Bump Petri to the commit that reports `pebble.usage_by_model`, the root
session's usage by the route that spent it, and add an end-to-end test:
an agent stage on a scripted model whose primary answers once and then
fails mid-prompt keeps every token Petri reported, and files the
primary's share and the fallback's share under their own models.
Only Petri moves; Pebble and sandbox-driver stay at their locked
revisions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A run whose sandbox cleanup fails is kept for a retry, and only an explicit
force deletes it without its sandboxes. Say so in the 409 so a caller with a
run stuck behind an unavailable provider knows how to proceed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A finished agent stage replaced its live usage, which included every
subagent session, with the parent session's usage alone, so completed
stage and run totals dropped descendant tokens and spend. The subagent
accounts were also read as an array, while Petri reports them as an
object keyed by session id, so no per-model rows were ever built.
The completed stage now totals the parent's usage and each descendant
account once, and builds per-model rows for the parent and every
descendant. The parent's usage goes under the routes Petri reports in
`pebble.usage_by_model` when present (lithoscomputer/petri#110), and
under the stage's model until then.
Fixes#933
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Move Petri to current main, which picks up streamed stdin for Daytona
from sandbox-driver, reports how an ACP agent exited, extracts
checkouts as the sandbox user, and bumps lithos-llm and Pebble. Move
graphviz-sys to its latest commit (CI and README only). The Windows
crates return to main's newer versions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Move sandbox-driver to the commit that streams stdin into Daytona
commands, and the Daytona SDK to the fix for stdout/stderr markers that
leaked into the session log stream. Together they let an ACP agent start
on Daytona and keep its JSON-RPC output intact. The agents docs no longer
say ACP fails on Daytona.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
FabroHooks always declares required run finalization instead of only
when the run publishes or checkpoints. Every run takes one path, the
best-effort diff branch in run_finished goes away, and a fork always
declares what its worker's hooks will declare on resume, so the fork no
longer carries its source's flag across.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ManagedRun::settle owns the rule that a run's first terminal status
sticks, and the lifecycle fold, the finish settle, fail_managed_run and
the in-process finish all go through it. One release_managed_run
replaces the two helpers that released a run's live state and also
frees its scheduler slot. The engine reads the finish through the
projection's finished_status, so a cancelled finish carrying a
checkpoint failure, and a failed publication, are mapped in one place.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A failed checkpoint cancels the run, so Petri recorded it as cancelled
and the worker overrode its own outcome in memory. Runs that checkpoint
now declare required finalization, and finalize_run rejects with
checkpoint_failed before publishing. The projection and the engine
outcome report a cancelled finish carrying that failure as a workflow
failure with the checkpoint's message, and the in-memory override is
gone. A run whose checkpoint failed is never published.
Retry a host failure that storage rejects with a short backoff, so a
brief storage fault does not leave the run active and holding its
scheduler slot. A failure that never commits still leaves the run's
status alone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Share the managed-run cleanup between persist_run_failure and
fail_managed_run, return the committed projection from
commit_host_failure, and keep the run's status when the failure cannot
be stored. Restore the cancelled-launch message and keep the spawn
error's cause in the launch failure.
Rebuild Cargo.lock from main with only the Petri bump so the Windows
crates stay on their newer versions. Import the projection module
rather than the function, wrap long tracing calls, and document the
finalization test fixture.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Name the publish failure once, settle host failures through one flat
helper, share the append-then-finish path for in-process runs, reuse
the source state already read when checking a fork, and drop the
unused finished-run status shim.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Track Petri main now that required run finalization has merged there,
read workflow execution from the engine state, resume the failed-publication
regression with its admitted workflow, and keep the worker lifecycle helper
usable for rejected appends.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
