Merge branch 'main' into feat/117-dlq-cloudwatch-alarms

Author: krokoko

.github/workflows/build.yml

@@ -30,7 +30,7 @@
 import task_state
 from nudge_reader import _xml_escape
 from output_scanner import scan_tool_output
-from policy import APPROVAL_RATE_LIMIT, Outcome
+from policy import APPROVAL_RATE_LIMIT, FLOOR_TIMEOUT_S, Outcome
 from progress_writer import _generate_ulid
 from shell import log, log_error_cw
 
@@ -42,7 +42,7 @@
 # Chunk 3 constants (§6.5 pseudocode)
 # ---------------------------------------------------------------------------
 
-FLOOR_30S: int = 30  # §6 decision #6: approval floor on effective timeout
+FLOOR_30S: int = FLOOR_TIMEOUT_S  # §6 decision #6: sourced from contracts/constants.json
 CLEANUP_MARGIN_120S: int = 120  # §6.5 lifetime-margin reserve for cleanup
 # Poll cadence per §3 decision #3 and IMPL-12: 2s for the first 30s, 5s
 # thereafter. Exact counts vary with ``timeout_s``; these pin the

agent/src/hooks.py

@@ -75,9 +75,7 @@
 # Constants (§3, §5.2, §12.9)
 # ---------------------------------------------------------------------------
 
-FLOOR_TIMEOUT_S: int = 30  # §6 decision #6: rejected below this at load
 WARN_TIMEOUT_S: int = 120  # IMPL-25: sub-120s emits WARN on blueprint load
-DEFAULT_TASK_TIMEOUT_S: int = 300  # §6 decision #6 default
 
 
 def _load_shared_constants() -> dict:
@@ -109,6 +107,9 @@ def _load_shared_constants() -> dict:
 DEFAULT_APPROVAL_GATE_CAP: int = int(_AGC["default"])  # decision #13 default
 APPROVAL_GATE_CAP_MIN: int = int(_AGC["min"])
 APPROVAL_GATE_CAP_MAX: int = int(_AGC["max"])
+_ATS = _SHARED_CONSTANTS["approval_timeout_s"]
+FLOOR_TIMEOUT_S: int = int(_ATS["min"])  # §6 decision #6: rejected below this at load
+DEFAULT_TASK_TIMEOUT_S: int = int(_ATS["default"])  # §6 decision #6 default
 CACHE_MAX_ENTRIES: int = 50  # §12.9: decoupled from approvalGateCap
 CACHE_TTL_S: float = 60.0  # §12.8 sliding-window TTL on DENIED/TIMED_OUT
 POLICIES_MAX_BYTES: int = 64 * 1024  # finding #12: reject blueprints > 64 KB

agent/src/policy.py

@@ -17,6 +17,7 @@ run = "yarn eslint"
 
 [tasks.test]
 description = "Jest tests"
+depends = [":compile"]
 run = "yarn test"
 
 [tasks.synth]
@@ -25,6 +26,7 @@ run = "yarn synth"
 
 [tasks."synth:quiet"]
 description = "cdk synth (quiet)"
+depends = [":compile"]
 run = "yarn synth:quiet"
 
 [tasks.deploy]
@@ -54,5 +56,5 @@ description = "No-op bundle step for cdk/cdk.json (NodejsFunction bundles at syn
 run = "node -e \"process.exit(0)\""
 
 [tasks.build]
-description = "compile, test, eslint, synth (quiet)"
-depends = [":compile", ":test", ":eslint", ":synth:quiet"]
+description = "compile, test, eslint, synth (quiet) — DAG: compile first, then test+synth+eslint in parallel"
+depends = [":test", ":eslint", ":synth:quiet"]

cdk/mise.toml

@@ -36,6 +36,12 @@ export interface UserConcurrencyTableProps {
    * @default RemovalPolicy.DESTROY
    */
   readonly removalPolicy?: RemovalPolicy;
+
+  /**
+   * Whether to enable point-in-time recovery.
+   * @default true
+   */
+  readonly pointInTimeRecovery?: boolean;
 }
 
 /**
@@ -44,9 +50,6 @@ export interface UserConcurrencyTableProps {
  * Schema: user_id (PK). Each item holds an atomic counter (active_count)
  * representing the number of currently running tasks for the user.
  * The application layer uses conditional updates for increment/decrement.
- *
- * No point-in-time recovery: this is transient counter data that can be
- * reconstructed from the Tasks table by a reconciliation process.
  */
 export class UserConcurrencyTable extends Construct {
   /**
@@ -64,6 +67,9 @@ export class UserConcurrencyTable extends Construct {
         type: dynamodb.AttributeType.STRING,
       },
       billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+      pointInTimeRecoverySpecification: {
+        pointInTimeRecoveryEnabled: props.pointInTimeRecovery ?? true,
+      },
       removalPolicy: props.removalPolicy ?? RemovalPolicy.DESTROY,
     });
   }

cdk/src/constructs/user-concurrency-table.ts

@@ -1022,15 +1022,18 @@ export const INITIAL_APPROVALS_MAX_ENTRIES = 20;
 /** Maximum per-entry length for an `initial_approvals` scope string. */
 export const INITIAL_APPROVALS_MAX_ENTRY_LENGTH = 128;
 
-/** Floor for `approval_timeout_s` (§6 decision #6). */
-export const APPROVAL_TIMEOUT_S_MIN = 30;
+/** Floor for `approval_timeout_s` (§6 decision #6).
+ *  Sourced from ``contracts/constants.json`` (S9). */
+export const APPROVAL_TIMEOUT_S_MIN = sharedConstants.approval_timeout_s.min;
 
 /** Absolute ceiling for `approval_timeout_s` before the
- *  `maxLifetime - 300` clip is applied (§7.3). */
-export const APPROVAL_TIMEOUT_S_MAX = 3600;
+ *  `maxLifetime - 300` clip is applied (§7.3).
+ *  Sourced from ``contracts/constants.json`` (S9). */
+export const APPROVAL_TIMEOUT_S_MAX = sharedConstants.approval_timeout_s.max;
 
-/** Default `approval_timeout_s` when the submit payload omits it. */
-export const APPROVAL_TIMEOUT_S_DEFAULT = 300;
+/** Default `approval_timeout_s` when the submit payload omits it.
+ *  Sourced from ``contracts/constants.json`` (S9). */
+export const APPROVAL_TIMEOUT_S_DEFAULT = sharedConstants.approval_timeout_s.default;
 
 /**
  * Cedar HITL: bounds + platform default for the per-task approval-gate cap

cdk/src/handlers/shared/types.ts

@@ -45,9 +45,11 @@ describe('UserConcurrencyTable', () => {
     });
   });
 
-  test('does not enable point-in-time recovery', () => {
+  test('enables point-in-time recovery by default', () => {
     template.hasResourceProperties('AWS::DynamoDB::Table', {
-      PointInTimeRecoverySpecification: Match.absent(),
+      PointInTimeRecoverySpecification: {
+        PointInTimeRecoveryEnabled: true,
+      },
     });
   });
 
@@ -96,4 +98,17 @@ describe('UserConcurrencyTable with custom props', () => {
       UpdateReplacePolicy: 'Retain',
     });
   });
+
+  test('allows disabling point-in-time recovery', () => {
+    const app = new App();
+    const stack = new Stack(app, 'TestStack');
+    new UserConcurrencyTable(stack, 'UserConcurrencyTable', { pointInTimeRecovery: false });
+    const template = Template.fromStack(stack);
+
+    template.hasResourceProperties('AWS::DynamoDB::Table', {
+      PointInTimeRecoverySpecification: {
+        PointInTimeRecoveryEnabled: false,
+      },
+    });
+  });
 });

cdk/test/constructs/user-concurrency-table.test.ts

@@ -3,5 +3,10 @@
     "min": 1,
     "max": 500,
     "default": 50
+  },
+  "approval_timeout_s": {
+    "min": 30,
+    "max": 3600,
+    "default": 300
   }
 }

contracts/constants.json

@@ -36,6 +36,11 @@ JSON at TypeScript compile time via `resolveJsonModule`.
     "min": 1,
     "max": 500,
     "default": 50
+  },
+  "approval_timeout_s": {
+    "min": 30,
+    "max": 3600,
+    "default": 300
   }
 }
 ```
@@ -49,6 +54,14 @@ JSON at TypeScript compile time via `resolveJsonModule`.
 - **`approval_gate_cap.default`** — value applied when a blueprint omits
   the field. 50 is the design-decision default (see
   `docs/design/CEDAR_HITL_GATES.md` decision #13).
+- **`approval_timeout_s.min`** — floor for `approval_timeout_s` (§6
+  decision #6). 30 seconds — below this, humans cannot realistically
+  respond to an approval prompt.
+- **`approval_timeout_s.max`** — absolute ceiling for `approval_timeout_s`
+  before the `maxLifetime - 300` clip is applied (§7.3). 3600 seconds
+  (1 hour).
+- **`approval_timeout_s.default`** — value applied when the submit payload
+  omits `approval_timeout_s`. 300 seconds (5 minutes) per §6 decision #6.
 
 ## Adding new constants
 

contracts/constants.md

@@ -151,16 +151,11 @@ run = [
 ##### BUILD #####
 ##################
 
-# Agent code is packaged by CDK (Docker asset); validate Python before heavy JS/CDK work.
-# Multiple `depends` run in parallel, so agent is a sole prerequisite, then packages run in order.
+# All packages run in parallel via DAG. Each resolves its own internal dependencies.
+# Agent quality runs alongside CDK/CLI/docs — no sequential bottleneck.
 [tasks.build]
-description = "Monorepo build (agent quality, then cdk, cli, docs)"
-depends = ["//agent:quality"]
-run = [
-  "MISE_EXPERIMENTAL=1 mise //cdk:build",
-  "MISE_EXPERIMENTAL=1 mise //cli:build",
-  "MISE_EXPERIMENTAL=1 mise //docs:build",
-]
+description = "Monorepo build (agent, cdk, cli, docs in parallel)"
+depends = ["//agent:quality", "//cdk:build", "//cli:build", "//docs:build"]
 
 [tasks.default]
 description = "Install + build"