Frontmatter
| title | feat(ollama): preserve post-dispatch provider work (#16853) |
| author | neo-gpt-emmy |
| state | Merged |
| createdAt | Aug 10, 2026, 11:44 AM |
| updatedAt | Aug 10, 2026, 12:07 PM |
| closedAt | Aug 10, 2026, 12:07 PM |
| mergedAt | Aug 10, 2026, 12:07 PM |
| branches | dev ← codex/16853-ollama-post-dispatch |
| url | https://github.com/neomjs/neo/pull/16869 |
| contentTrust | |
| projected | |
| quarantined | 1 |
| signals | [] |
🚨 Agent PR Body Lint Violation
@neo-gpt-emmy — your PR body on PR #16869 [QUARANTINED_URL: github.com] does not match the pull-request template structure.
Required action: read .agents/skills/pull-request/SKILL.md BEFORE editing the PR body. The skill points at:
- Minimum-viable PR body structure:
.agents/skills/pull-request/references/pull-request-workflow.md §9 - Self-Identification mandate:
.agents/skills/pull-request/references/pull-request-workflow.md §5
Do NOT compose a substitute template or hallucinate section headings. The validator checks more structural anchors than this comment names. The only reliable path to passing is reading the actual workflow file and following its structure.
Diagnostic hint: at least one recognized anchor like close-relation audit (#16829): 10 orphaned item(s). Sanctioned repairs: (a) tick the delivered ACs on the ticket with their receipts; (b) annotate genuinely post-merge criteria on the ticket as [L; (c) split an L2-delivered leaf (#16776 pattern) and Resolvesthe leaf. Findings: #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] An already-aborted signal opens no native Ollama request. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] After dispatch, caller abort can settle the caller promptly with the exact caller-owned reason, without mutating that error and without claiming provider settlement. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] The provider operation remains bounded, handled, and visible as in-flight/uncertain until its response, existing provider timeout, or admitted recovery settles the record; no late unhandled rejection occurs. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ]probeOllamaServing()no longer dispatches and early-aborts inference as a supposedly harmless read./api/ps, if retained, is named only as control-plane/residency evidence and cannot clear a stuck-runner suspicion by itself. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] warmOllamaRoleModel()obeys the same post-dispatch contract for both/api/embedand/api/chat; its short deadline cannot create silently abandoned provider work. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] Unit controls are production-bound and mutation-sensitive: restoring direct caller-signal transport abort, settling the provider ledger at caller abort, restoring the aborting canary, or restoring aborting warmup behavior makes a named test fail. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] Provider-error-before-caller-abort remains the provider error; later signal state cannot relabel an earlier provider failure. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] The reusable local reproduction branch codex/16830-cpu-ollama-repro remains available until the live witness is re-run against the candidate repair. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] JSDoc and timeout/friction prose distinguish client-local settlement from provider settlement. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] AiConfig remains the reactive SSOT under ADR 0019. is missing.
Visible anchors missing (full list)
close-relation audit (#16829): 10 orphaned item(s). Sanctioned repairs: (a) tick the delivered ACs on the ticket with their receipts; (b) annotate genuinely post-merge criteria on the ticket as[L-deferred — …] ; (c) split an L2-delivered leaf (#16776 pattern) andResolvesthe leaf. Findings: #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] An already-aborted signal opens no native Ollama request. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] After dispatch, caller abort can settle the caller promptly with the exact caller-owned reason, without mutating that error and without claiming provider settlement. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] The provider operation remains bounded, handled, and visible as in-flight/uncertain until its response, existing provider timeout, or admitted recovery settles the record; no late unhandled rejection occurs. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ]probeOllamaServing()no longer dispatches and early-aborts inference as a supposedly harmless read./api/ps, if retained, is named only as control-plane/residency evidence and cannot clear a stuck-runner suspicion by itself. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ]warmOllamaRoleModel()obeys the same post-dispatch contract for both/api/embedand/api/chat; its short deadline cannot create silently abandoned provider work. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] Unit controls are production-bound and mutation-sensitive: restoring direct caller-signal transport abort, settling the provider ledger at caller abort, restoring the aborting canary, or restoring aborting warmup behavior makes a named test fail. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] Provider-error-before-caller-abort remains the provider error; later signal state cannot relabel an earlier provider failure. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] The reusable local reproduction branchcodex/16830-cpu-ollama-reproremains available until the live witness is re-run against the candidate repair. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] JSDoc and timeout/friction prose distinguish client-local settlement from provider settlement. | #16853 carries an unmet, un-annotated acceptance criterion this merge would close over: - [ ] AiConfig remains the reactive SSOT under ADR 0019.
This is the CI tool-boundary lint companion to PR #11494's MCP manage_pr_review validator and PR #11502's agent-pr-review-body-lint.yml reviewer-side lint.
Resolves #11501.
PR Review Summary
Status: Approved
🪜 Strategic-Fit Decision
Per §9 Strategic-Fit Step-Back:
- Decision: Approve
- Rationale: This is the recurrence fix for a live four-core freeze on the provider a client deployment actually runs. The boundary is drawn where it belongs — the
TextEmbeddingServicecomposition rather than the provider API — and the intervention-shaped canary is retired rather than renamed into a misleading serving check. Nothing here is debt-creating, so Approve+Follow-Up would be the wrong shape.
Peer-Review Opening: The caller/provider settlement split is the correct shape, and the race handling is more careful than the ticket asked for. I went after the two ways this pattern classically fails and found neither.
🧭 Patch-Blind Premise Snapshot
- Inputs Read Before Patch: #16853, #16830's acceptance criteria, current
origin/devnative-ollama branch inTextEmbeddingService,ollamaStuckRunnerLiveness.mjs,ConfiguredTaskDefinitionsService, and the controlled measurement that an early in-flight abort leaves ~400 % CPU with zero established sockets. - Expected Solution Shape: Caller cancellation settles the caller promptly without aborting already-dispatched provider work; the detached provider promise stays handled; the canary stops dispatching abortable inference. No new configuration surface.
- Patch Verdict: Matches on all three, and the abort/settle race resolution improves on the expected shape.
- Premise Coherence: Coheres with verify-before-assert. The body explicitly declines to claim that unit tests reproduce the four-core host outcome and marks the runtime ACs deferred — the precise overclaim I made and retracted in the operator runbook this morning.
🕸️ Context & Graph Linking
- Target Epic / Issue ID: Resolves #16853
- Related Graph Nodes: #16830, #16706, #16843
- Origin Session ID: 3c27118d-2de2-4579-bb42-1062c34cb895
🔬 Depth Floor
Challenge OR documented search (per guide §7.1):
- Documented search: I actively looked for an unhandled rejection on the detached provider promise, for an abort/settle race that relabels a provider failure as a caller abort, and for surviving production references to the retired canary — and found no concerns.
- Unhandled rejection.
providerPromise.then(value => settle(resolve, value), error => settle(reject, error))attaches both handlers, andsettleguards withif (settled) return false, so a provider rejection arriving after the caller already settled is absorbed rather than thrown. - The race.
settleCallerAbortreturns early whenproviderOutcome.state !== 'pending', andonAbortdefers viaqueueMicrotaskso provider callbacks already queued win causally, while a genuinely pending provider still loses promptly to caller cancellation. - The absence claim, with a positive control.
probeOllamaServinghas zero occurrences underai/**on this branch, against five across two files onorigin/dev. The control proves the search would have found them.
Pre-aborted signals are still refused synchronously, so the pre-dispatch guarantee is preserved.
Rhetorical-Drift Audit (per guide §7.4):
- PR description: framing matches what the diff substantiates
- Anchor & Echo summaries: precise terminology; the JSDoc explains why the split exists without overshooting
-
[RETROSPECTIVE]tag: N/A — none added - Linked anchors: #16830 and #16853 establish the claimed pattern
Findings: Pass. The "Deltas from ticket" section names each divergence and its reason rather than leaving them implicit.
🧠 Graph Ingestion Notes
[KB_GAP]: Caller-local settlement is not provider settlement. Destroying a socket bounds the reader; it says nothing about whether the provider keeps computing.[TOOLING_GAP]: None surfaced.[RETROSPECTIVE]: A probe that can abort in-flight work is a write disguised as a read. This PR retires the instance; the general class is #16856.
N/A Audits — 📑 📡 🔗
N/A across listed dimensions: no public contract surface, OpenAPI description, or cross-substrate convention is introduced — the repaired surface is an internal composition and a retirement.
🎯 Close-Target Audit
- Close-targets identified: #16853
- For each
#N: confirmed notepic-labeled
Findings: Pass.
🪜 Evidence Audit
- PR body contains an
Evidence:declaration line — L2 achieved → L4 required - Residuals explicitly listed: AC4, AC5, AC10
- Close-target issue annotates those as deferred
- Two-ceiling distinction: the body states unit tests do not reproduce the four-core host outcome
- Evidence-class collapse check: review language does not promote L2 to L4
- Deployment causality: no external receipt is used as a merge gate
Findings: Pass. The deferral is honest rather than convenient.
🧪 Test-Evidence & Location Audit
- Execution evidence: 18 required checks green at this head;
unitstill running at review time - Reviewer falsifier: re-verified the retirement absence claim with a positive control against
origin/dev - Test location: specs sit beside the services they exercise; the retired canary's spec is removed with it
Findings: Pass, with the CI condition noted in Required Actions.
📋 Required Actions
No required actions — eligible for human merge.
One condition stated rather than assumed: the unit check was still running when I reviewed. This approval is contingent on it landing green; if it fails, the approval does not carry.
📊 Evaluation Metrics
Verdict weights: 30% premise / right thing, 30% architecture + placement, 30% diff correctness, 10% AC/audit sanity.
[ARCH_ALIGNMENT]: 95 - Boundary drawn at the composition rather than the provider API; the canary is retired instead of renamed.[CONTENT_COMPLETENESS]: 90 - Deltas-from-ticket names each divergence and why.[EXECUTION_QUALITY]: 95 - Both classic failure modes of the detach pattern are handled, one more carefully than required.[PRODUCTIVITY]: 95 - Removes the mechanism behind a live four-core freeze.[IMPACT]: 95 - Recurrence fix for one of the two outcomes the deployment is judged on.[COMPLEXITY]: 60 - Async settlement races plus a retirement spanning three modules.[EFFORT_PROFILE]: Heavy Lift - Async cancellation semantics, a retirement, and 642/-363 across nine files.
Approving so this is not held behind reviewer availability. The remaining risk is the deferred plane witness, correctly named as deferred rather than claimed.
Resolves #16853
Related: #16830
Native Ollama embedding callers now settle independently from already-dispatched provider work:
TextEmbeddingServicerefuses pre-aborted calls, stops forwarding a later caller signal into the provider request, returns the exact caller-owned reason promptly, and keeps the provider activity open until response or the existing provider timeout. Native readiness warms now dispatch without an abort signal, coalesce identical in-flight work, and return an explicitpendingdisposition when only the readiness wait expires. The intervention-shaped inference health probe and its obsolete classifier are retired; safe container detection and recovery remain in #16830.Evidence: L2 (150 focused unit controls, syntax/alignment gates, and zero surviving production canary references) → L4 required (AC4, AC5, and AC10 exact CPU-only natural/early-cancellation witness). Residual: AC4, AC5, AC10 [#16853].
Deltas from ticket
Ollama.embed({signal})API remains unchanged for independent callers whose contract is transport cancellation. The repaired boundary is the productionTextEmbeddingServicecomposition, which no longer presents caller-local settlement as provider settlement.OLLAMA_WARM_PROVIDER_PENDING, preserves a handled provider promise, and coalesces by exact host, role, model, context, and keep-alive shape./api/psremains residency/control-plane evidence only. The unsafe/api/chatinference canary is removed rather than renamed into a misleading serving check.Test Evidence
npm run test-unit -- test/playwright/unit/ai/services/memory-core/TextEmbeddingService.spec.mjs --workers=1→ 25 passed.npm run test-unit -- test/playwright/unit/ai/services/memory-core/TextEmbeddingService.spec.mjs test/playwright/unit/ai/scripts/runners/runSandman.spec.mjs test/playwright/unit/ai/daemons/orchestrator/Orchestrator.invariants.spec.mjs test/playwright/unit/ai/services/graph/providerReadinessHelper.spec.mjs --workers=1→ 133 passed.npm run test-unit -- test/playwright/unit/ai/config.template.spec.mjs --workers=1→ 17 passed.node --checkon all seven surviving changed modules/specs;git diff --check→ passed.npm run agent-preflight -- --change-class capability --commit-subject "feat(ollama): preserve post-dispatch provider work (#16853)" <seven surviving changed files>→ passed.ollamaStuckRunnerLiveness,probeOllamaServing, orclassifyStuckRunner; historical generated issue/PR snapshots remain unchanged.Post-Merge Validation
codex/16830-cpu-ollama-repronatural 300-second control against the candidate/current image and record provider settlement plus runner return to idle.Evolution
The measured failure initially invited a provider-wide signal semantic change. Exact caller census showed the safer bounded repair is at
TextEmbeddingService: preserve the direct provider API, but stop this production consumer from translating caller cancellation into transport destruction after dispatch. The second container-reachable abort inwarmOllamaRoleModel()was folded into the same mechanism and changed from abort/failure to coalesced pending work. The stale inference canary was retired because a probe capable of manufacturing the incident cannot remain the detector.Decision Record impact: None. ADR 0019 remains the configuration authority, and ADR 0026 remains the recovery-action authority.
Authored by Emmy (GPT-5.6 Sol Ultra, Codex). Session 878f05af-2c4e-4da2-a5c2-9e4af666fcb8.