Route subprocess worker stderr directly into server tracing and remove
the scratch-file sink. Update the run-directory docs to reflect that
runtime now only documents blob materialization here.
Guard server worker cleanup against superseded subprocesses so rewind and
resume flows do not append a synthetic failure from an older worker. Update
CLI snapshots for the current interview events and give the shared test
session lock more time to cover daemon startup and shutdown.
Collapse the live answer rendezvous into ControlInterviewer, move pending
question storage onto a shared typed record, and route HTTP and Slack answer
submission through one server-side flow.
Persist pending interviews in run state, deliver accepted answers to workers
through the server-owned control path, and remove the old scratch-file and
WebInterviewer transports.
This also moves Slack onto the canonical server answer flow, adds richer
question metadata to the API and run events, and covers the subprocess
question lifecycle with end-to-end tests.
Reapply the lint-safe changes that were partially displaced while merging
origin/main, including the billing serialization assertion and the attach
replay/server annotation cleanups. This keeps the merged main branch back to a
clean full-workspace clippy pass before the store-dump debugging continues.
Tighten the worker upload path so object-backed runs only fail when an
artifact upload is actually attempted without a token, and update CLI
snapshots for the new artifact storage metadata.
Fold in the workspace test and clippy fixes needed to verify the final
artifact upload implementation cleanly across Rust and web targets.
Add scoped worker upload tokens and HTTP artifact upload clients.
Support manifest-first multipart stage artifact uploads with validation and checksums.
Gate artifact reads by run capability while preserving legacy scratch fallback.
Active runs deleted through rm --force were removed from server state
without signalling the worker process, which could leave detached
workers orphaned after test cleanup. Terminate the tracked worker
process group before deleting run state and cover it with an
integration regression.
Replace the overlapping usage and cost model with canonical billing
primitives centered on ModelRef, ModelHandle, TokenCounts, and
BilledModelUsage. This also renames the public API and web surface from
usage to billing, removes compatibility aliases, and normalizes provider
usage adapters onto the shared billing vocabulary.
Move detached workers onto an HTTP-backed runtime store so the server
remains the only SlateDB owner. This replaces the worker's seeded local
RunDatabase with a canonical server-backed handle for state, events, and
blobs, and updates workflow runtime plumbing to use that abstraction.
Replay persisted run events for attach requests, keep the SSE stream live
only while the run is active, and close on terminal run events instead of
returning 410 for completed runs.
The CLI now treats premature attach EOF as an error, and the affected
integration tests were stabilized around store-backed event ordering and
recovered rewind timelines.
Persist server, client, and subject provenance on run creation so
run state and inspect output can show which Fabro version created a
run, which first-party client submitted it, and how the request was
authenticated.
Default test daemons now opt into an in-memory object store and test
helpers carry explicit run ids instead of rediscovering runs from
shared state.
This also disables the disk-backed store dump integration tests until
store dump is routed through the server's live store handles.
Remove GET /workflows, GET /workflows/{name}, GET /workflows/{name}/runs,
and POST /runs/{id}/steer from the OpenAPI spec, server routes, demo
fixtures, pagination tests, docs navigation, and generated TS client.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Move subprocess workers fully behind the server-owned run store by
switching worker/server coordination to HTTP-backed run events and
control state. Reconcile stale in-flight runs on boot, terminate live
workers during shutdown, and update process titles to reflect server and
worker lifecycle phases.
These endpoints had zero CLI callers and served only the web UI demo.
Verification and retros were `not_implemented` stubs in real mode;
sessions had an in-memory implementation but no CLI usage. Removing
them shrinks the API surface and eliminates ~9,000 lines of dead code.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Dead feature cleanup: `skill install` was hidden/experimental and never
graduated; the run verification endpoint was only implemented in demo mode.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Increase the artifact scenario timeout so the retry fixture still forces one timeout without spuriously creating a third retry under full-workspace nextest load. Also import the generated ServerSettings type directly so workspace clippy stays clean.
default_settings_path() and active_settings_path() always return a
value (Home::from_env() never fails), so unwrap_or_else fallbacks to
".fabro/settings.toml" were dead code. Change both functions to return
PathBuf instead of Option<PathBuf> and remove the unreachable branches
in server_client, serve, and user config.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Default `fabro settings` now resolves effective runtime settings against the
selected server, while `--local` preserves local-only inspection. This also
extracts shared settings resolution logic so CLI output, manifest preparation,
and the `/api/v1/settings` contract stay aligned.
Keep local server targeting based on explicit server targets instead of
implicitly deriving a socket from storage_dir. This makes ~/.fabro/fabro.sock
the default local socket again, keeps storage under ~/.fabro/storage, threads
FABRO_CONFIG through server autostart paths, and updates the CLI test harness
for the new split.
- centralize FABRO_HOME and storage path resolution in fabro-config
- rename store types, extract ArtifactStore, and simplify run key layout
- switch run scratch to scratch/, remove RuntimeState, and refresh docs/clients
Consolidate CLI and server machine defaults under settings.toml,
including loader renames, writer preservation fixes, same-machine
manifest handling, and docs/test updates for the new config model.
Resolve the fabro-server merge conflicts by keeping the settings-aware test
app-state helper from origin/main while preserving the secret-store-aware
AppState construction added locally.
Move secret storage, diagnostics, and repo/provider validation behind the
server API so credentials live under the server storage dir and take effect
immediately without process env mutation.
This also removes the old .env runtime path, rewires doctor/install/secret/
provider login/repo init around the server contract, and regenerates the
TypeScript client for the new endpoints.
Server scenario tests were inheriting the default local sandbox
worktree mode, which meant they created git worktrees and branches
before stage execution. Under suite load that setup intermittently
stalled the run long enough for the scenario polling windows to fail.
Disable worktrees in the shared server test settings and let lifecycle
scenarios use the same test-only settings through a settings-aware
registry factory helper.
Move integration tests from monolithic api.rs into api/ (single-endpoint
contract tests) and scenario/ (multi-API-step flows), mirroring the CLI's
cmd/ vs scenario/ pattern. Move 3 scheduler-dependent unit tests from
server.rs into it/scenario/ where they get the correct nextest timeout
(kind=test override). Deduplicate shared helpers into helpers.rs.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove redundant config_change_after_submission test (1.67s avg) from
fabro-server — already covered by start_run_persists_full_settings_snapshot
and architectural guarantees. Defer reqwest::Client init past validation
in web_search tool so missing-key/missing-query tests skip macOS proxy
discovery (1.56s → 9ms). Move telemetry panic event tests to a CLI IT
via a new cfg(debug_assertions) __test_panic subcommand. Lower default
nextest SLOW threshold from 3s to 1.5s with 2x headroom over the new
worst-case (0.84s).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Persist a cancelled terminal record when a live run is interrupted by the
server-side cancel signal, and abort pending web interview questions so
human-gated runs can unwind instead of hanging in a non-terminal durable
state.
Also align server tests with the current succeeded status contract and poll
aggregate usage until the in-memory accumulator converges with the store-
backed run status.
Keep durable run summaries aligned with in-memory cancellation state,
including runs cancelled before startup completes, and update server
coverage to assert the durable cancelled reason.
