You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(orchestration): native chats get each orchestration message whole instead of a check pointer - #28567
Worker reports previously reached native chats as a mailbox-check notice. This change puts each report into the chat's ordinary durable message queue, attributed to its sender, with a 4,000-character excerpt and orca orchestration inbox --id for the full text. Reports wait while the chat is working or waiting for a person's answer, then run one per full turn in order.
Stop keeps reports that were already waiting paused until the person sends or uses Resume. A provably new report after Stop can wake the chat while the person's paused messages stay paused. Reports whose saved order around Stop is unknown stay held. Existing queue Edit, Delete, Move, Send and Resume controls apply to report cards.
Durable queue creation marks the source report delivered. Inbox read/check acknowledgement remains separate, and later card edits, deletion or turn failure do not offer the source report again. This is rebuilt directly on main and has no dependency on the closed#32108.
Current head: 39a039ba3101d90a8aad764467a548a3287d6fe5. The normal commit hook passed, and targeted production-path and mounted-consumer tests passed. Independent source, reference and accounting qualification is in progress. Some ACP/runtime tests could not collect locally because fflate is missing; their execution must be confirmed in CI. Targeted real Claude and Codex runs have not started. This PR is not ready to merge.
The work is tracked in STA-8718. The single review status comment retains historical screenshots and will receive the current-head verification evidence.
…ing turn
A native-chat coordinator's mail notice always queued as a card until the whole turn ended, so a
coordinator busy in a long command never saw its workers' reports. Agents that take a message
mid-turn (Claude, Codex, Pi) now get the notice at once; agents that would cancel their turn for
it (ACP) still queue it.
… instead of a check pointer
Each mail message is sent to a native-chat agent as its own chat message,
with the sender, type, subject, body, payload and exact reply command, and
is marked read once the chat accepts it. Heartbeats are marked read, never
sent. Mail an unacknowledged check batch holds stays with that batch.
Worker reports now use the native chat's ordinary durable queue, with their own content and sender attribution. Busy chats and pending questions hold reports until the current turn completes; each report then gets its own turn. Stop keeps waiting reports paused, while provably fresh reports can wake the chat without releasing the person's paused messages. Unknown saved order stays held until Send or Resume.
Not ready to merge. Frozen head 39a039ba3101d90a8aad764467a548a3287d6fe5 is committed and non-force-pushed, and the PR now targets main with no dependency on the closed #32108. The normal hook passed and 49 post-repair tests passed; earlier overlapping test runs are not added to that count. Three fresh source/reference reviewers are running. Final accounting, CI execution of locally uncollected ACP/runtime targets, and targeted real Claude/Codex flows remain unqualified.
The current-head real runs will cover busy delivery, answered questions with ordered separate report turns, Stop and restart, fresh reports without personal-queue release, and existing Resume including a report-only backlog. No current-head QA pass or readiness marker is claimed.
The screenshots and outcomes below are historical evidence from the earlier implementation, including its recorded failure. They do not qualify the rebuilt delivery/Stop flows.
Earlier review and historical screenshots
Native chats currently receive a notice asking the agent to check its mailbox. This PR puts each worker report into the conversation as a separate attributed message, with a 4,000-character excerpt and an exact-message command for the full text. Real Grok QA found that sending reports into a running turn can cancel the person's answer and lose a report. The approved revision holds mail while any agent is working or waiting for the person, then starts one report turn at a time, oldest first. Terminal delivery stays unchanged.
Current review on fe6c675fbed87b2742bf6257627a02d141cf3fcd: blocked; not ready to merge. Two review rounds of the revised timing design are complete, after six source-review rounds of the earlier design. The independent test-only repair is committed and pushed; shared source repairs remain pending. Independent correctness, architecture and readiness/performance reviews and the three-seat architecture ruling are complete. The ruling keeps mailbox-owned pending delivery because other consumers can explicitly read and acknowledge the same mail; putting another executable copy into the chat's editable queue would change ownership and show reports before the required idle point.
The review found these remaining repairs and integration checks:
Pressing Stop can release a report that was already waiting, restart the agent and unpause the person's queued follow-up. Protecting that pause also requires a reliable release wake when the person later uses Resume. Following the existing Stop ruling, reports already held or owed at Stop remain stopped until the person sends or resumes; fresh reports follow ordinary idle-send behavior. Automatic mail must preserve the person’s own queue pause. This is settled, not a new product decision.
Busy worker history updates repeatedly rebuild the chat's history before discovering that new mail must wait. Remove that recurring work or establish the required operation-count performance contract while preserving settlement of an already-issued report.
The obsolete steering test is repaired: two reports remain invisible during personal work, then each gets its own completed attributed turn in order. The targeted test passes and the named coordinator file now has 23 passes and one failure. The unchanged failure is the ambiguous failed-start recovery interaction to reconcile with fix: recover orchestration mail after interrupted chats #32108; the working hold was preserved. Ordering across the chat's direct, Run and Dispatch mailboxes also needs the composed contract; sorting within one mailbox does not prove that result.
This round changed only the coordinator integration test (+84/−41); no production source changed. An independent Codex reviewer agreed with the whole-flow contract and its size. The normal commit hook passed, the non-force push is verified, and the worktree is clean. No main synchronization or QA launch occurred. Shared eligibility, consuming-turn recovery and outstanding-delivery repair remain with #32108, which is still open. Production work at that boundary waits for its handoff. The plan now records the repair contracts and an estimate of 100–150 additional production lines, with 120–180 changed test lines; the estimate will be checked against the landed interface before the shared repairs. The independent slice has updated the obsolete busy-turn test without changing recovery code.
Verification limits: the named real-host coordinator test used the scripted protocol fixture; its tested/reviewed patch exactly matches this commit. The file still has the known recovery failure. This is not real-agent QA. The older green full workflow and real-agent screenshots below are historical. Only the housekeeping workflow is registered on this head; full PR Checks, final mergeability/conflict verification, the final main synchronization, and real Codex/Grok/Claude QA on the resulting head remain required. No completion marker is claimed.
For Brennan's review: final-head main-versus-branch screenshots remain outstanding. The historical comparison and the Grok failure are preserved below. The three places where behavior depends on the admission and release contract are mail admission, idle release, and the person's Stop pause.
Historical QA only; these images do not prove the current timing revision:
QA on head 021e26d (M4Air, real signed-in Codex and Grok): FAIL, needs a fix before this can merge.
Flow
Result
Screenshot
Busy Codex chat gets the report as its own message
PASS
Busy Grok chat gets the report as its own message
PASS
Reports held while Grok's question waits
PASS
Reports after the question is answered
FAIL
Long report shortened; full text by message id; older-CLI guidance
PASS
Clicking the sender opens the sender
PASS
Main for comparison: old "check your mailbox" notice
as expected
The failure: Grok can't take a message while a turn runs, so Orca cancels the turn to send one. Held reports are released the moment the person answers, and each report is now its own send, so the second report cancels the first before Grok sees it. Grok's saved history has no trace of report A while Orca marks it read and delivered. On main the single notice gets both reports read. Separately, the first report also cancels the turn that carries the answer, so Grok re-asks its question; that also happens on main (main evidence). The fix is being decided; QA reruns after it. Final main sync, its CI and the completion marker also remain.
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
The PR changes structured orchestration mail from pointer notices to individually formatted messages sent through the agent-session queue. It adds journal mail boundaries and source metadata to control eligibility across Stop, Resume, and queue operations. Mail creation receipts support recovery after restarts and uncertain outcomes. The inbox RPC and CLI gain exact message-ID lookup. Tests cover delivery, queue behavior, sender lookup, database query work, and runtime recovery.
Priority: Normal
Merge Risk: Moderate · up to 39a03
The change delivers orchestration reports as ordinary queued messages. Before merging, fix the failing CI gates and the broken status-sink test, and fix the delivery loop so older reports are not overtaken and a superseded report does not abort the batch. Also check that Stop works when the mail database has not been opened yet.
Pre-merge checks: 3 · 1
Failed checks: 1 warning
Check name
Status
Explanation
Resolution
Description check
The description explains the behavior and current validation status, but it does not follow the required template. It omits the required linked-issue format, visual-proof status, checklist sections, A…
Update the description to include every required template section. Add an actual issue reference such as Fixes #<issue>, provide before-and-after visual proof or state N/A with a reason, complete the Testing checklist, add AI Disclosure…
Passed checks: 3 passed
Check name
Status
Explanation
Title check
The title clearly and concisely describes the primary change: native chats receive complete orchestration messages instead of check pointers.
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Description check
Explanation
The description explains the behavior and current validation status, but it does not follow the required template. It omits the required linked-issue format, visual-proof status, checklist sections, AI disclosure, review notes, and explicit testing checklist entries.
Resolution
Update the description to include every required template section. Add an actual issue reference such as Fixes #<issue>, provide before-and-after visual proof or state N/A with a reason, complete the Testing checklist, add AI Disclosure when applicable, complete Review, Agent skill upstream boundary, Notes, and Checklist sections, and retain the stated CI and readiness limitations.
Finishing Touches: 💡 1
🛠️ Fix failing CI checks: 💡
Commit to this branch
Create a new PR
📝 Generate docstrings
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
…28540's hold
Each orchestration message still reaches a native chat as its own message, now through the
merged plain send for every agent and its admission hold: a message held for a waiting prompt
stops the pass so later mail cannot overtake it, and the mailbox is parked before the first
read. Heartbeats are skipped in this lane only and stay unread. A mailbox with an unacknowledged
check batch waits for its ack, as on main. Chat text is capped at 4,000 characters with the
command that shows the whole message.
GLOBAL_FLAGS is probably the source of --json, so the flag stays valid. The handler still reads json and prints JSON output. The usage string no longer lists it, and the other specs do. Users cannot find the flag in help output.
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.
A mail send admitted into a running turn cancels that turn for agents that
cannot take a message mid-turn (ACP: Grok, OpenCode, OMP, Antigravity): the
second of two reports cancelled the first before the agent saw it, and the
first report cut off the turn carrying the person's answer. Mail now waits
while the chat is working or a prompt waits on the person, for every agent,
and goes out at the idle edge, one message per turn, oldest first.
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.
The reason will be displayed to describe this comment to others. Learn more.
Minor · Functional Correctness · Quick win
Supported by static analysis
Script executed:
sed -n '2070,2140p' config/reliability-gates.jsonc
rg -n 'crashed immutable cohort|expiry of an uncertain original' src config | head
Repository: stablyai/orca
Length of output: 8238
Script executed:
# Locate the checker and every place it reads the gate "assertions" field.
rg --files -g 'check-reliability-gates.mjs'||test"$?" -eq 1
rg -n -F -e 'assertions' -e 'structured-send-at-most-once' -- scripts config/scripts 2>/dev/null ||test"$?" -eq 1
forfin$(rg --files -g 'check-reliability-gates.mjs'2>/dev/null);doecho"== $f"
rg -n -e 'assertion' -e 'readFileSync' -e 'includes\(' -e 'test\(' -- "$f"||test"$?" -eq 1
done
Repository: stablyai/orca
Length of output: 9226
Replace the stale assertion references in the reliability gate.
agent-session.structured-send-at-most-once maps two assertion names to src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts. Neither name appears under src/, so the mapped file does not contain them. The manifest therefore records recovery coverage that the referenced file does not provide. Replace these references with the current test that covers this behavior, or record the coverage gap. The manifest checker validates that each reference names a listed test file and has a non-empty assertion array. It does not check that the assertion names exist in that file, so this mismatch passes validation.
The reason will be displayed to describe this comment to others. Learn more.
Major · Maintainability & Code Quality · Quick win
Replace Date.now() with fixed timestamps to pass the flaky-test gate.
The test-no-wall-clock ast-grep gate reports 4 findings in this file, and its baseline allows 0. The 4 findings are the Date.now() calls on Line 102, Line 103, Line 157 and Line 210. The static analysis and typecheck job fails until they are removed. These turn items only need stable, ordered timestamps, so fixed values are enough.
The reason will be displayed to describe this comment to others. Learn more.
Major · Functional Correctness · Quick win
Supported by static analysis
Script executed:
rg -n 'MailLineageScope' src | head
sed -n '1,100p' src/main/runtime/orca-runtime-structured-status-sink-wiring.test.ts
sed -n '1,40p' src/main/native-chat/agent-session-journal/journal-mail-holds.ts
sed -n '265,295p' src/main/runtime/workspaces/workspace-process-listing.ts
Repository: stablyai/orca
Length of output: 6342
Script executed:
rg -n -F -- 'captureSessionMail' src/main/runtime/orca-runtime.ts src/main/runtime/workspaces/workspace-process-listing.ts src/main/native-chat/agent-session-journal/journal-mail-holds.ts src/main/runtime/orca-runtime-structured-status-sink-wiring.test.ts
sed -n '45,75p' src/main/runtime/orca-runtime-structured-status-sink-wiring.test.ts
sed -n '270,290p' src/main/runtime/workspaces/workspace-process-listing.ts
Repository: stablyai/orca
Length of output: 3014
Update this test to the zero-argument captureSessionMail contract.
MailLineageScope is not exported, so the test fails typecheck. The installed callback ignores all supplied arguments and calls this.captureSessionMail() without arguments, so the current forwarding assertions fail when the test runs.
The reason will be displayed to describe this comment to others. Learn more.
Minor · Stability & Availability · Quick win
Supported by static analysis
Script executed:
sed -n '169,300p' src/main/runtime/orchestration/structured-mailbox-pointer-delivery.ts
sed -n '45,85p' src/main/runtime/orchestration/structured-mailbox-pointer-host.ts
rg -n 'beforeRun|beforeInsert' src/main/native-chat src/main/runtime/orchestration --glob '!*.test.ts'
Repository: stablyai/orca
Length of output: 7313
Script executed:
set -o pipefail
printf'%s\n''--- relevant declarations and callers ---'
rg -n -F --glob '*.ts' -e 'function sendAgentTurn' -e 'const sendAgentTurn' -e 'maybeQueueStructuredAgentSessionSend' -e 'deliverForHandle' -e 'ordinary mail creation failed' -e 'delete.*recovery' -e 'recovery' src/main/runtime/orchestration src/main/native-chat
printf'%s\n''--- send-agent-turn ---'
sed -n '1,220p' src/main/runtime/orchestration/send-agent-turn.ts
printf'%s\n''--- queued message path ---'
sed -n '80,210p' src/main/native-chat/agent-session-journal/journal-queued-messages.ts
sed -n '90,210p' src/main/native-chat/agent-session-wire/structured-agent-session-queued-messages.ts
printf'%s\n''--- delivery owner ---'
sed -n '1,180p' src/main/runtime/orchestration/structured-mailbox-pointer-delivery.ts
Repository: stablyai/orca
Length of output: 42765
Script executed:
printf'%s\n''--- delivery control flow ---'
nl -ba src/main/runtime/orchestration/structured-mailbox-pointer-delivery.ts | sed -n '55,115p;235,315p'printf'%s\n''--- sendStructuredSessionTurn ---'
nl -ba src/main/runtime/orchestration/send-agent-turn.ts | sed -n '125,185p'printf'%s\n''--- queue admission ---'
nl -ba src/main/native-chat/agent-session-wire/structured-agent-session-queued-messages.ts | sed -n '100,180p'printf'%s\n''--- journal insertion ---'
nl -ba src/main/native-chat/agent-session-journal/journal-queued-messages.ts | sed -n '90,145p'
Repository: stablyai/orca
Length of output: 12987
Handle source creation superseded per message.
beforeRun can throw after a batch selects a message. The exception propagates through host.send, rejects deliver, and skips the remaining messages in the current batch. The outer handler logs ordinary mail creation failed and clears the mailbox recovery marker. The skipped messages can remain undelivered until a later trigger or coalesced retry.
Catch a dedicated error for message-level supersession around host.send, then continue the loop. Keep a separate cancellation path for !current(): do not continue with a stale target. Re-throw all other errors.
#!/bin/bashset -eu
printf'%s\n''--- host send block ---'
nl -ba src/main/runtime/orchestration/structured-mailbox-pointer-host.ts | sed -n '1,95p'printf'%s\n''--- capacity test ---'
nl -ba src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts | sed -n '1,110p'
Repository: stablyai/orca
Length of output: 9008
Stop delivery after the first declined report.
JournalQueuedMessages appends accepted cards in position order. If an older report returns held, the loop currently attempts newer reports. A newer report can then enter the queue before the older report, which breaks oldest-first delivery.
🐛 Suggested fix
--- "a/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.ts"+++ "b/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.ts"@@ -286,13 +286,16 @@
if (!current()) {
return
}
if (
outcome.kind === 'queued' ||
this.deps.host.readCreation(operationId, target.sessionId) === 'accepted'
) {
db.markAsDelivered([message.id], mailbox)
+ continue
}
+ // Preserve oldest-first: a newer report must not overtake a declined one.+ return
}
}
}
}
Update the capacity test so that it expects delivery to stop after the first held result.
// What a rewind's recovery does: the journal is rebuilt, and no send is on record any more.
// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the host keeps its conversations private; this is the one journal call rewind recovery makes.
const open = (host as unknown as { sessions: Map<string, { journal: AgentSessionJournal }> })
The reason will be displayed to describe this comment to others. Learn more.
Major · Maintainability & Code Quality · Quick win
Prune the flaky-test ratchet baseline for the removed real-time wait.
This file no longer contains the real-time wait that the test-no-real-time-wait baseline still counts. CI now reports 0 findings against a baseline of 1. The ratchet allows the baseline only to shrink, and it treats a stale baseline as a regression. As a result, the ast-grep test step and ast-grep-gates.mjs fail in the static analysis job. Run pnpm check:flaky-test-pattern-ratchet --prune and commit the updated baseline file. No change to this test is needed.
The reason will be displayed to describe this comment to others. Learn more.
Minor · Functional Correctness · Quick win
Capture against the existing database when it has not been opened yet.
captureSessionMail passes this._orchestrationDb to the capture. That field stays null until something calls getOrchestrationDb(). After a restart, a person can press Stop before any mail code has opened the database. In that state, captureSessionMailAtStop returns {}, so the Stop writes a held boundary without a cut. journalMailSourceEligible then refuses every later report, including fresh local reports, until the person presses Resume. This contradicts the stated rule that fresh reports may run after Stop.
Use getExistingOrchestrationDb(). It opens the file only when the file exists, and it still returns null for a profile that has no mail.
IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Worker reports previously reached native chats as a mailbox-check notice. This change puts each report into the chat's ordinary durable message queue, attributed to its sender, with a 4,000-character excerpt and
orca orchestration inbox --idfor the full text. Reports wait while the chat is working or waiting for a person's answer, then run one per full turn in order.Stop keeps reports that were already waiting paused until the person sends or uses Resume. A provably new report after Stop can wake the chat while the person's paused messages stay paused. Reports whose saved order around Stop is unknown stay held. Existing queue Edit, Delete, Move, Send and Resume controls apply to report cards.
Durable queue creation marks the source report delivered. Inbox read/check acknowledgement remains separate, and later card edits, deletion or turn failure do not offer the source report again. This is rebuilt directly on main and has no dependency on the closed #32108.
Current head:
39a039ba3101d90a8aad764467a548a3287d6fe5. The normal commit hook passed, and targeted production-path and mounted-consumer tests passed. Independent source, reference and accounting qualification is in progress. Some ACP/runtime tests could not collect locally becausefflateis missing; their execution must be confirmed in CI. Targeted real Claude and Codex runs have not started. This PR is not ready to merge.The work is tracked in STA-8718. The single review status comment retains historical screenshots and will receive the current-head verification evidence.