] A returned but unacknowledged batch is replayed after client/runtime restart. -- [x] Success, failure, stale completion, malformed completion, and duplicate completion tests pass. -- [x] Ask timeout/resume, same reply replay, conflicting reply, and stopped-Dispatch tests pass. -- [x] A forged pane/handle field cannot mutate lifecycle state. - -## Phase 2 — Same-server composed worker lifecycle - -### Command grammar and topology - -- [x] Implement `worker-start`, `worker-show`, `worker-read`, `worker-stop`, and - `worker-abandon` for workers owned by the Run home. -- [x] Current worktree creates one fresh agent terminal unless `--terminal` is explicit. -- [x] Named existing worktree creates one fresh agent terminal unless reuse is explicit. -- [x] Current/existing worktrees do not rerun creation-time setup or configured tabs. -- [x] New child worktree uses agent-first creation and reuses its returned agent terminal. -- [x] New top-level worktree uses agent-first creation with independent Orca lineage. -- [x] Reject child/top-level creation for folder projects before effects; use current/existing folder - workspaces instead. -- [x] Pass the supported exact repo, base, lineage, display/comment metadata, and setup options to - the existing worktree primitive rather than duplicating policy. `--on` owns connected-server - placement; project/host convenience selection remains on low-level `worktree create`. -- [x] Require a configured agent launcher before any mutation. -- [x] Reject selector/option conflicts before effects for current/existing worktrees. - -### Setup and startup - -- [x] Omitted setup on a new worktree resolves to `run` for orchestration starts. -- [x] No configured setup hook resolves to `not_configured`, not failure. -- [x] Preserve repository `setupAgentStartupPolicy`. -- [x] Preserve whether setup came from an explicit request or Orca's orchestration default across - connected-server starts. -- [x] Default `start-immediately` launches setup and agent side by side. -- [x] Under `start-immediately`, setup outcome never gates Dispatch readiness regardless of when - it is observed. -- [x] Track the setup command's exit code without waiting for its interactive terminal shell to - exit or closing the setup tab. -- [x] Register the completion observer before replaying bounded recent output so fast local setup - commands cannot finish in an observation gap. -- [x] Carry the exact created setup terminal handle; never infer setup identity from a display - title shared with configured tabs or split panes. -- [x] Scope completion signals to a private per-invocation token and preserve uncertain terminal - outcomes as running rather than converting a disconnect into setup failure. -- [x] The return receipt contains the latest setup state. -- [x] Only post-return setup state changes emit a typed setup notice. -- [x] Setup failure never automatically stops or fails an already-ready worker. -- [x] Explicit `wait-for-setup` completes setup successfully before agent launch and task injection. -- [x] Under `wait-for-setup`, setup failure produces start failure before task delivery. -- [x] Custom-argv two-step launch is rejected or clearly unsupported under `wait-for-setup`. - -### Start operation and receipts - -- [x] In one transaction, create a starting Dispatch, move the Task, and record the mutation request. -- [x] Persist the accepted Dispatch ID in a pending start receipt so restart recovery returns an - exact `worker-show` command. -- [x] Persist before/after stage receipts around irreversible effects. -- [x] Return only `ready`, `failed`, or `outcome_unknown`. -- [x] Define ready as TUI idle, durable Dispatch attachment, and accepted lifecycle/task input. -- [x] Echo effective timeout, setup startup policy, defaults, and resolution sources. -- [x] Enumerate every effect: worktree, setup, agent terminal, setup terminal, each configured - terminal pane, and dispatch input; include exact tab/leaf identity when available. -- [x] Persist accepted dispatch input atomically with the ready transition so later setup refreshes - cannot erase it. -- [x] Tag every terminal effect with role and created/reused action. -- [x] Report setup as running only after its exact PTY spawn receipt is durable. -- [x] List every residual resource on failure or unknown outcome. -- [x] Never claim an effect was created before it exists. -- [x] Do not add a background provisioning executor; intentionally launched setup may continue as - its receipt states. - -### Dispatch and Task state machine - -- [x] Implement starting, ready, start-unknown, failed, succeeded, stopping, stop-unknown, stopped, - and abandoned Dispatch states. -- [x] Block the Task while start/stop outcome remains unknown. -- [x] Allow semantic `--retry-of` only from explicit failed, stopped, abandoned, or proven no-effect - states. -- [x] Require the replacement to repeat its intended placement and agent/terminal choice; do not - silently inherit a prior attempt's topology. -- [x] Reject unsafe retry without mutation. -- [x] Completed Tasks require a follow-up Task rather than retry. - -### Show, read, stop, and abandon - -- [x] Route operations by Dispatch ID after start; do not require resource IDs again. -- [x] Implement V1 `worker-read` as a thin route to bounded terminal-read. -- [x] Preserve cursor, limit, terminal status, and limited/truncated fields. -- [x] Stop fences lifecycle and blocks the Task in one home-side compare-and-set. -- [x] Stop affects only the supervised agent terminal/process. -- [x] Never delete the worktree, setup terminal, configured tabs, or unrelated processes. -- [x] Return stopped, already-settled, failed, and stop-unknown receipts truthfully. -- [x] Abandon performs no remote/process action, retains possibly-live resources, and enables a - warned replacement. - -### Same-server recovery tests - -- [x] Current, existing, child, top-level, explicit-terminal, and configured-tab starts pass. -- [x] Setup run/skip/inherit and start-immediately/wait-for-setup combinations pass. -- [x] Trust/update prompt, setup failure, terminal failure, and task-input failure receipts pass. -- [x] Crash before effect, after possible effect/before receipt, and after durable receipt are - distinguishable as failed/no-residual, outcome-unknown, and failed-with-residual respectively. -- [x] Stop/completion races preserve the first committed terminal transition. -- [x] Restart never adopts a same-looking pane or process incarnation. - -## Phase 3 — Connected Orca server federation - -### Placement and identity - -- [x] Add worker-only `--on ` without changing global `--environment` meaning. -- [x] Default worker placement to the Run home. -- [x] Require `--on` for remote existing worktree/terminal selectors in V1. -- [x] Resolve remote resources through explicit read-only discovery; never guess by name/path. -- [x] Return `server_required`, `worktree_not_found_on_server`, and - `terminal_worktree_mismatch` before related worker effects; treat a mismatched remote - Dispatch/home receipt as `resource_server_mismatch` and never adopt it. -- [x] Pin each remote Dispatch to the authenticated worker-server public-key fingerprint. -- [x] Store runtime ID only as a process epoch, never durable server identity. -- [x] Return `peer_changed` with no effect if a saved environment is re-paired to a different server. -- [x] Preserve a routing tombstone when an environment with nonterminal Dispatches is removed. - -### Remote Dispatch attachment - -- [x] Persist a narrow attachment on the worker server before task input. -- [x] Store home peer identity, Dispatch capability verifier, stable pane/process incarnation, - resource receipts, protocol version, and relay cursors. -- [x] Do not copy the Run DAG/database to the worker server. -- [x] Protect attachment credentials/database/WAL/SHM as current-user-only on macOS, Linux, and - Windows. - -### Bidirectional relay - -- [x] Use the existing authenticated saved-environment connection; require no public callback or - reciprocal pairing. -- [x] Run a Run-home subscription/pull service for active remote Dispatches. -- [x] Persist worker-to-home lifecycle/questions until home import acknowledgment. -- [x] Persist home-to-worker replies/control mail until worker import acknowledgment. -- [x] Route coordinator `send --to dispatch:` through that same durable relay and wake the - exact remote worker's local `check --wait`. -- [x] Key relay items by pinned peer, Dispatch ID, direction, monotonic sequence, and a - 128-bit-or-stronger message ID. -- [x] Import only contiguous source sequences; buffer/reject gaps. -- [x] Acknowledge only the highest contiguous committed sequence. -- [x] Assign ordinary Run-mailbox order only at home import. -- [x] Apply lifecycle transition and message import in one transaction before acknowledgment. -- [x] Enforce per-message and per-Dispatch count/byte quotas. -- [x] Coalesce heartbeats and reserve room for one terminal lifecycle report. -- [x] Return `relay_quota_exceeded`; do not add a dead-letter system. - -### Federated control and recovery - -- [x] Route show/read/stop/retry by Dispatch receipt; agents do not repeat `--on`. -- [x] Forward the same application retry request ID across home and worker server. -- [x] Return typed unknown outcome with last durable stage and exact next commands. -- [x] Reconcile a lost federated stop response from a later authoritative stopped receipt. -- [x] Treat abandonment of a superseded Dispatch as a no-op for the replacement Task. -- [x] Preserve and relay post-return federated setup evidence without changing worker lifecycle. -- [x] Recreate active relay subscriptions after Run-home restart. -- [x] Preserve worker attachment and relay state after worker-server restart. -- [x] Report running only when pane and process incarnation match after restart. -- [x] One disconnected worker server must not block local or other-server inbox delivery. -- [x] No automatic worker replacement on disconnect or silence. - -### Capability negotiation - -- [x] Advertise one aggregate `orchestrationFederationV1` control-plane capability. -- [x] Pin peer fingerprint and protocol version in the durable operation record. -- [x] Revalidate them inside the worker-side mutation, not only in a preflight probe. -- [x] Return `capability_unsupported` before Dispatch/resource/prompt effects. -- [x] Keep host/Git/setup validation inside existing primitives rather than a generalized capability - matrix. - -### Federation scenario matrix - -- [x] Post-rebase physical Mac Run home -> Windows worker preserves exact process identity through - renderer adoption, routed read, heartbeat, question/reply, completion, and stop. -- [x] Mac Run home -> Windows worker: start, completion, failure, question/reply, read, and stop. -- [x] Windows Run home -> Mac worker: the same flows through a saved Mac pairing. -- [x] Native, WSL, SSH, and relay-backed execution-host paths preserve ownership and CLI capability. -- [x] Run home restarts alone; worker server restarts alone; both restart. -- [x] Disconnect before send proves no effect. -- [x] Disconnect after possible acceptance returns unknown and deduplicates exact retry. -- [x] Duplicate and reordered relay frames/acknowledgments converge without loss or duplication. -- [x] Re-pair/key change cannot retarget an active Dispatch. -- [x] Same-looking handles/resources on two servers never cross-route. -- [x] Mixed server versions fail before effects. -- [x] Windows PowerShell quoting, Windows paths, WSL environment propagation, and SSH bridge - allowlists pass. - -## Phase 4 — Structured worker output - -- [x] Reuse Orca's exact pane/process-to-provider-session association; do not create a second status - system. -- [x] Keep bounded terminal-read as the universal fallback. -- [x] Read only Codex, Claude/OpenClaude, and Grok transcripts supported by the existing - Native Chat decoders. -- [x] Never guess the latest session by current working directory, terminal title, logo, or agent - type. -- [x] Pin Dispatch, process, source, and provider session for the full opaque cursor chain. -- [x] Preserve the existing structured native-chat message/block representation and emit bounded - parsing/clipping warnings. -- [x] Label terminal fallback and its reason explicitly. -- [x] Read transcripts on the worker-owning server and never serialize their filesystem paths. -- [x] Fall back to the legacy federated terminal-read RPC when a connected server lacks the additive - structured-read method. -- [x] Cover exact selection, sibling-session isolation, source changes, malformed input, limits, - path privacy, CLI rendering, and mixed-version fallback with automated tests. -- [x] Physically verify local Codex, two same-worktree Codex sessions, cursor continuation, - provider-session replacement, explicit terminal selection, and safe Run-home restart behavior. -- [x] Physically verify Mac Run home -> older Windows worker terminal fallback, including an opaque - continuation cursor and explicit transcript-required failure. -- [ ] Physically verify hooks-disabled automatic fallback and disconnect/reconnect. -- [ ] Physically verify exact structured Mac-to-Windows and Windows-to-Mac reads after both worker - servers run the new additive method. -- [x] Do not add resume, live-stream control, session exclusivity, or a universal transcript ontology. - -## Migration — Hard cutover from pre-Run orchestration - -### Contract and effect fence - -- [x] Add one orchestration contract version and one advertised runtime capability without changing - the global runtime protocol. -- [x] Keep one shared mutation/read classifier for CLI, runtime dispatch, durable receipts, and - connected-server calls. -- [x] Require the contract before parameter parsing, mutation receipts, database writes, prompt - injection, process actions, or connected-server mutations. -- [x] Preflight local and paired runtime capabilities before a new CLI sends a mutation. -- [x] Carry the contract through native Unix/named-pipe, WebSocket, and connected-server envelopes. -- [x] Retire `coordinator-start`, `coordinator-stop`, `run`, and `run-stop` before RPC effects. -- [x] Do not add a compatibility executor, automatic rewrite, legacy scheduler, or in-flight drain. - -### Agent recovery and legacy inspection - -- [x] Return `effectsApplied=false`, structured guide metadata, and executable argument-only - `skills get orchestration --full` recovery. -- [x] Attach the same guide recovery to no-bound-Run and missing worker outcome errors. -- [x] Preserve explicit read-only Run, task, inbox, Dispatch, gate, and terminal inspection. -- [x] Allow `task-list --run run_legacy_local` without binding the legacy Run. -- [x] Keep default/actionable check and acknowledgment fenced; only explicit peek/all history reads - may inspect legacy mail. -- [x] Document that active pre-upgrade agents keep running as processes but are unsupervised and - must be inspected before replacement. -- [x] Remove the legacy scheduler recipe from the version-matched full orchestration guide. - -### Migration acceptance - -- [x] Missing/wrong contract rejects every classified mutation before parsing, receipt, and effect. -- [x] Current-contract mutations still execute and retain durable retry receipts. -- [x] Read-only inspection works without a contract and does not consume legacy data. -- [x] Local and remote clients reject a runtime missing the contract capability before mutation. -- [x] Native and encrypted WebSocket transports preserve the contract field. -- [x] Old `worker_done` leaves message, Task, and Dispatch state unchanged. -- [x] Human and JSON errors preserve no-effects and guide-reload recovery. -- [x] `skills get orchestration --full` remains runtime-independent and generated guides stay in - sync. -- [ ] Branch-head CI passes after the verified migration commit is pushed. Local orchestration, - repository tests, typechecks, reliability gates, and production builds pass. - -## Cross-cutting quality gates - -### Persistence and transactions - -- [x] Define process-crash durability separately from sudden-power-loss durability. -- [x] Keep SQLite WAL + `synchronous=NORMAL` for the documented process-crash guarantee; require a - separate policy change before promising sudden-power-loss durability. -- [x] Keep lifecycle import, terminal transitions, and acknowledgment transaction boundaries explicit. -- [x] Exercise migrations from existing task/message/dispatch/scheduler-run data. - -### Cross-platform - -- [x] Native macOS, Linux, and Windows tests cover each new CLI/RPC contract. -- [x] WSL and SSH host identity/capability state is scoped to the actual execution host. -- [x] Paths use platform utilities; examples are PowerShell/cmd/POSIX safe. -- [x] Named-pipe, Unix-socket, WebSocket, WSL, and SSH bridges carry Dispatch capabilities safely. - -### Documentation - -- [x] CLI help owns exact flags, selectors, defaults, outcome fields, and exit-code behavior; typed - RPC errors remain the machine-readable error contract. -- [x] The skill owns short decision recipes and common misuses, not protocol internals. -- [x] Every shipped phase updates this checklist and adds a progress-log entry. -- [x] The ignored HTML proposal and this tracked checklist remain semantically synchronized. - -## Findings and decision log - -### 2026-07-22 — Phase 2 closure without option-surface creep - -- `worker-start` passes exact repository, base, child/top-level lineage, display/comment metadata, - and setup choices into the existing worktree primitive. It does not duplicate `worktree create`'s - project/host convenience resolver: `--on` already names the connected Orca server and `--repo` - names the repository on that server. -- A gated setup receipt becomes `succeeded` only after the agent wrapper proves setup completed. A - confirmed spawn/script failure fails before task input; timeout keeps `running` because silence is - not failure. -- The existing single durable worker row is the operation stage journal. A pre-effect failure has no - residuals, possible acceptance before receipt is unknown, and later failure after a durable effect - lists exact residual resources. No background saga executor or general effect engine was added. -- This earlier Phase 4 deferral was based on an incomplete audit. Orca already retained an exact - pane-scoped provider-session association from agent hooks; the narrow implementation now exposes - it to the worker-owning runtime and still falls back when that evidence is absent. - -### 2026-07-22 — Final setup/startup review - -- Keep setup-run as the new-worktree orchestration default. -- Preserve Orca's existing `start-immediately` default: setup and agent run side by side. -- Only explicit `wait-for-setup` gates agent launch/task delivery. -- A custom-argv two-step terminal launch cannot preserve wait-for-setup and must not silently bypass - it. -- Receipts must enumerate role-tagged agent, setup, and configured terminals; a boolean - `setupSpawned` is insufficient. -- Setup outcome never gates readiness under start-immediately, regardless of observation timing. - -### 2026-07-22 — Federation robustness review - -- Multi-server operation is a core requirement, not a later optional product feature. -- Use a single authoritative Run home with narrow remote Dispatch attachments and bidirectional - relay; do not replicate the Run database. -- Pin active Dispatches to authenticated peer identity so re-pairing cannot redirect work. -- Use contiguous, scoped relay sequences and bounded storage. -- Hide peer fingerprints, relay cursors, process incarnations, and capabilities from normal agents. - -### 2026-07-22 — Validation and scope boundary - -- Phase 0 and Phase 1 are complete: their command, recipe, Run, inbox, lifecycle, question, - authority, and mutation-ledger acceptance rows now have focused passing tests. -- Phase 2 remains open until the full existing-worktree/explicit-terminal/setup-policy/failure-stage - matrix is covered. Passing current/new-worktree and recovery slices are not enough to claim it. -- Phase 3 remains open until the named Mac/Windows, WSL, SSH, relay, restart, disconnect, and quoting - matrix runs on those actual paths. The in-process federation harness proves protocol behavior but - is not a substitute for cross-platform acceptance. - - At this point Phase 4 stayed deferred pending proof of an exact association. The later - structured-output audit found the existing pane-scoped hook association and superseded this - decision without adding a universal provider framework. - -### 2026-07-21 — Simplification decision - -- Replace the original broad orchestration redesign with four public concepts: Run, Task, Dispatch, - and Message. -- Keep agent-owned strategy and strong control-plane primitives. -- Remove UI, scheduler, capacity allocation, access enforcement, commit/integration tracking, - generalized provider/session abstractions, and other speculative product machinery. -- Retain Run because it provides a durable namespace and home mailbox across connected servers, not - because it schedules work. - -## Progress log - -Append new entries chronologically. Do not rewrite older entries except to correct factual errors. - -### 2026-07-22 — Checklist initialized - -- Changes: - - Created this tracked implementation ledger from the reviewed orchestration proposal. - - Recorded all phases, acceptance tests, non-goals, and review-derived invariants. - - Updated the current orchestration skill to prefer setup-run, preserve start-immediately, process - message batches, prefer `agentTerminalHandle`, and reject custom-argv wait-policy bypass. -- Files: - - `ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md` - - `skills/orchestration/SKILL.md` - - `docs/orchestration-primitives.html` (ignored design source) -- Verification: - - HTML parsed successfully with balanced tags and unique IDs. - - Final review Task completed without an architectural blocker. -- Findings: - - Implementation may begin with Phase 0. - - Phase 2 readiness/receipt work depends on the explicit setup and role-tagged-effect contracts - recorded above. -- Next: - - Finish Phase 0 command compatibility and version-matched recipes. - -### 2026-07-22 — Phase 0 command safety and vocabulary - -- Changes: - - Renamed the scheduler-like command surface to `coordinator-start` and `coordinator-stop` while - retaining `run` and `run-stop` as documented deprecated aliases. - - Updated root help and both orchestration skill sources to distinguish the legacy automatic loop - from the proposed lightweight Run namespace and to prefer the explicit task/dispatch/wait loop. - - Made `orchestration reset` require exactly one of `--all`, `--tasks`, or `--messages` before it - contacts the runtime. - - Synchronized setup, worker-terminal selection, and message-batch guidance into the canonical - guide and regenerated the bundled CLI guide. -- Files: - - `src/cli/specs/orchestration.ts` - - `src/cli/handlers/orchestration.ts` - - `src/cli/help.ts` - - `src/cli/handlers/orchestration.test.ts` - - `src/cli/index.test.ts` - - `src/main/runtime/orchestration-cli-subprocess.test.ts` - - `skill-guides/orchestration.md` - - `skills/orchestration/SKILL.md` - - `src/cli/bundled-skill-guides.ts` -- Verification: - - `pnpm vitest run --config config/vitest.config.ts src/cli/index.test.ts src/cli/handlers/orchestration.test.ts` — 199 tests passed. - - `pnpm verify:bundled-skill-guides` — passed. - - `pnpm typecheck:cli` — passed. - - `git diff --check` — passed. -- Findings: - - Keeping hidden compatibility aliases preserves existing scripts without advertising the old - scheduler noun as the normal agent path. - - Truthful success/failure recipes depend on the Phase 1 explicit lifecycle outcome; do not - document the current behavior as if a failed `worker_done` failed the Task. -- Next: - - Implement explicit succeeded/failed worker-report semantics and then finish the version-matched - Phase 0 recipes without lying about failure behavior. - -### 2026-07-22 — Truthful worker terminal outcomes - -- Changes: - - Added the structured `--outcome succeeded|failed` worker-report field to local and SSH fallback - CLI payload construction and injected preambles. - - Added one transactional compare-and-set that settles the Dispatch and Task together, promotes - dependents only on success, and replays an identical terminal outcome idempotently. - - Persisted worker result provenance, message identity, summary, files, and report path as a - labeled `worker_report` rather than an Orca-verified result. - - Converted missing, invalid, unknown, stale, mismatched, inactive, and foreign reports into - typed, high-priority audit rows without mutating lifecycle state. - - Updated the legacy automatic coordinator loop to record failed worker reports as failed tasks. -- Files: - - `src/cli/specs/orchestration.ts` - - `src/cli/handlers/orchestration.ts` - - `src/main/ssh/ssh-remote-orchestration-send.ts` - - `src/main/runtime/orchestration/types.ts` - - `src/main/runtime/orchestration/db.ts` - - `src/main/runtime/orchestration/lifecycle-reconciliation.ts` - - `src/main/runtime/orchestration/preamble.ts` - - `src/main/runtime/orchestration/coordinator.ts` - - Corresponding CLI, SSH, preamble, DB lifecycle, coordinator, and RPC tests/snapshots - - Both orchestration skill sources and the generated bundled guide -- Verification: - - Five focused CLI/lifecycle/preamble/coordinator/SSH test files — 124 tests passed. - - `src/main/runtime/rpc/methods/orchestration.test.ts` — 114 tests passed. - - `pnpm typecheck:node` — passed. - - `pnpm typecheck:cli` — passed. - - `pnpm verify:bundled-skill-guides` and `git diff --check` — passed. -- Findings: - - The old subject-based failure convention was not merely confusing: it irreversibly completed a - failed Task. Requiring a tiny enum is a robust primitive, not workflow policy. - - Stop and abandon still need to share this terminal-transition fence before the broader - first-writer-wins checklist item can be marked complete. -- Next: - - Add the lightweight Run schema and explicit coordinator binding, then key new Task/Dispatch/ - Message state to that Run without changing agent placement policy. - -### 2026-07-22 — Lightweight Run foundation and inbox-only mail - -- Changes: - - Added schema v7 with lightweight Runs, stable explicit pane binding, consumer generations, and - an inspect-only legacy Run for all migrated pre-Run rows. - - Kept legacy automatic coordinator-loop storage in its existing `coordinator_runs` table. - - Added `run-create`, `run-use`, `run-current`, `run-list`, and `run-show` across CLI/RPC, with - explicit binding and no worktree or sole-candidate inference. - - Scoped new Task creation/list/update/dispatch operations to an explicit or currently bound Run; - Dispatches and decision gates inherit their Task's Run. - - Removed structured-mail prompt injection from send and ask. Mail now persists and wakes waiters - only; deliberate `dispatch --inject` and `terminal send` remain the input-writing paths. - - Renamed the local message renderer from `check --inject` to `check --format`, retaining only a - one-release RPC compatibility field. -- Files: - - `src/main/runtime/orchestration/db.ts` - - `src/main/runtime/orchestration/types.ts` - - `src/main/runtime/rpc/methods/orchestration-runs.ts` - - `src/main/runtime/rpc/methods/orchestration.ts` - - `src/main/runtime/orchestration/orchestration-error.ts` - - `src/main/runtime/rpc/errors.ts` - - `src/cli/specs/orchestration.ts` - - `src/cli/handlers/orchestration.ts` - - Related DB, RPC, CLI, and help tests; both skill sources and the bundled guide -- Verification: - - Focused DB/RPC/CLI command suite — 384 tests passed. - - `pnpm typecheck:node` and `pnpm typecheck:cli` — passed. - - `pnpm generate:bundled-skill-guides` and `pnpm verify:bundled-skill-guides` — passed. - - `git diff --check` — passed. -- Findings: - - Run identity is now real without changing scheduling or placement policy, but Messages and - questions still need stable logical recipients before mandatory Run association is complete. - - Consumer generation exists, but waiter cancellation and acknowledgment fencing belong to the - crash-safe Delivery implementation and remain intentionally unchecked. -- Next: - - Implement Run-owned logical mailboxes and stable `run:` / `dispatch:` routing, then - replace consume-on-read with one crash-safe outstanding Delivery per Run. - -### 2026-07-22 — Crash-safe Run inbox and durable questions - -- Changes: - - Added stable `run:` and `dispatch:` recipients; lifecycle sends from an active Dispatch - now default to its Run and no longer require agents to carry a coordinator terminal handle. - - Added schema v8 Deliveries: one FIFO batch of at most 50 rows, one outstanding batch per Run, - exact replay until whole-batch acknowledgment, and consumer-generation fencing. - - Made `check --ack --wait` perform ack, check, and waiter registration without an - intervening async gap; type filters are wake predicates and never split the FIFO batch. - - Added typed timeout, cancellation/connection-loss, second-waiter, stale-Delivery, and fenced- - consumer outcomes, plus persisted Delivery replay after an Orca database reopen. - - Added schema v9 question threads keyed by the original message ID, with active-Dispatch Run - defaulting, timeout-safe resume, current-consumer first-answer authority, idempotent replay, and - conflicting-answer rejection. - - Updated injected worker guidance and the orchestration skill so normal lifecycle and question - commands omit internal Run/server identity and coordinators explicitly process/ack each batch. -- Files: - - `src/main/runtime/orchestration/types.ts` - - `src/main/runtime/orchestration/db.ts` - - `src/main/runtime/orca-runtime.ts` - - `src/main/runtime/rpc/methods/orchestration.ts` - - `src/main/runtime/rpc/methods/orchestration-runs.ts` - - `src/main/runtime/orchestration/preamble.ts` - - CLI specs/handlers, RPC error mapping, skill sources, snapshots, and focused tests -- Verification: - - DB/RPC/runtime/CLI/preamble focused suite — 1,190 tests passed after the expected preamble - snapshot update. - - Delivery tests cover 50-row bounds, FIFO replay, idempotent ack, filter wake semantics, - consumer fencing, and reopen recovery. - - Question tests cover create/answer, same-answer replay, answer conflict, timeout persistence, - resume, unrelated wakes, and Dispatch closure storage behavior. -- Findings: - - A Run inbox needs only one durable Delivery row plus immutable message IDs; no dead-letter, - selective NACK, or second Event subsystem is necessary. - - Question answers belong in thread state rather than inbox-read state, so replying never - accidentally acknowledges the coordinator's whole Delivery. -- Next: - - Replace caller-supplied pane claims with a narrow Dispatch capability and add the durable - mutation ledger needed to recover unknown acceptance without replaying effects. - -### 2026-07-22 — Narrow Dispatch lifecycle capability - -- Changes: - - Minted a 256-bit per-Dispatch secret for injected workers while persisting only its SHA-256 - verifier. - - Bound lifecycle/question authority to the exact runtime-observed pane and PTY process - incarnation in addition to the Dispatch ID. - - Carried the secret in the authenticated RPC envelope across local socket, WebSocket, - shared remote-runtime, and SSH fallback transports rather than orchestration payload fields. - - Revoked the capability when worker completion/failure settles the Dispatch and stopped trusting - caller-supplied pane metadata in the SSH fallback. -- Files: - - `src/main/runtime/orchestration/db.ts` - - `src/main/runtime/orchestration/types.ts` - - `src/main/runtime/orchestration/preamble.ts` - - `src/main/runtime/rpc/core.ts` - - `src/main/runtime/rpc/dispatcher.ts` - - `src/main/runtime/rpc/methods/orchestration.ts` - - CLI and remote transport implementations plus focused tests -- Verification: - - Ten focused DB/RPC/runtime/CLI/SSH files — 1,238 tests passed. - - Capability cases cover missing token, wrong token, wrong pane, changed process incarnation, - success, and post-settlement revocation. - - `pnpm typecheck:node` and `pnpm typecheck:cli` — passed. -- Findings: - - Terminal handles and environment-provided pane strings are useful routing metadata but are not - lifecycle authority. - - Stop, abandon, and replacement must use the same revocation fence before that remaining - checklist item can be completed. -- Next: - - Add the durable mutation ledger and use it to recover unknown acceptance without repeating - external effects. - -### 2026-07-22 — Durable mutation receipts - -- Changes: - - Added schema v11 mutation receipts keyed by an authenticated-caller fingerprint and opaque - request ID, with canonical payload hashing and pending/completed state. - - Replayed completed results across retries and restart, joined concurrent identical mutations, - rejected changed input as `request_mismatch`, and surfaced orphaned pending work as - `operation_unknown`. - - Added request IDs to local socket, named-pipe, WebSocket, saved-environment, and SSH fallback - envelopes; successful receipts echo the ID while transport failures retain it as recovery data. - - Persisted blocking-question acceptance before waiting, so retry after a lost response returns - the original question instead of creating another. -- Files: - - `src/main/runtime/orchestration/db.ts` - - `src/main/runtime/orchestration/types.ts` - - `src/main/runtime/rpc/core.ts` - - `src/main/runtime/rpc/dispatcher.ts` - - Runtime-client and transport files, CLI orchestration handlers/specs, and focused tests -- Verification: - - Twelve focused DB/RPC/runtime/CLI/SSH files — 1,260 tests passed. - - `pnpm typecheck:node`, `pnpm typecheck:cli`, and `git diff --check` — passed. -- Findings: - - Generic control-plane mutations can safely discard a pending receipt when their handler returns - a known failure; future worker start/stop must instead return and preserve typed unknown outcomes - around external effects. - - The ledger infrastructure covers every existing V1 mutation; worker start/stop/abandon will be - added to the same policy when those commands exist. -- Next: - - Implement the same-server worker lifecycle and its first-writer-wins stop/abandon fence. - -### 2026-07-22 — Same-server worker lifecycle foundation - -- Changes: - - Added schema v12 composed-worker state and created the starting Dispatch plus Task transition - before terminal effects. - - Added synchronous `worker-start` for the current or an exact existing worktree, with fresh-agent - default, explicit-terminal reuse, TUI readiness, capability attachment, lifecycle injection, and - honest failed receipts with residual resources. - - Added Dispatch-routed `worker-show` and bounded `worker-read`. - - Added first-writer-wins `worker-stop` and `worker-abandon`; stop closes only the supervised agent - terminal, while abandon performs no process/filesystem action and retains residual receipts. - - Closed and woke pending question waits when a worker is settled, stopped, or abandoned. -- Files: - - `src/main/runtime/orchestration/db.ts` - - `src/main/runtime/orchestration/types.ts` - - `src/main/runtime/rpc/methods/orchestration-workers.ts` - - `src/main/runtime/rpc/methods/orchestration.ts` - - `src/main/runtime/orca-runtime.ts` - - CLI orchestration specs/handlers and focused DB/RPC/CLI tests -- Verification: - - Focused DB/RPC/CLI command suite — 412 tests passed. - - `pnpm typecheck:node` and `pnpm typecheck:cli` — passed. -- Findings: - - Keeping composed state in a narrow extension table preserves legacy Dispatch compatibility while - giving worker operations the richer start/stop states they need. - - New-worktree setup, stage journaling around worktree creation, and true unknown-start recovery - remain open; current/existing workers are the verified slice. -- Next: - - Add agent-first child/top-level creation with setup-run default and startup-policy receipts, then - extend the same Dispatch routing across connected Orca servers. - -### 2026-07-22 — Agent-first new-worktree workers and setup receipts - -- Changes: - - Added child and top-level agent-first worktree creation to `worker-start`, reusing the exact - startup agent terminal and listing setup/configured terminals as role-tagged effects. - - Made omitted setup resolve to `run`, preserved explicit run/skip/inherit and repository startup - policy, and returned `not_configured` when no setup hook exists. - - Kept `start-immediately` setup non-gating, persisted later setup success/failure, and emitted a - typed Run notice without changing a ready worker's lifecycle state. - - Narrowed setup receipts to callers that explicitly await terminal provisioning so ordinary - worktree creation does not report renderer-delegated setup as a false spawn failure. - - Added typed unknown-start recovery when worktree creation may have been accepted before a - connection failure. -- Files: - - `src/main/runtime/orca-runtime.ts` - - `src/main/runtime/rpc/methods/orchestration-workers.ts` - - `src/main/runtime/rpc/methods/orchestration-workers-new-worktree.test.ts` - - `src/main/runtime/rpc/methods/orchestration.test.ts` - - `src/shared/types.ts` -- Verification: - - New-worktree worker scenarios — 8 tests passed. - - Worker RPC plus runtime worktree suites — 911 tests passed. - - `pnpm typecheck:node` — passed. -- Findings: - - A setup status is only truthful after the supervised caller awaits the runtime's terminal - provisioning result; normal renderer-delegated creation should retain its existing launch - payload instead. - - The generic mutation receipt and starting Dispatch are still separate commits, so atomic start - acceptance and crash-boundary reconciliation remain open. -- Next: - - Make worker-start acceptance one transaction, then add restart reconciliation that never adopts - a same-looking pane or process. - -### 2026-07-22 — Atomic worker acceptance and conservative restart recovery - -- Changes: - - Moved the worker-start retry request insertion into the same SQLite transaction that creates the - starting Dispatch and moves its Task to dispatched. - - Added a process runtime epoch to composed Dispatches so interrupted starts/stops become explicit - unknown outcomes after restart instead of remaining indefinitely in transitional states. - - Made worker show/read/stop verify the persisted stable pane plus exact PTY process incarnation; - a same-looking replacement is reported as changed and is never read or closed. - - Restricted semantic retry to the Task's latest failed, stopped, or abandoned Dispatch. -- Files: - - `src/main/runtime/orchestration/db.ts` - - `src/main/runtime/orchestration/types.ts` - - `src/main/runtime/rpc/core.ts` - - `src/main/runtime/rpc/dispatcher.ts` - - `src/main/runtime/rpc/errors.ts` - - `src/main/runtime/rpc/methods/orchestration-workers.ts` - - Focused DB, mutation-ledger, new-worktree, and recovery tests -- Verification: - - Atomic acceptance and recovery suite — 231 tests passed. - - Follow-up DB/recovery/new-worktree suite — 93 tests passed. - - `pnpm typecheck:node` — passed. -- Findings: - - Runtime ID is useful only as a process epoch. It is not a durable server identity and must not be - used to route federated Dispatches. - - After restart, preserving uncertainty is safer than adopting a restored pane: the prior worker - may still exist, but only explicit stop/abandon/retry recovery may replace it. -- Next: - - Audit and close the remaining same-server acceptance rows, then implement saved-environment - placement and the narrow federated Dispatch attachment. - -### 2026-07-22 — Connected-server federation and crash-safe relay - -- Changes: - - Added worker-only `--on ` placement while keeping Run/Task authority on the - current server and routing later show/read/stop operations solely by Dispatch ID. - - Pinned remote Dispatches to the saved server public-key fingerprint and stored runtime identity - only as a replaceable process epoch; re-pairing returns `peer_changed` before effects. - - Added a narrow worker-server attachment with protocol version, capability verifier, exact - pane/process identity, effects, setup state, and bidirectional relay cursors—without copying the - Run DAG. - - Added durable worker-to-home lifecycle/question relay and home-to-worker reply relay with - contiguous sequence checks, source acknowledgment, quotas, heartbeat coalescing, and reserved - terminal-report capacity. - - Made home import commit the message, question/lifecycle transition, and source cursor in one - transaction before acknowledgment. - - Added federated show/read/stop, stop/completion ordering, timeout/resume after worker restart, - relay restart, exact-process checks, ack-loss replay, gap rejection, peer-change fencing, and - POSIX database/WAL/SHM permission coverage. Windows uses Orca's existing current-user-only - userData DACL boundary. - - Added an agent-facing cookbook for local fan-out, setup-default new worktrees, Mac/Windows - placement, completion/failure, ask/resume/reply, and conditional recovery. -- Files: - - `src/main/runtime/orchestration/environment-transport.ts` - - `src/main/runtime/orchestration/federation-sync.ts` - - `src/main/runtime/orchestration/db.ts` - - `src/main/runtime/rpc/methods/orchestration-federation.ts` - - `src/main/runtime/rpc/methods/orchestration-workers.ts` - - Federation, permissions, CLI, transport, skill-guide, and protocol capability tests/sources -- Verification: - - Federation scenarios — 14 tests passed. - - Federation plus database-permission scenarios — 15 tests passed. - - Focused database/lifecycle/federation regression suite — 111 tests passed. - - `pnpm typecheck:node` and bundled skill-guide verification — passed. -- Findings: - - The stable saved-environment public-key fingerprint is server identity; a runtime UUID is only an - epoch and must never retarget a Dispatch after restart. - - The worker server needs only an authenticated attachment and relay outbox, not a replicated Run - database, scheduler, callback listener, or general ACL system. - - Setup remains explicit in receipts but non-gating by default; only repository - `wait-for-setup` policy delays agent launch. -- Next: - - Run the complete orchestration/CLI regression matrix, close any remaining checklist gaps, then - run repository validation and prepare the commit/PR. - -### 2026-07-22 — Final modularization and verification pass - -- Changes: - - Split federation, worker control/observation/topology, mutation execution, CLI specs, runtime - transport support, SSH error formatting, and database/CLI tests into domain-named modules so no - new max-lines bypass was needed. - - Regenerated the bundled skill manifests after the orchestration guide changed. - - Updated skill-guidance and lifecycle-rejection tests for the renamed legacy coordinator command, - setup-run default, agent-terminal fallback, and mandatory worker outcome. - - Kept unrelated daemon/UI/localization baseline failures out of the orchestration diff. -- Files: - - `src/main/runtime/rpc/methods/orchestration-federation-*.ts` - - `src/main/runtime/rpc/methods/orchestration-worker-*.ts` - - `src/main/runtime/orchestration/orchestration-*-db.test.ts` - - `src/main/runtime/rpc/orchestration-mutation-executor.ts` - - `src/main/runtime/rpc/runtime-feature-interaction.ts` - - `src/main/ipc/runtime-environment-shared-control-support.ts` - - `src/cli/specs/orchestration-worker-specs.ts` - - `src/cli/handlers/orchestration-run-cli.test.ts` - - `src/main/ssh/ssh-remote-cli-error-response.ts` -- Verification: - - Focused orchestration/CLI/SSH suite: 20 files, 565 tests passed. - - Runtime/subprocess/transport suite: 780 passed, 2 skipped. - - Updated skill-guidance/lifecycle-rejection tests: 12 passed. - - Full TypeScript check (Node, CLI, web), ordinary `oxlint`, max-lines ratchet, reliability gates, - bundled guide verification, manifest verification, and localization catalog verification passed. - - `pnpm test` could not start because the patched `node-pty` artifact does not load under local - Node 24.18.0. Direct full Vitest ran 33,058 passing tests; its 24 remaining failures and 3 worker - errors were native-PTY or unrelated timeout/baseline failures after the three stale - orchestration assertions were fixed and rerun. - - Full `pnpm lint` remains blocked only by unrelated existing switch-exhaustiveness and - localization-coverage failures outside this change. -- Findings: - - The implemented protocol has a clean authority split: the Run home owns orchestration truth; - connected worker servers own only exact resources, an authenticated Dispatch attachment, and - durable relay state. - - The remaining unchecked Phase 2/3 rows are real acceptance work, not reasons to add a scheduler, - UI, generalized capability matrix, provider-session layer, or automatic recovery. -- Next: - - Add the missing focused Phase 2 scenarios and run the Phase 3 matrix on real Mac/Windows and - WSL/SSH paths before marking those phases complete. - -### 2026-07-22 — Phase 2 setup and receipt acceptance complete - -- Changes: - - Made wait-for-setup receipts settle to `succeeded` only after gated agent readiness and fail at - `setup_start` or `setup_wait` before lifecycle/task input when setup is confirmed failed. - - Preserved `running` on a gated timeout, avoiding a false setup-failure claim. - - Added stage, role-tagged dispatch input, rich setup effect data, and exact terminal tab/leaf - coordinates to composed-worker receipts. - - Kept worker-start's option surface narrow: exact server via `--on`, exact repo via `--repo`, and - pass-through base/lineage/display/comment/setup choices. - - Updated CLI help, both skill sources, the generated guide/manifests, and the ignored HTML design. -- Files: - - `src/main/runtime/rpc/methods/orchestration-workers.ts` - - `src/main/runtime/rpc/methods/orchestration-worker-topology.ts` - - `src/main/runtime/rpc/methods/orchestration-federation.ts` - - `src/main/runtime/rpc/methods/orchestration-federated-worker-start.ts` - - `src/main/runtime/rpc/methods/orchestration-federation-effects.ts` - - Focused worker, federation, and CLI tests plus help/skill/checklist/design sources -- Verification: - - Local/new-worktree/federation worker suites: 166 tests passed. - - CLI handler/help suite: 197 tests passed. - - Full Node/CLI/web TypeScript check passed. -- Findings: - - The existing worktree startup wrapper already enforces setup-before-agent ordering; the missing - work was truthful orchestration state and acceptance coverage, not a second setup runner. - - Phase 2 is complete. Remaining unchecked rows are the real connected-platform Phase 3 matrix - and cross-platform transport evidence. -- Next: - - Exercise federation disconnect/reorder/restart semantics, then run branch-head Mac/Windows - acceptance without replacing either production Orca runtime. - -### 2026-07-22 — Native Mac-to-Windows acceptance gaps - -- Changes: - - Built and launched branch-head Mac and Windows servers on isolated profiles and paired them over - the existing authenticated WebSocket transport. - - Used a temporary, exact Tailscale TCP proxy because Windows Firewall correctly blocked the new - test-binary port; production Orca and firewall policy were left unchanged. - - Added explicit dev-CLI provenance so custom profile paths still generate `orca-dev` worker - commands. - - Increased only the Windows ConPTY bracketed-paste render gap before Enter from 500 ms to 1.5 s. -- Files: - - `config/scripts/orca-dev.mjs` - - `src/cli/handlers/orchestration.ts` - - `src/shared/agent-prompt-injection.ts` - - Focused wrapper, CLI, and prompt-injection tests -- Verification: - - Native Windows discovery, exact worktree routing, pre-effect failure, retry, ready receipt, - worker-read, and remote worker-stop all returned truthful branch-head receipts. - - Focused dev-provenance and prompt-injection suite: 160 tests passed. -- Findings: - - A fresh Windows agent profile surfaces trust/login/update prompts as typed `agent_readiness` - failures with residual terminals, as designed. - - The first authenticated Windows worker proved that 500 ms could leave a long preamble in the - Codex input buffer, and that a custom dev profile could incorrectly call the production CLI. - - Phase 3 remains open until the fixes are rebuilt on Windows and the full completion/question/ - failure/restart matrix succeeds without a manual Enter or CLI substitution. -- Next: - - Rebuild both branch servers with these fixes and repeat the real Mac-home to Windows-worker flow. - -### 2026-07-22 — Headless Windows dev-worker CLI routing - -- Changes: - - Made every `orca-dev` entry path install profile-scoped `orca-dev` and `orca` terminal wrappers, - including Windows `.cmd` wrappers and headless `orca-dev serve`. - - Kept the wrapper generation shared with the Electron dev runner so interactive and headless dev - servers expose the same exact CLI and user-data profile to worker terminals. -- Files: - - `config/scripts/dev-cli-terminal-wrapper.mjs` - - `config/scripts/orca-dev.mjs` - - `config/scripts/run-electron-vite-dev.mjs` - - Focused cross-platform wrapper tests -- Verification: - - Wrapper, CLI provenance, dev-runner, preamble, and orchestration handler suites: 55 tests passed. - - Focused oxlint and formatting checks passed. -- Findings: - - The rebuilt prompt submitted automatically on Windows, but the worker then found no - profile-scoped `orca-dev` command because headless serve bypassed the Electron dev runner and the - runner itself had never written Windows wrappers into the PATH directory used by Orca terminals. - - This is a dev/acceptance launcher defect, not a new federation primitive or production routing - requirement. -- Next: - - Rebuild and restart the Windows branch server, then repeat the same Dispatch and require an - automatically relayed `worker_done` before checking any federation acceptance row. - -### 2026-07-22 — Mac-home to Windows-worker federation accepted - -- Changes: - - Fast-forwarded and restarted the isolated Windows branch server with the profile-scoped wrapper - fix while preserving its authenticated server key and saved-environment binding. - - Exercised separate success, intentional failure, and blocking question/reply Dispatches from the - isolated Mac Run home to native Windows Codex workers. -- Files: - - `ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md` -- Verification: - - Success `ctx_f982ddb1bdf9` submitted without manual input, relayed `worker_done`, and atomically - settled its Task/Dispatch as completed/succeeded. - - Failure `ctx_5f28665cf04a` relayed `outcome=failed` and atomically settled its Task/Dispatch as - failed without treating failure prose as success. - - Question `ctx_4aec24c47e30` relayed a typed question to the Mac Delivery, carried the `blue` reply - back to the blocked Windows ask, then relayed a successful terminal report. - - Routed bounded read and exact-agent stop were also exercised against Windows Dispatch receipts; - stop closed only the accepted agent terminal. -- Findings: - - Windows ConPTY prompt submission, profile-specific CLI selection, authenticated lifecycle - acceptance, contiguous bidirectional relay, whole-batch acknowledgment, and terminal-state - reconciliation now pass together in the real Mac-to-Windows path. - - This completes only the named Mac-home to Windows-worker row; reverse direction, restart with an - active Dispatch, disconnect/unknown-outcome, WSL/SSH/relay-host, and transport coverage remain - open. -- Next: - - Pair the isolated Mac server into the Windows test profile and run the same acceptance flow with - Windows as the Run home. - -### 2026-07-22 — Windows-home to Mac-worker federation accepted - -- Changes: - - Added a reciprocal saved Mac environment to the isolated Windows profile without exposing its - pairing credential in terminal history. - - Exercised separate success, intentional failure, blocking question/reply, bounded read, and exact - stop Dispatches with Windows as Run home and native macOS as worker server. - - Made worker observations report `exited` for the exact disconnected terminal instead of - misleadingly projecting `running`; stop now refuses to close an exact-but-exited process again. -- Files: - - `src/main/runtime/rpc/methods/orchestration-worker-observation.ts` - - `src/main/runtime/rpc/methods/orchestration-federation-control.ts` - - `src/main/runtime/rpc/methods/orchestration-worker-stop.ts` - - Focused local/federated observation and stop tests -- Verification: - - Success `ctx_5188e1f8417e` relayed from macOS and settled at the Windows Run home. - - Failure `ctx_a3418dc84ed6` relayed `outcome=failed` and settled failed at the Windows home. - - Question `ctx_a2521b88b6c9` carried `square` from Windows to the blocked macOS ask, followed by a - successful terminal report. - - Stop `ctx_bec120349d3f` first proved routed read against the exact Mac worker, then closed only that - terminal and settled stopped/failed; the observation regression suites pass 36 tests. -- Findings: - - One reciprocal pairing is sufficient for a Windows-owned Run to route Mac worker control while - preserving a single Run database on Windows; no replicated scheduler or failover layer is needed. - - Stable process identity and live process status are separate facts. A disconnected terminal can - still be the exact historical worker, but it must not be labeled running or closed again. -- Next: - - Validate active-Dispatch restart/disconnect and exact-retry behavior, then exercise WSL/SSH/relay - execution-host propagation without broadening the federation protocol. - -### 2026-07-22 — Federated restart and pre-acceptance disconnect accepted - -- Changes: - - Restarted the Windows Run home alone, the macOS worker server alone, and both servers while each - had an active federated Dispatch. - - Stopped the macOS worker server before a Windows-home start request could be accepted. -- Files: - - `ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md` -- Verification: - - Home-only restart preserved `ctx_f0693ff30c27`; `worker-show` found the same exact running macOS - worker under the unchanged worker epoch, and routed stop succeeded. - - Worker-only restart preserved `ctx_3bbb0142f9aa` at its Run home while the new macOS epoch - truthfully reported the missing terminal as non-exact; routed stop returned `stop_unknown` - without adopting or closing another process. - - Restarting both sides preserved `ctx_d46f68fa1400` and its attachment; inspection used the new - worker epoch, reported `missing` with `exactWorker=false`, and stop again returned - `stop_unknown` safely. - - With macOS already unreachable, retry request `disconnect-before-send-01` created neither a - Dispatch nor an attachment for `task_04fd0dc61065`; the Task remained ready. -- Findings: - - Durable home state and worker identity fencing survive independent epochs without requiring Run - replication or authority failover. - - A failed connection before remote acceptance is a clean no-effect result; it must not be - promoted to an ambiguous outcome or consume the Task. -- Next: - - Disconnect the worker route after possible acceptance, then follow the returned exact recovery - command and prove that retry deduplicates to one remote effect. - -### 2026-07-22 — Post-acceptance disconnect deduplicated - -- Changes: - - Cut the Windows Tailscale proxy while a Mac-home `worker-start` was provisioning remotely, then - restored the same route and replayed the exact application request ID. - - Allowed an explicit `worker-stop` to fence `start_unknown` locally and on the worker server; - exact pane/process observation still decides whether a terminal may actually be closed. -- Files: - - `src/main/runtime/orchestration/db.ts` - - `src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts` - - `ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md` -- Verification: - - The lost response left `task_bb86c87bdc60` attached to one pending Dispatch, - `ctx_6580d07d9006`, rather than creating a replacement. - - Replaying request `disconnect-after-start-01` returned the same Dispatch with - `state=outcome_unknown` and `mutation.replayed=true`. - - Remote inspection found one `disconnect-after-acceptance-01` worktree, one exact agent - terminal, and one expected setup terminal; no duplicate topology was created. - - Worker Dispatch DB, federated control, and recovery suites passed 29 tests; node typecheck and - focused oxlint passed. Branch-head CLI and Electron builds succeeded on macOS and Windows. - - Relay tests reject an out-of-order sequence without advancing the cursor, later accept the - missing and retried frames contiguously, treat the repeated frame as a duplicate, and preserve - exactly two messages. Lost-ack retry and mailbox delivery suites passed with it (24 tests). -- Findings: - - The acceptance run exposed one narrow recovery inconsistency: `worker-show` could prove an exact - worker existed while `worker-stop` rejected the durable `start_unknown` state. Explicit stop now - enters the same fenced stopping path from `ready` or `start_unknown`; unattached, missing, or - identity-changed workers still become `stop_unknown` without a process action. - - No scheduler, automatic retry, adoption, cleanup, or general distributed-operation framework is - needed for this recovery path. -- Next: - - Exercise duplicate/reordered relay convergence and the native/WSL/SSH transport matrix, then - synchronize the HTML proposal with the implemented contract. - -### 2026-07-22 — Cross-platform capability transport verified - -- Changes: - - Added an SSH compatibility-bridge test that carries the opaque Dispatch capability in the RPC - envelope and settles only the matching pane/process Dispatch. - - Added a composed worker-start test that binds the host-resolved `orca-ide` command and the - Dispatch capability into one WSL worker preamble. - - Updated the built-CLI reset fixture to recreate its required coordinator Run after a task reset. - - Updated the HTML recovery contract so explicit stop from `start_unknown` remains fenced and - process-identity checked. -- Files: - - `src/main/ssh/ssh-remote-orca-cli.test.ts` - - `src/main/runtime/rpc/methods/orchestration-workers-new-worktree.test.ts` - - `src/main/runtime/orchestration-cli-subprocess.test.ts` - - `docs/orchestration-primitives.html` (ignored design source) - - `ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md` -- Verification: - - Native macOS Unix-socket worker control, native Windows named-pipe lifecycle reporting, and - bidirectional authenticated WebSocket federation passed in the real Mac/Windows matrix. - - On the real Windows host, the PowerShell/SSH launcher, SSH command allowlist, host passthrough, - WSL/native command selection, and multiline Windows quoting suites passed 31 tests; 13 - Unix-socket-only runtime-client tests correctly skipped on Windows. - - Platform-neutral SSH capability, WSL command selection, preamble, worker-start, and CLI envelope - suites passed 94 focused tests on macOS. - - The rebuilt CLI plus every orchestration, composed-worker, federation, and SSH regression file - passed together: 25 files and 456 tests. Full Node/CLI/web typecheck, focused oxlint/format, - generated-skill verification, and `git diff --check` passed. -- Findings: - - The available Windows acceptance host has no WSL distribution installed and prompts to install - the feature. Acceptance therefore uses explicit WSL host/path tests rather than mutating the - machine. SSH is likewise exercised at the bridge and lifecycle boundary rather than requiring a - new external host. - - Native and relay-backed behavior is real end-to-end evidence; WSL and SSH evidence is bounded to - the host-selection, prompt, envelope, quoting, allowlist, and lifecycle contracts Orca owns. -- Next: - - Run the remaining full validation and Linux CI, then finish the ignored HTML synchronization and - PR evidence without adding new orchestration concepts. - -### 2026-07-22 — Phase 3 and cross-platform gates closed - -- Changes: - - Marked connected-server federation and the native cross-platform quality gate complete after - branch-head Linux CI joined the real macOS/Windows acceptance evidence. -- Files: - - `ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md` -- Verification: - - PR #9925 completed with 17 successful checks and no failures: full Linux verify, Ubuntu and - Windows native smoke, packaged Windows crash survival, and macOS/Ubuntu/Windows skill round trips. - - Linux verify passed lint, generated-skill checks, max-lines enforcement, typecheck, repository- - wide tests, unpacked-app build, and packaged CLI smoke. -- Findings: - - Every implementation phase is now either complete or explicitly deferred with its prerequisite; - no additional orchestration subsystem is required for V1. -- Next: - - Review and merge PR #9925; keep Phase 4 deferred until exact provider-session association exists. - -### 2026-07-22 — Final agent-contract audit - -- Changes: - - Synchronized the ignored HTML examples with the shipped mutation, Delivery, worker-start, and - terminal-read result shapes; removed speculative Phase 4 output fields from the V1 path. - - Made semantic retry explicitly repeat placement and agent/terminal choices, while transport - recovery reuses only the exact `mutation.requestId` after a lost response. - - Corrected worker state/error terminology, the cross-platform structured completion recipe, and - the HTML implementation-status footer. - - Updated the installed/versioned orchestration guidance to prefer `worker-start`, use - `question` mail, and reserve low-level `dispatch --inject` for custom topology. - - Fixed `worker-read --cursor 0`; the runtime supported the initial retained-output cursor but the - orchestration CLI incorrectly required a positive value. -- Files: - - `src/cli/handlers/orchestration.ts` - - `src/cli/handlers/orchestration-worker-cli.test.ts` - - `src/cli/specs/orchestration-worker-specs.ts` - - `skill-guides/orchestration.md` - - `skills/orchestration/SKILL.md` - - generated bundled skill guide and skill-bundle manifests - - `docs/orchestration-primitives.html` (ignored design source) - - `ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md` -- Verification: - - Focused worker CLI suite passed 3 tests, including cursor zero. - - Final orchestration runtime/CLI/renderer/skill regression set passed 24 files and 450 tests. - - Node, CLI, and web typechecks, bundled-guide and skill-manifest verification, focused - formatting, and `git diff --check` passed. - - A repository-wide run reached 34,190 passing tests and exposed the one intentionally changed - skill assertion; after updating that assertion, the focused configured rerun above passed. The - broad run also exhausted several Vitest fork-start deadlines under full local concurrency, while - the previously green PR checks remain the authoritative clean full-suite baseline. -- Findings: - - The implementation already returned durable request IDs as `mutation.requestId`; the remaining - problem was stale naming and invented provenance fields in the ignored design example. - - Stored start options are recovery evidence, not implicit replacement policy. Requiring explicit - replacement placement keeps agents in control and avoids recreating a possibly-existing remote - worktree by accident. - - No new scheduler, retry engine, output adapter, projection layer, or federation subsystem is - needed. Phase 4 remains deferred. -- Next: - - Push the audit corrections and confirm PR #9925 is green at the new head. - -### 2026-07-22 — CodeRabbit and internal review until clean - -- Changes: - - Validated every CodeRabbit finding; fixed relay type validation, stale runtime-owned terminal - identity, setup receipt classification, Windows batch percent escaping, worker reconciliation, - root-help discovery, canonical question schema, and deterministic waiter timing. - - Coalesced overlapping per-Dispatch federation polls and added one warning per outage window. - - Centralized the orchestration RPC envelope type without adding a new runtime abstraction. - - Made reset scopes atomic and cleared matching worker/federation state while preserving relay - cursors for message-only resets and the mutation ledger needed for lost-response deduplication. -- Files: - - orchestration runtime, federation, worker-control, database, CLI help/client, wrapper, skill, and - focused regression tests listed in the current working diff. -- Verification: - - Focused runtime, federation, database, CLI, SSH, wrapper, and skill suites passed 1,103 tests. - - The repository-wide configured suite passed 34,253 tests with 58 intentional skips. - - Node, CLI, and web typechecks passed; focused oxlint, formatting, generated-skill checks, and - `git diff --check` passed. -- Findings: - - The type-only pairing import is valid TypeScript and remains type-only; Dispatch capability - flags stay intentionally hidden because the authenticated worker preamble supplies them. - - Persistent envelope-bearing WebSocket reuse remains a measured-later optimization; the V1 - single-flight relay removes overlapping connection churn without growing transport scope. - - The final re-review found no remaining in-scope correctness, ergonomics, elegance, or - performance defect after fixing reset scope and relay-cursor preservation in round 2. - - Full lint reaches unrelated existing failures in the unchanged skill-freshness switch and - localization catalog; changed-file lint and every in-scope quality gate pass. -- Next: - - Resolve CodeRabbit threads and confirm the PR checks at the final head. - -### 2026-07-24 — Post-rebase physical federation dogfood - -- Changes: - - Rebased the branch onto current main and launched isolated branch-head desktop runtimes on the - Mac Run home and the physical Windows worker server. - - Started a real Windows Codex worker in a new top-level worktree with explicit setup-run. - - Replaced the orchestration process fence's renderer generation with the controller-issued PTY - incarnation when available, retaining the prior value only for legacy providers. - - Added a runtime regression covering a visible terminal surface detaching and reattaching around - the same process, followed by a replacement incarnation. -- Files: - - `src/main/runtime/orca-runtime.ts` - - `src/main/runtime/orca-runtime.test.ts` - - `ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md` -- Verification: - - The remote start returned ready in about nine seconds with setup `running`, - `startupPolicy=start-immediately`, one agent terminal, one setup terminal, and accepted task - input. - - The original branch head then reproduced immediate `identity_changed`: routed read failed and - the exact injected capability could not send a heartbeat or question. - - The new focused process-identity regression passed, the 18-test federation suite passed, and - Node typecheck passed. -- Findings: - - A renderer pane generation is presentation state, not process identity. A healthy PTY can move - between a runtime-owned background surface and the renderer without losing Dispatch authority. - - The PTY controller incarnation is already available on native Windows/macOS and SSH/relay paths; - using it fixes the race without relaxing replacement-process fencing or adding a new identity - subsystem. -- Next: - - Rebuild both branch runtimes, repeat the full physical Mac-to-Windows lifecycle, then run the - remaining local error/recovery matrix before closing the revalidation rows. - -### 2026-07-24 — Post-fix physical federation revalidation - -- Changes: - - Rebuilt and restarted the physical Windows branch runtime from `b09c635ec`, then repeated the - Mac Run-home to Windows-worker flow on a fresh top-level worktree. - - Abandoned the controlled stale-build attempt, linked the replacement with `--retry-of`, and - exercised exact start-request replay plus exact remote worker stop. - - Exercised missing-agent and invalid-remote-repo rejection without adding recovery automation. -- Verification: - - The replacement returned ready while setup was running under `start-immediately`; - `worker-show` reported the exact running process, bounded `worker-read` succeeded, and the - worker's heartbeat reached the Mac Run home. - - An inferred-Run blocking question carried the `blue` reply back to Windows, and the authenticated - success report atomically settled the Task and Dispatch. - - A transient connection close before acceptance left the second Task ready with no Dispatch. - Retrying its exact request ID started one worker, and repeating that request returned the same - Dispatch with `replayed=true` and no duplicate worktree or terminal. - - `worker-stop` killed only the exact agent PTY. The setup terminal remained present, the Dispatch - became stopped/failed, and the Task became blocked for explicit recovery. - - An unconfigured agent failed locally. A missing remote repo produced a typed failed Dispatch - with `effects=[]` and no residual resources. -- Findings: - - The first repeated failure was a stale Windows build artifact, not a failed fix: the source - checkout was at `b09c635ec` while `out/main/index.js` still had the old generation fence. - Relaunching the branch dev process produced a new runtime epoch and the fixed behavior. - - Omitted setup correctly resolved to Orca's `run` default. Its independent Windows install later - failed in `windows-native-registry`, but that did not delay task delivery and remained isolated - from exact agent stop. - - From an unmanaged shell, a coordinator mailbox check must name `--terminal`; a CLI running - inside the bound coordinator terminal continues to infer that identity normally. -- Next: - - Resolve only concrete findings from the independent ergonomics/federation re-review, run the - final local verification set, and reconcile PR review threads and CI. - -### 2026-07-24 — Post-dogfood recovery and ergonomics hardening - -- Changes: - - Made lost remote stop responses reconcilable and prevented stale Dispatch abandonment from - blocking an active replacement. - - Persisted setup completion as evidence only, preserving settled lifecycle state locally and - relaying the same outcome from a connected worker server. - - Rejected misleading explicit targets from federated workers and consumed `ask` answers exactly - once while retaining their durable thread record. - - Stored the accepted Dispatch in pending worker-start receipts so a post-restart retry returns the - exact inspection command. - - Rejected new-worktree placement for folder projects before effects. - - Restored the generated skill-history ledgers that the branch had accidentally truncated. -- Verification: - - The full orchestration DB/RPC/CLI/SSH regression selection passed 516 tests; its focused - recovery, setup, messaging, and mutation slice passed 239 tests. - - The earlier physical Mac-home to Windows-worker lifecycle covered ready/read/heartbeat, - ask/reply, completion, exact request replay, and exact stop. -- Findings: - - These were narrow truthfulness and recovery gaps; none required a scheduler, automatic retry, - access-control framework, replicated Run database, UI, or provider-session abstraction. - - The release-contract test failure is already present on `main`; it is separate from this - orchestration change. The skill round-trip failures were branch-caused and are fixed by - restoring their committed history. -- Next: - - Run the complete changed-file quality gates, rebuild the physical Windows dev runtime with this - final patch, repeat the setup-status slice, then push and recheck PR CI/review state. - -### 2026-07-24 — Physical receipt follow-up - -- Changes: - - Made local and connected-server ready transitions persist the accepted `dispatch_input` effect - atomically, so later setup evidence cannot replace it with an older effect snapshot. - - Carried the already-resolved setup source through the internal federation attach request, keeping - omitted setup labeled `orchestration_default` and explicit setup labeled `explicit_request`. -- Verification: - - The focused new-worktree, federation, and setup-evidence slice passed 37 tests. - - The broader orchestration DB/RPC/CLI/SSH execution-host selection passed 630 tests. - - Node and CLI typechecks, changed-file lint/format, and `git diff --check` passed. -- Findings: - - Both defects were receipt-provenance bugs found by the physical Mac-home to Windows-worker run; - neither changes worker placement, setup timing, lifecycle authority, or agent-facing commands. -- Next: - - Rebuild both dev runtimes from this patch and repeat the physical setup-status slice before final - PR reconciliation. - -### 2026-07-24 — Truthful setup command completion - -- Changes: - - Wrapped only orchestration-created non-gating setup commands with a private per-invocation - completion signal that preserves the command exit code. - - Added one runtime observer that subscribes to raw PTY output, replays the bounded recent-output - buffer, scans across chunk boundaries, and treats terminal exit as a fallback. - - Updated local and connected-server setup evidence monitors to observe command completion while - leaving the interactive setup terminal open. - - Propagated the exact setup terminal handle through worktree receipts and hardened native Windows - launch with an encoded PowerShell command plus an environment-carried runner path. -- Files: - - `src/main/runtime/orchestration/setup-completion-signal.ts` - - `src/main/runtime/orca-runtime.ts` - - local and federation setup monitors and focused tests - - `ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md` -- Verification: - - The completion helper, exact-effect, local worker, federation, and setup-evidence suites passed - 43 tests. - - Focused runtime tests proved live completion, replay-before-observer recovery, and opt-in setup - wrapping while the shell remains running. - - The complete runtime service suite passed 884 tests. - - The broader orchestration/CLI/SSH/execution-host selection passed 529 tests. - - Node, CLI, and web typechecks, the CLI/Electron build, focused lint/format, max-lines ratchet, - and `git diff --check` passed. - - The independent no-scope-creep recheck found no remaining correctness blocker. -- Findings: - - Terminal exit is not setup-command completion because Orca intentionally runs setup in an - interactive terminal that returns to a shell prompt. - - Display titles are not terminal identity, and a disconnected terminal is not proof that its - setup command failed. - - The correction is runtime evidence only: it adds no public flag, setup job, scheduler, retry - policy, process heuristic, or automatic tab closure. -- Next: - - Rebuild both dev runtimes and repeat the physical Mac Run-home to Windows-worker setup-status - slice, including a failing setup command that returns to a PowerShell prompt. - -### 2026-07-24 — Physical Windows setup-completion proof - -- Changes: - - Rebuilt and restarted the Mac Run-home and physical Windows worker runtimes from `4aba390af`. - - Started a fresh Windows Codex worker from the Mac with omitted `--setup`, a new top-level - worktree, and the exact Windows repo selector. -- Verification: - - Mac runtime epoch `4a2a1cba-fd8b-41c7-b50b-caeac7415d9c` and Windows runtime epoch - `04cecad3-65a9-49a5-90ff-cdf04b09050f` both became ready after restart. - - Run `run_0f6b471005af`, Task `task_11e981c692b5`, and Dispatch `ctx_f009a65c6d9d` returned - ready with setup `running`, source `orchestration_default`, policy `start-immediately`, the exact - setup terminal `term_bdcb2a0b-89c5-429c-8ae6-0fdc2457db15`, and accepted dispatch input. - - The real Windows setup command later exited 1 in `windows-native-registry`; `worker-show` - changed setup to `failed` while preserving the succeeded worker, settled Dispatch, accepted - input effect, and exact setup-terminal effect. - - The setup terminal remained running and accepted a follow-up PowerShell command after failure. - The Run mailbox contained exactly one high-priority setup-failed notice for the Dispatch. -- Findings: - - The private per-invocation marker carried exit code 1 in raw setup-terminal output and did not - appear in orchestration receipts or lifecycle messages. - - Windows terminal reads still flatten PowerShell line-editor redraws into noisy repeated input - text. The command executed once and orchestration state remained correct, so this pre-existing - rendering artifact stays outside this PR. -- Next: - - Re-run the final local quality gates, push this evidence-only checklist update, and reconcile PR - CI and review state. - -### 2026-07-24 — Structured worker-output implementation - -- Changes: - - Extended `worker-read` with `auto|transcript|terminal` source selection while preserving one - Dispatch-only agent command. - - Added exact pane/process/session selection from existing hook evidence, bounded Codex/Claude - transcript reading, path-free source identities, and opaque source-pinned cursors. - - Added a worker-local federated output RPC; mixed-version servers fall back through the existing - terminal-read method and still receive an opaque Run-home cursor. - - Added readable non-JSON transcript rendering, CLI help, skill guidance, typed errors, and - malformed/oversized/clipping warnings. -- Files: - - `src/shared/orchestration-worker-output.ts` - - `src/main/runtime/orchestration/worker-output-cursor.ts` - - `src/main/runtime/orchestration/worker-provider-session.ts` - - `src/main/runtime/orchestration/worker-transcript-payload.ts` - - `src/main/runtime/orchestration/worker-transcript-read.ts` - - `src/main/runtime/rpc/methods/orchestration-worker-output.ts` - - Worker control/federation, runtime status lookup, CLI, skill, design, and focused tests -- Verification: - - Node and CLI typechecks passed. - - Nineteen native-chat/structured-output suites passed 142 tests. - - Sixteen orchestration CLI/RPC/federation suites passed 289 tests. - - Five CLI registry/help/runtime-error suites passed 213 tests. - - Mixed-version fallback continuation was additionally verified with an opaque cursor. -- Findings: - - The prior Phase 4 deferral was factually wrong: hook snapshots already bind provider sessions to - exact panes. Reusing that evidence avoids directory/title/logo guessing and avoids a second - status subsystem. - - Method probing is enough for mixed-version compatibility; a generalized provider capability - matrix is unnecessary. -- Next: - - Run the remaining full lint/test gates and the physical local plus Mac/Windows dogfood matrix - before marking Phase 4 complete. - -### 2026-07-24 — Structured-output local and mixed-version dogfood - -- Changes: - - Ran two simultaneous same-worktree Codex Dispatches with unique markers and verified exact - transcript isolation plus opaque continuation. - - Made transcript-position fallback IDs opaque after the physical response exposed the local - Codex JSONL path. - - Redacted pane-bound Dispatch capability tokens from structured prose, tool input, tool output, - metadata, and image URLs after continuation exposed the lifecycle send command. - - Corrected `worker-read --help` so `--cursor` is described as opaque rather than numeric. - - Made forward paging advance safely across a transcript record larger than the bounded scan - window, while continuing to discard its unfinished fragments. - - Extended Dispatch-capability redaction to tool-input object keys as well as values. -- Verification: - - Both simultaneous local reads selected different exact Codex source identities and contained - only their own marker. - - Continuation returned newly appended tool/assistant messages, `limited=true`, and the expected - completion marker. - - A fresh local response contained stable `worker-message-*` IDs, no `.codex/sessions` path, no - `dcap_` token, and explicit privacy/redaction warnings. - - Starting a new Codex chat in the same pane caused the old cursor to return `source_changed`; a - fresh read selected only the new chat marker. - - Restarting the Run-home runtime preserved settled state and rejected a read when the exact - worker process was no longer present. - - Mac Run home -> older Windows worker returned `source=terminal`, - `fallbackReason=remote_capability_unavailable`, an opaque cursor that continued successfully, - and `transcript_required` when structured output was explicitly required. -- Findings: - - Synthetic path-leak tests need fallback-ID records, not only provider records with explicit IDs. - - Structured output must treat lifecycle capability text as secret even though the capability is - also pane-bound; redaction is a narrow output boundary, not a generalized secret scanner. - - Additive RPC probing works against the physical older Windows server without a capability - matrix or server upgrade gate. - - A bounded scan must still guarantee cursor progress; otherwise one pathological provider record - can trap an agent in a valid-looking continuation loop. -- Next: - - Commit/push the tested implementation, update the physical Windows dev runtime, then run exact - Mac-to-Windows and Windows-to-Mac structured reads plus disconnect/reconnect. - -### 2026-07-24 — Reverse dogfood found missing coordinator control mail - -- Finding: - - A Windows Run home successfully started and read an exact Mac Codex worker, and worker-to-home - status relayed correctly. However, coordinator mail addressed to that remote worker remained - queued at the Run home because only question replies used the home-to-worker relay. - - The injected worker's local `check --wait` also looked only for a same-server Dispatch, so even - an imported generic message could not wake it. -- Changes: - - Route stable `dispatch:` coordinator guidance through the existing per-Dispatch durable - relay; terminal-handle targeting remains a legacy/local path. - - Import control mail idempotently on the worker server, tolerate a replay after a lost import - acknowledgment, and wake only the exact attached worker process. - - Return a direction-aware relay receipt and teach CLI help, the versioned skill, and the - cross-server cookbook to use the Dispatch ID for follow-ups. -- Verification: - - Focused Node/CLI typechecks and 184 orchestration/federation/CLI tests passed before physical - revalidation. -- Next: - - Regenerate the bundled skill guide, re-review the narrow change, then repeat Windows-home to - Mac-worker follow-up, completion, exact transcript continuation, and disconnect/reconnect. - -### 2026-07-24 — Federated control-mail race hardening - -- Changes: - - Fence already-imported relay sequences before parsing or applying message side effects. - - Require the remote attachment to remain ready before accepting each new coordinator message. - - Recheck the Run-home worker state after importing worker lifecycle mail and do not push queued - guidance after the worker settles. - - Wake filtered worker waiters with the imported message's real type instead of always using - `status`. - - Negotiate a narrow control-mail capability and reject the send before queueing when an older - worker server supports base federation but not the new relay kind. -- Verification: - - Regression tests prove a replayed sequence with a different message ID creates no duplicate. - - A waiter registered before `worker_done` receives no stale control mail after completion, and a - direct late import is rejected as inactive. - - An imported escalation wakes an escalation-filtered waiter while a status-filtered waiter times - out normally. - - A new Run home connected to a prior worker build can still start the worker, but control mail - returns `capability_unsupported` and leaves no undeliverable relay row. - - The focused federation suites passed 24 tests; the broader orchestration/CLI selection passed - 475 tests. - - Full typecheck, lint, bundled-skill verification, CLI build, Electron/Vite build, - `git diff --check`, and the design-document reference-name audit passed. -- Findings: - - Relay ordering and worker settlement are control-plane guardrails, not agent policy: the - coordinator still chooses what to send and when. - - Terminal worker state is authoritative for delivery; queued guidance is retained at the Run - home but never injected into a completed worker. -- Next: - - Complete the final read-only review, then repeat the physical Windows-home to Mac-worker - follow-up, completion, exact transcript continuation, and disconnect/reconnect proof. - -### 2026-07-24 — Physical control-mail acceptance and dogfood fixes - -- Changes: - - Restarted the physical Windows runtime from branch head and confirmed both federation - capabilities before creating a fresh Windows-home Run. - - Fixed `check --ack --peek` so the exact Delivery is acknowledged before the - read-only history projection; the previous early return silently ignored `--ack`. - - Preserved the existing structured remote transport codes through the Run-home RPC boundary - instead of collapsing disconnect, timeout, and malformed-response failures to `runtime_error`. -- Verification: - - Run `run_074503e3edc6`, Task `task_8a07840e7aad`, and Dispatch `ctx_d6bac1ee6409` started a fresh - Codex worker in the existing Mac worktree with setup `not_applicable`. - - The worker relayed `ORCA_MAC_CONTROL_INITIAL_7C31`, blocked on its Dispatch inbox, received - coordinator guidance addressed to the stable Dispatch as `ORCA_MAC_CONTROL_FOLLOWUP_A842`, and - returned one authenticated successful `worker_done` containing both markers. - - The Windows home settled the Task and Dispatch once. `worker-read --source auto` returned - `source=transcript`, `provider=codex`, an opaque cursor, both markers, and no capability token or - transcript path. - - Removing the Mac listener left the Windows Task completed. Reconnecting with the wrong leftover - profile was rejected as unauthorized; reconnecting with the original profile preserved the - settled Dispatch and correctly returned `worker_identity_changed` for transcript reads after the - exact worker process was gone. - - The focused RPC suites passed 163 tests; formatting, diff checks, full typecheck, CLI build, and - desktop/web builds passed. - - After the Windows generated main bundle was verified at `8dd0d1b16`, Delivery - `delivery_888f972841d6` was acknowledged by `check --ack ... --peek`; the response echoed the - exact acknowledged ID and returned zero unread rows. - - With that build running, removing the Mac listener returned - `remote_runtime_unavailable` while the Task stayed completed. Reconnect preserved the succeeded - Dispatch, produced no duplicate Run mail, and returned `worker_identity_changed` rather than - attributing the old transcript to a replacement process. -- Findings: - - Delivery acknowledgment must compose with inspection modes explicitly; a successful command may - not silently ignore the acknowledgment effect. - - Remote transport already had narrow error codes. Preserving them is enough; no federation error - hierarchy or retry engine is needed. - - Saved peer identity fencing prevented accidental adoption of a server started from a different - profile. Exact process fencing also prevented stale transcript attribution after restart. - - On the Windows dogfood shell, the `pnpm` wrapper returned before its spawned Vite build - completed. Verifying the generated bundle before restart exposed the race; invoking the Node - build script directly produced the expected branch-head bundle. -- Next: - - Run the final quality gates and review, push this evidence update, inspect PR CI, and remove only - the temporary dogfood profile and listener after verification is complete. - -### 2026-07-24 — Current-main rebase integration - -- Changes: - - Rebased the full implementation onto current `origin/main`. - - Combined main's bounded one-shot remote-request admission with the orchestration authentication - envelope in the same pre-serialized encrypted request. - - Added a direct WebSocket regression proving the admitted request retains the orchestration - capability and mutation ID. -- Verification: - - The repository-configured orchestration, federation, remote-client, and skill selection passed - 35 files and 465 tests. - - Full Node/CLI/web typecheck, lint/reliability/manifest/localization gates, focused formatting, - generated-skill verification, and `git diff --check` passed after the rebase. - - Relay, CLI, Electron/Vite, and web production builds passed. The local CLI installer reported - only the expected non-fatal lack of permission to replace `/usr/local/bin/orca-dev`. -- Findings: - - The request must be serialized with its authentication envelope before it reserves bounded - admission; rebuilding the frame after authentication would bypass the retained-byte contract. -- Next: - - Push the rebased branch, inspect branch-head CI, then remove only the exact temporary dogfood - resources. - -### 2026-07-24 — Structured-output proposal synchronization - -- Changes: - - Updated the newer HTML proposal from its obsolete terminal-only Phase 4 deferral to the shipped - `auto|transcript|terminal` contract. - - Documented exact pane/process/session selection, opaque source-pinned cursors, labeled fallback, - mixed-version behavior, and the implemented Phase 4 status. -- Verification: - - Confirmed the proposal contains no named references to other orchestration products. -- Findings: - - Implementation status and optional remaining physical acceptance are separate: the narrow output - primitive is complete, while symmetric cross-machine dogfood remains visible in this ledger. -- Next: - - Run document/skill checks, push the synchronization fix, resolve the review thread, and continue - branch-head CI monitoring. - -### 2026-07-25 — Physical Grok and OpenCode provider dogfood - -- Changes: - - Reused Native Chat's existing Grok session resolver and transcript decoder in `worker-read`. - - Kept OpenCode on the generic terminal fallback because Native Chat has no OpenCode transcript - decoder. - - Applied Dispatch-capability redaction to terminal fallback lines as well as structured - transcript blocks. - - Updated the agent-facing skill and proposal to name the current structured provider set. -- Verification: - - An isolated branch-head server started fresh same-worktree Grok and OpenCode workers through - `worker-start`; both accepted their injected tasks and returned authenticated successful - `worker_done` reports. - - Grok returned `source=transcript`, `provider=grok`, the exact marker, opaque message IDs and - cursor, and no capability token or transcript path. - - OpenCode returned `source=terminal`, `fallbackReason=provider_unsupported`, the exact marker, - and a source-pinned opaque cursor; explicitly requiring a transcript returned - `transcript_required`. - - The first OpenCode read exposed its pane-bound Dispatch capability in terminal text. After the - fix and a clean runtime rebuild, the repeated physical read replaced it with - `[dispatch capability redacted]`, emitted an explicit warning, and contained no raw token. - - Focused Native Chat/orchestration output tests passed 49 tests and Node typecheck passed. -- Findings: - - Provider support and structured-output support remain separate: OpenCode orchestration is fully - usable without inventing an OpenCode transcript adapter. - - Terminal fallback is an orchestration output boundary and needs the same narrow secret - redaction as structured output; this does not change direct terminal-read behavior. -- Next: - - Run the complete orchestration regression selection and repository quality gates, then commit - and push the provider dogfood fixes. - -### 2026-07-25 — CI ask-admission fixture correction - -- Changes: - - Updated the WebSocket long-poll admission tests to place each simulated asking worker in a real - Run with an active supervised Dispatch. - - Kept the production rule that unsupervised workers cannot create blocking questions. -- Verification: - - The complete runtime RPC test file passed 59 tests. - - The broader orchestration/RPC/CLI selection passed 23 files and 391 tests. - - Node typecheck and `git diff --check` passed. -- Findings: - - The red CI assertions were stale test setup: old arbitrary terminal handles now fail - `orchestration.ask` before holding an admission slot, exactly as the new contract requires. -- Next: - - Push the test-only correction and confirm the replacement PR check is green. - -### 2026-07-26 — Hard orchestration contract cutover - -- Changes: - - Added one shared orchestration contract version, runtime capability, and mutation classifier. - - Fenced old, missing, and wrong-contract mutations before parsing, durable receipts, database - writes, process actions, prompt injection, and connected-server effects. - - Propagated the contract through Unix/named-pipe, WebSocket, connected-server, and SSH CLI - transports, with capability preflight before local or federated mutations. - - Retired the legacy scheduler commands locally and at RPC dispatch, preserving only explicit - read-only legacy inspection. - - Returned no-effects plus argument-only full-skill recovery and documented that pre-upgrade - worker processes continue unsupervised until inspected. -- Verification: - - Focused orchestration/federation selection: 56 files and 721 tests passed. - - Repository suite excluding the independently reproducible system-SSH native-installer timeout: - 3,479 files and 37,181 tests passed. - - Node, CLI, and web typechecks passed. - - Relay, CLI, Electron/Vite, and web production builds passed. - - Bundled-skill verification, reliability gates, max-lines ratchet, and `git diff --check` passed. - - The newer tracked HTML contains no named references to the audited orchestration projects; the - older redesign HTML remains ignored and untracked. -- Findings: - - A hard version fence plus executable skill recovery is simpler and safer than maintaining a - legacy executor or draining in-flight legacy state. - - Existing pre-upgrade processes are deliberately left alive, but rejected lifecycle calls - cannot mutate current Task, Dispatch, or inbox state. - - Full lint still reports the pre-existing localization audit for six unchanged `Ghostty` - keyword strings; the excluded system-SSH test independently times out while installing native - dependencies. Neither baseline issue is changed by this migration. -- Next: - - Commit and push as `OrcaWin`, then inspect branch-head CI and mark the final remote acceptance - item only after those checks settle. - -### 2026-07-27 — Current-main rebase and CLI registry integration - -- Changes: - - Rebased the 26 orchestration commits onto current `origin/main`. - - Preserved both main's active-worktree plugin context and orchestration's terminal process - incarnation and launcher validation in their one overlapping runtime conflict. - - Registered the current Run, worker, and retired-coordinator handler keys in main's new lazy CLI - handler-group manifest. - - Removed one trailing-whitespace artifact from the structured-output design header. -- Verification: - - Conflict-focused runtime, federation, migration, and transport selection: 6 files and 995 tests - passed. - - Handler manifest, registry parity, and CLI integration: 3 files and 169 tests passed. - - Repository suite excluding the independently reproducible system-SSH native-installer timeout: - 3,586 files and 37,864 tests passed. - - Node, CLI, and web typechecks, bundled-skill verification, reliability gates, max-lines - ratchet, and conflict-marker audit passed. -- Findings: - - The rebase itself had one additive method-placement conflict; neither behavior needed redesign. - - Main's lazy handler manifest is an additional command-registration source of truth, so every new - exported orchestration handler must be listed there. - - Tests added on main depend on newly patched packages; refreshing from the rebased lockfile was - required before their results were meaningful. -- Next: - - Push the rebased branch as `OrcaWin` and inspect replacement branch-head CI. - -### Entry template - -```text -### YYYY-MM-DD — Short implementation milestone - -- Changes: - - ... -- Files: - - `path` -- Verification: - - command/test and result -- Findings: - - decision, surprise, or risk -- Next: - - one concrete next step -``` diff --git a/i18next.config.ts b/config/i18next.config.ts similarity index 100% rename from i18next.config.ts rename to config/i18next.config.ts diff --git a/config/reliability-gates.jsonc b/config/reliability-gates.jsonc index a79433f87..f6af7d2ea 100644 --- a/config/reliability-gates.jsonc +++ b/config/reliability-gates.jsonc @@ -3106,11 +3106,11 @@ "oracle": "Resolve the launched instance's real main PID from inside Electron, force-kill only that PID, require it to die, require one command-line-scoped daemon PID and the stamped interactive shell PID to remain live, relaunch with persisted state, require the daemon PID to remain identical, read the exact shell PID and a per-shell environment sentinel back through the exact restored tab, then require a successful Windows Application event-log query with zero matching pwsh FailFast events across the full crash-to-input window.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts config/scripts/win-crash-survival-e2e.test.mjs", - "node tools/win-crash-survival-e2e/run.mjs --expect survival --exe-path \"$env:ORCA_EXE\" --soak-seconds 8" + "node tests/tools/win-crash-survival-e2e/run.mjs --expect survival --exe-path \"$env:ORCA_EXE\" --soak-seconds 8" ], "testFiles": [ "config/scripts/win-crash-survival-e2e.test.mjs", - "tools/win-crash-survival-e2e/run.mjs" + "tests/tools/win-crash-survival-e2e/run.mjs" ], "assertionRefs": [ { @@ -3124,7 +3124,7 @@ ] }, { - "file": "tools/win-crash-survival-e2e/run.mjs", + "file": "tests/tools/win-crash-survival-e2e/run.mjs", "assertions": [ "force-killing only the real Electron main leaves the exact scoped daemon and stamped interactive shell alive", "packaged relaunch adopts the unchanged daemon and reads the survivor shell's environment sentinel through the restored terminal" @@ -3136,7 +3136,7 @@ "date": "2026-07-18", "runner": "ci", "platform": "windows", - "command": "node tools/win-crash-survival-e2e/run.mjs --expect survival --exe-path \"$env:ORCA_EXE\" --soak-seconds 8", + "command": "node tests/tools/win-crash-survival-e2e/run.mjs --expect survival --exe-path \"$env:ORCA_EXE\" --soak-seconds 8", "result": "passed", "durationSeconds": 61, "summary": "The packaged branch build's real main died; the same daemon and shell PIDs survived; the event-log scan found zero FailFast events; relaunch adopted the unchanged daemon; and terminal input read the survivor shell sentinel back." @@ -6004,14 +6004,14 @@ "oracle": "Runtime tests assert the exact PTY write sequence and failure cleanup; orchestration tests assert dispatch/coordinator use the agent prompt path; the live CLI harness dispatches a 32KB task to a fake Codex-like TUI and requires marker present, bracketed paste present, zero unframed line breaks, and submit observed.", "commands": [ "pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration.test.ts src/main/runtime/orchestration/coordinator.test.ts", - "node tools/repro-orchestration-long-prompt.mjs --cli out/bin/orca-dev --mode codex-like --size-kb 32 --timeout-ms 20000" + "node tests/tools/repro-orchestration-long-prompt.mjs --cli out/bin/orca-dev --mode codex-like --size-kb 32 --timeout-ms 20000" ], "testFiles": [ "src/shared/agent-prompt-injection.test.ts", "src/main/runtime/orca-runtime.test.ts", "src/main/runtime/rpc/methods/orchestration.test.ts", "src/main/runtime/orchestration/coordinator.test.ts", - "tools/repro-orchestration-long-prompt.mjs" + "tests/tools/repro-orchestration-long-prompt.mjs" ], "assertionRefs": [ { @@ -6047,7 +6047,7 @@ ] }, { - "file": "tools/repro-orchestration-long-prompt.mjs", + "file": "tests/tools/repro-orchestration-long-prompt.mjs", "assertions": [ "fake Codex-like worker observes submit after long orchestration dispatch", "32KB task marker survives before submit", @@ -6069,7 +6069,7 @@ "date": "2026-07-07", "runner": "local", "platform": "macos", - "command": "node tools/repro-orchestration-long-prompt.mjs --cli out/bin/orca-dev --mode codex-like --size-kb 32 --timeout-ms 20000", + "command": "node tests/tools/repro-orchestration-long-prompt.mjs --cli out/bin/orca-dev --mode codex-like --size-kb 32 --timeout-ms 20000", "result": "passed", "durationSeconds": 2.2, "summary": "Live dev-runtime repro passed: expectedSpecBytes=32830, hasSubmit=true, rawContainsMarker=true, hasBracketedPasteFrame=true, unframedLineBreaks=0, contractOk=true." diff --git a/config/scripts/pr-workflow-parallelism.test.mjs b/config/scripts/pr-workflow-parallelism.test.mjs index dbece23ca..5afa11074 100644 --- a/config/scripts/pr-workflow-parallelism.test.mjs +++ b/config/scripts/pr-workflow-parallelism.test.mjs @@ -22,7 +22,7 @@ const testFilePatterns = [ 'config/**/*.{test,spec}.{js,cjs,mjs,ts,tsx}', 'src/**/*.{test,spec}.{js,cjs,mjs,ts,tsx}', 'tests/**/*.{test,spec}.{js,cjs,mjs,ts,tsx}', - 'tools/**/*.{test,spec}.{js,cjs,mjs,ts,tsx}' + 'tests/tools/**/*.{test,spec}.{js,cjs,mjs,ts,tsx}' ] const realZshUsage = /(?:spawnSync|execFileSync|spawn)\(\s*['"](?:\/(?:usr\/)?bin\/)?zsh['"]|spawnSync\(\s*['"]which['"]\s*,\s*\[\s*['"]zsh['"]|name:\s*['"]zsh['"]\s*,\s*path:\s*executablePath/ diff --git a/config/scripts/run-multi-workspace-typing-bench.mjs b/config/scripts/run-multi-workspace-typing-bench.mjs index 7208afb47..8543dd0fa 100644 --- a/config/scripts/run-multi-workspace-typing-bench.mjs +++ b/config/scripts/run-multi-workspace-typing-bench.mjs @@ -6,7 +6,7 @@ * pnpm bench:multi-workspace-typing [-- --panes 8 --rate-kbps 512 \ * --keys 48 --cadence-ms 250 --cpu-workers 4 --label before-fix] * - * Results land in tools/benchmarks/results/multi-workspace-typing-*.json. + * Results land in tests/tools/benchmarks/results/multi-workspace-typing-*.json. * Run once per build/config with distinct --label values, then diff the * totalMs/inputHalfMs/echoHalfMs percentiles. */ diff --git a/config/scripts/verify-localization-extraction.mjs b/config/scripts/verify-localization-extraction.mjs index df101e652..d3334a1d3 100644 --- a/config/scripts/verify-localization-extraction.mjs +++ b/config/scripts/verify-localization-extraction.mjs @@ -82,13 +82,17 @@ async function extractToTemporaryCatalog(root, tempDir) { const outputPattern = path.join(tempDir, '{{language}}.json') // Why: extraction output is evidence for this check, not another committed // catalog that feature authors must keep synchronized. - await execFileAsync(process.execPath, [cliPath, 'extract', '--sync-primary', '--quiet'], { - cwd: root, - env: { - ...process.env, - ORCA_I18N_EXTRACTION_OUTPUT: outputPattern.split(path.sep).join('/') + await execFileAsync( + process.execPath, + [cliPath, '--config', 'config/i18next.config.ts', 'extract', '--sync-primary', '--quiet'], + { + cwd: root, + env: { + ...process.env, + ORCA_I18N_EXTRACTION_OUTPUT: outputPattern.split(path.sep).join('/') + } } - }) + ) return JSON.parse(await fs.readFile(path.join(tempDir, 'en.json'), 'utf8')) } diff --git a/config/scripts/win-crash-survival-e2e.test.mjs b/config/scripts/win-crash-survival-e2e.test.mjs index 8ad77b913..40a2e1bb4 100644 --- a/config/scripts/win-crash-survival-e2e.test.mjs +++ b/config/scripts/win-crash-survival-e2e.test.mjs @@ -1,16 +1,16 @@ import { readFileSync } from 'node:fs' import { describe, expect, it, vi } from 'vitest' -import { parseArgs } from '../../tools/win-crash-survival-e2e/cli-args.mjs' -import { buildCrashAssertions } from '../../tools/win-crash-survival-e2e/crash-assertions.mjs' -import { scanPwshFailFast } from '../../tools/win-crash-survival-e2e/crash-step.mjs' -import { selectScopedDaemon } from '../../tools/win-crash-survival-e2e/daemon-identity.mjs' +import { parseArgs } from '../../tests/tools/win-crash-survival-e2e/cli-args.mjs' +import { buildCrashAssertions } from '../../tests/tools/win-crash-survival-e2e/crash-assertions.mjs' +import { scanPwshFailFast } from '../../tests/tools/win-crash-survival-e2e/crash-step.mjs' +import { selectScopedDaemon } from '../../tests/tools/win-crash-survival-e2e/daemon-identity.mjs' import { reattachSentinelMatches, selectCreatedTabId -} from '../../tools/win-crash-survival-e2e/reattach-proof.mjs' -import { quotePowerShellLiteral } from '../../tools/win-update-e2e/powershell-runner.mjs' -import { closeApp, resolveElectronMainPid } from '../../tools/win-update-e2e/app-driver.mjs' -import { isPidAlive } from '../../tools/win-update-e2e/daemon-processes.mjs' +} from '../../tests/tools/win-crash-survival-e2e/reattach-proof.mjs' +import { quotePowerShellLiteral } from '../../tests/tools/win-update-e2e/powershell-runner.mjs' +import { closeApp, resolveElectronMainPid } from '../../tests/tools/win-update-e2e/app-driver.mjs' +import { isPidAlive } from '../../tests/tools/win-update-e2e/daemon-processes.mjs' describe('win-crash-survival-e2e proof contracts', () => { it('keeps the packaged proof manually dispatchable without a PR trigger', () => { @@ -59,7 +59,7 @@ describe('win-crash-survival-e2e proof contracts', () => { }) it('scans for FailFast only after the post-crash input probe', () => { - const harness = readFileSync('tools/win-crash-survival-e2e/run.mjs', 'utf8') + const harness = readFileSync('tests/tools/win-crash-survival-e2e/run.mjs', 'utf8') const scanIndex = harness.indexOf('const { events: failFastEvents }') const probeIndex = harness.indexOf('reattachProven = await proveReattachedShell') expect(scanIndex).not.toBe(-1) @@ -163,7 +163,7 @@ describe('win-crash-survival-e2e proof contracts', () => { }) it('requires the real packaged main for the crash proof but permits fallback cleanup', async () => { - const harness = readFileSync('tools/win-crash-survival-e2e/run.mjs', 'utf8') + const harness = readFileSync('tests/tools/win-crash-survival-e2e/run.mjs', 'utf8') expect(harness).toContain( 'resolveElectronMainPid(session.app, { allowLauncherFallback: false })' ) diff --git a/config/vitest.config.ts b/config/vitest.config.ts index ee791d96b..1146cd4a5 100644 --- a/config/vitest.config.ts +++ b/config/vitest.config.ts @@ -22,7 +22,7 @@ export default defineConfig({ 'src/**/*.test.tsx', 'config/scripts/**/*.test.ts', 'config/scripts/**/*.test.mjs', - 'tools/**/*.test.mjs', + 'tests/tools/**/*.test.mjs', 'tests/e2e/**/*.unit.test.ts' ], // Why: the full suite runs heavy TS transforms plus real git/http fixtures; diff --git a/package.json b/package.json index ac69d5d6c..a24daae62 100644 --- a/package.json +++ b/package.json @@ -98,23 +98,23 @@ "test:e2e:ssh-docker-terminal-parking": "node config/scripts/run-ssh-docker-terminal-parking-e2e.mjs", "test:e2e:nested-runtime-ssh": "node config/scripts/run-nested-runtime-ssh-e2e.mjs", "test:e2e:source-control-scale": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/source-control-large-file-count.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1", - "win-update-e2e": "node tools/win-update-e2e/run.mjs", - "win-crash-survival-e2e": "node tools/win-crash-survival-e2e/run.mjs", + "win-update-e2e": "node tests/tools/win-update-e2e/run.mjs", + "win-crash-survival-e2e": "node tests/tools/win-crash-survival-e2e/run.mjs", "test:e2e:ssh-codex-artifacts-repro": "node config/scripts/run-ssh-codex-artifacts-repro-e2e.mjs", "test:e2e:headful": "pnpm run ensure:electron-runtime && npx playwright test --config tests/playwright.config.ts --project electron-headful", "test:e2e:terminal-ime-native": "node config/scripts/run-terminal-ibus-hangul-e2e.mjs", "test:e2e:computer": "vitest run --config tests/e2e/vitest.config.ts", "bench:idle-cpu": "pnpm run ensure:electron-runtime && node config/scripts/run-idle-cpu-benchmark.mjs", "bench:macos-computer-helper-owner-loss": "node config/scripts/macos-computer-helper-owner-loss-benchmark.mjs", - "bench:startup": "pnpm run ensure:electron-runtime && node tools/benchmarks/startup-time-bench.mjs", - "bench:daemon-coldstart": "pnpm run ensure:electron-runtime && node tools/benchmarks/daemon-coldstart-bench.mjs", + "bench:startup": "pnpm run ensure:electron-runtime && node tests/tools/benchmarks/startup-time-bench.mjs", + "bench:daemon-coldstart": "pnpm run ensure:electron-runtime && node tests/tools/benchmarks/daemon-coldstart-bench.mjs", "bench:hang-watchdog-memory": "pnpm run ensure:electron-runtime && node config/scripts/hang-watchdog-memory-benchmark.mjs", - "bench:main-thread-jank": "pnpm run ensure:electron-runtime && node tools/benchmarks/main-thread-jank-bench.mjs", - "bench:worktree-deletion": "node tools/benchmarks/worktree-deletion-dev-bench.mjs", + "bench:main-thread-jank": "pnpm run ensure:electron-runtime && node tests/tools/benchmarks/main-thread-jank-bench.mjs", + "bench:worktree-deletion": "node tests/tools/benchmarks/worktree-deletion-dev-bench.mjs", "bench:zustand-selector-fanout": "node config/scripts/zustand-selector-fanout-benchmark.mjs", "bench:multi-workspace-typing": "pnpm run ensure:electron-runtime && node config/scripts/run-multi-workspace-typing-bench.mjs", - "bench:cold-park-reveal": "pnpm run ensure:electron-runtime && node tools/benchmarks/terminal-cold-park-reveal-bench.mjs", - "bench:cold-park-resource": "pnpm run ensure:electron-runtime && node tools/benchmarks/terminal-cold-park-resource-bench.mjs", + "bench:cold-park-reveal": "pnpm run ensure:electron-runtime && node tests/tools/benchmarks/terminal-cold-park-reveal-bench.mjs", + "bench:cold-park-resource": "pnpm run ensure:electron-runtime && node tests/tools/benchmarks/terminal-cold-park-resource-bench.mjs", "bench:compare": "node config/scripts/compare-benchmark-artifacts.mjs" }, "dependencies": { diff --git a/renderer-worktree-freeze-incident-2026-07-29.md b/renderer-worktree-freeze-incident-2026-07-29.md deleted file mode 100644 index 20c4be9ed..000000000 --- a/renderer-worktree-freeze-incident-2026-07-29.md +++ /dev/null @@ -1,1268 +0,0 @@ -# Incident report: workspace window freezes in a React renderer hot loop - -Date: 2026-07-29 -Timezone: America/Los_Angeles (PDT, UTC-07:00) -Affected build: Orca `1.4.162-rc.0` -Affected platform: macOS `26.5.1` (`25F80`), Apple Silicon -Status: reproduced in production and isolated Electron; reconnect scan fix validated; exact React setter unproven - -## Executive summary - -One Orca workspace window became partially responsive while a second Agent Dashboard window in the same desktop app remained fully functional. - -The affected window still accepted terminal-tab selection and highlighted the selected tab, but: - -- worktree selection no longer changed the workspace; -- the yellow agent-working animation stopped; -- ordinary renderer animation and state transitions appeared frozen. - -The backend was healthy throughout. `orca status --json` reported the app, runtime, and graph as ready and reachable. Terminal PTYs and agents continued running. - -The immediate failure was a live-but-hot-looping renderer, not a dead backend, blocked PTY, renderer crash, or V8 heap-limit OOM: - -- the affected renderer stayed runnable at roughly `123–290%` CPU; -- its physical footprint was about `1.9 GiB`, with a `2.7 GiB` peak; -- process samples found its main thread executing V8/JavaScript for every sample rather than waiting; -- the Orca trace recorded React production error `#185` at `17:50:15.542 PDT`; -- React error `#185` is `Maximum update depth exceeded`; -- the captured stack began with `getRootForUpdatedFiber -> enqueueConcurrentHookUpdate -> dispatchSetStateInternal`; -- memory-heartbeat telemetry stopped only for the affected renderer, while the Agent Dashboard renderer continued emitting normal telemetry. - -The machine was also severely saturated: 2,369 processes, 18,467 threads, load around `18–24` on 18 logical CPUs, about `19.36/20 GiB` of swap used, hundreds of agent processes, 509 PTYs, a stale headless Chrome tree burning several cores, and a QEMU Android emulator that intermittently consumed multiple cores. This pressure likely increased the probability or duration of the renderer bug, but it does not explain the React `#185` exception by itself. - -The strongest current causal model is: - -1. a flapping remote runtime repeatedly changed its reachable status; -2. the sidebar reacted to every status-set transition by requesting a global all-host worktree and lineage refresh; -3. the unusually large worktree/terminal/agent population and host pressure amplified that refresh stream until the workspace renderer entered a synchronous JavaScript/update feedback loop; -4. React reached its nested-update safety limit and emitted `#185`; -5. the renderer remained alive and CPU-bound, so Electron's existing `render-process-gone` recovery did not run; -6. the Agent Dashboard window remained healthy because it used a different renderer process. - -The reconnect-driven global scan is now the strongest initiating event and load mechanism. -It does not establish which downstream React setter crossed the nested-update limit. - -## User and collaboration context - -The user reported that a colleague froze at approximately the same time. Both were connected to the same remote host. - -The colleague later found that their Windows remote host setting was continuously -`reconnecting`. Disconnecting that host immediately restored fast worktree-sidebar -scrolling. This report was not independently inspected, but its immediate -cause-and-effect relationship strongly implicates a shared reconnect refresh storm. It -does not prove that both clients hit the same React loop; the colleague's trace and -renderer sample are still needed to establish that. - -The inspected Orca worktree records used `hostId: "local"` and `terminalPlatform: "darwin"` on this machine. The user's description of the shared remote-host topology should therefore be preserved separately from the inspected runtime labels rather than silently equating the two. - -## User-visible symptoms - -Observed before recovery: - -- terminal tabs could still be selected; -- selection highlighting updated correctly; -- worktrees could not be switched; -- the yellow working indicator was no longer animating; -- Orca appeared frozen only in the primary workspace window; -- a separately opened Agent Dashboard window remained fully responsive; -- the user also saw an Electron dialog: - - ```text - A JavaScript error occurred in the main process - - Uncaught Exception: - Error: Refusing to start E2E outside its disposable home boundary - ``` - -The E2E dialog and the workspace renderer freeze were separate failure paths. See [Separate E2E/main-process error](#separate-e2emain-process-error). - -## Environment - -| Field | Value | -| --- | --- | -| Orca version | `1.4.162-rc.0` | -| Original desktop PID | `92719` | -| Frozen workspace renderer PID | `92772`, renderer client `4` | -| Healthy dashboard renderer PID | `24530`, renderer client `5` | -| Terminal daemon PID | `92773` | -| Runtime ID before restart | `0d531b83-4510-49a1-b4b6-961a704fd83b` | -| Replacement desktop PID | `96542` | -| Replacement workspace renderer PID | `96741`, renderer client `4` | -| Replacement dashboard renderer PID | `4106`, renderer client `5` | -| Runtime ID after restart | `5060148b-ece8-4d60-b53c-20e59043b2a4` | -| OS | macOS `26.5.1` (`25F80`) | -| Logical CPUs | 18 | -| Physical memory | 64 GiB | -| System uptime | 21 days, 2 hours at capture | - -## Timeline - -Times are PDT. - -| Time | Evidence | -| --- | --- | -| `12:24:11` | Frozen renderer PID `92772` launched. | -| `17:44:45` | Affected renderer still emitted an on-time high-memory heartbeat, about 404 MiB used JS heap. | -| `17:45:24` | Two concurrent Git fetches occurred during an already-heavy worktree/status scan period. This is correlation, not proven causation. | -| `17:46:09` | Affected renderer memory heartbeat was delayed; used JS heap was about 417 MiB. | -| `17:49:07` | Last affected-renderer memory heartbeat: 518 MiB used heap, 591 MiB total heap, one browser webview. | -| `17:50:15.542` | Trace recorded `Uncaught Error: Minified React error #185`. | -| `17:50:17.580` | Trace recorded `terminal_webgl_diagnostic`, kind `webgl-atlas-reset`, with 59 live managers. | -| `17:51:03–17:51:09` | Two independent process samples captured the renderer hot loop. | -| After `17:51` | Small/dashboard renderer continued its telemetry while the affected renderer did not. | -| Recovery | In-place reload and graceful quit paths were unresponsive; desktop PID `92719` was terminated with `SIGTERM`. Daemon `92773` survived and was reparented to PID 1. | -| Recovery | Normal `orca open --json` timed out because a headless E2E/repro Orca process was registered without a desktop window. | -| Recovery | `open -n -b com.stablyai.orca` forced a new desktop instance, PID `96542`. | -| Validation | Runtime returned to `ready`; worktrees and live terminals reattached; replacement renderer was no longer continuously pinned in the prior hot loop. | - -## Evidence - -### 1. Backend and runtime remained healthy - -While the workspace window was frozen: - -```json -{ - "app": { - "running": true, - "pid": 92719, - "desktopWindowStatus": "available" - }, - "runtime": { - "state": "ready", - "reachable": true, - "runtimeId": "0d531b83-4510-49a1-b4b6-961a704fd83b", - "appVersion": "1.4.162-rc.0" - }, - "graph": { - "state": "ready" - } -} -``` - -The CLI returned this in approximately 27 ms. `orca worktree ps --json` also returned successfully. - -This rules out: - -- a dead desktop main process; -- a dead runtime; -- an unreachable graph; -- total IPC loss; -- a global terminal-daemon failure. - -It does not rule out a renderer event loop that is consuming CPU while only intermittently servicing work. - -### 2. The failure was isolated to one window renderer - -The user had two windows: - -1. the normal workspace window; -2. an Agent Dashboard window. - -The workspace window froze, while the Agent Dashboard stayed fully functional. - -The process tree matched that report: - -- workspace renderer: PID `92772`, renderer client `4`, hot; -- dashboard renderer: PID `24530`, renderer client `5`, responsive. - -Renderer-memory telemetry also split the same way: - -- the large affected renderer's heartbeat became delayed and then stopped; -- a smaller renderer continued emitting heartbeats after the freeze. - -This is strong evidence against an app-wide main-process deadlock. It is a renderer/root-specific failure. - -### 3. React recorded `Maximum update depth exceeded` - -Original local trace: - -```text -/Users/brennanbenson/Library/Application Support/orca/logs/main.trace.ndjson:19781 -``` - -Captured record: - -```json -{ - "type": "effect-span", - "name": "renderer.breadcrumb", - "startTimeUnixNano": "1785372615542000000", - "attributes": { - "kind": "crash-breadcrumb", - "breadcrumb.name": "renderer_error", - "breadcrumb.data": { - "message": "Uncaught Error: Minified React error #185; visit https:/[redacted-path]", - "filename": "file://[redacted-path]", - "lineno": 1778, - "colno": 31, - "errorType": "Error", - "errorName": "Error", - "errorMessage": "Minified React error #185; visit https:/[redacted-path]", - "errorStack": "Error: Minified React error #185; visit https:/[redacted-path]\n at getRootForUpdatedFiber (file://[redacted-path])\n at enqueueConcurrentHookUpdate (file://[redacted-path])\n at dispatchSetStateInternal (file://[redacted-path])\n a..." - } - } -} -``` - -The error occurred once in the current trace set: - -```text -rg -c -F 'Minified React error #185' main.trace.ndjson* -main.trace.ndjson:1 -``` - -React `#185` means the root exceeded React's nested update limit. This is not a generic "renderer too slow" error. - -Important interpretation from Orca's own prior fix `#11326`: - -- `nestedUpdateCount` is global to the React root; -- the component that happens to call `setState` after the counter is saturated may be an innocent bystander; -- the short captured stack cannot identify the loop driver; -- a sidebar button, terminal component, portal, or working indicator near the throw site must not be assumed to be causal without a full source-mapped/component stack or deterministic reproduction. - -### 4. The captured stack was truncated before the useful component frames - -Current renderer diagnostics capture `window.error` in: - -```text -src/renderer/src/lib/crash-diagnostics.ts -``` - -The shared crash sanitizer caps string detail values at 240 characters: - -```text -src/shared/crash-reporting.ts -const MAX_STRING_DETAIL_LENGTH = 240 -``` - -That limit reduced the only captured stack to React internals plus `a...`, removing the first application/component frame that could distinguish: - -- an unstable state object identity; -- a layout/measurement feedback loop; -- a portal readiness oscillation; -- a store snapshot/subscription loop; -- a ref attach/detach loop; -- worktree/sidebar state churn; -- terminal parking, fit, or WebGL recovery churn. - -The 240-character limit is useful for ordinary breadcrumbs but inadequate for the first occurrence of React `#185`. - -### 5. The renderer was CPU-bound, not blocked - -Representative process observations: - -```text -PID STATE CPU RSS -92772 R 179.8% 1,354,016 KiB -92772 R 164.9% 1,338,656 KiB -92772 R 123–290% across later samples -``` - -The renderer stayed in runnable state `R`. - -Two macOS samples were captured: - -```text -/tmp/Orca_Helper_(Renderer)_2026-07-29_175103_x5q7.sample.txt -/tmp/Orca_Helper_(Renderer)_2026-07-29_175106_hF2a.sample.txt -``` - -The first sample observed the Electron/V8 main thread for 2,255 samples. The second observed it for 1,566 samples. In both, the main thread was active for every sample and dominated by V8 microtask, JavaScript call, serialization, JIT, and unresolved JIT-code frames. - -The samples did not show the renderer waiting on a lock, socket, or event source. - -This supports an active JavaScript/render loop or event storm. - -### 6. Renderer memory was elevated but below the V8 heap limit - -Process/sample measurements: - -| Measurement | Value | -| --- | --- | -| Physical footprint | about 1.8–1.9 GiB | -| Peak physical footprint | 2.7 GiB | -| Writable virtual regions | 2.8 GiB | -| Writable resident | 1.1 GiB | -| Renderer pages already swapped | 579 MiB | -| Last JS used heap | 518 MiB | -| Last JS total heap | 591 MiB | -| Configured V8 heap limit | about 4.2 GiB | - -The renderer was memory-heavy and under system memory pressure, but the last JS heap measurement was far below the configured limit. There was no evidence of a V8 heap-limit OOM. - -The physical footprint was substantially larger than `ps` RSS and the reported JS heap, so non-JS allocations, graphics, mapped resources, terminal surfaces, and swapped writable memory mattered. - -### 7. Renderer heartbeat cadence proves event-loop loss - -The affected renderer's normal memory breadcrumb cadence degraded: - -```text -17:44:45 normal heartbeat, ~404 MiB used JS heap -17:46:09 delayed heartbeat, ~417 MiB -17:49:07 delayed final heartbeat, 518/591 MiB -afterward no affected-renderer heartbeat -``` - -The smaller/dashboard renderer continued emitting heartbeat breadcrumbs after that point. - -This is stronger than a screenshot-level "the animation stopped" report: a renderer-owned interval itself stopped being serviced in the affected renderer only. - -### 8. Worktree, terminal, and agent population was extreme - -The Orca graph reported: - -```text -tracked worktrees: 261 -result truncated: true -worktrees returned: 200 -``` - -Within only the first 200 returned worktrees: - -```text -worktrees with live terminals: 142 -sum of liveTerminalCount: 438 before restart, 439 after restart -worktrees with status "working": 9 -agent states: 219 done, 20 working in the first incident snapshot -``` - -Because the result was truncated at 200 of 261 worktrees, `438` is a lower bound, not a guaranteed global total. - -The raw `orca worktree ps --json` result was 11,636 lines and roughly 210,850 tool-output tokens before truncation. The CLI snapshot is not proof that the renderer receives the identical JSON payload, but it demonstrates the size and fan-out of the live graph the UI represents. - -Largest returned terminal populations included: - -| Worktree | Live terminals | -| --- | ---: | -| `pr-8783-internal-review` | 14 | -| `pr-9190-internal-review` | 14 | -| `mobile-9717-dup-sessions` | 9 | -| `Submit images as feedback` | 7 | -| `mobile-6927-close-tabs` | 7 | -| `mobile-6863-android-scroll` | 7 | -| `mobile-pr-10148` | 7 | -| `orca-trust-dialog` | 7 | - -The renderer emitted: - -```json -{ - "breadcrumb.name": "terminal_webgl_diagnostic", - "breadcrumb.data": { - "managers": 59, - "kind": "webgl-atlas-reset" - } -} -``` - -In current source, `liveManagers` is a module-level set in: - -```text -src/renderer/src/lib/pane-manager/pane-manager-registry.ts -``` - -The code documents managers as approximately terminal tabs. `resetAndRefreshAllTerminalWebglAtlases()` synchronously iterates all managers once to reset and again to refresh. - -The 59-manager reset happened about two seconds after the React error. It is evidence of a large mounted terminal surface and expensive global work. It is not proof that WebGL reset started the React loop. - -### 9. The host was heavily saturated - -System snapshot: - -| Metric | Captured value | -| --- | ---: | -| Logical CPUs | 18 | -| Load average | `23.61 24.84 24.09` | -| Processes | 2,369 | -| Threads | 18,467 | -| PTYs | 509 | -| `uptime` users | 508 | -| Physical memory in use | about 62/64 GiB | -| Compressed memory | about 28 GiB | -| Swap used | 19,228.81 MiB / 20,480 MiB | -| Swap free | 1,251.19 MiB | -| Disk free | about 381 GiB | -| Observed I/O | about 6,500–8,800 IOPS, 42–59 MiB/s | - -`uptime`'s `508 users` should be interpreted as login/PTY sessions, not 508 human users. The independently counted 509 PTYs corroborates that interpretation. - -`memory_pressure` reported no throttled pages and a 43% system-wide memory-free percentage at the instant it was sampled. A brief `top` interval showed no active swap-in/out. Therefore: - -- swap was nearly exhausted and the system had performed enormous historical compression/swap work; -- the brief evidence did not prove active swap thrashing at the exact sample moment. - -Disk capacity was healthy, so a full disk was not involved. - -### 10. Agent processes consumed tens of GiB - -Counts fluctuated while agents started and exited, but incident snapshots found: - -| Process class | Count range | Aggregate RSS | -| --- | ---: | ---: | -| Claude | 117 | about 22.8–23.3 GiB | -| Codex | 252–320 | about 10.7–11.6 GiB | -| Node | about 38 | about 1.2 GiB | -| Orca renderers | 3 | about 1.7 GiB by `ps`; affected renderer footprint was higher by `vmmap` | - -These totals do not include all descendants, file mappings, compressed pages, or swapped writable regions. - -### 11. A stale headless Chrome tree was burning several cores - -An `agent-browser` process tree had been alive for about 7 days and 23 hours: - -```text -PID 2617 agent-browser-darwin-arm64 -PID 2648 headless Google Chrome -``` - -Seven Chrome helpers repeatedly consumed approximately `35–100%` CPU each: - -- GPU helper near `100%`; -- network service near `96%`; -- storage service near `95–97%`; -- one renderer near `100%`; -- three more renderers around `35–90%`. - -Aggregate snapshots placed this tree around `500–700%` CPU, or roughly five to seven logical cores. - -This tree was not killed during recovery because ownership by another agent or test was not established. - -### 12. Other transient high-CPU processes - -Examples: - -- Android QEMU PID `89397`, device `@orca_pr9190_api36`, observed from about `12%` to `390%` CPU and roughly `1.6–2.8 GiB` RSS; -- an Expo dev server briefly at `128.6%` CPU; -- Vitest workers at more than `80%` CPU; -- WindowServer around `65%` in one snapshot; -- continuous Git scans and worktree status operations. - -The values are time samples, not stable allocations, but they show that the 18-core machine had little scheduling slack. - -### 13. Git/worktree background activity was high - -In an approximately 12-minute trace slice around the incident: - -```text -git worktree calls: 107 -git remote calls: 98 -git status calls: 65 -``` - -Two fetches overlapped near `17:45:24`, close to the first renderer-heartbeat delay. - -This is correlation. Git calls ran in the main process and continued completing after the renderer error, which further supports a healthy main process and an isolated renderer failure. - -## Separate E2E/main-process error - -The visible Electron dialog said: - -```text -Error: Refusing to start E2E outside its disposable home boundary -``` - -The guard is in: - -```text -src/main/startup/configure-process.ts -``` - -It runs when `ORCA_E2E_USER_DATA_DIR` is set and verifies that Node's `homedir()` matches the declared disposable E2E home before using the E2E profile. - -Important evidence: - -- the frozen production main PID `92719` had no `ORCA_E2E_*` variables in its process environment; -- the production main process had been running for more than five hours; -- therefore this startup-only E2E exception did not originate from the already-running frozen main process; -- it came from a separate or transient Orca/E2E launch. - -There was a live headless repro process tree: - -```text -PID 99457 Orca CLI: serve --port 6795 --mobile-pairing -PID 99612 Orca: --serve --serve-json --serve-port 6795 -``` - -Both carried: - -```text -ORCA_E2E_USER_DATA_DIR=/tmp/repro6713/userData -``` - -However, PID `99612`'s GPU and network helpers showed: - -```text ---user-data-dir=/Users/brennanbenson/Library/Application Support/orca -``` - -That discrepancy needs a separate isolation investigation: a process marked as E2E/repro appeared to create Chromium helpers against the production profile path. - -It also affected recovery: - -1. after desktop PID `92719` exited, `orca open --json` returned `runtime_open_timeout`; -2. no normal desktop process appeared; -3. the headless Orca process was still registered as a running Orca application; -4. `open -n -b com.stablyai.orca` forced a distinct desktop instance and succeeded. - -The E2E process was left running because it could belong to another active repro agent. - -Conclusions: - -- the E2E exception is not the direct cause of the React renderer loop; -- stale/headless app registration and production-profile leakage made restart less reliable; -- this is a related robustness bug worth fixing alongside, or tracking separately from, renderer recovery. - -## Recovery sequence and outcome - -### Attempt 1: in-place renderer reload - -The intended least-disruptive recovery was `CmdOrCtrl+R` in the affected window. - -The computer-control provider could capture the Orca window, but the frozen window would not accept focus. Retrying with window restore still returned `window_not_focused`. Clicking and activating the app did not make keyboard delivery verifiable. - -Result: reload shortcut could not be delivered. - -### Attempt 2: graceful app quit - -An AppleScript quit request returned successfully, but after 10 seconds: - -```text -PID 92719 still running -PID 92772 still runnable at ~158% CPU -``` - -The current window-close code includes a renderer-ack timeout intended to destroy an unresponsive window, but the observed quit did not complete. - -Result: graceful quit path did not recover the app. - -### Attempt 3: terminate the desktop main process - -`SIGTERM` was sent only to desktop PID `92719`. - -The desktop process exited after about four seconds. No agent, Claude, Codex, QEMU, Chrome, or worktree process was intentionally killed. - -Terminal daemon PID `92773` survived: - -```text -PID PPID STATE -92773 1 Ss -``` - -### Attempt 4: reopen - -`orca open --json` timed out because the headless `repro6713` Orca instance was registered without a desktop window. - -The forced new-instance launch succeeded: - -```text -open -n -b com.stablyai.orca -``` - -New desktop PID: `96542`. - -### Validation after recovery - -`orca status --json`: - -```json -{ - "app": { - "running": true, - "pid": 96542, - "desktopWindowStatus": "available" - }, - "runtime": { - "state": "ready", - "reachable": true, - "runtimeId": "5060148b-ece8-4d60-b53c-20e59043b2a4", - "appVersion": "1.4.162-rc.0" - }, - "graph": { - "state": "ready" - } -} -``` - -The graph still reported: - -```text -tracked worktrees: 261 -worktrees with live terminals in returned slice: 142 -liveTerminalCount in returned slice: 439 -``` - -The active local worktree was restored as: - -```text -I18n architecture improvements -/Users/brennanbenson/orca/workspaces/orca/scylla -liveTerminalCount: 5 -``` - -Replacement renderer observations: - -```text -workspace renderer PID 96741: initially ~9% CPU, later variable ~14–72% during restore -dashboard renderer PID 4106: ~3% CPU -``` - -The new workspace renderer showed normal variability rather than remaining pinned at the prior `160–290%` hot-loop level. - -## Recurrence in the replacement renderer - -The replacement workspace renderer reproduced the same user-visible failure class about -18 minutes after launch, without a desktop-process, runtime, graph, daemon, or dashboard -failure. - -At `18:18 PDT`, while the workspace UI appeared stuck again: - -```text -desktop PID 96542: alive -workspace renderer PID 96741: runnable, ~100–117% CPU, up to 1,472,992 KiB RSS -dashboard renderer PID 4106: responsive, generally low CPU -runtime: ready and reachable -graph: ready -``` - -`orca status --json` returned normally with the same desktop PID and runtime ID. An -independent `orca worktree ps --json` also completed and returned 257 tracked worktrees -before truncation. The backend remained usable while the workspace renderer was hot. - -A two-second process sample captured the recurrence: - -```text -/tmp/Orca_Helper_(Renderer)_2026-07-29_181809_jmia.sample.txt -``` - -The sample observed the renderer main thread for all 1,555 samples in an active -V8/JavaScript/microtask call chain. It did not show the main thread parked on a lock or -event source. The sample measured a 1.6 GiB physical footprint and a 1.7 GiB peak. - -### Heartbeat degradation repeated - -The dashboard renderer, identifiable by its small heap and zero browser webviews, -continued its approximately once-per-minute memory telemetry. The larger workspace -renderer became progressively late: - -| Renderer | Time | Used / total JS heap | Interpretation | -| --- | --- | --- | --- | -| Workspace | `18:12:05` | `866 / 948 MiB` | on-time interval | -| Dashboard | `18:12:17` | `36 / 80 MiB` | healthy | -| Workspace | `18:13:11` | `401 / 995 MiB` | about 6 seconds late | -| Dashboard | `18:13:17` | `25 / 80 MiB` | healthy | -| Dashboard | `18:14:17` | `42 / 81 MiB` | healthy | -| Workspace | `18:14:24` | `874 / 1,060 MiB` | about 13 seconds late | -| Dashboard | `18:15:17` | `43 / 83 MiB` | healthy | -| Workspace | `18:15:50` | `645 / 1,046 MiB` | about 26 seconds late | -| Dashboard | `18:16:17` | `42 / 84 MiB` | healthy | -| Workspace | `18:17:24` | `456 / 1,027 MiB` | about 34 seconds late | -| Dashboard | `18:18:17` | `33 / 85 MiB` | healthy | -| Dashboard | `18:19:17` | `39 / 90 MiB` | healthy | - -This is the same per-window event-loop-starvation pattern as the first occurrence. The -workspace heartbeat degraded while the other window's renderer continued on schedule. - -### Similar terminal-manager and WebGL churn preceded the recurrence - -Before the recurrence, the trace recorded repeated worktree activations, terminal safe-fit -retry exhaustion, and WebGL atlas resets. The live manager count rose from 29 at -`18:10:00` to 42 by `18:14:07`. The first occurrence had the same classes of breadcrumbs -with 59 live managers. - -This correlation makes terminal park/unpark, fit, manager lifecycle, and WebGL recovery -high-priority replay inputs. It still does not prove that WebGL or a terminal manager was -the React loop driver. - -### No second React `#185` was recorded - -The rotating trace set contains only the original `17:50:15.542` React `#185` record: - -```text -main.trace.ndjson: 0 occurrences -main.trace.ndjson.1: 1 occurrence, original incident at line 19781 -``` - -Therefore the recurrence is confirmed to be the same renderer-local hot-loop and -heartbeat-failure class, but the available evidence does not prove that the second -occurrence crossed React's nested-update limit or had the identical initiating setter. -The two occurrences may share the same driver without producing a second observable -`window.error`, or they may be two related renderer feedback loops under the same load. - -### User-initiated `Cmd+R` restored progress - -At `18:19:23.552`, the trace recorded, in the existing PID `96741`: - -```text -renderer_bootstrap_started -renderer_memory reason=startup -renderer_bootstrap_rendered -``` - -The user confirmed that they initiated this renderer reload with `Cmd+R`. No desktop, -daemon, runtime, graph, or dashboard restart accompanied it. After the reload: - -- workspace CPU dropped from a sustained `~100–117%` to variable `~15–37%`; -- RSS dropped from as high as about 1.47 GiB to about 517 MiB; -- workspace telemetry resumed at `18:20:23`; -- terminal-manager reconstruction restarted from one manager and rose to seven. - -This result establishes that a user-delivered `Cmd+R` is a successful, least-disruptive -recovery for this live-renderer hot loop. It also strongly supports a bounded per-window -reload as the corresponding automatic recovery mechanism: the workspace can be restored -without terminating the desktop process or disrupting the healthy dashboard and backend. - -### Host pressure was worse during the recurrence - -At recurrence capture: - -```text -load averages: 54.10 42.54 31.29 -logical CPUs: 18 -``` - -Other simultaneous consumers included a TypeScript/Go linter near `341%` CPU, several -stale headless-Chrome helpers near one core each, an Android emulator near one core, and -a TypeScript compiler above half a core. This pressure can explain delayed scheduling and -can amplify the product bug, but it cannot by itself explain why only the workspace -renderer stayed in an active JavaScript call chain while the dashboard and backend -continued to progress. - -At `18:51 PDT`, a later process census attributed the machine-wide CPU load to several -independent trees: - -```text -stale headless agent-browser Chrome tree: ~392% CPU, running for eight days -iOS 26.5 Simulator tree: ~336% CPU across 597 processes -production Orca main/renderer/GPU: ~175% CPU combined -two Android emulators: ~35% CPU combined -Claude/Codex/Node processes: >140% CPU combined -total machine process count: 2,740 -``` - -The eight-day Chrome tree was the clearest abnormal long-lived consumer. No process from -that tree was stopped during this investigation because it was not launched by the -investigating session. - -### Remote-runtime reconnect scanning is the strongest trigger evidence - -The colleague's immediate recovery after disconnecting a continuously reconnecting -Windows runtime led to a matching code path in -`src/renderer/src/components/sidebar/index.tsx`. - -Before the fix, every change to the set of reachable runtime environments requested: - -```text -fetchAllWorktrees() -> fetchWorktreeLineage() -``` - -That is a global all-host refresh. A `SingleFlightCoalescer` prevented overlapping calls, -but a status stream that continued to flap could keep producing one leading scan and one -trailing scan indefinitely. - -The global path was already redundant. Commit `bbc5951958` added the host-scoped -`runtimeProjectRefreshScheduler` in `useIpcEvents` four days after the sidebar effect was -introduced. The scoped scheduler: - -- refreshes only the affected environment's repo catalog and worktrees; -- debounces bursts; -- enforces a five-second minimum interval per environment; -- runs the existing focused-host lineage merge without invoking `fetchAllWorktrees`. - -Trace volume matches the broad-scan hypothesis. One rolling ten-minute sample captured -during investigation contained: - -```text -git worktree: 169 -git remote: 136 -git status: 112 -``` - -A later rolling ten-minute window still contained 155 `git worktree`, 112 `git remote`, -and 80 `git status` spans, including bursts of 38–51 `git worktree` commands per minute. -The runtime and graph continued to report healthy during this activity. - -The implemented fix removes the sidebar's runtime-status-driven global refresh and its -now-unused coalescer. The existing repo-count-triggered broad refresh remains, while -runtime reconnect discovery continues through the per-environment scheduler. A regression -test repeatedly alternates one runtime between connected and unreachable and asserts that -the sidebar never starts `fetchAllWorktrees`. - -This evidence identifies a concrete reconnect load storm and a defensible fix. It does -not conclusively identify the application setter below React's -`dispatchSetStateInternal`, so the longer first-failure stack remains necessary. - -### Isolated Electron reproduction - -The branch was launched through `config/scripts/run-electron-vite-dev.mjs` with: - -```text -branch/worktree: brennanb2025/fix-electron-freeze-repro / anchovy -renderer URL: http://127.0.0.1:5177/ -CDP endpoint: http://127.0.0.1:9337/ -profile: disposable ORCA_DEV_USER_DATA_PATH -``` - -The app identity API confirmed the intended worktree. The isolated profile was populated -through Orca's real repo IPC with: - -```text -repo rows: 13 -visible worktrees: 266 -detected worktree records: 3,458 -``` - -The old sidebar reconnect effect was temporarily restored under HMR to replay the failure -path, then removed again before final validation. - -With the pre-fix effect: - -- 60 alternating reachable/unreachable transitions caused 27 - `fetchAllWorktrees` calls; -- a longer 600-transition run caused 139 calls; -- the 600-transition run took 35.7 seconds; -- mean / p95 / max animation-frame gaps were `59.5 / 124.6 / 272.5 ms`; -- the renderer reached `140.9%` CPU and a 2.1 GiB physical footprint; -- all 2,353 main-thread samples in the active capture were inside - V8/JavaScript/microtask execution. - -Active sample: - -```text -/tmp/orca-anchovy-prefx-runtime-flap-active-renderer.sample.txt -``` - -With the fixed source after an in-place renderer reload: - -- the same 600 transitions caused zero `fetchAllWorktrees` calls; -- the run completed in 18.2 seconds; -- mean / p95 / max frame gaps improved to `30.3 / 49.5 / 150.1 ms`; -- peak observed RSS during the run was about 735 MiB; -- real wheel events moved the visible worktree sidebar from `scrollTop=0` to - `scrollTop=2400`, then from `2419` to `10419`, after the run. -- after the stress stopped, interval CPU returned to `0.0%` and 120 idle animation - frames averaged `8.3 ms` with a `9.2 ms` p95 and `9.3 ms` maximum. - -Visible proof: - -```text -/tmp/orca-anchovy-fixed-runtime-flap-sidebar-scrolled.png -``` - -The replay used a synthetic Windows-runtime status entry injected into the real Zustand -store because the disposable profile had no paired remote host. It exercised the exact -sidebar status dependency and all-host scan path, but it did not exercise an actual -Windows transport reconnect or emit a second React `#185`. The active JavaScript hot-loop, -CPU, and memory failure class were nevertheless reproduced. - -### Validation status - -Validation completed: - -- 6 focused Vitest files, 118 tests passed; -- sidebar reconnect regression passed; -- runtime refresh scheduler tests passed; -- both existing React `#185` regression suites passed; -- crash stack-length regression passed; -- focused `oxlint` passed; -- renderer/web TypeScript check passed; -- `git diff --check` passed. - -The isolated app also exposed an unrelated startup limitation: its long disposable profile -path made the daemon Unix-socket path invalid, so the dev app fell back to local PTYs. -This did not affect the sidebar/runtime-status reproduction. - -## Confirmed facts, likely contributors, and unknowns - -### Confirmed - -1. One workspace-window renderer entered a CPU hot loop. -2. A different Agent Dashboard renderer remained healthy. -3. The main process, runtime, graph, and terminal daemon remained healthy. -4. The affected renderer emitted React `#185`. -5. The affected renderer's own heartbeat stopped. -6. The affected renderer was alive and runnable, so crash-only recovery did not apply. -7. Host CPU, memory, process, PTY, and I/O pressure was extreme. -8. Restarting the desktop while preserving the daemon restored Orca and its live sessions. -9. A separate headless E2E/repro process interfered with normal reopening. -10. Runtime status transitions could initiate a global all-host worktree refresh from the sidebar despite an existing host-scoped scheduler. -11. The old effect reproduced a 140.9%-CPU, 2.1-GiB renderer JavaScript hot loop in isolated Electron; the fixed source issued zero global scans under the same status workload. - -### Likely contributors - -1. A flapping remote runtime repeatedly triggered the redundant global sidebar refresh. -2. Large numbers of mounted terminal managers and live terminal/worktree state increased synchronous renderer work. -3. Continuous agent status/output changes increased update frequency. -4. Host pressure widened timing windows and delayed normal renderer tasks. -5. A state/effect/layout/ref feedback loop converted one update source into unbounded nested updates. -6. The lack of live-renderer hang recovery allowed the loop to persist indefinitely. - -### Not proven - -1. The 59-manager WebGL atlas reset caused the React loop. -2. The reconnect-driven scans directly caused the exact React setter loop rather than an equivalent JavaScript hot loop that amplified another downstream defect. -3. The sidebar or yellow indicator component contained the setter that crossed React's update-depth limit. -4. The remote host sent malformed data rather than an ordinary but repeated reconnect transition. -5. The colleague hit React `#185`. -6. Memory pressure alone caused the freeze. -7. The separate E2E exception caused the renderer freeze. - -## Related React `#185` history already in this repository - -This repository has several recent fixes for distinct `#185` loops: - -| Commit / PR | Mechanism | -| --- | --- | -| `4543bb6826` / `#11326` | Bounded Activity portal readiness `loading <-> unavailable` oscillation. | -| `17617b1a6c` / `#10632` | Preserved pane-title overlay rect object identity to stop equal-state layout churn. | -| `7a422712b1` / `#10028` | Fixed Voice speech-model dropdown update loop. | -| `9038a78d37` | Stopped terminal overlay measure/fit/ResizeObserver feedback loop. | -| `f01bfd937f` / `#8679` | Upgraded Radix and React to stop React 19 callback-ref identity churn. | -| `58293445e1` / `#9615` | Guarded status-bar notice anchor state against equal-geometry re-renders; explicitly not a proven root fix for its crash cluster. | - -Current dependencies already include: - -```json -{ - "radix-ui": "^1.6.2", - "react": "^19.2.7", - "react-dom": "^19.2.7" -} -``` - -Therefore, do not assume this is simply the old Radix `1.4.3` bug recurring. - -The recurring patterns in prior fixes are highly relevant: - -- a fresh object written to state despite equal logical value; -- a `useLayoutEffect` sync-lane feedback loop; -- measurement causing fit/resize causing measurement; -- portal readiness oscillation; -- unstable ref identity; -- the component where `#185` throws being an innocent bystander. - -## Current recovery and observability gaps - -### 1. Recovery only handles a renderer that exits - -`src/main/window/createMainWindow.ts` recovers on: - -```text -webContents.on('render-process-gone', ...) -``` - -This renderer never went away. It remained alive and CPU-bound. - -No main-window handler for Electron's `unresponsive` event was found. - -### 2. The watchdog covers the main thread, not renderer windows - -`src/main/hang-watchdog/main-thread-hang-watchdog.ts` monitors the packaged macOS main process from a worker. - -That watchdog correctly did not fire here because the main process was healthy. There is no equivalent per-renderer heartbeat/recovery controller. - -### 3. PTY code can detect unresponsive renderer IPC but only logs - -`src/main/ipc/pty.ts` can time out a delivery-resync probe and logs: - -```text -[pty] delivery resync probe unanswered — renderer IPC unresponsive -``` - -The code explicitly performs no mutation because it expects a reload to cure dead IPC. That signal could feed a bounded per-window recovery/prompt path. - -### 4. First-failure stack detail is too short - -The first and only `#185` stack lost its application frames due to the 240-character breadcrumb cap. - -### 5. The UI had no usable "reload this window" escape hatch - -The renderer would not accept the keyboard reload shortcut, and graceful quit did not complete. - -### 6. Headless E2E instances can interfere with desktop open - -The normal open command targeted or detected a no-window headless Orca process and timed out. - -## Recommended fix plan - -### Priority 0: isolate runtime reconnect refreshes - -1. Do not run `fetchAllWorktrees` when a remote runtime's status changes. -2. Route connect and reconnect discovery through `runtimeProjectRefreshScheduler`. -3. Keep refresh state scoped per runtime environment. -4. Retain the normal all-host refresh for actual repo-catalog count changes. -5. Regress repeated reachable/unreachable transitions against global scan calls. - -### Priority 0: capture the actual loop driver - -1. Special-case the first React `#185` occurrence: - - retain a substantially longer sanitized stack; - - preserve source-map frames; - - record the renderer surface and `webContents.id`; - - include the React error boundary component stack when available; - - include the last bounded set of store/effect diagnostics. -2. Keep later identical events coalesced so an error storm cannot fill the breadcrumb ring. -3. Record a renderer heartbeat sequence and lag: - - expected timestamp; - - actual timestamp; - - event-loop delay; - - pending terminal write/ACK totals; - - live manager and pane census; - - active worktree/tab; - - high-level store collection sizes. -4. Preserve the first `#185` diagnostic bundle even if the renderer never exits. - -### Priority 0: recover a live-but-unresponsive window - -Add per-window recovery rather than app-wide recovery: - -1. Main process tracks a heartbeat from each main renderer window. -2. Treat missing heartbeat plus Electron `unresponsive` or unanswered PTY resync as a renderer-hang candidate. -3. Capture diagnostics before mutation. -4. Surface a native/main-process-controlled recovery prompt: - - `Reload workspace window`; - - `Wait`; - - `Restart Orca`. -5. Reload only the affected workspace window when safe. -6. Preserve live PTYs using the same orphan-sweep protection already used by `render-process-gone` recovery. -7. Use a circuit breaker so a deterministic loop cannot cause infinite auto-reloads. -8. Leave the healthy Agent Dashboard window intact. - -Automatic reload should require strong evidence and remain bounded. A user-driven reload prompt is safer for loops that recur immediately. - -### Priority 1: audit high-probability update loops - -Focus on code exercised by: - -- worktree activation and sidebar status; -- agent working-state updates; -- Activity portal reconciliation; -- terminal tab cold parking; -- pane title/overlay geometry; -- ResizeObserver and `useLayoutEffect` measurement; -- global WebGL atlas reset/refresh; -- external-store/Zustand selectors used by the sidebar and workspace shell. - -For every state setter in those paths: - -- return the previous reference when the logical state is unchanged; -- avoid allocating a new array/object snapshot on every `getSnapshot`; -- guard layout measurements with field equality and appropriate rounding; -- bound two-state readiness oscillations; -- keep effect dependencies and subscriptions stable; -- avoid synchronous store write-back from a selector/subscriber; -- avoid global manager work when only one visible pane needs recovery. - -### Priority 1: reduce mounted and subscribed surface area - -At this scale, validate that: - -- inactive worktrees do not keep terminal React trees mounted unnecessarily; -- cold-parked terminal tabs release renderer-heavy objects and subscriptions; -- the pane-manager registry does not retain managers after unmount; -- sidebar rows subscribe to the narrowest stable scalar state; -- agent spinner updates do not rerender the full worktree list; -- graph updates are batched; -- worktree switching does not synchronously reconcile hundreds of inactive terminal surfaces; -- WebGL recovery is chunked or scoped when a global reset is unavoidable. - -### Priority 1: isolate headless E2E/repro app identity - -1. Ensure every E2E/serve launch sets and uses the disposable Electron `userData` and home paths before Chromium helpers spawn. -2. Ensure headless serve/repro instances cannot claim or confuse the production desktop singleton. -3. Ensure `orca open` selects a desktop-capable process or starts a new desktop window when only headless instances exist. -4. Add a regression test for: - - headless E2E instance running; - - production desktop stopped; - - `orca open`; - - desktop window becomes available; - - no production profile path appears in E2E helper arguments. - -### Priority 2: resource-pressure hygiene - -Resource cleanup will not replace a renderer-loop fix, but it should reduce recurrence: - -- detect obviously orphaned agent-browser trees; -- expose per-worktree process and terminal cost; -- make done-agent cleanup visible and safe; -- warn when PTY/process/swap thresholds are extreme; -- avoid indefinitely retaining dormant E2E daemons and emulator processes; -- provide ownership metadata before offering cleanup. - -## Required regression tests - -### Runtime reconnect isolation test - -1. Create a large local graph and one paired runtime. -2. Alternate that runtime between reachable and unreachable status. -3. Assert that no transition invokes `fetchAllWorktrees`. -4. Assert that the connected environment still refreshes through - `runtimeProjectRefreshScheduler`. -5. In Electron, verify sidebar scrolling and animation heartbeats remain responsive while - the status flaps. - -### Renderer update-loop stress test - -Create a deterministic fixture approximating this incident: - -- 250–300 worktrees; -- at least 450 live terminal records; -- at least 59 mounted/live pane managers; -- hundreds of done agent records; -- 15–25 actively changing agent statuses; -- continuous terminal output; -- two renderer windows: workspace plus Agent Dashboard; -- periodic Git/worktree metadata updates; -- periodic WebGL atlas recovery signal; -- repeated worktree switches. - -Assertions: - -- no React `#185`; -- animation/requestAnimationFrame heartbeat continues; -- worktree activation completes within a bounded interval; -- terminal-tab selection and worktree selection both update; -- dashboard remains responsive; -- renderer commit count settles after equal-state updates; -- no unbounded manager, DOM-node, or heap growth; -- renderer CPU returns toward idle after the event burst. - -### State identity tests - -For high-risk selectors and geometry/readiness helpers: - -- equal inputs return the previous reference; -- subscription snapshots remain referentially stable; -- repeated identical ResizeObserver deliveries add at most one settling commit; -- readiness state cannot oscillate indefinitely; -- store subscribers do not synchronously write back to the same slice. - -### Per-window recovery test - -1. Open workspace and dashboard windows. -2. Deliberately block or spin the workspace renderer test hook. -3. Verify main process and dashboard remain responsive. -4. Verify a renderer-hang diagnostic is captured. -5. Reload only the workspace window. -6. Verify existing PTYs reattach without duplicate sessions or lost output. -7. Verify the recovery circuit breaker stops repeated reloads. - -### E2E/headless-open isolation test - -1. Launch a headless E2E/serve process with disposable paths. -2. Confirm every child helper uses those paths. -3. Invoke `orca open`. -4. Confirm a desktop window appears. -5. Confirm the E2E process cannot redirect the production open request into a no-window runtime. - -## Reproduction strategy - -The original incident was not triggered by an intentional click. Build a replay rather than relying on manual timing: - -1. Capture or synthesize the worktree/terminal/agent graph at the observed cardinality. -2. Alternate one paired runtime between reachable and unreachable while recording refresh calls. -3. Replay agent-state and terminal-output events at field-observed rates. -4. Open a second Agent Dashboard window. -5. Exercise Activity portal staging and worktree switching. -6. Trigger terminal park/unpark and atlas recovery at controlled points. -7. Run under both normal and CPU-throttled conditions. -8. Record: - - React Profiler commits; - - renderer heartbeat lag; - - state setter call sites; - - store version/snapshot identities; - - layout-effect transitions; - - manager registration/unregistration; - - PTY ACK backlog. - -Start with macOS because that is the observed platform, then cover Windows, Linux, SSH-hosted workspaces, and folder workspaces. - -## Diagnostic commands used - -These are read-only unless explicitly noted. - -```sh -orca status --json -orca worktree ps --json -ps -axo pid,ppid,state,%cpu,%mem,rss,etime,command -memory_pressure -sysctl vm.swapusage -uptime -sample 92772 3 1 -``` - -Compact graph census: - -```sh -orca worktree ps --json | jq '{ - total: .result.totalCount, - returned: (.result.worktrees | length), - active_worktrees: [.result.worktrees[] | select(.liveTerminalCount > 0)] | length, - live_terminals: ([.result.worktrees[].liveTerminalCount] | add), - working_worktrees: [.result.worktrees[] | select(.status == "working")] | length, - agent_states: ( - [.result.worktrees[].agents[]?.state] - | group_by(.) - | map({state: .[0], count: length}) - ) -}' -``` - -React error lookup: - -```sh -rg -n -F 'Minified React error #185' \ - '/Users/brennanbenson/Library/Application Support/orca/logs/main.trace.ndjson' -``` - -## Evidence preservation - -At report creation time, the following files still existed: - -```text -/Users/brennanbenson/Library/Application Support/orca/logs/main.trace.ndjson -/Users/brennanbenson/Library/Application Support/orca/logs/daemon.log -/tmp/Orca_Helper_(Renderer)_2026-07-29_175103_x5q7.sample.txt -/tmp/Orca_Helper_(Renderer)_2026-07-29_175106_hF2a.sample.txt -/tmp/Orca_Helper_(Renderer)_2026-07-29_181809_jmia.sample.txt -``` - -The `/tmp` samples and rotating trace logs are ephemeral. Copy them into a durable, access-controlled diagnostic bundle before reboot, cleanup, or log rotation if the raw artifacts are needed. - -Do not publish the full process list or terminal output without reviewing it for secrets and user content. - -## Open questions - -1. What was the first Orca application frame below `dispatchSetStateInternal`? -2. Did the colleague's renderer record React `#185` at the same time? -3. Which shared host/runtime event occurred immediately before both users froze? -4. Was Activity portal readiness involved despite the `#11326` bound? -5. Did any state-identity loop remain in terminal/worktree/sidebar code added after earlier `#185` fixes? -6. Why were 59 pane managers live in one renderer? -7. Were all 59 expected, or did manager unregistration leak? -8. Did the atlas reset begin before the truncated trace timestamp, or was the recorded reset strictly a post-error recovery action? -9. Why did the graceful quit renderer-ack timeout not close the affected window? -10. Why did a process with `ORCA_E2E_USER_DATA_DIR=/tmp/repro6713/userData` spawn helpers using the production profile path? -11. Why did `orca open` target or defer to a headless no-window instance? -12. Can per-window renderer heartbeat/recovery reuse the existing PTY delivery-resync and orphan-sweep mechanisms? - -## Bottom line - -This was an Orca renderer correctness bug exposed under an extreme but legitimate multi-agent/worktree workload. - -The replacement renderer reproduced the same hot-loop and heartbeat-failure class in less -than 20 minutes. A continuously reconnecting remote runtime and the sidebar's redundant -global all-host refresh now provide the strongest initiating-event explanation. Host -saturation was severe and amplified the storm, but the product bug is that an ordinary -runtime reconnect stream could repeatedly rescan unrelated hosts until one live renderer -entered an unbounded JavaScript/update loop. The first occurrence is confirmed as React -`#185`; the recurrence is not, and the exact setter remains unproven. - -The fix should combine: - -1. host-isolated, throttled runtime reconnect refreshes; -2. better first-failure `#185` diagnostics; -3. deterministic reconnect stress reproduction; -4. state/effect identity fixes if the longer stack reveals a downstream loop; -5. bounded per-window live-renderer recovery; -6. headless E2E/desktop-open isolation. diff --git a/src/main/daemon/session-ingest-throughput.bench.test.ts b/src/main/daemon/session-ingest-throughput.bench.test.ts index e226ddf86..aa83e578f 100644 --- a/src/main/daemon/session-ingest-throughput.bench.test.ts +++ b/src/main/daemon/session-ingest-throughput.bench.test.ts @@ -5,7 +5,7 @@ import { Session, type SubprocessHandle } from './session' // Benchmark harness for the terminal performance initiative: measures the // daemon-side ingest rate (Session.handleSubprocessData -> HeadlessEmulator // write + pending-output recording + client fanout) for the same workload -// shapes as tools/benchmarks/terminal-pipeline-bench.mjs. Bare headless +// shapes as tests/tools/benchmarks/terminal-pipeline-bench.mjs. Bare headless // xterm parses these at ~80-100 MB/s; the end-to-end Orca pipeline measured // 2-15 MB/s (baseline-jul02) — this isolates the daemon layer's share. // Run with: diff --git a/test-results/pr-11293-11177-integration-r1.md b/test-results/pr-11293-11177-integration-r1.md deleted file mode 100644 index 40a0887a9..000000000 --- a/test-results/pr-11293-11177-integration-r1.md +++ /dev/null @@ -1,123 +0,0 @@ -# PR #11293 + PR #11177 semantic integration R1 - -## Result - -- #11293 base: `a9d8be94df2b750c9d363fc8310567dd7e5504cd` -- Preserved contributor commit: `eb76873ce7b9564b248f7317924e6c49b4001b13` - (`JeongUk Park `, cherry-picked from `2cb6a50e3`) -- Integration commit: `c1b329b72f25d8701769be52d0c400c5eaf29510` -- Finalized #11177 reference: `dc2b59723dcc8cbf2cf44ebe0511323551e9d3b3` -- Upstream xterm source: `53a98a720ae4a973e384fa2440880d09537132f3` -- Published runtime/source-map version: `6.1.0-beta.287` -- Final pnpm patch hash: - `db949d673197f31341f8cac2b25acff4cf6073725bfb6c6d3ca2ed02cfd5c898` - -The integration retains #11293/#11011's transaction IDs, pending-composition record, -tracked timers, input/blur/disposal ownership, stale-end rejection, and -Japanese/Chinese/Korean reconciliation. It layers #11177's Korean won/backtick native -forwarding, compatible optional helper interface, accepted/settled events, immediate -restart balance, runtime version, and complete generated artifact set. - -Immediate restart cancels the superseded finalizer timer and settles its lifecycle before -the new transaction is accepted, while retaining the stronger pending byte record until -the restarted composition supplies authoritative text. This preserves both -`accepted, settled, accepted, settled` and Korean final-consonant transfer (`아아`, not -`앙아`). When a browser/test double omits `CompositionEvent.data`, the fallback uses -#11177's shortest ordered keypress merge; data-bearing Chromium/IBus paths retain -#11293's distinct-following-keypress contract. - -## Authorship and history - -JeongUk Park's original contributor authorship is preserved in its own commit before the -integration fix. The exact #11293 base remains intact, including its existing -AmethystLiang and nwparker-authored history. No commit was squashed or rewritten. - -## Red control - -The final 16-test CJS/ESM transaction suite was run against exact round-six parent -`be7b9b85574266d2da114e3171020db645262bc1`. - -- Result: 2 failed, 14 passed. -- Both failures were the intended immediate-full-restart controls. -- Parent events were `accepted, accepted`; the candidate reports - `accepted, settled, accepted`. - -The candidate passes all 16 tests and produces `한글` exactly once. - -## IME and terminal validation - -| Gate | Result | -| ----------------------------------------------- | ----------------------------- | -| Exact #11011 composition suite from `a76760649` | 42/42 passed | -| Exact #11177 ten-file matrix from `dc2b59723` | 127/127 passed | -| Combined current IME superset | 13 files, 218/218 passed | -| Focused transaction/won/#11293 suite | 4 files, 75/75 passed | -| Broad terminal-pane suite | 200 files, 2,673/2,673 passed | -| Native IBus workflow contract tests | 4/4 passed | - -The native Linux IBus harness was not run because the integration host is macOS -(`Darwin`); the harness requires Linux/X11 and running it here would violate the -no-GUI/no-input-source-change constraint. - -## Artifact and supply-chain integrity - -A clean checkout of upstream xterm `53a98a7` received the publication substitutions and -the semantic source union. Upstream `tsgo -b ./tsconfig.all.json`, webpack CJS, and -production esbuild ESM builds passed. A fixture-local self-package link prevented Orca's -ancestor `node_modules` typings from contaminating the clean upstream compile. - -| Artifact | SHA-256 | -| ------------------- | ------------------------------------------------------------------ | -| `lib/xterm.js` | `81b4efd747ab4188635955ef60dcc02a4c4920039fad4c9b898ff93710ff8b3a` | -| `lib/xterm.mjs` | `13afb1a5bb49e2bbc8ff8b2867b71b0c8e61f6fb25f49af69ac8f25b72ccf24f` | -| `lib/xterm.js.map` | `2f4394dbed6e3a5baeab2b7fb24ce6e5f940ebbab728d30c093ff8fa0f8ebb4d` | -| `lib/xterm.mjs.map` | `4d7b8a4775bca851c4c19aac70543b2881dad7af27e4f5397403ddb59ec3f090` | - -- The final patch applies cleanly to the pristine npm package. -- All patched package files match the installed pnpm package byte-for-byte. -- All 24 lockfile references use the raw patch SHA-256. -- Frozen and frozen-offline installs passed, including native dependency validation. -- CJS and ESM DCS probes both report `xterm.js(6.1.0-beta.287)`. -- Both maps contain the matching `src/common/Version.ts` source. - -## Repository gates - -- Node, CLI, and web typechecks: passed. -- Full repository lint: passed, including type-aware/native code-quality, reliability, - max-lines, localization, and bundled-skill gates. -- Changed-code-quality and React Doctor: 0 new findings. -- Changed TypeScript formatting: passed. -- Electron Vite production build: passed with existing chunking/CSS warnings. -- `git diff --check`: passed. - -One lint invocation intentionally overlapped the Electron build and observed the build's -ephemeral `electron.vite.config.*.mjs` disappear during scanning. The standalone final -lint rerun passed; this was concurrent command interference, not a source failure. - -## Latest main compatibility - -- Fetched `origin/main`: `a7c8b8e07161ec05c44dbf2a0d11dad9c71a4710` -- Conflict-free merge tree: `95f1aa9fa14d3664adb9aa20a3c35f0ee481979d` -- Materialized merge frozen-offline install: passed. -- Materialized merge IME superset: 13 files, 218/218 passed. -- Materialized merge Node/CLI/web typechecks: passed. - -## Security, performance, platform, and workspace audit - -- No dependency version or dependency graph changed; `pnpm-lock.yaml` changes only the - xterm patch hash references. -- No filesystem, shell, Git, provider, credential, IPC, HTML injection, or network - surface changed. -- No unbounded timer or collection was added. Superseded finalizers are canceled and - removed from the tracked timer set; the large-observation performance guard remains - green. -- macOS won/backtick routing remains behind the existing input-source feature gate. - Linux and Windows retain their existing paths, including Windows IME ownership tests. -- Forwarded native text still enters `terminal.input()` and xterm's existing ordered - `onData` transport. Local PTYs, SSH/remote runtimes, git worktrees, and folder - workspaces therefore share the established transport with no host-local assumption. -- No Git command, provider-specific review behavior, path handling, or native module - baseline changed. - -No push, merge, GitHub/Slack comment, reaction, GUI automation, window focus, or system -input-source change was performed. diff --git a/test-results/pr-11293-11177-integration-r2.md b/test-results/pr-11293-11177-integration-r2.md deleted file mode 100644 index 7054eb295..000000000 --- a/test-results/pr-11293-11177-integration-r2.md +++ /dev/null @@ -1,130 +0,0 @@ -# PR #11293 + PR #11177 semantic integration R2 - -## Result - -- R1 product: `c1b329b72f25d8701769be52d0c400c5eaf29510` -- R1 evidence: `1d60de49452ebd7cf0b5e3255c5c48d83d96220a` -- R2 product: `2f5811d7f6e45c0da925ed4b17f68a558b974497` -- Integration base: `a9d8be94df2b750c9d363fc8310567dd7e5504cd` -- Preserved contributor commit: - `eb76873ce7b9564b248f7317924e6c49b4001b13` - (`JeongUk Park `) -- Upstream xterm source: `53a98a720ae4a973e384fa2440880d09537132f3` -- Runtime/source-map version: `6.1.0-beta.287` -- Final xterm patch hash: - `642f6920fa1fdcbd740542f81895b092f383e9bfa926aa3967c4197729c5e40b` - -Verifier A's P2 and P3 are fixed in both installed package formats. A restarted -transaction now rejects a pre-update end that repeats the retained prior -transaction's end observation, so the delayed stale sequence emits `AB`, not -`AA`. Deferred composition-position and view work is coalesced by ownership -slot and canceled on restart, bounding the 256-transaction same-task burst at -three tracked timers instead of 769; all tracked state drains to zero. - -The retained pending composition record remains separate from accepted/settled -lifecycle settlement. This preserves immediate restart balance, Korean final -consonant reconciliation, Japanese/Chinese ordering, #11052 newline ownership, -and #11177 won/backtick forwarding. - -## Parent red and candidate green - -The exact verifier A R1 oracle was read and retained as the control: - -- R1 installed CJS/ESM oracle: 10 passed, 4 failed of 14. -- Intended failures: delayed stale end in CJS and ESM, plus the timer bound in - CJS and ESM. -- R2 full verifier oracle: 14/14 passed. -- Tracked focused R2 regression: - `terminal-ime-xterm-adversarial.test.ts`, 4/4 passed. -- The tracked regression SHA-256 is - `69b48b8733b407e8cb2ddd716bbd6dbb87ec12696e950ecaf0e738b67af9512f`. - -The regression uses real installed xterm DOM listeners and separately imports -the CJS and ESM bundles. It asserts exact PTY bytes, the four-timer ceiling, -timer drainage, and disposal. - -## IME and terminal validation - -| Gate | Result | -| ----------------------------------------- | ----------------------------- | -| Exact #11011 historical suite | 42/42 passed | -| Exact #11177 ten-file historical matrix | 127/127 passed | -| #11052 Enter/newline matrix | 3 files, 49/49 passed | -| Current combined IME matrix | 14 files, 222/222 passed | -| Full verifier A adversarial oracle | 14/14 passed | -| Focused tracked P2/P3 CJS+ESM regressions | 4/4 passed | -| Broad terminal-pane suite | 201 files, 2,677/2,677 passed | - -The combined matrix covers accepted/settled restarts, stale/duplicate ends, -Korean/Japanese/Chinese reconciliation, won/backtick forwarding, Enter and -deferred newline behavior, blur, disposal, Linux candidates, and Windows -ownership guards. - -## Artifact and lock integrity - -The exact upstream xterm checkout at `53a98a7` compiled with `tsgo`, webpack -CJS, and production esbuild ESM. The installed package reconstructed from the -committed pnpm patch matches the build/package fixture byte-for-byte for the -four artifacts and all modified upstream sources. - -| Artifact | SHA-256 | -| ------------------- | ------------------------------------------------------------------ | -| `lib/xterm.js` | `c624587a60f1ed497255262c8d894d7e83e7345e6477be1167a0531b56aedfe8` | -| `lib/xterm.mjs` | `53e259559fb78c996ad5d3cfd608a8e77285e3d39b4f445719ec2ce4eea1b6e0` | -| `lib/xterm.js.map` | `ecb49132c05a0042b563b2434756a985806cb58f024ceecec698f8cec232f509` | -| `lib/xterm.mjs.map` | `5413dad5ed07bf66a8d382e0e3da1cb3b41578f34a275e1dc5e47cbc4ae0054a` | - -Both maps contain the exact rebuilt `CompositionHelper.ts` sources content -with SHA-256 -`6cffe8b2aeb6d8279d1315c1c26fe7f270370e66ddc5ef43faf5b73e18c337a1`. -All 24 lockfile references use the final raw patch hash. A frozen offline -install passed and selected the matching pnpm virtual-store package. - -## Repository gates - -- Node, CLI, and web typechecks passed. -- Full lint passed, including native and type-aware code-quality, reliability, - max-lines ratchet, localization, and bundled-skill checks. -- Changed-code quality and React Doctor reported zero new findings. -- Changed TypeScript formatting passed. -- Clean-worktree `git diff --check` passed; the generated patch also applies - cleanly and reconstructs exact source and artifacts. -- Electron Vite production build passed with existing chunking and CSS - pseudo-element warnings. -- Frozen offline install and native dependency validation passed. - -## Latest main compatibility - -- Fetched `origin/main`: - `238d3a1ea167396a1b38275846cea0dd5059b04a` -- Conflict-free synthetic merge tree: - `8d3178427df19c4e3b4d96287d66a354106b1f0b` -- Materialized merge frozen-offline install: passed. -- Materialized merge IME matrix: 14 files, 222/222 passed. -- Materialized merge Node, CLI, and web typechecks: passed. - -## Platform, transport, security, and performance audit - -The R2 product changes only the xterm patch, its lock hash, and deterministic -tests. No Orca PTY, SSH, remote-runtime, folder-workspace, git-worktree, -filesystem, provider, IPC, credential, HTML, or network path changed. -Forwarded text still enters xterm's ordered `onData` transport for local, -remote, and SSH terminals. Linux and Windows routing remains unchanged, while -macOS won forwarding retains its existing runtime and modifier gates. - -The new timer slots are constant-space and are cleared on supersession, -callback completion, and disposal. The 256-transaction burst emitted all 256 -Hangul commits exactly once and drained both pending state and the timer set. -No dependency version or graph changed. - -## Bounded gaps - -- The host is Darwin, so the native Linux IBus harness was unavailable. -- No GUI automation, window focus, or system input-source change was used. -- No physical macOS, Linux, Windows, Japanese, Chinese, or Korean IME journey - was run. -- No live SSH or folder-workspace native-IME journey was run; deterministic - transport and ownership suites cover those invariant paths. - -No push, merge, comment, reaction, GUI action, window focus, or input-source -mutation was performed. diff --git a/test-results/pr-11293-11177-integration-r3.md b/test-results/pr-11293-11177-integration-r3.md deleted file mode 100644 index fa884babc..000000000 --- a/test-results/pr-11293-11177-integration-r3.md +++ /dev/null @@ -1,168 +0,0 @@ -# PR #11293 + PR #11177 semantic integration R3 - -## Result - -- R2 evidence HEAD: `6c26dbae39d5c9bd338b6fd3c425a3545d1bf050` -- R2 product: `2f5811d7f6e45c0da925ed4b17f68a558b974497` -- R3 product: `06e3ec2db829b8b5e4cf40f0018fa896ca267c87` -- Integration base: `a9d8be94df2b750c9d363fc8310567dd7e5504cd` -- Preserved contributor commit: - `eb76873ce7b9564b248f7317924e6c49b4001b13` - (`JeongUk Park `) -- Upstream xterm source: `53a98a720ae4a973e384fa2440880d09537132f3` -- Runtime/source-map version: `6.1.0-beta.287` -- Final xterm patch SHA-256: - `936fabb7682c1f7d37b9c7f49f3130c4141b6c32974f202e6f03bafaa42350ba` - -R3 replaces R2's data-equality stale-end heuristic with transaction-owned observable -progress. Each composition records its starting textarea value and selection. An end -belongs to the current transaction only after the transaction has visibly changed that -value or selection, an input/deferred position callback has observed that change, or its -non-empty data matches the current transaction's own non-empty `compositionupdate`. - -An ambiguous end is held in one tracked, callback-owned timer slot. If native -textarea/selection progress lands later in the same task, the end is accepted and -finalized; otherwise it remains stale and the transaction waits for its true end. This -fixes all three R2 correctness failures: - -- a legitimate repeated no-update `가` commit with visible `가` to `가가` progress emits - `가가` with balanced `accepted, settled, accepted, settled`; -- a data-less stale end immediately after restart no longer consumes the new transaction, - and its true `B` emits final `AB`; -- a stale `end('A')` after the restarted `update('B')` but before textarea mutation no - longer emits `AA`; the true end emits final `AB`. - -Immediate restart still settles the old lifecycle before accepting the new transaction, -while retained pending bytes remain available for Korean final-consonant reconciliation. -The Orca composition route does not forward provisional session-end data marked as -pending reconciliation. - -## Parent red and candidate green - -The complete verifier A R2 installed-bundle oracle was read and reproduced against the -R2 product: - -- R2: 20 passed, 6 failed of 26. -- The six expected failures were the repeated no-update false positive, data-less stale - end, and stale end after current update, each in installed CJS and ESM. -- Verifier A's other 20 CJS/ESM controls remained green, including the R1 stale-end - sequence and timer-bound/race cases. - -R3 validation combined verifier A's 26 tests, verifier B's repeated no-update test in CJS -and ESM, and the R1 14-test oracle: - -- R3 verifier/R1 oracle matrix: 42/42 passed. -- Tracked installed CJS/ESM xterm plus Orca route regressions: 27/27 passed. -- Combined focused regression run: 55/55 passed. -- Tracked regression SHA-256: - `ed375b0ccba820a80385ddb2c0104fb3a37dc285cadfce6f1482483d9cdef086`. - -Tracked regressions cover repeated no-update commits with progress before the end and -progress later in the same task, the original data-bearing stale end, the data-less stale -end, current-update-before-textarea stale end, same-data with and without progress, the -four-timer ceiling, timer drainage, disposal, and forced canceled-callback races. - -Verifier B also reported ten trailing-whitespace additions in the R2 patch. The regenerated -R3 patch removes them: `git show --check`, `git diff --check HEAD^ HEAD`, and working-tree -`git diff --check` all pass. - -## IME and terminal validation - -| Gate | Result | -| ----------------------------------------------------- | ----------------------------- | -| Exact #11011 historical suite | 42/42 passed | -| Exact #11177 ten-file historical matrix | 127/127 passed | -| Exact inherited #11052 Enter/newline cases | 49/49 passed | -| Current #11052/route set with R3 reconciliation test | 50/50 passed | -| Current combined IME matrix | 14 files, 233/233 passed | -| Verifier A R2 + verifier B + R1 oracles | 42/42 passed | -| Focused tracked CJS/ESM and route regressions | 27/27 passed | -| Broad terminal-pane suite | 201 files, 2,688/2,688 passed | -| Verifier B R2 native Linux IBus shared local-PTY path | 60/60 exact sequences passed | - -The combined matrix covers accepted/settled immediate restarts, stale and duplicate ends, -Korean final-consonant transfer, Japanese/Chinese ordering, #11052 Enter/deferred newline, -#11177 won/backtick forwarding, blur, disposal, Linux candidates, Windows ownership, and -bounded timer/callback ownership. - -## Artifact and lock integrity - -The exact upstream xterm checkout at `53a98a7` compiled with TypeScript, webpack CJS, and -production esbuild ESM. The committed pnpm patch applies to the matching pristine package; -the reconstructed package, installed package, and synthetic-merge installed package match -byte-for-byte for all modified source and generated artifacts. - -| Artifact | SHA-256 | -| ------------------- | ------------------------------------------------------------------ | -| `lib/xterm.js` | `605f406ca62d58e3bdc4367a53b338a0504ef023d4b67d9ce55a0ebe4ef6e575` | -| `lib/xterm.mjs` | `3073b72926335549c5b8b3549da091035be489c774e08f2b71780b92a00db6dc` | -| `lib/xterm.js.map` | `1e2492bd1fbe8147dd9b6e47c875e4b11478c9f42c5cb24b27b8bb54482d8189` | -| `lib/xterm.mjs.map` | `851ad7e138f5a73a7ae74a404269a9a5cf1fd618c7c13db856f0b345499a09bb` | - -Both maps contain the exact rebuilt `CompositionHelper.ts` sources content with SHA-256 -`a2d5f3252e73c8da40e2fca91281789f8cc98ae16387d679d21b93218b697b4c`. -All 24 lockfile references use the final raw patch hash. Frozen-offline installation -passed for both the R3 product and the latest-main synthetic merge. - -## Repository gates - -- Node, CLI, and web typechecks passed. -- Full lint passed, including native and type-aware code-quality, reliability, - max-lines ratchet, localization, and bundled-skill checks. -- Changed-code quality, changed React Doctor, and changed React Doctor lint reported zero - new findings. -- Changed TypeScript formatting and `git diff --check` passed. -- Electron Vite production build passed with existing chunking and CSS pseudo-element - warnings. -- Exact package/source/artifact reconstruction and frozen-offline install passed. - -The full-repository formatter check was run and reported 20 unrelated pre-existing files, -including documentation, workflows, reliability config, and renderer files untouched by -R3. No unrelated formatting was rewritten; all R3 TypeScript files pass the formatter. - -## Latest main compatibility - -- Fetched `origin/main`: - `ef55429f3d2ce3fbbcc542e4dcc8a6b36e464455` -- Conflict-free synthetic merge tree: - `5613493fa46eaedabcc86c7041bc2369a2031d38` -- Materialized merge frozen-offline install: passed. -- Materialized merge IME matrix: 14 files, 233/233 passed. -- Materialized merge Node, CLI, and web typechecks: passed. -- Materialized merge CJS, ESM, and both maps match the R3 hashes above. - -## Security, performance, platform, and workspace audit - -The dependency graph and versions are unchanged; `pnpm-lock.yaml` changes only the xterm -patch hash references. The production dependency audit reports no known vulnerabilities. -The all-dependency audit was also run and reported five existing development-tool -advisories: one moderate and four high, through `shadcn > postcss` and -`electron-builder > minimatch > brace-expansion`. R3 adds no package and does not alter -those dependency paths. - -R3 changes no PTY, SSH, remote-runtime, folder-workspace, git-worktree, filesystem, -provider, Git command, IPC, credential, HTML, or network path. Forwarded bytes still use -xterm's ordered `onData` transport for local, SSH, and remote terminals. Linux and Windows -routing is unchanged; macOS won forwarding retains the existing runtime/modifier gates. - -Deferred composition work remains constant-space: position, view, end, and finalizer work -each owns at most one tracked slot, superseded callbacks cannot clear newer slots, and all -slots are removed on callback completion, restart, cancellation, blur, or disposal. The -4,096-transaction verifier controls and tracked 256-transaction burst emit exact ordered -bytes and fully drain tracked state. - -## Bounded gaps - -- The host is Darwin, so the native Linux IBus harness was unavailable. -- Verifier B independently ran the exact R2 package on isolated Debian/Xvfb/IBus and - passed 60/60 local-PTY byte sequences; R3 changes only end ownership classification and - retains that transport path. -- No GUI automation, window focus, or system input-source change was used. -- No physical macOS, Linux, Windows, Japanese, Chinese, or Korean IME journey was run. -- No live SSH or folder-workspace native-IME journey was run; deterministic transport and - ownership suites cover those invariant paths. -- The repository-wide formatter and dependency audit retain the unrelated baseline - findings described above. - -No push, merge, comment, reaction, GUI action, window focus, or input-source mutation was -performed. diff --git a/tests/e2e/terminal-multi-workspace-typing-latency.spec.ts b/tests/e2e/terminal-multi-workspace-typing-latency.spec.ts index 49bb13fc4..261d92b76 100644 --- a/tests/e2e/terminal-multi-workspace-typing-latency.spec.ts +++ b/tests/e2e/terminal-multi-workspace-typing-latency.spec.ts @@ -15,7 +15,7 @@ * may legitimately "fail" while the bug reproduces, not CI regression gates). * Entry point: pnpm bench:multi-workspace-typing (see * config/scripts/run-multi-workspace-typing-bench.mjs for knobs). Results are - * written as JSON to tools/benchmarks/results/ for A/B comparison. + * written as JSON to tests/tools/benchmarks/results/ for A/B comparison. */ import type { Page, TestInfo } from '@stablyai/playwright-test' import { type ChildProcess, spawn } from 'node:child_process' diff --git a/tools/benchmarks/cpu-pressure-worker.mjs b/tests/tools/benchmarks/cpu-pressure-worker.mjs similarity index 100% rename from tools/benchmarks/cpu-pressure-worker.mjs rename to tests/tools/benchmarks/cpu-pressure-worker.mjs diff --git a/tools/benchmarks/daemon-coldstart-bench.mjs b/tests/tools/benchmarks/daemon-coldstart-bench.mjs similarity index 98% rename from tools/benchmarks/daemon-coldstart-bench.mjs rename to tests/tools/benchmarks/daemon-coldstart-bench.mjs index 2bea42f49..eebc02a3d 100644 --- a/tools/benchmarks/daemon-coldstart-bench.mjs +++ b/tests/tools/benchmarks/daemon-coldstart-bench.mjs @@ -11,12 +11,12 @@ * (event-loop-stall probe) while pid identity checks run. * * Usage: - * node tools/benchmarks/daemon-coldstart-bench.mjs --label baseline + * node tests/tools/benchmarks/daemon-coldstart-bench.mjs --label baseline * [--iterations 3] [--linger-ms 15000] [--timeout-ms 240000] * [--exe ] * * Prereq (when not using --exe): `pnpm build:electron-vite` so out/ exists. - * Results: tools/benchmarks/results/daemon-coldstart-