feat(self-healing): API-key preflight + cost_preflight claim-guard + launchd KeepAlive - #8
Open
kushalj1997 wants to merge 1 commit into
Open
feat(self-healing): API-key preflight + cost_preflight claim-guard + launchd KeepAlive#8kushalj1997 wants to merge 1 commit into
kushalj1997 wants to merge 1 commit into
Conversation
…launchd KeepAlive Three self-healing P0s so the perpetual swarm survives failures without an agent babysitting it: 1. API-key fail-fast — conductors/env.py require_anthropic_api_key() (deliberately never returns the key value, only proves readiness) wired into factory.py + api.py, so an API conductor refuses to claim a task when ANTHROPIC_API_KEY is missing/blank instead of claiming it then dying mid-run (stranded task). 2. cost_preflight enforced — supervisor._preflight_before_claim() runs cost_preflight (previously written + unit-tested but NEVER called) before every claim, rejecting over-cap tasks; same guard wired into perpetual.py's drive path. 3. launchd KeepAlive — docs/launchd/ template + README for OS-level auto-restart of the perpetual supervisor. NO API key embedded in the plist (placeholders only). Tests: test_conductor_api, test_conductor_factory, test_perpetual, test_supervisor, test_launchd_template. Known follow-ups before activation (tracked, not in this PR): tune default cost_cap_usd + prefer hold-admit over hard-reject so slices never starve agents; supply ANTHROPIC_API_KEY to the launchd supervisor via a runtime wrapper reading the chmod-600 api_keys file (the DM task-queue-wrapper pattern) rather than launchctl setenv, to avoid a fail-fast crash-loop. Implemented by the Codex agent-swarm worker (worktree .worktrees/agent-swarm-p0-self-healing-20260607); published by Claude per direct operator approval (Kushal, 2026-06-07). Verified: placeholders only, no real key in any committed file. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
agent-swarm self-healing P0 — survive failures without a babysitter
Three self-healing features so the perpetual swarm keeps running as reliable code, not something an agent has to nurse:
conductors/env.py:require_anthropic_api_key()(deliberately never returns the key value — readiness proof only), wired intofactory.py+api.py. An API conductor now refuses to claim a task whenANTHROPIC_API_KEYis missing/blank, instead of claiming it then dying mid-run and stranding the task.supervisor._preflight_before_claim()runscost_preflight(which was written + unit-tested but never actually called) before every claim, rejecting over-cap tasks; same guard wired intoperpetual.py's drive path.docs/launchd/template + README for OS-level auto-restart of the perpetual supervisor. No API key embedded (placeholders only).Tests:
test_conductor_api,test_conductor_factory,test_perpetual,test_supervisor,test_launchd_template.cost_cap_usdis generous enough that a normal sliced task passes, and prefer hold-admit over hard-reject on ambiguous estimates — otherwise agents idle. Mitigation: assign work in slices + sane cap.launchctl setenvcombo can crash-loop the supervisor if the key doesn't reach the launchd context. Prefer a runtime wrapper that reads the key from the chmod-600api_keys/file (the DMtask-queue-wrapperpattern) before everlaunchctl load-ing it.Implemented by the Codex agent-swarm worker; published by Claude per direct operator approval (Kushal, 2026-06-07). Verified: placeholders only, no real key in any committed file.
🤖 Generated with Claude Code