AskaEth
de1fa83b79
修的是「文档说 ✅、生产不可达」：此前 Scheduler.Spawn 只有测试调用方、无 bus 入口、无派发工具；Span.Record 无生产调用方 → 泳道画不出、节点日志恒空。
- 入口：subagent_spawn 工具（internal/runtime/orchestration/spawntool.go，同包便于用真 Scheduler/loop/Tracer/Flow 做集成测试；注册在 cmd/cyrene/subagent_tool.go 照 terminal_tool 范式）。默认 owner-only，不设 AllowInGroup/AllowInStranger；安全仍由 restrictSchemas + applyToolSecurityGate 双层保证，未绕代审
- 父会话归属：AgentSpec.ParentSession（请求语义）→ Scheduler 转运行期 ctx 标记 loop.WithFlowBranch → 分支 span 以父 session 发布；**allow 谓词一行未改**；单图语义靠「分支 Run 不调 StartRound/EndRound」+ FlowPublisher 不新建图；未归属 spawn 一张图都不发（有测试锁）
- 前台最多等 2s（对齐 task.autoBackgroundThreshold）→ 合并结果作工具结果；转后台则广播 bus subagent.result（design/05 §9 回填 hook）；新增 Scheduler.Wait(ids) 按批等待（Join 会串并发批次，故不重用）
- 子代理跑在 WithoutCancel(ctx)：保留 span 归属、不被工具超时/回合结束顺手杀掉；生命周期由 PerAgentTimeout + CancelAll 约束；内部 WithMutedBroadcast 静音（不进前台 stream）
- 节点日志：loop/spanlog.go 新增 llm.done / tool.done / subagent.done；工具参数**只记键名不记值**；仅步骤真正结束才追加（跳过/被拒路径不发，不伪造）
- 脱敏（红线）：新增 trace/redact.go（形状规则 sk-/Bearer/JWT/key:value + 键名规则 api_key/token/authorization/password…，递归嵌套、不改调用方事件），graph.go 发布前必经；**顺带修掉一个既有泄漏**：result_summary prop 原先未脱敏（工具结果里的密钥会进图），由图级变异测试抓出
- 测试：新增 22 个（工具级 / 图级 / 日志级），含 4 次变异验证（去掉 WithFlowBranch、去掉 record*、还原未脱敏、去掉静音 各自 FAIL）；-race 过 orchestration+trace+loop
- 已知限制：真实模型端到端未验（无凭据/不起服务）；工具白名单是 design gap 未做；subagent.result 暂无消费者（design/15 未实现）；后台子代理跨轮次边界迟到 span 会丢泳道根；PerAgentTimeout=10min 待确认
91 lines
3.6 KiB
Go
91 lines
3.6 KiB
Go
package orchestration
|
|
|
|
import (
|
|
"log/slog"
|
|
"time"
|
|
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/bus"
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/loop"
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/memory"
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/orchestration/audit"
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/orchestration/comm"
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/trace"
|
|
)
|
|
|
|
// Defaults for the orchestration layer.
|
|
const (
|
|
// DefaultMaxParallel is the maximum number of sub-agents that run at once
|
|
// when Options.MaxParallel is non-positive.
|
|
DefaultMaxParallel = 4
|
|
|
|
// defaultAgentID is the comm probe identity used when Options.AgentID is
|
|
// blank and a probe must be built from Bus.
|
|
defaultAgentID = "orchestrator"
|
|
)
|
|
|
|
// Options configures a Scheduler built by New. All fields are optional; each nil
|
|
// dependency degrades gracefully (a missing Loop makes sub-agents fail fast, a
|
|
// missing Comm skips progress events, a missing Approver makes Approve error,
|
|
// and so on).
|
|
type Options struct {
|
|
// MaxParallel caps how many sub-agents execute concurrently. Excess sub-agents
|
|
// queue until a slot frees. Non-positive selects DefaultMaxParallel (4).
|
|
MaxParallel int
|
|
|
|
// PerAgentTimeout bounds every sub-agent's run. When it elapses the sub-agent
|
|
// is aborted (status aborted). Non-positive means no timeout.
|
|
PerAgentTimeout time.Duration
|
|
|
|
// Loop is the execution template: a *loop.Loop used to run every sub-agent.
|
|
// It must be safe for concurrent Run calls (as loop.Loop documents); the
|
|
// template's agent/tools/guardrails/persona apply to every sub-agent. When
|
|
// nil, sub-agents fail fast with ErrNoRunner.
|
|
Loop *loop.Loop
|
|
|
|
// Bus is the in-process event bus used for progress events and, when Comm is
|
|
// nil, to build a default comm probe. When nil no events are published.
|
|
Bus bus.Bus
|
|
|
|
// Comm is the comm probe used to publish progress events. When nil, a probe
|
|
// bound to AgentID is built from Bus (when Bus is non-nil).
|
|
Comm *comm.Probe
|
|
|
|
// Memory is the long-term memory store used by SinkMemory. Optional.
|
|
Memory *memory.Store
|
|
|
|
// Tracer emits a per-sub-agent span (kind subagent) around each run. Optional.
|
|
Tracer *trace.Tracer
|
|
|
|
// Flow, when non-nil, receives the sub-agent span transitions so a spawned
|
|
// branch appears in the flow graph of the session named by
|
|
// AgentSpec.ParentSession (design/19 §2). *loop.FlowPublisher is the
|
|
// production implementation. Optional: a nil sink leaves sub-agent branches
|
|
// unvisualized (the sub-agent's own inner spans still fold into the parent
|
|
// graph through the loop's flow branch).
|
|
Flow FlowSpanSink
|
|
|
|
// Approver records sensitive-operation review-and-approve (代审) triggered by
|
|
// Approve. Policy judgement belongs to the upper layer. Optional.
|
|
Approver *audit.Approver
|
|
|
|
// Logger is the base logger. Nil is replaced with a discard logger tagged with
|
|
// source "orchestration".
|
|
Logger *slog.Logger
|
|
|
|
// AgentID is the comm probe identity. When blank and a probe must be built
|
|
// from Bus, "orchestrator" is used.
|
|
AgentID string
|
|
}
|
|
|
|
// FlowSpanSink folds a span transition into a session's live flow graph so the
|
|
// realtime visualization shows the work in flight (design/19 §1). *loop.FlowPublisher
|
|
// is the production implementation; tests substitute a capturing fake. The
|
|
// interface keeps orchestration from depending on the concrete publisher beyond
|
|
// the loop template it already takes.
|
|
type FlowSpanSink interface {
|
|
// SpanStarted registers a running placeholder node for a span that just began.
|
|
SpanStarted(sessionID string, sp *trace.Span)
|
|
// SpanFinished folds a just-finished span into the session graph.
|
|
SpanFinished(sessionID string, sp *trace.Span)
|
|
}
|