Apply redact::redact_jsonl_line at all three serialization sites so
secrets (AWS keys, GitHub PATs, private keys, etc.) are scrubbed
before reaching disk or the network.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Entire-Checkpoint: e23c92750cd9
Cyclic graphs (e.g. consensus_task.dot, semport.dot) loop infinitely
under --dry-run because the mock backend always returns outcome=success,
which never matches conditional edges. Add a configurable max_node_visits
limit (graph attr, default 0=disabled) that defaults to 10 in dry-run
mode, terminating execution when any node is visited more than the limit.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 633b59435252
AgentEvent variants were duplicated in PipelineEvent with `stage: String`
added, requiring a 130-line mechanical bridge to translate between them.
Collapse into a single `PipelineEvent::Agent { stage, event }` variant.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 9e9f00828e4b
The run and serve commands now resolve model aliases (e.g. "claude-haiku"
→ "claude-haiku-4-5-20251001") through the catalog before passing to the
backend, matching the behavior of the ullm CLI.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 2b1f7b77b1ab
- LlmRetry: wrap agent session stream() with llm::retry, emit
AgentEvent::LlmRetry and forward to PipelineEvent::LlmRetry
- failure_class on StageFailed/StageCompleted: "transient" for
retry-eligible failures, "terminal" for final failures, None for success
- ParallelEarlyTermination: emit on fail_fast break with reason,
completed_count, and pending_count
- SubgraphStarted/SubgraphCompleted: boundary events with timing and
step count for sub-pipeline execution
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 82c1bbcbe2f2
The parser used separated_list1 for attr_block which required at least
one attribute inside brackets. DOT files from kilroy use empty brackets
(e.g., `consolidate_dod []`) which caused parse failures. Changed to
separated_list0 to accept empty attribute blocks.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: bccbc8222bde
Makes Haiku discoverable via list_models and get_model_info with
aliases "haiku" and "claude-haiku".
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: ed7df801c2a4
Emit missing progress NDJSON data identified in gap analysis:
- Add attempt/max_attempts fields to StageStarted, StageCompleted, StageRetrying
- Add EdgeSelected event emitted after edge selection with label/condition
- Add LoopRestart event emitted before recursive loop-restart execution
- Simplify backend.rs usage aggregation to use Usage::Add impl
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: f47850c1422d
Embed the full Usage struct (with cache_read_tokens, cache_write_tokens,
reasoning_tokens) in AssistantMessage events instead of bare input/output
token fields. Add skip_serializing_if annotations to keep NDJSON clean.
Extend StageUsage with cache/reasoning aggregation. Track files touched
via write_file/edit_file tool call correlation in the backend bridge.
Update format functions, cost accumulator, and TypeScript types.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 2c15cd247556
Adds observability for skill expansion so CLI users and pipeline event
consumers know when a skill reference was matched and expanded.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: d94221388541
Thread existing data through to pipeline events to match kilroy's
progress.ndjson schema: handler_type on StageStarted, failure_reason on
StageFailed/StageCompleted, notes on StageCompleted, join_policy and
error_policy on ParallelStarted, status (replacing success bool) on
ParallelBranchCompleted, and question_type on InterviewStarted. Adds
Display impls for QuestionType, JoinPolicy, and ErrorPolicy.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 2d4a98c3b5f0
Skills are markdown files with YAML frontmatter that define reusable
prompt templates (e.g., /commit, /review-pr). When a user references
/skill-name in their input, the skill template expands in place with
{{user_input}} receiving the remaining text.
- Add skills.rs with parse, expand, discover, and formatting functions
- Discover skills from ~/.attractor/skills/, <git-root>/.attractor/skills/,
and <git-root>/skills/ (overridable with --skills-dir CLI flag)
- Inject available skills into system prompt between project docs and
user instructions
- Expand skill references in session input before recording user turn
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 2a8ed77f26c5
Use structured handoff-style prompt with explicit sections (Task & Goal,
Completed Work, Current State, Failed Approaches, Open Issues, Next Steps)
instead of generic summarizer prompt, improving context preservation across
compaction boundaries.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 2a12087def60
Decorator that tracks which files the agent has read (via read_file or
grep) and returns an error when writing to an existing file that hasn't
been read first. Prevents the model from hallucinating file contents and
blindly overwriting working code. New files are always allowed.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: a565c5a5e2f9
Layered library for blob/tree/commit/ref operations without touching
the working directory. Four modules: gitobj (primitives), branchstore
(key-value on a branch), snapshot (working dir captures), trailerlink
(commit message trailers). 56 tests.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 1e40b3267885
When context usage exceeds the configurable threshold (default 80%), older
turns are summarized via a non-streaming LLM call and replaced with a single
System turn. Compaction is non-fatal — errors are emitted as AgentEvent::Error
and the session continues.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 18435f31db91
Restructures agent events from misaligned EventKind+EventData pair into flat
AgentEvent enum, enriches AssistantMessage with model/token/tool_call data,
adds 8 new PipelineEvent variants (Prompt, AssistantMessage, ToolCallStarted,
ToolCallCompleted, SessionError, ContextWindowWarning, LoopDetected,
TurnLimitReached), and forwards agent session events to the pipeline emitter
in AgentBackend so they appear in progress.ndjson.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Entire-Checkpoint: d59f9e69008a
Logs from `attractor run` were cluttering project directories. Now defaults
to ~/.attractor/logs/attractor-run-TIMESTAMP instead of ./attractor-run-TIMESTAMP.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Every PipelineEvent is now logged as a JSON envelope with timestamp,
run_id, and event fields — matching the Kilroy reference implementation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
LLM API calls should not have HTTP-level request or stream-read timeouts.
These are better controlled at the application level via TimeoutConfig
(total/per_step). The connect timeout is increased from 10s to 30s since
network conditions vary.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Removed the workspace-level clippy lint config that enabled all, pedantic, nursery,
and cargo lint groups. Removed all #[allow(clippy::...)] annotations that were only
needed to suppress those extra lints, and fixed the few default clippy warnings that
were uncovered.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The previous approach scanned LLM response text for JSON containing
routing fields (extract_status_fields), which was fragile and violated
the spec's abstraction boundary. Replace with two clean mechanisms:
- Backend registers a report_outcome tool that the LLM calls to declare
routing decisions (status, preferred_next_label, context_updates, etc.)
- Handler auto-generates a routing preamble listing available edge labels,
appended to the prompt only when 2+ labeled unconditional edges exist
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Downstream nodes in multi-model pipelines reference response.<node_id>
context keys in their prompts. The codergen handler was only storing
last_response (truncated) and last_stage, so these references resolved
to nothing.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Surface LLM token consumption and dollar cost at every verbosity level:
default mode appends per-stage tokens/cost, verbose modes include it in
event summary/detail, and the Pipeline Result section shows a total.
Cost is computed from the catalog pricing for Anthropic models; providers
without pricing (OpenAI, Gemini) show token counts only. Dry runs with
zero tokens omit the cost line entirely.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Use `status: "incomplete"` instead of `is_error` for OpenAI tool results (fixes rejection)
- Add merge_provider_options to forward unknown anthropic provider options to API body
- Derive Clone on Client to enable subagent session factory
- Enable error_recovery scenario for all providers now that OpenAI is fixed
- Improve subagent_spawn test to actually exercise spawn/wait/read workflow
- Adjust multi-turn cache test temperature to 0.5
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Test 1 (llm crate): Multi-turn cache verification runs 6 conversation turns
with a large system prompt (~5460 tokens) and verifies cache_read_tokens on
the final turn. Anthropic threshold 0.5, OpenAI/Gemini 0.0 (automatic
caching not guaranteed).
Test 2 (agent crate): Cross-provider parity matrix with 15 scenarios
(file CRUD, shell, grep/glob, editing, steering, reasoning effort, loop
detection, error recovery, etc.) across Anthropic, OpenAI, and Gemini.
41 total tests. Some scenarios excluded for OpenAI due to gpt-4o-mini
limitations (no reasoning.effort, is_error rejection, weak editing).
Test 3 (attractor crate): E2E pipeline with real LLM using AgentBackend,
AutoApproveInterviewer, and default_registry. Verifies pipeline success,
artifact files, goal gate outcomes, and checkpoint state.
All tests are #[ignore] and require API keys to run.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Show per-stage completion/failure timing and total pipeline duration
in the result block, even without -v flag. Uses a new
format_duration_human helper for human-readable durations (ms/s/m s).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Thread CancellationToken into tool executors and exec_command so that
running processes are killed (SIGTERM -> 2s -> SIGKILL) when abort fires,
rather than only checking the flag between LLM calls. Key changes:
- ToolExecutor type gains CancellationToken parameter
- ExecutionEnvironment::exec_command gains cancel_token param
- LocalExecutionEnvironment uses tokio::select! (completion vs timeout
vs cancellation) with extracted sigterm_then_kill helper
- DockerExecutionEnvironment uses same select! pattern
- Session replaces Arc<AtomicBool> with CancellationToken, passes
child_token() per tool call
- Shell tool forwards cancel token to exec_command
- CLI SIGINT handler calls cancel_token.cancel()
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Interactive TTY sessions now use dialoguer widgets (Select, MultiSelect,
Confirm, Input) instead of raw eprintln/read_line. Non-TTY input falls
back to the existing line-based reader. Suppresses redundant "Stage
started" inform message for wait.human nodes since the prompt itself
serves as notification.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Stylesheet: add bare-word Shape selector (specificity between Universal and Class)
- LLM: apply per_step timeout to connection and total timeout to stream (Section 4.7)
- Interviewer: add MultiSelect question type alongside MultipleChoice
- Session: move SessionStart/SessionEnd to initialize()/close(), deduplicate close logic
- Engine: return Ok(fail outcome) instead of error when goal gate unsatisfied with no retry_target
- Docker: mark Docker-dependent tests with #[ignore]
- Validation: add extensive unit test coverage for all rule types
- Integration: update tests to match engine/fidelity changes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Prevents tests from loading .env and making real API calls without
manipulating environment state.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Drop event_tx from ManagedPipeline when pipeline completes/cancels/fails so
SSE streams end promptly instead of blocking until timeout (3.5s → 0.02s)
- Switch reqwest from native-tls to rustls-tls to avoid 500ms macOS cert store
load per process (0.67s → 0.005s per OpenAI adapter test)
- Replace hardcoded sleep(500ms)/sleep(200ms)/sleep(100ms) in server and
integration tests with 10ms poll loops (0.2-0.5s → 0.02-0.03s each)
- Add env_clear() to ullm prompt tests to prevent .env from triggering real
Anthropic API calls (0.45s → 0.15s)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add status, preferred_label, and suggested_next_ids fields to the
StageCompleted event so pipeline flow decisions are visible in CLI
output and the web UI, making it easier to debug why a pipeline
took a particular path.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ParallelHandler and SubPipelineHandler needed Arc<HandlerRegistry> at
construction time but also lived inside the registry, creating a circular
dependency. The previous fix special-cased ParallelHandler as a separate
field on PipelineEngine with a resolve_handler() override.
Instead, add an EngineServices struct (registry + emitter) passed through
Handler::execute(). ParallelHandler and SubPipelineHandler become unit
structs that get what they need at execution time. No special-casing,
both register normally in default_registry() like every other handler.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The test criteria incorrectly said FAIL outcomes should be retried.
The pseudocode (Section 3.5) and the C reference implementation both
return immediately on FAIL. Only RETRY status triggers the retry loop.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The spec says "exactly one" exit node in the shape table (line 184),
exit handler docs (line 648), and test criteria (line 1834). The lint
rule table (line 1437) says "at least one" but is the minority. The
previous commit incorrectly reverted this — the terminal node change
was not causing the test failures (all three were from retry-on-Fail).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Revert two incorrect behavioral changes introduced in ceaa9bf:
1. StageStatus::Fail must return immediately, not retry. Fail is a
deliberate routing outcome (e.g. to take a "fail" edge). Retrying it
caused conditional_branching and manager_loop tests to hang.
2. Pipelines can legitimately have multiple terminal nodes. The
"exactly one" constraint broke branching_loop_back_on_failure.
Restore "at least one" validation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The parallel handler was never registered in default_registry() due to a
circular dependency (ParallelHandler::new needs Arc<HandlerRegistry>).
Break the cycle by storing ParallelHandler as a separate field on
PipelineEngine, created after Arc-wrapping the registry and emitter.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Break out of streaming loop on abort and drop the stream before emitting
SessionEnd to properly cancel the HTTP connection
- Emit ToolCallOutputDelta events for tool call results in both sequential
and parallel execution paths
- Retry on StageStatus::Fail in addition to Retry in pipeline engine
- Set preferred_label on WaitHumanHandler choice outcomes
- Enforce exactly one terminal node in pipeline validation
- Downgrade unreachable node diagnostic from Error to Warning
- Update context window test to match 1M token limit
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Strip the CWD prefix from string arguments in format_tool_args so tool
call output shows relative paths instead of absolute ones.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The Anthropic streaming API sends thinking block signatures via a
signature_delta event, not in content_block_start or content_block_stop.
The parser was ignoring this event type, falling back to the empty
placeholder signature from content_block_start, causing "Invalid
signature in thinking block" errors on multi-turn conversations.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
