diff --git a/rfcs/0011-job-limits-and-recovery.md b/rfcs/0011-job-limits-and-recovery.md index abfa676..430b77e 100644 --- a/rfcs/0011-job-limits-and-recovery.md +++ b/rfcs/0011-job-limits-and-recovery.md @@ -1,6 +1,6 @@ # RFC 0011: Job limits and recovery semantics -- Status: Draft; contract-owner decision pending +- Status: Draft; synthetic-only prototype scope approved; normative contract decision pending - Authors: Codex draft for Studio O03 - Created: 2026-10-27 - Contract family: bounded orchestration over Comic Manifest and Provider Execution @@ -21,15 +21,20 @@ recovery rules for one synthetic Comic Manifest production revision and one offline mock Provider Execution call per attempt. It defines a nonresettable job deadline, bounded resource use, an explicit one-retry ceiling, and fail-closed resume behavior. Candidate numeric limits are recommendations for owner review, -not requirements inherited from an existing contract. +not requirements inherited from an existing contract. The owner approved these +candidate limits and the reviewed conservative behavior below for a bounded, +synthetic-only prototype on 2026-10-28; that decision does not accept this RFC +as a normative contract. This proposal builds on [RFC 0010](0010-build-attempt-lifecycle.md), which was merged to `main` at [952518820f8f7984414acbedba9dcc8d7082f394](https://github.com/DefinitelySecureStudio/codex/commit/952518820f8f7984414acbedba9dcc8d7082f394) but remains **Draft; contract-owner decision pending**. The merge records the proposal; it does not adopt the contract. O03's retry, cancellation, and recovery rules must be reviewed against this merged Draft before any coordinated -normative adoption. Neither RFC changes a schema or authorizes runtime, -release, or production work. +normative adoption. Neither RFC changes a schema, and merging either RFC is not +implementation authorization. The separate prototype-scope approval recorded +below authorizes only the bounded synthetic prototype; it does not authorize +release or production work. ## Motivation and boundaries @@ -381,49 +386,80 @@ reconciliation must establish the prior call outcome before further work. ## Implementation plan -1. Record the contract owner's decisions on the proposed numeric limits, - `job_id`/`dispatch-started` host index, restart authorization, clock-epoch - behavior, cancellation mapping, and retry allowlist. -2. Reconcile any O03 decisions the owner accepts with merged Draft RFC 0010 and - confirm the host-index fields and recovery authority boundary before - coordinated normative adoption. RFC 0010's merge alone does not constitute - acceptance. -3. If separately authorized, add synthetic fixture tests for the table above in - the appropriate implementation repository. No schema, runtime, storage, - real-provider, release, or production work is included here. - -## Owner decisions (proposed dispositions) - -1. **Adopt the candidate finite limits or provide replacements:** one active - job/no queue, two attempts total, one provider call per attempt, 300,000 ms - job execution budget, and 128 MiB aggregate material. These values are - stricter host policy over existing per-document/profile limits; they do not - change Provider Execution `timeout_ms`. -2. **Accept host-only identity and dispatch marker:** one opaque `job_id` and - confirmed append-only `dispatch-started` entry, coordinated with RFC 0010. - A marker that may exist blocks redelivery until the reader reconciles it. -3. **Accept read-only restart by default:** require explicit one-job, - one-transition caller/owner authorization before any restart-driven write, - dispatch, cancellation signal, or result advancement. Authorization does not - override expired deadlines, unknown clock epochs, changed revisions, - ambiguous dispatch, or unresolved writes. Read-only inspection remains - available without it. -4. **Accept clock and budget recovery:** same stable monotonic epoch and original - admission deadline only; no reset. An unavailable/different epoch blocks - new calls and retries while allowing read-only reconciliation. -5. **Accept the conservative retry allowlist:** at most one explicit retry, only - after a terminal/reconciled `rate-limit` result proves no output or ambiguous - action, with finite `retry_after_ms`, unchanged production bytes, and - positive remaining job/time/material budgets. All other outcomes remain - ineligible in this bounded version. -6. **Accept cancellation as a request, not outcome rewriting:** before dispatch - it prevents the call; during a call it signals cancellation once and - preserves the actual normalized result; during persistence it requires - reconciliation. Use only RFC 0010's proposed existing Manifest mappings. -7. **Preserve RFC 0010 timeout and integrity deferrals:** a timed-out outcome - remains protected and `contract-mapping-blocked`; uncertain writes remain - nonterminal. No invented Manifest status/diagnostic, automatic finalization, - or blind side-effect retry is authorized. - -These are design decisions only. Until the contract owner records acceptance, -this RFC remains non-normative and no implementation or production use follows. +1. The contract owner approved the bounded synthetic-only prototype scope and + choices recorded below on 2026-10-28. +2. Coordinate the prototype's host index with merged Draft RFC 0010, preserving + its distinct attempt, execution, and result identities and its prepared, + persisting, and terminal verification boundaries. RFC 0010's merge alone + does not constitute normative acceptance. +3. Implement the separately approved prototype in Platform with synthetic + fixtures and a mock provider. This RFC remains a design record and adds no + schema or released contract. Runtime and storage implementation are separate; + this approval does not authorize real providers, release, or production. + +## Owner decision record + +On 2026-10-28, the owner approved the following choices for one bounded, +offline prototype using a synthetic Comic Manifest revision, one mock Provider +Execution call per attempt, and tests. They are accepted as prototype host +policy only, not as normative contract requirements: + +1. **Finite limits:** one active admitted job with no queue; two total attempts + per job (one initial attempt and at most one explicit retry); one provider + call per attempt; a 300,000 ms (five-minute) monotonic job budget from + admission; an 8 MiB rendered-prompt cap per attempt or the lower exact + descriptor `max_input_bytes`; 16 MiB UTF-8 normalized Provider Execution + output content per call; 64 MiB total generated artifacts per job; 128 MiB + aggregate job material; at most 32 lifecycle metadata entries, 32 KiB per + entry, and 1 MiB reserved for that metadata within the aggregate ceiling. + Keep the existing Manifest parse limits (8 MiB document, depth 32, 100,000 + JSON values, and 32,768 UTF-8 bytes per string), and never exceed an + individual artifact's existing production `max_bytes` or profile cap. + These limits do not change Provider Execution `timeout_ms`. +2. **Host identity and dispatch:** use an opaque `job_id` and confirmed, + append-only `dispatch-started` host-index marker, coordinated with RFC 0010's + distinct attempt, execution, and result identities. A marker that may exist + blocks redelivery until its state is reconciled. This is prototype index + state, not a schema addition. +3. **Restart and clock:** restart recovery is read-only by default. Any + restart-driven mutation requires explicit authorization for one job and one + enumerated next transition, using existing IDs, the pinned revision, original + monotonic clock epoch and deadline, and persisted budgets. Authorization + cannot override an expired deadline, unknown clock epoch, changed revision, + ambiguous dispatch, or unresolved write. Never reset the deadline or infer + that an uncertain side effect did not occur. A post-restart cancellation-only + request may signal only a verified existing execution ID; it cannot authorize + dispatch or result advancement. Read-only inspection remains available + without authorization. +4. **Retry:** at most one explicit caller-authorized retry, only after a + terminal, fully reconciled `rate-limit` outcome with `retryable: true`, + finite `retry_after_ms`, and safe provider details that positively establish + rejection before acceptance/action and no output. The caller must wait at + least that delay and explicitly authorize the retry; the same production + bytes and positive time/material budgets must still verify. Give the new + attempt fresh IDs and preserve prior records. Do not automatically retry; + timeout, cancellation, changed revision, exhausted limits, or unresolved + call/write is ineligible. +5. **Cancellation:** before dispatch, cancellation prevents the call; during a + call, signal cancellation once and preserve the actual normalized provider + outcome; after a successful response, do not relabel success; after an + outcome is recorded, stop future attempts but preserve that outcome; during + persistence, preserve fixed IDs and reconcile without overwrite or replay. + Cancellation before admission creates no job or attempt IDs. Use only the + existing proposed RFC 0010 mappings; cancellation is not a new Comic + Manifest status, and cancellation after terminal confirmation does not alter + the immutable result. + +This prototype decision does not accept RFC 0010 or RFC 0011 as normative, +change any existing schema, authorize real providers, production execution, +release, or stable adoption, or decide deferred timeout and result-integrity +semantics. A timed-out outcome remains `contract-mapping-blocked` under the +current draft; ambiguous dispatch or persistence remains nonterminal and +requires read-only reconciliation. Do not invent a Manifest status or +diagnostic, automatically finalize an uncertain write, or retry a possibly +performed side effect. Any normative adoption or change to these deferred +semantics requires a separate decision and coordinated review. + +The recorded approval is limited to the separately scoped synthetic prototype. +This RFC remains non-normative, and the approval does not authorize production +use or stable adoption. diff --git a/rfcs/README.md b/rfcs/README.md index dcdc073..da90087 100644 --- a/rfcs/README.md +++ b/rfcs/README.md @@ -32,8 +32,13 @@ released schema, consumer migration, or production integration yet. [RFC 0010 (merged; still Draft)](0010-build-attempt-lifecycle.md) proposes bounded build-attempt and terminal-result lifecycle semantics for Studio O02. -Its merge did not accept the contract or authorize runtime or production work. - -[Draft RFC 0011](0011-job-limits-and-recovery.md) proposes finite job limits, -cancellation, retry, and recovery semantics for Studio O03. It is not accepted -and does not change an existing schema or authorize runtime or production work. +Its merge did not itself accept the contract or authorize runtime or production +work. A separate owner decision permits only the bounded synthetic prototype +described in RFC 0011; RFC 0010 remains a nonnormative Draft. + +[RFC 0011 (Draft; synthetic-only prototype scope approved)](0011-job-limits-and-recovery.md) +proposes finite job limits, cancellation, retry, and recovery semantics for +Studio O03. The approval covers only a bounded offline prototype using +synthetic inputs, a mock provider, and tests. It does not accept a normative +contract, change an existing schema, authorize real-provider or production +execution, or authorize release or stable adoption.