wangxuming/makelore
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
08099ea1c2ea24efc10c20f878fc25a557ea9d90
makelore/.project-docs/30-worklog/tasks/20260826-fix-pi-model-provider-8d4c2a71.md
brother7 48a9189939
Some checks failed
Electron E2E / Electron E2E (macos-latest) (push) Has been cancelled
Details
Electron E2E / Electron E2E (ubuntu-latest) (push) Has been cancelled
Details
Electron E2E / Electron E2E (windows-latest) (push) Has been cancelled
Details
docs(project): complete Pi provider recovery task
2026-08-26 14:56:30 +08:00

11 KiB
Raw Blame History

Task: Fix Pi first-model and Provider context failures

Identity

  • Task ID: 20260826-fix-pi-model-provider-8d4c2a71
  • Mode: Feature
  • Branch: codex/20260826-fix-pi-model-provider-8d4c2a71-fix-pi-model-provider
  • Worktree: D:\Datas\OthersProjects\makelore-fix-pi-model-provider-8d4c2a71
  • Base commit: 9f05e2d7e1
  • Owner: codex-root
  • Status: Ready for Integration

Scope

  • Fix the production ordering for an unresolved Conversation's first model selection: validate the selected managed model, persist resolved product metadata, and only then prepare the Pi worker/session. Preserve the existing active-run-safe runtime.setModel() path for already-resolved Conversations.
  • Add a production-shaped regression whose runtime rejects every unresolved prepare, so the InMemory runtime can no longer hide the ordering defect.
  • Classify the exact captured Works Square gateway failure "did not return one-api user context" at the Main-owned local AI proxy boundary as a Provider credential/context failure. Preserve the upstream body, avoid generic Pi automatic retry of the deterministic 502, and reuse the existing single credential refresh/reopen boundary without replaying a mutation.
  • Replace the misleading generic English "local Agent retry failed" projection with a fixed Provider-neutral Chinese retry failure message while retaining content redaction.
  • Rebuild and verify the Windows package and final packaged proof after the product-code correction; durably bind the candidate/artifact/runtime/test identity required by the prior planner review.

Intent And Constraints

  • The installed incident is confirmed to be a Works/one-api user-context rejection, not a Pi worker crash and not the unresolved-first-model defect. These are two independent defects fixed in one bounded correction because both block acceptance of the same candidate.
  • Do not invent a new Provider authentication protocol or forward the local Host Authorization token upstream. Existing evidence shows the same proxy contract worked before the incident; only the exact observed structured failure may be reclassified unless tests or source contracts prove more.
  • Keep Provider refresh bounded to the existing one refresh/reopen attempt. Never replay an accepted or uncertain mutation, and never add another Pi restart/watchdog/fallback path.
  • Preserve Pi 0.84.2, the hard cutover, Conversation target isolation, selected-account secret scoping, redaction, and Main ownership of Provider and runtime lifecycle.
  • Real Provider remains Explicitly Waived / Accepted Risk with realTurnVerified=false. A loopback or captured-response regression is not a real Provider Pass. macOS and native non-WSL Linux remain unverified.
  • No external Works account, gateway mapping, installed user data, or running application is mutated by this feature task. If the server mapping remains invalid, the client must expose an actionable Provider failure but cannot manufacture a successful turn.

Project Context Loaded

  • .project-docs/10-overview/read-before-planning.md
  • .project-docs/10-overview/project-positioning.md
  • .project-docs/10-overview/current-state.md
  • .project-docs/20-architecture/system-overview.md
  • .project-docs/20-architecture/module-map.md
  • .project-docs/20-architecture/data-flow.md
  • .project-docs/40-rules/business-rules.md
  • .project-docs/40-rules/success-criteria.md
  • .project-docs/60-contracts/commitments.md
  • .project-docs/60-contracts/stale-items.md
  • .project-docs/00-governance/memory-index.md
  • .project-docs/00-governance/decision-index.md
  • .project-docs/00-governance/evidence-index.md
  • .project-docs/00-governance/reflection-index.md
  • .project-docs/00-governance/planning-gate.md
  • .project-docs/30-worklog/proposals/20260825-pi-runtime-resilience-proposal.md
  • Peer scopes inspected: the completed background-run implementation, its planner review, and the installed-package diagnosis. This task owns only the two accepted corrections and their regenerated Windows proof; it does not reopen retained-correlation/background-lease design or modify the read-only diagnosis records.
  • All registry peers still marked planning were inspected through their task records. Eight retain placeholder/undefined scope and therefore provide unknown coordination state, but none claims this worktree or a concrete Pi Provider/conversation-service code path. The one concrete E2E peer is scoped to an AI Design test. The existing main integration task owns only the old OpenCode model-switch reconciliation and the canonical integration lock; it does not conflict with feature implementation here, but it must be resolved before any later merge to main.
  • Planning Gate: Passed. Ownership matches this task's feature worktree and branch; no concrete semantic conflict blocks the bounded correction.

Plan

  1. Add failing regressions for strict unresolved preparation and the exact captured Works user-context response; confirm both fail for the expected contract reason.
  2. Make the minimal ordering and Provider-classification changes, plus the redacted Provider-neutral retry message, then rerun the focused feedback loop.
  3. Run typecheck, scoped/full lint and unit tests, build:vite, applicable Windows Electron E2E, Windows package/artifact/Pi verifiers, and final packaged proof. Record exact candidate and artifact identity.
  4. Complete the task documentation gate and commit only owned product/tests/ task-record changes. Integration to main remains a separate Integration Gate after the feature candidate is accepted.

Outcome

  • CodingConversationService.setModel() now keeps the already-resolved path unchanged (prepare -> authoritative Snapshot guard -> runtime.setModel -> persist) while the unresolved path performs validate -> persist resolved metadata -> initial prepare. A strict runtime that rejects unresolved input reproduces the old CODING_MIGRATION_MODEL_REQUIRED failure and passes only after the ordering correction.
  • The Main-owned AI proxy recognizes only the captured Works Square user-context failure shape. It expires the cached gateway credential, preserves the upstream JSON body, maps the retryable upstream 502 to a non-retryable 401, and does not replay the current Provider mutation. The next user retry obtains a fresh gateway credential through the existing credential service.
  • Pi projection now terminalizes a non-retrying assistant Provider error on agent_end, preserves the failure through agent_settled, and classifies both fail-fast and exhausted-retry forms of the observed Works failure as CODING_PROVIDER_AUTH_REQUIRED. Raw Provider/request text is not projected. Other exhausted Provider retries use a fixed Chinese Provider-neutral message instead of blaming a local Agent crash.
  • This client correction cannot repair a persistently invalid Works backend account mapping. It makes one fresh-credential retry possible and attributes any continuing failure to the correct Provider boundary.
  • Implementation commit a09826676e224a699f7ee6a05a931c14e5238aca produced the final Windows candidate. The clean-worktree artifact verifier bound the installer to that exact verificationHead; this repository does not embed the optional buildCommit field in packaged package.json.
  • Final Windows installer: D:\Datas\OthersProjects\makelore-fix-pi-model-provider-8d4c2a71\release\Makelore-2.0.0-win-x64.exe; 208162564 bytes; SHA-256 A02F79FCD3273FB0B013450492DC788B6E5ED7BBC1007468FB83BE949B8CB30D; Authenticode NotSigned. Final app.asar SHA-256 is A8394D0F7324B27D2C95469ABD4E2A39C739EABCC6D8B41E1D65BA4B41FB9D39.

Verification

  • Regression red phase: the three new production-shaped tests failed on the old implementation with unresolved prepare, forwarded 502, and an incorrectly completed run.
  • Focused related tests: 5 files / 54 tests passed before the exhausted-retry addition; final projector file 12/12 passed.
  • pnpm run typecheck: passed.
  • Scoped ESLint: passed.
  • Clean-candidate pnpm test: 181 functional files / 1541 passed / 2 skipped, plus REN-008 pressure 1/1 passed.
  • pnpm run lint:check: 0 errors / 5 pre-existing warnings.
  • pnpm run build:vite: passed.
  • pnpm run test:electron:windows: 2 files / 4 tests passed.
  • pnpm run package:stage:win-x64 and clean-candidate electron-builder Windows packaging passed. The external GitHub uv download timed out twice, so the exact verified uv 0.10.0 Windows binaries were reused from the immediately preceding accepted candidate; no runtime version or source change was made.
  • pnpm run verify:publish-runtime: passed with npm 11.6.2.
  • pnpm run verify:artifact:win: passed from clean a098266; Electron 43.4.0, Node 24.18.1, bundled Python/pip/sqlite/SSL, uv 0.10.0, npm, msgpackr, Canvas native assets, Unicode copy, final NSIS, and app.asar were verified from the product artifact.
  • pnpm run verify:artifact:pi -- --samples 2: passed; exact Pi 0.84.2, 130 production packages, six runtime assets, five unpacked native assets, session reopen, prompt/settle, abort isolation, and clean exit were verified. Cold/warm ready p95 was 705/659 ms; exit p95 was 22 ms.
  • node scripts/run-pi-subagent-packaged-smoke.mjs: passed from the final executable and packaged app.asar Main. It covered the materialized extension, real ephemeral read-only child, 4 persistent parent + 4 child live processes, 12-second prompt/compact confirmation uncertainty, late terminal settlement, background lifecycle, intentional/unexpected/protocol-invalidated stops, failure-safe cleanup, Composer unlock, and zero lingering tracked PIDs.
  • A read-only ASAR inspection confirmed the compiled Main contains both the exact Works context classifier and the fixed Provider-auth projection. The structured ignored reports are release/pi-model-provider-artifact-win.json, release/pi-model-provider-artifact-pi.json, and release/pi-model-provider-final-product-proof.json.
  • Real external Provider success remains unverified by explicit user waiver: realTurnVerified=false. The final packaged loopback/fault-injection proof is not recorded as a real Provider Pass. macOS and native non-WSL Linux were not run by this task.

Follow-ups

  • After feature acceptance, use a separate Integration Gate to resolve the old main integration lock, reconcile canonical project memory, and merge. Do not conflate this feature branch with integration ownership.

Promotion Candidates

  • Target canonical document: Pi runtime/provider failure contract. Proposal: record that deterministic Works user-context failures expire the cached gateway credential, fail fast without replay, and remain Provider failures through Renderer projection rather than being relabeled as local worker crashes. Evidence: captured installed-package trace plus strict proxy and projector regressions. Human confirmation required during Integration Gate: yes.